@cloudbase/cloudbase-mcp 2.25.10 → 2.27.0

package/dist/index.cjs

@@ -3321,6 +3321,7 @@ const auth_js_1 = __webpack_require__(77291);
 const cloudbase_manager_js_1 = __webpack_require__(3431);
 const logger_js_1 = __webpack_require__(13039);
 const tool_result_js_1 = __webpack_require__(9835);
+const gateway_access_urls_js_1 = __webpack_require__(22435);
 const env_setup_js_1 = __webpack_require__(6978);
 /**
  * Resources accepted by CreateEnv. Matches Cloud API / Manager SDK contract.
@@ -4073,6 +4074,89 @@ async function enrichEnvInfoWithMissingFields(manager, result, envId) {
         return result;
     }
 }
+/**
+ * Project gateway Route.Enable onto envQuery(info) without mutating StaticDomain.
+ *
+ * StaticStorages[].StaticDomain stays the cloud-API nominal hostname.
+ * Sibling field staticDomainRouteEnabled (and EnvInfo-level mirrors for the
+ * primary store) tell callers whether the default hosting domain route is
+ * actually reachable (Enable !== false). Matches queryHosting websiteConfig.
+ */
+async function enrichEnvInfoWithStaticDomainRouteEnabled(manager, result, envId) {
+    const envInfo = result?.EnvInfo;
+    if (!envInfo || typeof envInfo !== "object") {
+        return result;
+    }
+    const staticStorages = Array.isArray(envInfo.StaticStorages)
+        ? envInfo.StaticStorages
+        : null;
+    if (!staticStorages || staticStorages.length === 0) {
+        return result;
+    }
+    if (typeof manager?.env?.describeHttpServiceRoute !== "function") {
+        return result;
+    }
+    const resolvedEnvId = (typeof envId === "string" && envId.trim()) ||
+        (typeof envInfo.EnvId === "string" && envInfo.EnvId.trim()) ||
+        undefined;
+    if (!resolvedEnvId) {
+        return result;
+    }
+    try {
+        const routeResult = await manager.env.describeHttpServiceRoute({
+            EnvId: resolvedEnvId,
+            Limit: 1000,
+        });
+        const routes = (0, gateway_access_urls_js_1.flattenHttpServiceRoutes)(routeResult);
+        let primaryRouteEnabled = null;
+        const enrichedStorages = staticStorages.map((store, index) => {
+            if (!store || typeof store !== "object" || Array.isArray(store)) {
+                return store;
+            }
+            const record = store;
+            const domain = typeof record.StaticDomain === "string" ? record.StaticDomain : "";
+            if (!domain) {
+                return store;
+            }
+            const reachable = (0, gateway_access_urls_js_1.isDomainPathReachableViaGateway)(routes, domain, "/");
+            if (index === 0) {
+                primaryRouteEnabled = reachable;
+            }
+            return {
+                ...record,
+                staticDomainRouteEnabled: reachable,
+            };
+        });
+        const enrichment = {
+            StaticStorages: enrichedStorages,
+        };
+        if (primaryRouteEnabled !== null) {
+            enrichment.staticDomainRouteEnabled = primaryRouteEnabled;
+            enrichment.accessUrlReachable = primaryRouteEnabled !== false;
+            if (primaryRouteEnabled === false) {
+                const primaryDomain = typeof enrichedStorages[0]
+                    ?.StaticDomain === "string"
+                    ? String(enrichedStorages[0].StaticDomain)
+                    : "";
+                enrichment.routeDisabled = true;
+                if (primaryDomain) {
+                    enrichment.disabledAccessUrls = [`https://${primaryDomain}/`];
+                }
+            }
+        }
+        return {
+            ...result,
+            EnvInfo: {
+                ...envInfo,
+                ...enrichment,
+            },
+        };
+    }
+    catch {
+        // Gateway route lookup is best-effort enrichment only.
+        return result;
+    }
+}
 function normalizeOptionalToolString(value) {
     return typeof value === "string" && value.trim().length > 0
         ? value.trim()
@@ -4554,8 +4638,9 @@ function registerEnvTools(server) {
                 if (action === "status") {
                     const loginState = await (0, auth_js_1.peekLoginState)();
                     const authFlowState = await (0, auth_js_1.getAuthProgressState)();
-                    // 判断是否为 API Key 模式
-                    const isApiKeyMode = !!(process.env.CLOUDBASE_API_KEY && process.env.CLOUDBASE_ENV_ID);
+                    // Detect API Key mode (CLOUDBASE_API_KEY preferred, CLOUDBASE_APIKEY fallback)
+                    const apiKeyFromEnv = (0, auth_js_1.getCloudBaseApiKeyFromEnv)();
+                    const isApiKeyMode = !!(apiKeyFromEnv && process.env.CLOUDBASE_ENV_ID);
                     const authStatus = loginState
                         ? "READY"
                         : authFlowState.status === "PENDING"
@@ -4603,8 +4688,9 @@ function registerEnvTools(server) {
                     });
                 }
                 if (action === "start_auth") {
-                    // API Key 模式：尝试换取临时密钥
-                    if (process.env.CLOUDBASE_API_KEY && process.env.CLOUDBASE_ENV_ID) {
+                    // API Key mode: exchange for temporary credentials
+                    const apiKeyFromEnv = (0, auth_js_1.getCloudBaseApiKeyFromEnv)();
+                    if (apiKeyFromEnv && process.env.CLOUDBASE_ENV_ID) {
                         try {
                             const existingLoginState = await (0, auth_js_1.peekLoginState)();
                             if (existingLoginState) {
@@ -4618,22 +4704,21 @@ function registerEnvTools(server) {
                             }
                         }
                         catch (e) {
-                            // peekLoginState 内部异常，记录后 fall through
+                            // peekLoginState threw; log and fall through to diagnostic
                             (0, logger_js_1.debug)("start_auth: peekLoginState threw", { error: e instanceof Error ? e.message : String(e) });
                         }
-                        // API Key 换取失败：返回详细诊断信息
-                        // 尝试获取更详细的错误信息
+                        // API Key exchange failed: return diagnostic details
                         let diagMessage = "当前配置了 API Key 认证模式，但换取临时密钥失败。";
                         const endpoint = process.env.CLOUDBASE_API_ENDPOINT || `https://${process.env.CLOUDBASE_ENV_ID}.ap-shanghai.tcb-api.tencentcloudapi.com`;
                         diagMessage += `\n\n诊断信息：`;
                         diagMessage += `\n- CLOUDBASE_ENV_ID: ${process.env.CLOUDBASE_ENV_ID}`;
-                        diagMessage += `\n- CLOUDBASE_API_KEY: ${process.env.CLOUDBASE_API_KEY.slice(0, 20)}...（已截断）`;
+                        diagMessage += `\n- CLOUDBASE_API_KEY: ${apiKeyFromEnv.slice(0, 20)}...（已截断）`;
                         diagMessage += `\n- Endpoint: ${endpoint}`;
                         diagMessage += `\n\n可能原因：`;
                         diagMessage += `\n1. API Key 已过期或被删除`;
                         diagMessage += `\n2. Endpoint 不可达（网络/DNS 问题）`;
                         diagMessage += `\n3. CLOUDBASE_ENV_ID 与 API Key 所属环境不匹配`;
-                        diagMessage += `\n\n建议：检查 MCP 配置中的 CLOUDBASE_API_KEY 和 CLOUDBASE_ENV_ID 环境变量是否正确。`;
+                        diagMessage += `\n\n建议：检查 MCP 配置中的 CLOUDBASE_API_KEY（或兼容的 CLOUDBASE_APIKEY）和 CLOUDBASE_ENV_ID 环境变量是否正确。`;
                         return (0, tool_result_js_1.buildJsonToolResult)({
                             ok: false,
                             code: "API_KEY_AUTH_FAILED",
@@ -4919,12 +5004,12 @@ function registerEnvTools(server) {
                     });
                 }
                 if (action === "logout") {
-                    // API Key 模式下不允许 logout
-                    if (process.env.CLOUDBASE_API_KEY && process.env.CLOUDBASE_ENV_ID) {
+                    // Disallow logout in API Key mode
+                    if ((0, auth_js_1.getCloudBaseApiKeyFromEnv)() && process.env.CLOUDBASE_ENV_ID) {
                         return (0, tool_result_js_1.buildJsonToolResult)({
                             ok: false,
                             code: "LOGOUT_NOT_ALLOWED",
-                            message: "当前使用 API Key 认证模式，不支持退出登录。如需切换认证方式，请移除 CLOUDBASE_API_KEY 环境变量后重启。",
+                            message: "当前使用 API Key 认证模式，不支持退出登录。如需切换认证方式，请移除 CLOUDBASE_API_KEY（或兼容的 CLOUDBASE_APIKEY）环境变量后重启。",
                             auth_mode: "api_key",
                         });
                     }
@@ -5146,6 +5231,8 @@ function registerEnvTools(server) {
                     if (envId) {
                         result = await enrichEnvInfoWithMissingFields(cloudbaseInfo, result, envId);
                     }
+                    // Project gateway Route.Enable next to StaticDomain (do not rewrite StaticDomain).
+                    result = await enrichEnvInfoWithStaticDomainRouteEnabled(cloudbaseInfo, result, envId);
                     result = await enrichEnvInfoWithRuntimeMode(result, cloudbaseInfo);
                     break;
                 case "domains":
@@ -5214,7 +5301,7 @@ function registerEnvTools(server) {
     // Register primary tool name (queryEnv)
     const queryEnvToolSchema = {
         title: "CloudBase 环境查询",
-        description: "查询 CloudBase 环境相关信息，支持查询环境列表、指定环境详情和安全域名。（曾用名：envQuery、listEnvs、getEnvInfo、getEnvAuthDomains）当 action=list 时，会按 DescribeEnvs 语义做列表/筛选，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段；aliasExact=true 时会按别名精确筛选，避免把前缀相近的环境误当作候选；即使传入 envId，action=list 也只返回摘要，不会返回完整资源明细或 expiry。如需查询某个已知 EnvId 对应环境的详细信息（包括资源字段和计费信息），必须使用 action=info 并传入目标环境的 envId 参数。action=info 会在可用时补充 BillingInfo（如 ExpireTime、PayMode、IsAutoRenew 等计费字段）。\n\n🔍 action=info 还会派生三个用于后端选型的字段：\n- `EnvInfo.RuntimeMode`：'postgresql' 或 'nosql'，表示新业务建议默认使用的后端（PG 已开通时为 postgresql，否则为 nosql）。\n- `EnvInfo.RuntimeBackends`：`{postgresql, nosql, mysql}` 三个布尔值，描述当前环境实际并存的后端。\n- `EnvInfo.RuntimeModeHints`：每个后端对应的 API/工具/skill 提示。\n\nAI 在写业务/权限/存储代码前必须先看这三项：PG 模式下新业务推荐 `app.rdb()` + RLS（`managePgDatabase action=execute` 跑 `CREATE POLICY`）+ pgstore；已存在的 NoSQL 集合 / 旧 storage / `managePermissions(resourceType=\"noSqlDatabase\")` 在 PG 环境下仍然有效。真正不适用的是 MySQL：当 `RuntimeBackends.mysql === false` 时，`manageMysqlDatabase` / `queryMysqlDatabase` / `relational-database-mcp-cloudbase` skill 都不该使用。",
+        description: "查询 CloudBase 环境相关信息，支持查询环境列表、指定环境详情和安全域名。（曾用名：envQuery、listEnvs、getEnvInfo、getEnvAuthDomains）当 action=list 时，会按 DescribeEnvs 语义做列表/筛选，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段；aliasExact=true 时会按别名精确筛选，避免把前缀相近的环境误当作候选；即使传入 envId，action=list 也只返回摘要，不会返回完整资源明细或 expiry。如需查询某个已知 EnvId 对应环境的详细信息（包括资源字段和计费信息），必须使用 action=info 并传入目标环境的 envId 参数。action=info 会在可用时补充 BillingInfo（如 ExpireTime、PayMode、IsAutoRenew 等计费字段）。\n\n🔍 action=info 还会派生三个用于后端选型的字段：\n- `EnvInfo.RuntimeMode`：'postgresql' 或 'nosql'，表示新业务建议默认使用的后端（PG 已开通时为 postgresql，否则为 nosql）。\n- `EnvInfo.RuntimeBackends`：`{postgresql, nosql, mysql}` 三个布尔值，描述当前环境实际并存的后端。\n- `EnvInfo.RuntimeModeHints`：每个后端对应的 API/工具/skill 提示。\n\n🌐 action=info 还会在不改写 `StaticStorages[].StaticDomain`（云 API 名义域名）的前提下，投影网关路由 Enable 状态：`StaticStorages[].staticDomainRouteEnabled` 与 `EnvInfo.staticDomainRouteEnabled`（与 queryHosting websiteConfig 同源）。`false` 表示默认静态域名根路由已禁用（访问会返回 GATEWAY_ROUTE_DISABLED），勿把名义域名当成可达 URL。\n\nAI 在写业务/权限/存储代码前必须先看这三项：PG 模式下新业务推荐 `app.rdb()` + RLS（`managePgDatabase action=execute` 跑 `CREATE POLICY`）+ pgstore；已存在的 NoSQL 集合 / 旧 storage / `managePermissions(resourceType=\"noSqlDatabase\")` 在 PG 环境下仍然有效。真正不适用的是 MySQL：当 `RuntimeBackends.mysql === false` 时，`manageMysqlDatabase` / `queryMysqlDatabase` / `relational-database-mcp-cloudbase` skill 都不该使用。",
         inputSchema: {
             action: zod_1.z
                 .enum(["list", "info", "domains"])
@@ -28365,6 +28452,7 @@ const manager_node_1 = __importDefault(__webpack_require__(95492));
 const auth_js_1 = __webpack_require__(77291);
 const logger_js_1 = __webpack_require__(13039);
 const tool_result_js_1 = __webpack_require__(9835);
+const site_map_js_1 = __webpack_require__(68107);
 // Timeout for envId auto-resolution flow.
 // 10 minutes (600 seconds) - matches InteractiveServer timeout
 const ENV_ID_TIMEOUT = 600000;
@@ -28389,7 +28477,7 @@ function createManagerFromLoginState(loginState, region) {
         envId: loginState.envId,
         token: loginState.token,
         proxy: process.env.http_proxy,
-        region: region ?? process.env.TCB_REGION ?? 'ap-shanghai',
+        region: region ?? (0, site_map_js_1.resolveSiteAndRegion)().region,
     });
 }
 async function listAvailableEnvCandidates(options) {
@@ -28417,7 +28505,7 @@ async function listAvailableEnvCandidates(options) {
         if (!loginState?.secretId || !loginState?.secretKey) {
             return [];
         }
-        const region = cloudBaseOptions?.region ?? process.env.TCB_REGION ?? 'ap-shanghai';
+        const region = (0, site_map_js_1.resolveSiteAndRegion)(cloudBaseOptions ?? {}).region;
         cloudbase = createManagerFromLoginState(loginState, region);
     }
     try {
@@ -28618,7 +28706,10 @@ function getCachedEnvId() {
 const databaseInstanceIdCache = new Map();
 function buildDatabaseInstanceIdCacheKey(options) {
     const envId = options?.envId ?? options?.cloudBaseOptions?.envId ?? process.env.CLOUDBASE_ENV_ID ?? 'unknown';
-    const region = options?.region ?? options?.cloudBaseOptions?.region ?? process.env.TCB_REGION ?? 'ap-shanghai';
+    const region = (0, site_map_js_1.resolveSiteAndRegion)({
+        site: options?.cloudBaseOptions?.site,
+        region: options?.region ?? options?.cloudBaseOptions?.region,
+    }).region;
     return `${region}:${envId}`;
 }
 function resetDatabaseInstanceIdCache() {
@@ -28724,11 +28815,11 @@ async function getCloudBaseManager(options = {}) {
         });
     }
     try {
-        // Region priority: explicit option > env var > ap-shanghai default
-        const fallbackRegion = cloudBaseOptions?.region ?? process.env.TCB_REGION ?? 'ap-shanghai';
+        // Region priority: explicit option > TCB_REGION/TCB_SITE env > .cloudbase/project.json > ap-shanghai default
+        const { region: fallbackRegion, site } = (0, site_map_js_1.resolveSiteAndRegion)(cloudBaseOptions ?? {});
         const loginState = authStrategy === 'ensure'
-            ? await (0, auth_js_1.getLoginState)({ region: fallbackRegion })
-            : await (0, auth_js_1.peekLoginState)();
+            ? await (0, auth_js_1.getLoginState)({ region: fallbackRegion, site })
+            : await (0, auth_js_1.peekLoginState)({ region: fallbackRegion, site });
         if (!loginState) {
             const authState = await (0, auth_js_1.getAuthProgressState)();
             if (authState.status === 'PENDING') {
@@ -28776,7 +28867,7 @@ async function getCloudBaseManager(options = {}) {
         }
         // envId priority: explicit option > envManager cache > loginState.envId
         const resolvedEnvId = finalEnvId || loginEnvId;
-        // region 直接使用 fallbackRegion（来自 cloudBaseOptions?.region ?? TCB_REGION ?? 'ap-shanghai'）
+        // region 直接使用 fallbackRegion（resolveSiteAndRegion 统一解析）
         // 不再通过 DescribeEnvs 查询 region，以兼容 STS 临时密钥场景
         const region = fallbackRegion;
         const manager = new manager_node_1.default({
@@ -28808,8 +28899,8 @@ function createCloudBaseManagerWithOptions(cloudBaseOptions) {
         hasSecretKey: !!cloudBaseOptions.secretKey,
         hasToken: !!cloudBaseOptions.token,
     });
-    // Region priority: explicit option > env var > ap-shanghai default
-    const region = cloudBaseOptions.region ?? process.env.TCB_REGION ?? 'ap-shanghai';
+    // Region priority: explicit option > TCB_REGION/TCB_SITE env > .cloudbase/project.json > ap-shanghai default
+    const region = (0, site_map_js_1.resolveSiteAndRegion)(cloudBaseOptions).region;
     const manager = new manager_node_1.default({
         ...cloudBaseOptions,
         proxy: cloudBaseOptions.proxy || process.env.http_proxy,
@@ -41721,424 +41812,6 @@ function done(stream, er, data) {
 })));
 
 
-/***/ }),
-
-/***/ 9097:
-/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
-
-"use strict";
-
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.registerDownloadTools = registerDownloadTools;
-const crypto = __importStar(__webpack_require__(55511));
-const fs = __importStar(__webpack_require__(29021));
-const fsPromises = __importStar(__webpack_require__(79748));
-const http = __importStar(__webpack_require__(81630));
-const https = __importStar(__webpack_require__(55591));
-const os = __importStar(__webpack_require__(21820));
-const path = __importStar(__webpack_require__(33873));
-const url_1 = __webpack_require__(79551);
-const zod_1 = __webpack_require__(7552);
-const remote_url_safety_js_1 = __webpack_require__(89192);
-// 常量定义
-const MAX_FILE_SIZE = 100 * 1024 * 1024; // 100MB
-const MAX_REDIRECT_HOPS = 5;
-const ALLOWED_CONTENT_TYPES = [
-    "text/",
-    "image/",
-    "application/json",
-    "application/xml",
-    "application/pdf",
-    "application/zip",
-    "application/x-zip-compressed"
-];
-// 获取项目根目录
-function getProjectRoot() {
-    // 优先级：环境变量 > 当前工作目录
-    return process.env.WORKSPACE_FOLDER_PATHS ||
-        process.env.PROJECT_ROOT ||
-        process.env.GITHUB_WORKSPACE ||
-        process.env.CI_PROJECT_DIR ||
-        process.env.BUILD_SOURCESDIRECTORY ||
-        process.cwd();
-}
-// 验证相对路径是否安全（不允许路径遍历）
-function isPathSafe(relativePath) {
-    // 检查是否包含路径遍历操作
-    if (relativePath.includes('..') ||
-        relativePath.includes('~') ||
-        path.isAbsolute(relativePath)) {
-        return false;
-    }
-    // 检查路径是否规范化后仍然安全
-    const normalizedPath = path.normalize(relativePath);
-    if (normalizedPath.startsWith('..') ||
-        normalizedPath.startsWith('/') ||
-        normalizedPath.startsWith('\\')) {
-        return false;
-    }
-    return true;
-}
-// 计算最终下载路径
-function calculateDownloadPath(relativePath) {
-    const projectRoot = getProjectRoot();
-    const finalPath = path.join(projectRoot, relativePath);
-    // 确保最终路径在项目根目录内
-    const normalizedProjectRoot = path.resolve(projectRoot);
-    const normalizedFinalPath = path.resolve(finalPath);
-    if (!normalizedFinalPath.startsWith(normalizedProjectRoot)) {
-        throw new Error('相对路径超出项目根目录范围');
-    }
-    return finalPath;
-}
-// 生成随机文件名
-function generateRandomFileName(extension = '') {
-    const randomBytes = crypto.randomBytes(16);
-    const fileName = randomBytes.toString('hex');
-    return `${fileName}${extension}`;
-}
-// 获取安全的临时文件路径
-function getSafeTempFilePath(fileName) {
-    return path.join(os.tmpdir(), fileName);
-}
-// 从 URL 或 Content-Disposition 获取文件扩展名
-function getFileExtension(url, contentType, contentDisposition) {
-    let extension = "";
-    // 从 URL 获取扩展名
-    const urlPath = new url_1.URL(url).pathname;
-    const urlExt = path.extname(urlPath);
-    if (urlExt) {
-        extension = urlExt;
-    }
-    // 从 Content-Disposition 获取扩展名
-    if (contentDisposition) {
-        const filenameMatch = contentDisposition.match(/filename=["']?([^"']+)["']?/);
-        if (filenameMatch) {
-            const dispositionExt = path.extname(filenameMatch[1]);
-            if (dispositionExt) {
-                extension = dispositionExt;
-            }
-        }
-    }
-    // 从 Content-Type 获取扩展名
-    if (!extension && contentType) {
-        const mimeToExt = {
-            "text/plain": ".txt",
-            "text/html": ".html",
-            "text/css": ".css",
-            "text/javascript": ".js",
-            "image/jpeg": ".jpg",
-            "image/png": ".png",
-            "image/gif": ".gif",
-            "image/webp": ".webp",
-            "application/json": ".json",
-            "application/xml": ".xml",
-            "application/pdf": ".pdf",
-            "application/zip": ".zip",
-            "application/x-zip-compressed": ".zip"
-        };
-        extension = mimeToExt[contentType] || "";
-    }
-    return extension;
-}
-function isAllowedContentType(contentType) {
-    return ALLOWED_CONTENT_TYPES.some((allowedType) => contentType.startsWith(allowedType));
-}
-// 检查是否为可重试的网络错误
-function isRetryableError(error) {
-    const retryableCodes = [
-        'ECONNRESET',
-        'ECONNREFUSED',
-        'ETIMEDOUT',
-        'ESOCKETTIMEDOUT',
-        'ENOTFOUND',
-        'EHOSTUNREACH',
-        'ENETUNREACH',
-        'ECONNABORTED'
-    ];
-    return retryableCodes.includes(error.code || '');
-}
-// 下载文件到指定路径（带重试逻辑）
-async function downloadFileToPath(url, targetPath, retryCount = 0, redirectCount = 0) {
-    const MAX_RETRIES = 3;
-    const BASE_DELAY_MS = 1000; // 1秒基础延迟
-    if (redirectCount > MAX_REDIRECT_HOPS) {
-        throw new Error(`重定向次数超过 ${MAX_REDIRECT_HOPS} 次限制`);
-    }
-    const { requestUrl, requestOptions } = await (0, remote_url_safety_js_1.prepareSafeRemoteRequest)(url);
-    const client = requestUrl.protocol === "https:" ? https : http;
-    return new Promise((resolve, reject) => {
-        const request = client.get(requestUrl, requestOptions ?? {}, async (res) => {
-            // 处理重定向
-            if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-                try {
-                    const redirectUrl = new url_1.URL(res.headers.location, requestUrl).toString();
-                    return resolve(await downloadFileToPath(redirectUrl, targetPath, retryCount, redirectCount + 1));
-                }
-                catch (error) {
-                    return reject(error);
-                }
-            }
-            if (res.statusCode !== 200) {
-                reject(new Error(`HTTP Error: ${res.statusCode}`));
-                return;
-            }
-            const contentType = res.headers["content-type"] || "";
-            const contentLength = parseInt(res.headers["content-length"] || "0", 10);
-            if (!isAllowedContentType(contentType)) {
-                reject(new Error(`不允许的内容类型: ${contentType || "unknown"}`));
-                return;
-            }
-            // 文件大小检查
-            if (contentLength > MAX_FILE_SIZE) {
-                reject(new Error(`文件大小 ${contentLength} 字节超过 ${MAX_FILE_SIZE} 字节限制`));
-                return;
-            }
-            // 确保目标目录存在
-            const targetDir = path.dirname(targetPath);
-            try {
-                await fsPromises.mkdir(targetDir, { recursive: true });
-            }
-            catch (error) {
-                reject(new Error(`无法创建目标目录: ${error instanceof Error ? error.message : "未知错误"}`));
-                return;
-            }
-            // 创建写入流
-            const fileStream = fs.createWriteStream(targetPath);
-            let downloadedSize = 0;
-            res.on("data", (chunk) => {
-                downloadedSize += chunk.length;
-                if (downloadedSize > MAX_FILE_SIZE) {
-                    fileStream.destroy();
-                    fsPromises.unlink(targetPath).catch(() => { });
-                    reject(new Error(`文件大小超过 ${MAX_FILE_SIZE} 字节限制`));
-                }
-            });
-            res.pipe(fileStream);
-            fileStream.on("finish", () => {
-                resolve({
-                    filePath: targetPath,
-                    contentType,
-                    fileSize: downloadedSize,
-                });
-            });
-            fileStream.on("error", (error) => {
-                fsPromises.unlink(targetPath).catch(() => { });
-                reject(error);
-            });
-        });
-        request.on("error", async (error) => {
-            // 检查是否可重试
-            if (isRetryableError(error) && retryCount < MAX_RETRIES) {
-                const delay = BASE_DELAY_MS * Math.pow(2, retryCount); // 指数退避
-                console.warn(`下载失败 (${error.code})，${delay}ms 后重试 (${retryCount + 1}/${MAX_RETRIES})...`);
-                await new Promise((resolveDelay) => setTimeout(resolveDelay, delay));
-                try {
-                    return resolve(await downloadFileToPath(url, targetPath, retryCount + 1, redirectCount));
-                }
-                catch (retryError) {
-                    return reject(retryError);
-                }
-            }
-            reject(error);
-        });
-    });
-}
-// 下载文件到临时目录（保持向后兼容，带重试逻辑）
-async function downloadFile(url, retryCount = 0, redirectCount = 0) {
-    const MAX_RETRIES = 3;
-    const BASE_DELAY_MS = 1000; // 1秒基础延迟
-    if (redirectCount > MAX_REDIRECT_HOPS) {
-        throw new Error(`重定向次数超过 ${MAX_REDIRECT_HOPS} 次限制`);
-    }
-    const { requestUrl, requestOptions } = await (0, remote_url_safety_js_1.prepareSafeRemoteRequest)(url);
-    const client = requestUrl.protocol === "https:" ? https : http;
-    return new Promise((resolve, reject) => {
-        const request = client.get(requestUrl, requestOptions ?? {}, async (res) => {
-            // 处理重定向
-            if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-                try {
-                    const redirectUrl = new url_1.URL(res.headers.location, requestUrl).toString();
-                    return resolve(await downloadFile(redirectUrl, retryCount, redirectCount + 1));
-                }
-                catch (error) {
-                    return reject(error);
-                }
-            }
-            if (res.statusCode !== 200) {
-                reject(new Error(`HTTP Error: ${res.statusCode}`));
-                return;
-            }
-            const contentType = res.headers["content-type"] || "";
-            const contentLength = parseInt(res.headers["content-length"] || "0", 10);
-            const contentDisposition = res.headers["content-disposition"];
-            if (!isAllowedContentType(contentType)) {
-                reject(new Error(`不允许的内容类型: ${contentType || "unknown"}`));
-                return;
-            }
-            // 文件大小检查
-            if (contentLength > MAX_FILE_SIZE) {
-                reject(new Error(`文件大小 ${contentLength} 字节超过 ${MAX_FILE_SIZE} 字节限制`));
-                return;
-            }
-            // 生成临时文件路径
-            const extension = getFileExtension(requestUrl.toString(), contentType, contentDisposition);
-            const fileName = generateRandomFileName(extension);
-            const filePath = getSafeTempFilePath(fileName);
-            // 创建写入流
-            const fileStream = fs.createWriteStream(filePath);
-            let downloadedSize = 0;
-            res.on("data", (chunk) => {
-                downloadedSize += chunk.length;
-                if (downloadedSize > MAX_FILE_SIZE) {
-                    fileStream.destroy();
-                    fsPromises.unlink(filePath).catch(() => { });
-                    reject(new Error(`文件大小超过 ${MAX_FILE_SIZE} 字节限制`));
-                }
-            });
-            res.pipe(fileStream);
-            fileStream.on("finish", () => {
-                resolve({
-                    filePath,
-                    contentType,
-                    fileSize: downloadedSize,
-                });
-            });
-            fileStream.on("error", (error) => {
-                fsPromises.unlink(filePath).catch(() => { });
-                reject(error);
-            });
-        });
-        request.on("error", async (error) => {
-            // 检查是否可重试
-            if (isRetryableError(error) && retryCount < MAX_RETRIES) {
-                const delay = BASE_DELAY_MS * Math.pow(2, retryCount); // 指数退避
-                console.warn(`下载失败 (${error.code})，${delay}ms 后重试 (${retryCount + 1}/${MAX_RETRIES})...`);
-                await new Promise((resolveDelay) => setTimeout(resolveDelay, delay));
-                try {
-                    return resolve(await downloadFile(url, retryCount + 1, redirectCount));
-                }
-                catch (retryError) {
-                    return reject(retryError);
-                }
-            }
-            reject(error);
-        });
-    });
-}
-function buildDownloadRemoteFileErrorMessage(url, error) {
-    const baseMessage = error instanceof Error ? error.message : String(error);
-    const suggestions = [];
-    if (/HTTP Error:\s*404/i.test(baseMessage)) {
-        suggestions.push("目标 URL 当前返回 404，说明资源链接已失效或路径不正确。");
-        suggestions.push("请先在浏览器中确认该链接可访问，再重新执行下载。");
-    }
-    if (/ENOTFOUND|ECONNRESET|ETIMEDOUT|socket hang up/i.test(baseMessage)) {
-        suggestions.push("下载过程中出现网络异常，系统已自动重试 3 次但均失败。");
-        suggestions.push("建议：1) 检查本地网络或代理设置；2) 该网站可能限频，请尝试更换其他图片源（如 Unsplash、Pexels）；3) 稍后重试。");
-    }
-    if (suggestions.length === 0) {
-        suggestions.push("请检查 URL 是否可访问，以及目标资源是否允许直接下载。");
-    }
-    return `[downloadRemoteFile] ${baseMessage}\nURL: ${url}\n建议：${suggestions.join(" ")}`;
-}
-function registerDownloadTools(server) {
-    server.registerTool("downloadRemoteFile", {
-        title: "下载远程文件到指定路径",
-        description: "下载远程文件到项目根目录下的指定相对路径。例如：小程序的 Tabbar 等素材图片，必须使用 **png** 格式，可以从 Unsplash、wikimedia【一般选用 500 大小即可、Pexels、Apple 官方 UI 等资源中选择来下载。",
-        inputSchema: {
-            url: zod_1.z.string().describe("远程文件的 URL 地址"),
-            relativePath: zod_1.z.string().describe("相对于项目根目录的路径，例如：'assets/images/logo.png' 或 'docs/api.md'。不允许使用 ../ 等路径遍历操作。")
-        },
-        annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
-            openWorldHint: true,
-            category: "download"
-        }
-    }, async ({ url, relativePath }) => {
-        if (!isPathSafe(relativePath)) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: JSON.stringify({
-                            success: false,
-                            error: "不安全的相对路径",
-                            message: "相对路径包含路径遍历操作（../）或绝对路径，出于安全考虑已拒绝",
-                            suggestion: "请使用项目根目录下的相对路径，例如：'assets/images/logo.png'"
-                        }, null, 2)
-                    }
-                ]
-            };
-        }
-        const targetPath = calculateDownloadPath(relativePath);
-        const projectRoot = getProjectRoot();
-        console.log(`📁 项目根目录: ${projectRoot}`);
-        console.log(`📁 相对路径: ${relativePath}`);
-        console.log(`📁 最终路径: ${targetPath}`);
-        let result;
-        try {
-            result = await downloadFileToPath(url, targetPath);
-        }
-        catch (error) {
-            throw new Error(buildDownloadRemoteFileErrorMessage(url, error));
-        }
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify({
-                        success: true,
-                        filePath: result.filePath,
-                        relativePath: relativePath,
-                        contentType: result.contentType,
-                        fileSize: result.fileSize,
-                        projectRoot: projectRoot,
-                        message: "文件下载成功到指定路径",
-                        note: `文件已保存到项目目录: ${relativePath}`
-                    }, null, 2)
-                }
-            ]
-        };
-    });
-}
-
-
 /***/ }),
 
 /***/ 9141:
@@ -83594,27 +83267,6 @@ function done(stream, er, data) {
   return stream.push(null);
 }
 
-/***/ }),
-
-/***/ 21454:
-/***/ ((__unused_webpack_module, exports) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.isInternationalRegion = void 0;
-exports.isValidRegion = isValidRegion;
-const REGION = {
-    SHANGHAI: 'ap-shanghai',
-    SINGAPORE: 'ap-singapore',
-};
-const isInternationalRegion = (region) => region === REGION.SINGAPORE;
-exports.isInternationalRegion = isInternationalRegion;
-function isValidRegion(region) {
-    return Object.values(REGION).includes(region);
-}
-
-
 /***/ }),
 
 /***/ 21605:
@@ -84798,12 +84450,19 @@ exports.colors = {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.isGatewayRouteEnabled = isGatewayRouteEnabled;
+exports.isDomainPathReachableViaGateway = isDomainPathReachableViaGateway;
 exports.rankGatewayAccessUrls = rankGatewayAccessUrls;
 exports.flattenHttpServiceRoutes = flattenHttpServiceRoutes;
 exports.filterRoutesByUpstream = filterRoutesByUpstream;
 exports.toAccessUrlEnvelope = toAccessUrlEnvelope;
 exports.resolveGatewayAccessUrls = resolveGatewayAccessUrls;
+exports.resolveAllGatewayRoutes = resolveAllGatewayRoutes;
 exports.preferGatewayOrFallback = preferGatewayOrFallback;
+/** Route is reachable unless Enable is explicitly false. */
+function isGatewayRouteEnabled(route) {
+    return route.Enable !== false;
+}
 function normalizeAccessPath(path) {
     if (!path) {
         return "/";
@@ -84813,13 +84472,63 @@ function normalizeAccessPath(path) {
 function buildHttpsUrl(domain, path) {
     return `https://${domain}${normalizeAccessPath(path)}`;
 }
+function extractHostname(urlOrHost) {
+    const trimmed = urlOrHost.trim();
+    if (!trimmed) {
+        return "";
+    }
+    try {
+        if (trimmed.includes("://")) {
+            return new URL(trimmed).hostname.toLowerCase();
+        }
+    }
+    catch {
+        // Fall through to treat as bare hostname.
+    }
+    return trimmed.replace(/\/.*$/, "").toLowerCase();
+}
+/**
+ * Whether a hostname has an enabled covering gateway route for the given path.
+ * Longest matching Path prefix wins. Missing route info → unknown (null).
+ */
+function isDomainPathReachableViaGateway(routes, domainOrUrl, requestPath) {
+    const hostname = extractHostname(domainOrUrl);
+    if (!hostname) {
+        return null;
+    }
+    const normalizedRequest = normalizeAccessPath(requestPath);
+    const domainRoutes = routes.filter((route) => Boolean(route.Domain) &&
+        route.Domain.toLowerCase() === hostname);
+    if (domainRoutes.length === 0) {
+        return null;
+    }
+    const covering = domainRoutes
+        .map((route) => ({
+        route,
+        path: normalizeAccessPath(route.Path),
+    }))
+        .filter(({ path }) => {
+        if (path === "/") {
+            return true;
+        }
+        return (normalizedRequest === path ||
+            normalizedRequest.startsWith(path.endsWith("/") ? path : `${path}/`));
+    })
+        .sort((a, b) => b.path.length - a.path.length);
+    if (covering.length === 0) {
+        return null;
+    }
+    return isGatewayRouteEnabled(covering[0].route);
+}
 /**
  * Rank gateway route URLs: custom domains (IsDefault !== true) before default domain.
- * Stable within each group; dedupe by full URL.
+ * By default skips Enable === false routes. Stable within each group; dedupe by full URL.
  */
-function rankGatewayAccessUrls(routes) {
+function rankGatewayAccessUrls(routes, options) {
+    const includeDisabled = options?.includeDisabled === true;
     const mapped = routes
         .filter((route) => Boolean(route.Domain))
+        .filter((route) => includeDisabled || isGatewayRouteEnabled(route))
         .map((route) => {
         const path = normalizeAccessPath(route.Path);
         const isDefault = route.IsDefault === true;
@@ -84828,6 +84537,7 @@ function rankGatewayAccessUrls(routes) {
             domain: route.Domain,
             path,
             isDefault,
+            enabled: isGatewayRouteEnabled(route),
             source: (isDefault
                 ? "gateway.default"
                 : "gateway.custom"),
@@ -84855,6 +84565,7 @@ function flattenHttpServiceRoutes(result) {
         Domain: domainItem.Domain ?? "",
         IsDefault: domainItem.IsDefault,
         Path: typeof route.Path === "string" ? route.Path : undefined,
+        Enable: typeof route.Enable === "boolean" ? route.Enable : undefined,
         UpstreamResourceType: typeof route.UpstreamResourceType === "string"
             ? route.UpstreamResourceType
             : undefined,
@@ -84877,64 +84588,116 @@ function filterRoutesByUpstream(routes, input) {
             types.includes(String(route.UpstreamResourceType)));
     });
 }
-function toAccessUrlEnvelope(ranked) {
-    if (ranked.length === 0) {
-        return { accessUrls: [], routes: [] };
+function toAccessUrlEnvelope(ranked, disabledAccessUrls = []) {
+    const enabled = ranked.filter((item) => item.enabled);
+    if (enabled.length === 0) {
+        return {
+            accessUrls: [],
+            routes: [],
+            disabledAccessUrls,
+        };
     }
     return {
-        accessUrl: ranked[0].url,
-        accessUrls: ranked.map((item) => item.url),
-        accessUrlSource: ranked[0].source,
-        routes: ranked,
+        accessUrl: enabled[0].url,
+        accessUrls: enabled.map((item) => item.url),
+        accessUrlSource: enabled[0].source,
+        routes: enabled,
+        disabledAccessUrls,
     };
 }
+async function loadHttpServiceRoutes(getManager, envId) {
+    const manager = await getManager();
+    const result = await manager.env.describeHttpServiceRoute({
+        EnvId: envId,
+        Limit: 1000,
+    });
+    return flattenHttpServiceRoutes(result);
+}
 /**
  * Best-effort lookup of gateway access URLs for an upstream resource.
  * Never throws — returns empty lists on failure.
+ * Disabled routes (Enable === false) are excluded from accessUrl(s).
  */
 async function resolveGatewayAccessUrls(input) {
     try {
-        const manager = await input.getManager();
-        const result = await manager.env.describeHttpServiceRoute({
-            EnvId: input.envId,
-            Limit: 1000,
-        });
-        const flattened = flattenHttpServiceRoutes(result);
+        const flattened = await loadHttpServiceRoutes(input.getManager, input.envId);
         const matched = filterRoutesByUpstream(flattened, {
             upstreamResourceName: input.upstreamResourceName,
             upstreamResourceTypes: input.upstreamResourceTypes,
         });
-        return toAccessUrlEnvelope(rankGatewayAccessUrls(matched));
+        const disabledAccessUrls = rankGatewayAccessUrls(matched, {
+            includeDisabled: true,
+        })
+            .filter((item) => !item.enabled)
+            .map((item) => item.url);
+        return toAccessUrlEnvelope(rankGatewayAccessUrls(matched), disabledAccessUrls);
     }
     catch {
-        return { accessUrls: [], routes: [] };
+        return { accessUrls: [], routes: [], disabledAccessUrls: [] };
+    }
+}
+/**
+ * Load all flattened HTTP service routes (best-effort). Used by hosting to
+ * judge whether the static-domain fallback itself is gateway-disabled.
+ */
+async function resolveAllGatewayRoutes(input) {
+    try {
+        return await loadHttpServiceRoutes(input.getManager, input.envId);
+    }
+    catch {
+        return [];
     }
 }
 /**
  * Merge ranked gateway URLs with a resource-native fallback URL.
  * Gateway custom/default always win over the fallback when present.
+ * Unreachable fallbacks are omitted from accessUrl(s) and listed under
+ * disabledAccessUrls instead.
  */
 function preferGatewayOrFallback(input) {
+    const disabledAccessUrls = [
+        ...(input.gateway.disabledAccessUrls ?? []),
+    ];
+    const fallbackReachable = input.fallbackReachable !== false;
     if (input.gateway.accessUrl) {
         const urls = [...input.gateway.accessUrls];
         if (input.fallbackUrl &&
+            fallbackReachable &&
             !urls.includes(input.fallbackUrl)) {
             urls.push(input.fallbackUrl);
         }
+        else if (input.fallbackUrl &&
+            !fallbackReachable &&
+            !disabledAccessUrls.includes(input.fallbackUrl)) {
+            disabledAccessUrls.push(input.fallbackUrl);
+        }
         return {
             accessUrl: input.gateway.accessUrl,
             accessUrls: urls,
             accessUrlSource: input.gateway.accessUrlSource,
+            accessUrlReachable: true,
+            disabledAccessUrls,
         };
     }
-    if (input.fallbackUrl) {
+    if (input.fallbackUrl && fallbackReachable) {
         return {
             accessUrl: input.fallbackUrl,
             accessUrls: [input.fallbackUrl],
             accessUrlSource: input.fallbackSource,
+            accessUrlReachable: true,
+            disabledAccessUrls,
         };
     }
-    return { accessUrls: [] };
+    if (input.fallbackUrl && !fallbackReachable) {
+        if (!disabledAccessUrls.includes(input.fallbackUrl)) {
+            disabledAccessUrls.push(input.fallbackUrl);
+        }
+    }
+    return {
+        accessUrls: [],
+        accessUrlReachable: false,
+        disabledAccessUrls,
+    };
 }
 
 
@@ -91262,8 +91025,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.CUSTOM_IMAGE_RUNTIME = exports.MANAGE_FUNCTION_ACTIONS = exports.QUERY_FUNCTION_ACTIONS = exports.TRIGGER_CONFIG_EXAMPLES = exports.SUPPORTED_TRIGGER_TYPES = exports.DEFAULT_NODEJS_RUNTIME = exports.SUPPORTED_NODEJS_RUNTIMES = exports.RECOMMENDED_RUNTIMES = exports.DEFAULT_RUNTIME = exports.ALL_SUPPORTED_RUNTIMES = exports.SUPPORTED_RUNTIMES = void 0;
+exports.CUSTOM_IMAGE_RUNTIME = exports.LAYER_SOFT_WARN = exports.MANAGE_FUNCTION_ACTIONS = exports.QUERY_FUNCTION_ACTIONS = exports.TRIGGER_CONFIG_EXAMPLES = exports.SUPPORTED_TRIGGER_TYPES = exports.DEFAULT_NODEJS_RUNTIME = exports.SUPPORTED_NODEJS_RUNTIMES = exports.RECOMMENDED_RUNTIMES = exports.DEFAULT_RUNTIME = exports.ALL_SUPPORTED_RUNTIMES = exports.SUPPORTED_RUNTIMES = void 0;
 exports.formatRuntimeList = formatRuntimeList;
+exports.layerNameIncludesEnvId = layerNameIncludesEnvId;
+exports.buildCreateLayerNameWarning = buildCreateLayerNameWarning;
 exports.validateTimerCron = validateTimerCron;
 exports.pickManageFunctionName = pickManageFunctionName;
 exports.shouldInstallDependencyForFunction = shouldInstallDependencyForFunction;
@@ -91368,6 +91133,24 @@ exports.MANAGE_FUNCTION_ACTIONS = [
     "updateFunctionLayers",
     "incrementalDeployFunction", // 增量部署，需通过 pluginOptions.functions 注入实现
 ];
+/** Layer soft-warn copy — account-scoped SCF LayerName guidance (no hard fail). */
+exports.LAYER_SOFT_WARN = {
+    createNameFormat: (envId) => `建议使用 {layerName}_${envId} 格式，当前名称可能与其他环境共享版本序列`,
+    deleteVersion: "该层为账号级共享资源，删除版本会影响所有绑定该版本的环境的函数，请确认",
+    bindShared: "层为账号级共享，绑定/解绑影响所有引用该层名的环境",
+    accountLevelView: "返回账号级视图，含其他环境创建的层",
+};
+function layerNameIncludesEnvId(layerName, envId) {
+    if (!envId)
+        return true;
+    return layerName.includes(envId);
+}
+function buildCreateLayerNameWarning(layerName, envId) {
+    if (!envId || layerNameIncludesEnvId(layerName, envId)) {
+        return undefined;
+    }
+    return exports.LAYER_SOFT_WARN.createNameFormat(envId);
+}
 const VPC_SCHEMA = zod_1.z.object({
     vpcId: zod_1.z
         .string()
@@ -91609,11 +91392,12 @@ function registerFunctionTools(server) {
     const cloudBaseOptions = server.cloudBaseOptions;
     const deployOverrides = server.pluginOptions?.functions;
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
-    const buildEnvelope = (data, message, nextActions) => ({
+    const buildEnvelope = (data, message, nextActions, warnings) => ({
         success: true,
         data,
         message,
         ...(nextActions?.length ? { nextActions } : {}),
+        ...(warnings?.length ? { warnings } : {}),
     });
     const buildErrorEnvelope = (error, errorCode) => ({
         success: false,
@@ -91864,7 +91648,7 @@ function registerFunctionTools(server) {
                         action: "createLayerVersion",
                         reason: "发布新的层版本",
                     },
-                ]);
+                ], [exports.LAYER_SOFT_WARN.accountLevelView]);
             }
             case "listLayerVersions": {
                 if (!input.layerName) {
@@ -91892,7 +91676,7 @@ function registerFunctionTools(server) {
                         action: "attachLayer",
                         reason: "将某个层版本绑定到函数",
                     },
-                ]);
+                ], [exports.LAYER_SOFT_WARN.accountLevelView]);
             }
             case "getLayerVersionDetail": {
                 if (!input.layerName) {
@@ -91925,7 +91709,7 @@ function registerFunctionTools(server) {
                         action: "deleteLayerVersion",
                         reason: "删除该层版本",
                     },
-                ]);
+                ], [exports.LAYER_SOFT_WARN.accountLevelView]);
             }
             case "listFunctionTriggers": {
                 if (!input.functionName) {
@@ -92441,6 +92225,8 @@ function registerFunctionTools(server) {
                 if (!input.contentPath && !input.base64Content) {
                     throw new Error("createLayerVersion 操作时，contentPath 和 base64Content 至少需要提供一个");
                 }
+                const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+                const nameWarning = buildCreateLayerNameWarning(input.layerName, envId);
                 const cloudbase = await getManager();
                 const result = await cloudbase.functions.createLayer({
                     name: input.layerName,
@@ -92463,7 +92249,7 @@ function registerFunctionTools(server) {
                         action: "listLayerVersions",
                         reason: "查看该层的全部版本",
                     },
-                ]);
+                ], nameWarning ? [nameWarning] : undefined);
             }
             case "deleteLayerVersion": {
                 if (!input.layerName) {
@@ -92490,7 +92276,7 @@ function registerFunctionTools(server) {
                         action: "listLayerVersions",
                         reason: "确认剩余层版本",
                     },
-                ]);
+                ], [exports.LAYER_SOFT_WARN.deleteVersion]);
             }
             case "attachLayer":
             case "detachLayer":
@@ -92500,6 +92286,7 @@ function registerFunctionTools(server) {
                 }
                 const cloudbase = await getManager();
                 const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+                const bindWarnings = [exports.LAYER_SOFT_WARN.bindShared];
                 if (input.action === "attachLayer") {
                     if (!input.layerName) {
                         throw new Error("attachLayer 操作时，layerName 参数是必需的");
@@ -92528,7 +92315,7 @@ function registerFunctionTools(server) {
                             action: "listFunctionLayers",
                             reason: "确认函数当前绑定层列表",
                         },
-                    ]);
+                    ], bindWarnings);
                 }
                 if (input.action === "detachLayer") {
                     if (!input.layerName) {
@@ -92559,7 +92346,7 @@ function registerFunctionTools(server) {
                             action: "listFunctionLayers",
                             reason: "确认解绑后的层列表",
                         },
-                    ]);
+                    ], bindWarnings);
                 }
                 const normalizedLayers = normalizeManageLayers(input.layers);
                 if (!normalizedLayers.length) {
@@ -92584,7 +92371,7 @@ function registerFunctionTools(server) {
                         action: "listFunctionLayers",
                         reason: "确认最新层顺序和绑定结果",
                     },
-                ]);
+                ], bindWarnings);
             }
             default:
                 // incrementalDeployFunction：无默认实现，必须通过 pluginOptions 注入
@@ -92614,6 +92401,10 @@ function registerFunctionTools(server) {
             "\n- 示例：`queryFunctions(action=\"listFunctionLogs\", functionName=\"my-function\")`" +
             "\n- 如需查看日志详情：`queryFunctions(action=\"getFunctionLogDetail\", requestId=\"xxx\")`" +
             "\n\n**定时任务 / cron / 定时跑**：使用 `listFunctionTriggers` 查询函数的 timer 触发器配置。" +
+            "\n\n**层（Layer）说明**：" +
+            "\n- 层为 SCF 账号级共享命名空间：不同环境创建同名层会共享同一层的版本序列；删除某版本会影响所有绑定该版本的环境的函数" +
+            "\n- 创建层必须用带环境标识的唯一层名，固定格式：`{layerName}_{当前envId}`（如 `common_cloud1-d9ghadgak3edf6b36`）。不要在不同环境使用相同裸层名，创建前先 `listLayers` 查重" +
+            "\n- `listLayers` / `listLayerVersions` / `getLayerVersionDetail` 返回账号级视图，可能含其他环境创建的层" +
             "\n\n**区分 `queryLogs` 工具**：" +
             "\n- 本工具用于查询特定 CloudBase 云函数的执行日志" +
             "\n- `queryLogs` 工具用于搜索 CLS 日志服务（跨服务日志聚合）",
@@ -92626,9 +92417,9 @@ function registerFunctionTools(server) {
                 "\n- `listFunctionLogs`: 查询 CloudBase 云函数执行日志（需要 functionName）" +
                 "\n- `getFunctionLogDetail`: 获取日志详情（需要 requestId）" +
                 "\n- `listFunctionLayers`: 列出函数绑定的层" +
-                "\n- `listLayers`: 列出所有层" +
-                "\n- `listLayerVersions`: 列出层的版本（注意：是 Versions 不是 Version）" +
-                "\n- `getLayerVersionDetail`: 获取层版本详情" +
+                "\n- `listLayers`: 列出所有层（账号级视图，含其他环境创建的层）" +
+                "\n- `listLayerVersions`: 列出层的版本（注意：是 Versions 不是 Version；账号级视图）" +
+                "\n- `getLayerVersionDetail`: 获取层版本详情（账号级视图）" +
                 "\n- `listFunctionTriggers`: 列出函数触发器（用于查看定时任务 / cron / timer 配置）" +
                 "\n- `getFunctionDownloadUrl`: 获取函数代码下载地址"),
             functionName: zod_1.z
@@ -92655,7 +92446,11 @@ function registerFunctionTools(server) {
             qualifier: zod_1.z.string().optional().describe("函数版本别名，如 $LATEST、$DEFAULT。日志查询时可选"),
             runtime: zod_1.z.string().optional().describe("层查询的运行时筛选，如 Nodejs18.15"),
             searchKey: zod_1.z.string().optional().describe("层名称搜索关键字"),
-            layerName: zod_1.z.string().optional().describe("层名称。`listLayerVersions`、`getLayerVersionDetail` 操作必填"),
+            layerName: zod_1.z
+                .string()
+                .optional()
+                .describe("层名称。`listLayerVersions`、`getLayerVersionDetail` 操作必填。" +
+                "层为账号级共享命名空间；推荐固定格式 `{layerName}_{当前envId}`（如 common_cloud1-d9ghadgak3edf6b36）"),
             layerVersion: zod_1.z.number().optional().describe("层版本号。`getLayerVersionDetail` 操作必填"),
         },
         annotations: {
@@ -92670,12 +92465,18 @@ function registerFunctionTools(server) {
             "如果要创建 cron 定时任务，先用 createFunction 创建函数，再用 createFunctionTrigger 创建 timer 触发器（支持7段cron表达式），deleteFunctionTrigger 删除触发器。" +
             "镜像部署（Runtime=CustomImage）：先把代码经 zip→COS→CloudApp custom 构建→TCR 推镜像（这一阶段为裸腾讯云 API，本工具不覆盖），" +
             "再用 createFunction(func.runtime=\"CustomImage\", imageConfig) 基于 TCR 镜像创建 HTTP 函数；后续迭代用 updateFunctionCode + imageConfig 换镜像 tag。" +
-            "危险操作需要显式 confirm=true。",
+            "危险操作需要显式 confirm=true。" +
+            "\n\n**层（Layer）说明**：" +
+            "\n- 层为 SCF 账号级共享命名空间：不同环境创建同名层会共享同一层的版本序列；删除某版本会影响所有绑定该版本的环境的函数" +
+            "\n- 创建层必须用带环境标识的唯一层名，固定格式：`{layerName}_{当前envId}`（如 `common_cloud1-d9ghadgak3edf6b36`）。不要在不同环境使用相同裸层名，创建前先 `listLayers` 查重" +
+            "\n- 相关 action：`createLayerVersion` / `deleteLayerVersion` / `attachLayer` / `detachLayer` / `updateFunctionLayers`（只读查询见 queryFunctions 的 listLayers / listLayerVersions / getLayerVersionDetail）",
         inputSchema: {
             action: zod_1.z
                 .enum(exports.MANAGE_FUNCTION_ACTIONS)
                 .describe("写操作类型，例如 createFunction、updateFunctionCode、incrementalDeployFunction、invokeFunction、deleteFunction、" +
-                "createFunctionTrigger（定时任务 / cron / timer）、deleteFunctionTrigger、attachLayer、detachLayer"),
+                "createFunctionTrigger（定时任务 / cron / timer）、deleteFunctionTrigger、" +
+                "createLayerVersion、deleteLayerVersion、attachLayer、detachLayer、updateFunctionLayers。" +
+                "层名推荐固定格式 `{layerName}_{当前envId}`（如 common_cloud1-d9ghadgak3edf6b36）"),
             func: CREATE_FUNCTION_SCHEMA.optional().describe("createFunction 操作的函数配置"),
             functionRootPath: zod_1.z.string().optional().describe("创建或更新函数代码时默认推荐的本地目录方式。" +
                 "必须是直接包含函数文件夹的目录绝对路径（如 /abs/path/cloudfunctions 或 /abs/path/functions），" +
@@ -92705,7 +92506,11 @@ function registerFunctionTools(server) {
                 .describe("createFunctionTrigger 的触发器列表，用于定时跑 / 定时任务 / scheduled job。timer 触发器使用7段 cron 表达式（秒 分 时 日 月 星期 年），" +
                 '如 "0 */5 * * * * *" 表示每5分钟执行一次'),
             triggerName: zod_1.z.string().optional().describe("deleteFunctionTrigger 的目标触发器名称"),
-            layerName: zod_1.z.string().optional().describe("层名称"),
+            layerName: zod_1.z
+                .string()
+                .optional()
+                .describe("层名称。创建层推荐固定格式 `{layerName}_{当前envId}`（如 common_cloud1-d9ghadgak3edf6b36）；" +
+                "不要跨环境复用裸层名。层为账号级共享命名空间"),
             layerVersion: zod_1.z.number().optional().describe("层版本号"),
             contentPath: zod_1.z.string().optional().describe("层内容路径，可为目录或 ZIP 文件"),
             base64Content: zod_1.z.string().optional().describe("层内容的 base64 编码"),
@@ -105248,7 +105053,6 @@ const mcp_js_1 = __webpack_require__(7011);
 const databaseNoSQL_js_1 = __webpack_require__(73903);
 const databasePG_js_1 = __webpack_require__(56473);
 const databaseSQL_js_1 = __webpack_require__(9782);
-const download_js_1 = __webpack_require__(9097);
 const env_js_1 = __webpack_require__(622);
 const functions_js_1 = __webpack_require__(25936);
 const hosting_js_1 = __webpack_require__(37279);
@@ -105269,7 +105073,7 @@ const logs_js_1 = __webpack_require__(92322);
 const permissions_js_1 = __webpack_require__(76485);
 const cloud_mode_js_1 = __webpack_require__(89684);
 const logger_js_1 = __webpack_require__(13039);
-const tencent_cloud_js_1 = __webpack_require__(21454);
+const site_map_js_1 = __webpack_require__(68107);
 const tool_result_js_1 = __webpack_require__(9835);
 const tool_wrapper_js_1 = __webpack_require__(71363);
 // 默认插件列表
@@ -105291,13 +105095,15 @@ const DEFAULT_PLUGINS = [
     "permissions",
     "logs",
     "agents",
-    "download",
     "capi",
 ];
 function registerDatabase(server) {
-    // Skip NoSQL database tools for international region (Singapore) as it doesn't support NoSQL DB
-    const region = server.cloudBaseOptions?.region || process.env.TCB_REGION;
-    if (!(0, tencent_cloud_js_1.isInternationalRegion)(region)) {
+    // NoSQL 数据库按站点能力集合注册（国际站默认不支持 NoSQL）
+    const { site } = (0, site_map_js_1.resolveSiteAndRegion)({
+        site: server.cloudBaseOptions?.site,
+        region: server.cloudBaseOptions?.region,
+    });
+    if (site_map_js_1.SITE_REGION_MAP[site].capabilities.noSql) {
         (0, databaseNoSQL_js_1.registerDatabaseTools)(server);
     }
     (0, dataModel_js_1.registerDataModelTools)(server);
@@ -105306,8 +105112,11 @@ function registerMysqlDatabase(server) {
     (0, databaseSQL_js_1.registerSQLDatabaseTools)(server);
 }
 function registerNoSQLDatabase(server) {
-    const region = server.cloudBaseOptions?.region || process.env.TCB_REGION;
-    if (!(0, tencent_cloud_js_1.isInternationalRegion)(region)) {
+    const { site } = (0, site_map_js_1.resolveSiteAndRegion)({
+        site: server.cloudBaseOptions?.site,
+        region: server.cloudBaseOptions?.region,
+    });
+    if (site_map_js_1.SITE_REGION_MAP[site].capabilities.noSql) {
         (0, databaseNoSQL_js_1.registerDatabaseTools)(server);
     }
 }
@@ -105326,7 +105135,6 @@ const AVAILABLE_PLUGINS = {
     storage: { name: "storage", register: storage_js_1.registerStorageTools },
     setup: { name: "setup", register: setup_js_1.registerSetupTools },
     rag: { name: "rag", register: rag_js_1.registerRagTools },
-    download: { name: "download", register: download_js_1.registerDownloadTools },
     gateway: { name: "gateway", register: gateway_js_1.registerGatewayTools },
     "app-auth": { name: "app-auth", register: app_auth_js_1.registerAppAuthTools },
     permissions: { name: "permissions", register: permissions_js_1.registerPermissionTools },
@@ -116766,8 +116574,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.CLOUDRUN_ACCESS_TYPES = exports.CLOUDRUN_SERVICE_TYPES = void 0;
+exports.CLOUDRUN_PACKAGE_TYPES = exports.CLOUDRUN_ACCESS_TYPES = exports.CLOUDRUN_SERVICE_TYPES = void 0;
+exports.queryCloudRunEnvStatus = queryCloudRunEnvStatus;
+exports.describeCloudRunEnvStatus = describeCloudRunEnvStatus;
+exports.ensureCloudRunEnvInitialized = ensureCloudRunEnvInitialized;
 exports.detectCloudRunDbNetworkRisk = detectCloudRunDbNetworkRisk;
+exports.extractCloudRunImageInfo = extractCloudRunImageInfo;
 exports.registerCloudRunTools = registerCloudRunTools;
 const child_process_1 = __webpack_require__(79646);
 const fs_1 = __importDefault(__webpack_require__(29021));
@@ -116782,24 +116594,31 @@ const cloudrun_config_js_1 = __webpack_require__(48266);
 exports.CLOUDRUN_SERVICE_TYPES = ['function', 'container'];
 // CloudRun access types
 exports.CLOUDRUN_ACCESS_TYPES = ['OA', 'PUBLIC', 'MINIAPP', 'VPC'];
+// CloudRun env package types (CreateCloudRunEnv.PackageType)
+exports.CLOUDRUN_PACKAGE_TYPES = ['Trial', 'Standard', 'Professional', 'Enterprise'];
 // Input schema for queryCloudRun tool
 const queryCloudRunInputSchema = {
-    action: zod_1.z.enum(['list', 'detail', 'templates', 'getDeployLog']).describe('查询操作类型：list=获取云托管服务列表（支持分页和筛选），detail=查询指定服务的详细信息（包含服务配置和最新部署状态），templates=获取可用的项目模板列表（用于初始化新项目），getDeployLog=获取指定服务最近一次或指定构建的部署日志'),
+    action: zod_1.z.enum(['list', 'detail', 'templates', 'getDeployLog', 'envStatus']).describe('查询操作类型：list=获取云托管服务列表（支持分页和筛选），detail=查询指定服务的详细信息（包含服务配置和最新部署状态），templates=获取可用的项目模板列表（用于初始化新项目），getDeployLog=获取指定服务最近一次或指定构建的部署日志，envStatus=查询当前环境云托管是否已开通及开通状态（Status=creating开通中/normal已开通），用于initEnv之后轮询进度或deploy之前确认环境是否就绪'),
     // List operation parameters
     pageSize: zod_1.z.number().min(1).max(100).optional().default(10).describe('分页大小，控制每页返回的服务数量。取值范围：1-100，默认值：10。建议根据网络性能和显示需求调整'),
     pageNum: zod_1.z.number().min(1).optional().default(1).describe('页码，用于分页查询。从1开始，默认值：1。配合pageSize使用可实现分页浏览'),
     serverName: zod_1.z.string().optional().describe('服务名称筛选条件，支持模糊匹配。例如：输入"test"可匹配"test-service"、"my-test-app"等服务名称。留空则查询所有服务'),
     serverType: zod_1.z.enum(exports.CLOUDRUN_SERVICE_TYPES).optional().describe('服务类型筛选条件：function=函数型云托管（仅支持Node.js，有特殊的开发要求和限制，适合简单的API服务），container=容器型服务（推荐使用，支持任意语言和框架如Java/Go/Python/PHP/.NET等，适合大多数应用场景）'),
+    envId: zod_1.z.string().optional().describe('环境 ID（action=envStatus 时使用；不传则使用当前配置的环境）。格式如 env-xxxxxx'),
     // Detail and log operation parameters
     detailServerName: zod_1.z.string().optional().describe('要查询详细信息或部署日志的服务名称。当action为detail或getDeployLog时建议提供，必须是已存在的服务名称。可通过list操作获取可用的服务名称列表'),
     buildId: zod_1.z.number().optional().describe('构建ID，仅在action=getDeployLog时使用。不传时默认返回最近一次部署的构建日志'),
 };
 // Input schema for manageCloudRun tool
 const ManageCloudRunInputSchema = {
-    action: zod_1.z.enum(['init', 'download', 'run', 'deploy', 'delete', 'createAgent', 'updateConfig']).describe('云托管服务管理操作类型：init=从模板初始化新的云托管项目代码（在targetPath目录下创建以serverName命名的子目录，支持多种语言和框架模板），download=从云端下载现有服务的代码到本地进行开发，run=在本地运行函数型云托管服务（用于开发和调试，仅支持函数型服务），deploy=将本地代码部署到云端云托管服务（支持函数型和容器型；已存在服务会 Read-Merge-Write 保留远程 VpcConf/EnvParams/OpenAccessTypes），updateConfig=仅更新服务配置不重新上传代码（对齐控制台服务设置，走 SubmitServerConfigChangeDiff；不需要 targetPath），delete=删除指定的云托管服务（不可恢复，需要确认），createAgent=创建函数型Agent（基于函数型云托管开发AI智能体）'),
-    serverName: zod_1.z.string().describe('云托管服务名称，用于标识和管理服务。命名规则：支持大小写字母、数字、连字符和下划线，必须以字母开头，长度3-45个字符。在init操作中会作为在targetPath下创建的子目录名，在其他操作中作为目标服务名'),
+    action: zod_1.z.enum(['init', 'download', 'run', 'deploy', 'delete', 'createAgent', 'updateConfig', 'initEnv']).describe('云托管服务管理操作类型：init=从模板初始化新的云托管项目代码（在targetPath目录下创建以serverName命名的子目录，支持多种语言和框架模板），download=从云端下载现有服务的代码到本地进行开发，run=在本地运行函数型云托管服务（用于开发和调试，仅支持函数型服务），deploy=将本地代码部署到云端云托管服务（支持函数型和容器型；传 imageUrl 时改为已有镜像部署，走 DeployType=image 容器型，targetPath 可省略；已存在服务会 Read-Merge-Write 保留远程 VpcConf/EnvParams/OpenAccessTypes），updateConfig=仅更新服务配置不重新上传代码（对齐控制台服务设置，走 SubmitServerConfigChangeDiff；不需要 targetPath），delete=删除指定的云托管服务（不可恢复，需要确认），createAgent=创建函数型Agent（基于函数型云托管开发AI智能体），initEnv=开通当前环境的云托管（异步创建云托管环境，幂等：已开通直接返回；适合新环境首次部署前使用）'),
+    serverName: zod_1.z.string().describe('云托管服务名称，用于标识和管理服务。命名规则：支持大小写字母、数字、连字符和下划线，必须以字母开头，长度3-45个字符。在init操作中会作为在targetPath下创建的子目录名，在其他操作中作为目标服务名。initEnv 操作不需要此参数'),
+    // InitEnv operation parameters
+    envId: zod_1.z.string().optional().describe('环境 ID（action=initEnv 时使用；不传则使用当前配置的环境）。格式如 env-xxxxxx'),
+    packageType: zod_1.z.enum(exports.CLOUDRUN_PACKAGE_TYPES).optional().default('Trial').describe('云托管环境套餐类型（action=initEnv 时使用）：Trial=试用，Standard=标准，Professional=专业，Enterprise=企业。默认 Trial'),
     // Deploy operation parameters
-    targetPath: zod_1.z.string().optional().describe('本地代码路径，必须是绝对路径。在deploy操作中指定要部署的代码目录，在download操作中指定下载目标目录，在init操作中指定云托管服务的上级目录（会在该目录下创建以serverName命名的子目录）。updateConfig 不需要此参数。建议约定：项目根目录下的cloudrun/目录，例如：/Users/username/projects/my-project/cloudrun'),
+    targetPath: zod_1.z.string().optional().describe('本地代码路径，必须是绝对路径。在deploy操作中指定要部署的代码目录，在download操作中指定下载目标目录，在init操作中指定云托管服务的上级目录（会在该目录下创建以serverName命名的子目录）。updateConfig 不需要此参数。建议约定：项目根目录下的cloudrun/目录，例如：/Users/username/projects/my-project/cloudrun。使用 imageUrl 部署已有镜像时此参数可省略'),
+    imageUrl: zod_1.z.string().optional().describe('已有镜像部署（action=deploy 时使用）：直接指定容器镜像地址，如 ccr.ccs.tencentyun.com/ns/img:v1 或公网 registry 地址。传入后走 DeployType="image"（容器型）部署，无需本地源码目录（targetPath 可省略）。支持：1) 公网匿名可拉取的镜像直填地址；2) 私有/需登录的镜像（如 ghcr.io）需先在本地 docker pull → docker tag/push 到腾讯云 CCR → 填入 CCR 地址。不传则维持源码构建（本地代码打包上传）。注意：无论哪种部署方式，环境都需先开通云托管（未开通时先调用 initEnv，Status=normal 后再部署）'),
     envParamsReplaceAll: zod_1.z.boolean().optional().default(false).describe('EnvParams 合并策略（deploy / updateConfig）：false（默认）= 与远程按 key 合并（输入覆盖同名 key，远程其余 key 保留）；true= 用输入 EnvParams 整包替换远程。仅当显式传入 EnvParams 时生效'),
     serverConfig: zod_1.z.object({
         OpenAccessTypes: zod_1.z.array(zod_1.z.enum(exports.CLOUDRUN_ACCESS_TYPES)).optional().describe('公网访问类型配置，控制服务的访问权限：OA=办公网访问，PUBLIC=公网访问（默认，可通过HTTPS域名访问），MINIAPP=小程序访问，VPC=VPC访问（仅同VPC内可访问）。可配置多个类型'),
@@ -116945,6 +116764,88 @@ function buildManageCloudRunErrorMessage(action, serverName, error) {
 }
 const CLOUDRUN_DB_ENV_KEY_PATTERN = /^(DATABASE_URL|DB_HOST|DB_PORT|DB_USER|DB_PASSWORD|DB_NAME|MYSQL_|POSTGRES_|PGHOST|PGPORT|PGUSER|PGPASSWORD|PGDATABASE|PG_|REDIS_|MONGO_|MONGODB_|SQLALCHEMY_DATABASE_URI|SPRING_DATASOURCE_)/i;
 const CLOUDRUN_DB_URL_PATTERN = /(mysql|mariadb|postgres|postgresql|mongodb(\+srv)?|redis|rediss):\/\//i;
+async function queryCloudRunEnvStatus(options) {
+    const manager = await (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions: options.cloudBaseOptions });
+    if (!manager?.commonService) {
+        throw new Error("Current CloudBase Manager does not support commonService; cannot query CloudRun env status.");
+    }
+    return describeCloudRunEnvStatus(manager, options.envId);
+}
+/**
+ * 核心实现：用已获取的 manager 查询云托管开通状态（供 initEnv/envStatus 及
+ * ensureCloudRunEnvInitialized 复用，避免重复 getCloudBaseManager）。
+ */
+async function describeCloudRunEnvStatus(manager, envId) {
+    const result = await manager
+        .commonService("tcbr", "2022-02-17")
+        .call({
+        Action: "DescribeEnvBaseInfo",
+        Param: { EnvId: envId },
+    });
+    const data = (result ?? {});
+    const baseInfo = (data.EnvBaseInfo ?? {}) ?? {};
+    if (data.IsExist !== true) {
+        return { isExist: false, status: "unopened", baseInfo };
+    }
+    const rawStatus = typeof baseInfo.Status === "string" ? baseInfo.Status : "";
+    const status = rawStatus === "creating" || rawStatus === "normal"
+        ? rawStatus
+        : "unknown";
+    return { isExist: true, status, baseInfo };
+}
+/**
+ * 探测当前环境云托管（大租户）是否已初始化。
+ *
+ * 背景（2026-08-13 用户实测）：新环境未调 CreateCloudRunEnv 初始化云托管时，
+ * 直接 CreateCloudRunServer 会因"无大租户记录"被默认转入小租户，创建出小租户的
+ * 服务和版本——这是错误路径。本函数在 deploy 创建新服务前用 tcbr DescribeEnvBaseInfo
+ * 探测环境是否已开通云托管；未开通则抛错引导先初始化，而不是默默走到小租户路径。
+ *
+ * 实测（2026-08-13 真实凭据）：tcbr 不存在 DescribeCloudRunEnv（单数）Action，调用
+ * 恒返回 InvalidAction；正确的探测接口是 DescribeEnvBaseInfo。未开通云托管的环境返回
+ * IsExist=false 且 EnvBaseInfo 为空结构（不抛错）；已开通的环境（实测 ai-share-
+ * d2guukyxybb63b206）返回 IsExist=true 且 EnvBaseInfo 含完整字段（Status="normal"、
+ * PackageType/Region/EnvType/CreateTime 等已填充），两分支可明确区分。
+ *
+ * 双验证：DescribeCloudRunServers 未初始化与已初始化但无服务均返回 ServerList=[]，
+ * 无法区分，故不作为初始化判定依据。
+ *
+ * @returns 已初始化返回 true；探测到未初始化抛出带引导信息的 Error。
+ */
+async function ensureCloudRunEnvInitialized(options) {
+    const manager = await (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions: options.cloudBaseOptions });
+    if (!manager?.commonService) {
+        // 老 SDK 无 commonService 时退化为不拦截（保持既有行为，避免误伤）。
+        return true;
+    }
+    try {
+        const status = await describeCloudRunEnvStatus(manager, options.envId);
+        if (!status.isExist) {
+            throwCloudRunEnvNotInitialized(options.envId);
+        }
+        return true;
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        // 错误兜底：未初始化/未开通类错误码。
+        // 注意：裸 InvalidParameter 可能是普通参数错误，不拦截；仅当其带 Env/CloudRun
+        // 上下文（疑似 "EnvironmentId not found / CloudRun Env 未开通"）时才按未初始化处理。
+        if (/ResourceNotFound|not.?initialized|未开通|未初始化/i.test(msg) ||
+            /InvalidParameter.*(?:Env|CloudRun)/i.test(msg)) {
+            throwCloudRunEnvNotInitialized(options.envId);
+        }
+        // 其他错误（网络/权限等）不拦截，让上层按原逻辑处理。
+        return true;
+    }
+}
+function throwCloudRunEnvNotInitialized(envId) {
+    throw new Error(`当前环境（${envId}）尚未初始化云托管（CloudRun Env）。` +
+        `不能直接创建服务（CreateCloudRunServer 在无大租户记录时会默认创建到小租户，产生错误的小租户服务与版本）。\n` +
+        `请先开通云托管环境，再重试部署：\n` +
+        `- MCP：manageCloudRun(action="initEnv", envId="${envId}")（异步开通，幂等；开通完成后可用 queryCloudRun(action="envStatus", envId="${envId}") 查询 Status=normal）\n` +
+        `- 或控制台：环境 → 云托管 → 开通（https://tcb.cloud.tencent.com/dev?envId=${envId}#/platform-run）\n` +
+        `初始化完成后重新调用 manageCloudRun(action="deploy")。`);
+}
 /**
  * Detect likely TCP database/cache env usage without VpcConf.
  * Soft signal for AI agents — does not block deploy.
@@ -117041,6 +116942,36 @@ function normalizeCloudRunDomainUrl(input) {
         ? raw
         : `https://${raw}`;
 }
+/**
+ * 从服务详情 / 最新部署记录中提取镜像信息（镜像部署时才有）。
+ * 镜像部署（DeployType=image）的服务详情与部署记录通常会携带 ImageUrl 等字段；
+ * 源码构建的服务无此字段，返回 undefined 表示无镜像信息。
+ */
+function extractCloudRunImageInfo(serviceDetail, latestDeploy) {
+    const candidates = [
+        latestDeploy,
+        serviceDetail?.ServerConfig,
+        serviceDetail?.BaseInfo,
+        serviceDetail,
+    ];
+    for (const source of candidates) {
+        if (!source || typeof source !== "object")
+            continue;
+        const imageUrl = source.ImageUrl ??
+            source.imageUrl ??
+            (typeof source.ImageInfo === "string" ? source.ImageInfo : undefined) ??
+            (typeof source.ImageInfo?.ImageUrl === "string" ? source.ImageInfo.ImageUrl : undefined);
+        if (typeof imageUrl === "string" && imageUrl.trim()) {
+            const deployType = typeof source.DeployType === "string"
+                ? source.DeployType
+                : typeof source.deployType === "string"
+                    ? source.deployType
+                    : undefined;
+            return { imageUrl: imageUrl.trim(), ...(deployType ? { deployType } : {}) };
+        }
+    }
+    return undefined;
+}
 function resolveCloudRunFallbackAccess(details) {
     const custom = normalizeCloudRunDomainUrl(details?.BaseInfo?.CustomDomainName);
     if (custom)
@@ -117071,7 +117002,7 @@ function registerCloudRunTools(server) {
     // Tool 1: Get CloudRun service information (read operations)
     server.registerTool("queryCloudRun", {
         title: "查询 CloudRun 服务信息",
-        description: "查询云托管服务信息，支持获取服务列表、查询服务详情、获取可用模板列表和部署日志。返回的服务信息包括服务名称、状态、访问类型、配置详情以及最近部署上下文。",
+        description: "查询云托管服务信息，支持获取服务列表、查询服务详情、获取可用模板列表、获取部署日志以及查询环境云托管开通状态（envStatus）。返回的服务信息包括服务名称、状态、访问类型、配置详情以及最近部署上下文。",
         inputSchema: queryCloudRunInputSchema,
         annotations: {
             readOnlyHint: true,
@@ -117183,6 +117114,10 @@ function registerCloudRunTools(server) {
                                 data: {
                                     service: result,
                                     latestDeploy,
+                                    // 若最新部署记录带镜像信息（镜像部署），透出便于展示
+                                    ...(extractCloudRunImageInfo(result, latestDeploy)
+                                        ? { imageInfo: extractCloudRunImageInfo(result, latestDeploy) }
+                                        : {}),
                                     ...(deployRecordsWarning ? { deployRecordsWarning } : {})
                                 },
                                 message
@@ -117281,6 +117216,65 @@ function registerCloudRunTools(server) {
                     ]
                 };
             }
+            case 'envStatus': {
+                const envId = input.envId?.trim() || (await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions));
+                if (!manager.commonService) {
+                    throw new Error("Current CloudBase Manager does not support commonService; cannot query CloudRun env status.");
+                }
+                let status;
+                try {
+                    status = await describeCloudRunEnvStatus(manager, envId);
+                }
+                catch (error) {
+                    const baseMessage = error instanceof Error ? error.message : String(error);
+                    if (/ResourceNotFound|not.?initialized|未开通|未初始化/i.test(baseMessage) ||
+                        /InvalidParameter.*(?:Env|CloudRun)/i.test(baseMessage)) {
+                        status = { isExist: false, status: "unopened", baseInfo: {} };
+                    }
+                    else {
+                        throw new Error(`[queryCloudRun/envStatus] ${baseMessage}`);
+                    }
+                }
+                let message;
+                if (!status.isExist) {
+                    message = `环境 ${envId} 尚未开通云托管。请先调用 manageCloudRun(action="initEnv", envId="${envId}") 开通（异步、幂等），或前往控制台 环境 → 云托管 → 开通；Status=normal 后即可 deploy。`;
+                }
+                else if (status.status === "creating") {
+                    message = `环境 ${envId} 云托管正在开通中（Status=creating）。请稍后重试 manageCloudRun(action="deploy")，或用本 action 再次查询直到 Status=normal。`;
+                }
+                else if (status.status === "normal") {
+                    message = `环境 ${envId} 云托管已开通（Status=normal），可直接 manageCloudRun(action="deploy")。`;
+                }
+                else {
+                    message = `环境 ${envId} 云托管状态未知（Status=${status.status ?? "unknown"}），请稍后重试。`;
+                }
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                success: true,
+                                data: {
+                                    envId,
+                                    status: status.status,
+                                    isExist: status.isExist,
+                                    ...(status.isExist
+                                        ? {
+                                            envBaseInfo: {
+                                                Status: status.baseInfo.Status ?? null,
+                                                PackageType: status.baseInfo.PackageType ?? null,
+                                                Region: status.baseInfo.Region ?? null,
+                                                EnvType: status.baseInfo.EnvType ?? null,
+                                            },
+                                        }
+                                        : {}),
+                                },
+                                message
+                            }, null, 2)
+                        }
+                    ]
+                };
+            }
             default:
                 throw new Error(`Unsupported action: ${input.action}`);
         }
@@ -117290,7 +117284,7 @@ function registerCloudRunTools(server) {
     // Tool 2: Manage CloudRun services (write operations)
     server.registerTool("manageCloudRun", {
         title: "管理 CloudRun 服务",
-        description: "管理云托管服务，按开发顺序支持：初始化项目（可从模板开始，模板列表可通过 queryCloudRun 查询）、下载服务代码、本地运行（仅函数型服务）、部署代码、仅更新配置（updateConfig，无需重新上传代码）、删除服务。deploy 对已存在服务会先读取远程配置再合并（保留 VpcConf/EnvParams/OpenAccessTypes）。updateConfig 对齐控制台服务设置页。删除操作需要确认，建议设置force=true。",
+        description: "管理云托管服务，按开发顺序支持：开通云托管环境（initEnv）、初始化项目（可从模板开始，模板列表可通过 queryCloudRun 查询）、下载服务代码、本地运行（仅函数型服务）、部署代码、仅更新配置（updateConfig，无需重新上传代码）、删除服务。deploy 支持两种方式：1) 源码构建（传入 targetPath，本地代码打包上传，默认路径）；2) 已有镜像部署（传入 imageUrl，如 ccr.ccs.tencentyun.com/ns/img:v1，走 DeployType=image 容器型部署，targetPath 可省略）。deploy 对已存在服务会先读取远程配置再合并（保留 VpcConf/EnvParams/OpenAccessTypes）。updateConfig 对齐控制台服务设置页。删除操作需要确认，建议设置force=true。新环境首次部署前若提示未开通云托管，先调用 initEnv 开通（异步、幂等）。",
         inputSchema: ManageCloudRunInputSchema,
         annotations: {
             readOnlyHint: false,
@@ -117311,6 +117305,99 @@ function registerCloudRunTools(server) {
             targetPath = validateAndNormalizePath(input.targetPath);
         }
         switch (input.action) {
+            case 'initEnv': {
+                const envId = input.envId?.trim() || (await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions));
+                const packageType = input.packageType || 'Trial';
+                if (!manager.commonService) {
+                    throw new Error("Current CloudBase Manager does not support commonService; cannot initialize CloudRun env.");
+                }
+                // 幂等：先查当前开通状态，已开通 / 开通中不重复创建。
+                let current;
+                try {
+                    current = await describeCloudRunEnvStatus(manager, envId);
+                }
+                catch (error) {
+                    const baseMessage = error instanceof Error ? error.message : String(error);
+                    if (/ResourceNotFound|not.?initialized|未开通|未初始化/i.test(baseMessage) ||
+                        /InvalidParameter.*(?:Env|CloudRun)/i.test(baseMessage)) {
+                        current = { isExist: false, status: "unopened", baseInfo: {} };
+                    }
+                    else {
+                        throw new Error(`[manageCloudRun/initEnv] ${baseMessage}`);
+                    }
+                }
+                if (current.isExist && current.status === "normal") {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({
+                                    success: true,
+                                    data: {
+                                        envId,
+                                        status: "normal",
+                                        packageType: current.baseInfo.PackageType ?? packageType,
+                                        created: false
+                                    },
+                                    message: `环境 ${envId} 已开通云托管（Status=normal），无需重复开通。可直接 manageCloudRun(action="deploy")。`
+                                }, null, 2)
+                            }
+                        ]
+                    };
+                }
+                if (current.isExist && current.status === "creating") {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({
+                                    success: true,
+                                    data: {
+                                        envId,
+                                        status: "creating",
+                                        created: false
+                                    },
+                                    message: `环境 ${envId} 云托管正在开通中（Status=creating），无需重复开通。请稍后用 queryCloudRun(action="envStatus", envId="${envId}") 查询，Status=normal 后即可 deploy。`
+                                }, null, 2)
+                            }
+                        ]
+                    };
+                }
+                // 未开通 → 发起异步开通（CreateCloudRunEnv 异步，不阻塞等待）。
+                let createResult;
+                try {
+                    createResult = await manager
+                        .commonService("tcbr", "2022-02-17")
+                        .call({
+                        Action: "CreateCloudRunEnv",
+                        Param: { EnvId: envId, PackageType: packageType },
+                    });
+                }
+                catch (error) {
+                    throw new Error(buildManageCloudRunErrorMessage('initEnv', envId, error));
+                }
+                const tranId = createResult?.TranId ??
+                    createResult?.Response?.TranId ??
+                    createResult?.tranId;
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                success: true,
+                                data: {
+                                    envId,
+                                    status: "creating",
+                                    packageType,
+                                    created: true,
+                                    ...(tranId ? { tranId } : {})
+                                },
+                                message: `已发起云托管开通（异步，Status=creating）。请稍后用 queryCloudRun(action="envStatus", envId="${envId}") 查询状态，Status=normal 后即可 manageCloudRun(action="deploy")。`
+                            }, null, 2)
+                        }
+                    ]
+                };
+            }
             case 'createAgent': {
                 if (!targetPath) {
                     throw new Error("targetPath is required for createAgent operation");
@@ -117476,14 +117563,18 @@ for await (let x of res.textStream) {
                 };
             }
             case 'deploy': {
-                if (!targetPath) {
-                    throw new Error("targetPath is required for deploy operation");
+                if (!targetPath && !input.imageUrl) {
+                    throw new Error("targetPath (source build) or imageUrl (existing image) is required for deploy operation");
                 }
                 // Determine service type - use input.serverType if provided, otherwise auto-detect
                 let serverType;
                 let remoteServerConfig = null;
                 let existingService = false;
-                if (input.serverType) {
+                if (input.imageUrl) {
+                    // Image deploy is always container type (SDK: DeployInfo={DeployType:"image", ImageUrl}).
+                    serverType = 'container';
+                }
+                else if (input.serverType) {
                     serverType = input.serverType;
                 }
                 else {
@@ -117537,6 +117628,17 @@ for await (let x of res.textStream) {
                         // New service create path
                     }
                 }
+                // 新环境必须先初始化云托管（大租户），否则 CreateCloudRunServer 会默认
+                // 创建小租户服务。仅创建新服务（非 existing）前探测一次。
+                // （2026-08-13 用户实测：luapi-v2 因未初始化云托管被创建到小租户）
+                if (!existingService) {
+                    const currentEnvId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+                    await ensureCloudRunEnvInitialized({
+                        cloudBaseOptions,
+                        envId: currentEnvId,
+                        serverName: input.serverName,
+                    });
+                }
                 let mergedFromRemote = [];
                 let effectiveServerConfig = input.serverConfig;
                 if (existingService) {
@@ -117554,6 +117656,9 @@ for await (let x of res.textStream) {
                     force: input.force,
                     serverType: serverType,
                 };
+                if (input.imageUrl) {
+                    deployParams.imageUrl = input.imageUrl;
+                }
                 if (effectiveServerConfig && Object.keys(effectiveServerConfig).length > 0) {
                     deployParams.serverConfig = effectiveServerConfig;
                 }
@@ -117574,22 +117679,26 @@ for await (let x of res.textStream) {
                 catch (error) {
                     throw new Error(buildManageCloudRunErrorMessage('deploy', input.serverName, error));
                 }
-                // Generate cloudbaserc.json configuration file
+                // Generate cloudbaserc.json configuration file (source-build only; image deploy has no local project dir)
                 const currentEnvId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
-                const cloudbasercPath = path_1.default.join(targetPath, 'cloudbaserc.json');
-                const cloudbasercContent = {
-                    envId: currentEnvId,
-                    cloudrun: {
-                        name: input.serverName
+                let cloudbasercGenerated = false;
+                if (targetPath) {
+                    const cloudbasercPath = path_1.default.join(targetPath, 'cloudbaserc.json');
+                    const cloudbasercContent = {
+                        envId: currentEnvId,
+                        cloudrun: {
+                            name: input.serverName
+                        }
+                    };
+                    try {
+                        fs_1.default.writeFileSync(cloudbasercPath, JSON.stringify(cloudbasercContent, null, 2));
+                        cloudbasercGenerated = true;
+                    }
+                    catch (error) {
+                        (0, logger_js_1.debug)('cloudbaserc.json creation skipped:', error instanceof Error ? error : new Error(String(error)));
                     }
-                };
-                const consoleUrl = `https://tcb.cloud.tencent.com/dev?envId=${currentEnvId}#/platform-run/service/detail?serverName=${input.serverName}&tabId=overview&envId=${currentEnvId}`;
-                try {
-                    fs_1.default.writeFileSync(cloudbasercPath, JSON.stringify(cloudbasercContent, null, 2));
-                }
-                catch (error) {
-                    (0, logger_js_1.debug)('cloudbaserc.json creation skipped:', error instanceof Error ? error : new Error(String(error)));
                 }
+                const consoleUrl = `https://tcb.cloud.tencent.com/dev?envId=${currentEnvId}#/platform-run/service/detail?serverName=${input.serverName}&tabId=overview&envId=${currentEnvId}`;
                 let preferredAccessUrl;
                 let preferredAccessUrls = [];
                 let preferredAccessSource;
@@ -117626,7 +117735,7 @@ for await (let x of res.textStream) {
                 }
                 // Send deployment notification to CodeBuddy IDE
                 try {
-                    const projectName = path_1.default.basename(targetPath);
+                    const projectName = targetPath ? path_1.default.basename(targetPath) : input.serverName;
                     await (0, notification_js_1.sendDeployNotification)(server, {
                         deployType: 'cloudrun',
                         url: preferredAccessUrl ?? "",
@@ -117656,9 +117765,11 @@ for await (let x of res.textStream) {
                                 data: {
                                     serviceName: input.serverName,
                                     status: 'deploying',
-                                    deployPath: targetPath,
+                                    deployType: input.imageUrl ? 'image' : 'source',
+                                    ...(targetPath ? { deployPath: targetPath } : {}),
+                                    ...(input.imageUrl ? { imageUrl: input.imageUrl } : {}),
                                     serverType: serverType,
-                                    cloudbasercGenerated: true,
+                                    cloudbasercGenerated,
                                     consoleUrl,
                                     ...(existingService
                                         ? {
@@ -117681,7 +117792,7 @@ for await (let x of res.textStream) {
                                         : {}),
                                     ...(warnings.length > 0 ? { warnings } : {}),
                                 },
-                                message: `Triggered deployment for ${serverType} service '${input.serverName}' from ${targetPath}. You can follow the progress in ${consoleUrl}.${warningSuffix}`
+                                message: `Triggered deployment for ${serverType} service '${input.serverName}' ${input.imageUrl ? `from image ${input.imageUrl}` : `from ${targetPath}`}. You can follow the progress in ${consoleUrl}.${warningSuffix}`
                             }, null, 2)
                         }
                     ]
@@ -121916,7 +122027,8 @@ function registerAppTools(server) {
                 .optional()
                 .describe("自定义部署命令。通常无需填写，默认自动生成 tcb hosting deploy 命令。" +
                 "有 buildPath 时远端已 cd 到该目录，默认用 . 作为源码路径；无 buildPath 时默认用 dist。"),
-            ignore: zod_1.z.array(zod_1.z.string()).optional().describe("上传时忽略的文件/目录 glob 模式，例如 **/node_modules/**。"),
+            ignore: zod_1.z.array(zod_1.z.string()).optional().describe("上传时忽略的文件/目录 glob 模式，例如 **/node_modules/**。\n" +
+                "⚠️ 打包的是项目根目录（filePath）而非 buildPath 产物目录：若项目根含 target/（Rust）、.next/、dist-old/、build/ 等大构建产物，必须加进 ignore（如 **/target/**），否则整个目录被打进上传 zip（实证 54GB target → 34GB zip）。默认已排除 node_modules/.git/.DS_Store/**/target/**/.next/**/.next.bak/**。"),
             versionName: zod_1.z
                 .string()
                 .optional()
@@ -121936,6 +122048,17 @@ function registerAppTools(server) {
             if (!appService) {
                 throw new Error("当前 manager 未提供 cloudAppService");
             }
+            // 默认排除的大目录（2026-08-14 实证：ato 项目 target/ 54GB 被整个打进 zip）
+            // tcb app deploy 打包的是项目根目录（localPath）而非 outputDir，必须排除构建产物
+            const defaultPackIgnore = [
+                "node_modules/**",
+                ".git/**",
+                ".DS_Store",
+                "**/.DS_Store",
+                "**/target/**",
+                "**/.next/**",
+                "**/.next.bak/**",
+            ];
             // getUploadUrl — 获取预签名上传 URL（cloud mode 专用）
             if (action === "getUploadUrl") {
                 if (!serviceName) {
@@ -121946,9 +122069,9 @@ function registerAppTools(server) {
                     serviceName,
                 });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, cosInfoResult);
-                const defaultIgnore = ["node_modules/**", ".git/**", ".DS_Store", "**/.DS_Store"];
+                const defaultIgnore = defaultPackIgnore;
                 // eslint-disable-next-line max-len
-                const zipCmd = "zip -r upload.zip . -x 'node_modules/**' -x '.git/**' -x '.DS_Store' -x '**/.DS_Store'";
+                const zipCmd = "zip -r upload.zip . -x 'node_modules/**' -x '.git/**' -x '.DS_Store' -x '**/.DS_Store' -x '**/target/**' -x '**/.next/**' -x '**/.next.bak/**'";
                 const followupArgs = {
                     action: "deployApp",
                     serviceName,
@@ -121992,11 +122115,17 @@ function registerAppTools(server) {
                 // 上传代码到 COS（仅本地模式需要，cloud mode 用 cosTimestamp 跳过）
                 let cosTs = cosTimestamp;
                 if (filePath && !cosTs) {
+                    // 默认排除大目录（2026-08-14 实证：ato 项目 target/ 54GB 被整个打进 zip）
+                    // 用户显式传 ignore 时合并，避免覆盖默认值
+                    const mergedIgnore = Array.from(new Set([
+                        ...defaultPackIgnore,
+                        ...(ignore ?? []),
+                    ]));
                     const uploadResult = await appService.uploadCode({
                         deployType: "static-hosting",
                         serviceName,
                         localPath: filePath,
-                        ignore,
+                        ignore: mergedIgnore,
                     });
                     (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, uploadResult);
                     cosTs = uploadResult.cosTimestamp;
@@ -123609,16 +123738,19 @@ function isDirectoryUploadTarget(localPath, cloudPath) {
         return true;
     return path_1.default.posix.extname(normalizedCloudPath) === '';
 }
-function buildHostingAccessUrl(staticDomain, cloudPath, localPath) {
-    if (!staticDomain)
-        return '';
+function hostingAccessPathname(cloudPath, localPath) {
     const normalizedCloudPath = (cloudPath ?? '').trim().replace(/^\/+|\/+$/g, '');
     const isDirectory = isDirectoryUploadTarget(localPath, cloudPath);
     if (!normalizedCloudPath) {
-        return `https://${staticDomain}/`;
+        return '/';
     }
     const pathname = isDirectory ? `${normalizedCloudPath}/` : normalizedCloudPath;
-    return `https://${staticDomain}/${pathname}`;
+    return `/${pathname}`;
+}
+function buildHostingAccessUrl(staticDomain, cloudPath, localPath) {
+    if (!staticDomain)
+        return '';
+    return `https://${staticDomain}${hostingAccessPathname(cloudPath, localPath)}`;
 }
 function buildUploadErrorMessage(error, localPath) {
     const baseMessage = error instanceof Error ? error.message : String(error);
@@ -123799,7 +123931,7 @@ function buildDomainMutationResult(params) {
         message: `静态托管域名${actionLabel}请求已提交。域名配置、证书校验和边缘侧传播通常需要 30 秒到 10 分钟，请继续调用 queryHosting(action="domainStatus") 确认最终结果。`,
     };
 }
-async function getHostingWebsiteConfig(cloudbase, logger) {
+async function getHostingWebsiteConfig(cloudbase, logger, cloudBaseOptions) {
     const websiteConfig = await cloudbase.hosting.getWebsiteConfig();
     (0, cloudbase_manager_js_1.logCloudBaseResult)(logger, websiteConfig);
     const hostingResult = {
@@ -123816,6 +123948,27 @@ async function getHostingWebsiteConfig(cloudbase, logger) {
     catch {
         // Ignore enrichment failures and return the website config as-is.
     }
+    try {
+        const cdnDomain = typeof hostingResult.CdnDomain === 'string' ? hostingResult.CdnDomain : '';
+        if (cdnDomain && typeof cloudbase.env?.describeHttpServiceRoute === 'function') {
+            const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+            const routeResult = await cloudbase.env.describeHttpServiceRoute({
+                EnvId: envId,
+                Limit: 1000,
+            });
+            const routes = (0, gateway_access_urls_js_1.flattenHttpServiceRoutes)(routeResult);
+            const reachable = (0, gateway_access_urls_js_1.isDomainPathReachableViaGateway)(routes, cdnDomain, '/');
+            hostingResult.staticDomainRouteEnabled = reachable;
+            hostingResult.accessUrlReachable = reachable !== false;
+            if (reachable === false) {
+                hostingResult.routeDisabled = true;
+                hostingResult.disabledAccessUrls = [`https://${cdnDomain}/`];
+            }
+        }
+    }
+    catch {
+        // Gateway route lookup is best-effort enrichment only.
+    }
     return hostingResult;
 }
 async function resolveHostingStaticDomain(cloudbase, logger) {
@@ -123899,7 +124052,7 @@ function registerHostingTools(server) {
             const cloudbase = await getManager();
             switch (input.action) {
                 case 'websiteConfig': {
-                    const websiteConfig = await getHostingWebsiteConfig(cloudbase, server.logger);
+                    const websiteConfig = await getHostingWebsiteConfig(cloudbase, server.logger, cloudBaseOptions);
                     return (0, tool_result_js_1.buildJsonToolResult)({
                         success: true,
                         data: {
@@ -124025,7 +124178,7 @@ function registerHostingTools(server) {
     });
     server.registerTool('manageHosting', {
         title: '管理 CloudBase 静态托管',
-        description: '管理 CloudBase 静态托管的变更操作。action=upload 上传本地构建产物到共享域名（域名格式：<envId>-<appId>.tcloudbaseapp.com/<cloudPath>）；action=delete 删除托管文件或目录（必须 confirm=true）；action=setWebsiteDocument 设置首页/错误页/路由规则；action=enableService 开通静态托管；action=bindDomain / unbindDomain / updateDomain 管理自定义域名；action=downloadFile / downloadDirectory 下载托管内容到本地。⚠️ 新项目部署优先使用 manageApps（部署到独立子域名），本工具适合已有老项目继续使用或作为 manageApps 的 fallback。manageApps 与 manageHosting 域名不同，切换会导致老链接失效。若任务只是查看配置、文件或域名状态，请改用 queryHosting。',
+        description: '管理 CloudBase 静态托管的变更操作。action=upload 上传本地构建产物到共享域名（域名格式：<envId>-<appId>.tcloudbaseapp.com/<cloudPath>）；action=delete 删除托管文件或目录（必须 confirm=true）；action=setWebsiteDocument 设置首页/错误页/路由规则；action=enableService 开通静态托管；action=bindDomain / unbindDomain / updateDomain 管理自定义域名；action=downloadFile / downloadDirectory 下载托管内容到本地。⚠️ 本工具没有关闭默认域名（*.tcloudbaseapp.com）的 action；要禁用该默认公网域名，请用 manageGateway(action="disableRoute", domain=该 STATIC_STORE IsDefault 域名, path="/")（底层 ModifyHTTPServiceRoute，不是 ModifyGatewayRoute）。⚠️ 新项目部署优先使用 manageApps（部署到独立子域名），本工具适合已有老项目继续使用或作为 manageApps 的 fallback。manageApps 与 manageHosting 域名不同，切换会导致老链接失效。若任务只是查看配置、文件或域名状态，请改用 queryHosting。',
         inputSchema: manageHostingInputSchema,
         annotations: {
             readOnlyHint: false,
@@ -124065,7 +124218,24 @@ function registerHostingTools(server) {
                     const cdnFromStore = (store.CdnDomain ?? store.StaticDomain);
                     const staticDomain = cdnFromStore || await resolveHostingStaticDomain(cloudbase, server.logger);
                     const fallbackAccessUrl = buildHostingAccessUrl(staticDomain, input.cloudPath, input.localPath);
+                    const accessPathname = hostingAccessPathname(input.cloudPath, input.localPath);
                     const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+                    const getGatewayManager = async () => {
+                        const manager = await getManager();
+                        if (!manager) {
+                            throw new Error("cloudbase manager unavailable");
+                        }
+                        return manager;
+                    };
+                    const allGatewayRoutes = await (0, gateway_access_urls_js_1.resolveAllGatewayRoutes)({
+                        envId,
+                        getManager: getGatewayManager,
+                    });
+                    const staticDomainRouteEnabled = staticDomain
+                        ? (0, gateway_access_urls_js_1.isDomainPathReachableViaGateway)(allGatewayRoutes, staticDomain, accessPathname)
+                        : null;
+                    // null = no matching gateway route info → keep legacy fallback.
+                    const fallbackReachable = staticDomainRouteEnabled !== false;
                     const gatewayCandidates = Array.from(new Set([
                         store.StaticStoreName,
                         store.Name,
@@ -124075,34 +124245,38 @@ function registerHostingTools(server) {
                     ]
                         .map((item) => (typeof item === "string" ? item.trim() : ""))
                         .filter(Boolean)));
-                    let accessUrl = fallbackAccessUrl;
+                    let accessUrl = fallbackReachable ? fallbackAccessUrl : "";
                     let accessUrls = accessUrl ? [accessUrl] : [];
                     let accessUrlSource = accessUrl
                         ? "hosting.staticDomain"
                         : undefined;
+                    let accessUrlReachable = Boolean(accessUrl);
+                    let disabledAccessUrls = [];
+                    if (fallbackAccessUrl && !fallbackReachable) {
+                        disabledAccessUrls.push(fallbackAccessUrl);
+                    }
                     for (const upstreamName of gatewayCandidates) {
                         const gateway = await (0, gateway_access_urls_js_1.resolveGatewayAccessUrls)({
                             envId,
                             upstreamResourceName: upstreamName,
                             upstreamResourceTypes: ["STATIC_STORE"],
-                            getManager: async () => {
-                                const manager = await getManager();
-                                if (!manager) {
-                                    throw new Error("cloudbase manager unavailable");
-                                }
-                                return manager;
-                            },
+                            getManager: getGatewayManager,
                         });
                         const preferred = (0, gateway_access_urls_js_1.preferGatewayOrFallback)({
                             gateway,
                             fallbackUrl: fallbackAccessUrl || undefined,
                             fallbackSource: "hosting.staticDomain",
+                            fallbackReachable,
                         });
-                        if (preferred.accessUrl) {
-                            accessUrl = preferred.accessUrl;
+                        if (preferred.accessUrl || preferred.disabledAccessUrls.length > 0) {
+                            accessUrl = preferred.accessUrl ?? "";
                             accessUrls = preferred.accessUrls;
                             accessUrlSource = preferred.accessUrlSource;
-                            break;
+                            accessUrlReachable = preferred.accessUrlReachable;
+                            disabledAccessUrls = preferred.disabledAccessUrls;
+                            if (preferred.accessUrl) {
+                                break;
+                            }
                         }
                     }
                     try {
@@ -124118,18 +124292,31 @@ function registerHostingTools(server) {
                                 projectName = path_1.default.basename(input.localPath);
                             }
                         }
-                        await (0, notification_js_1.sendDeployNotification)(server, {
-                            deployType: 'hosting',
-                            url: accessUrl,
-                            projectId: envId,
-                            projectName,
-                            consoleUrl: `https://tcb.cloud.tencent.com/dev?envId=${envId}#/static-hosting`,
-                        });
+                        // sendDeployNotification requires a concrete url; skip when no reachable accessUrl
+                        if (accessUrl) {
+                            await (0, notification_js_1.sendDeployNotification)(server, {
+                                deployType: 'hosting',
+                                url: accessUrl,
+                                projectId: envId,
+                                projectName,
+                                consoleUrl: `https://tcb.cloud.tencent.com/dev?envId=${envId}#/static-hosting`,
+                            });
+                        }
                     }
                     catch {
                         // Notification failure should not block uploads.
                     }
                     const uploadPrefix = input.cloudPath ?? input.files?.[0]?.cloudPath ?? '';
+                    const routeDisabled = staticDomainRouteEnabled === false;
+                    let message = '静态托管文件上传成功。若需要校验上传结果，请继续调用 queryHosting(action="findFiles") 或 queryHosting(action="listFiles")。';
+                    if (routeDisabled && accessUrlReachable) {
+                        message =
+                            '静态托管文件上传成功。默认静态托管域名的网关路由已禁用（访问会返回 GATEWAY_ROUTE_DISABLED），已改用其他可达域名作为 accessUrl。可用 manageGateway(action="updateRoute", route.enable=true) 重新启用默认域路由。';
+                    }
+                    else if (routeDisabled && !accessUrlReachable) {
+                        message =
+                            '静态托管文件上传成功，但默认静态托管域名的网关路由已禁用（GATEWAY_ROUTE_DISABLED），当前没有可达的 accessUrl。请用 manageGateway(action="updateRoute", domain="<静态域名>", path="/", upstreamResourceType="STATIC_STORE", targetName="staticstore", route.enable=true) 启用路由，或改用已启用的自定义域名 / CloudBase Sites 域名访问。';
+                    }
                     return (0, tool_result_js_1.buildJsonToolResult)({
                         success: true,
                         data: {
@@ -124139,13 +124326,19 @@ function registerHostingTools(server) {
                             files: input.files ?? [],
                             ignore: input.ignore,
                             staticDomain,
-                            accessUrl,
+                            staticDomainRouteEnabled,
+                            accessUrl: accessUrl || undefined,
                             accessUrls,
                             accessUrlSource,
+                            accessUrlReachable,
+                            ...(disabledAccessUrls.length > 0
+                                ? { disabledAccessUrls }
+                                : {}),
+                            ...(routeDisabled ? { routeDisabled: true } : {}),
                             result,
                             nextActions: uploadPrefix ? [buildFindFilesNextStep(uploadPrefix.replace(/^\/+/, ''))] : undefined,
                         },
-                        message: '静态托管文件上传成功。若需要校验上传结果，请继续调用 queryHosting(action="findFiles") 或 queryHosting(action="listFiles")。',
+                        message,
                     });
                 }
                 case 'delete': {
@@ -131266,6 +131459,7 @@ module.exports = setup;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.assertTcbCloudRunActionAllowed = assertTcbCloudRunActionAllowed;
 exports.removeEmptyStringParams = removeEmptyStringParams;
 exports.buildCapiErrorMessage = buildCapiErrorMessage;
 exports.registerCapiTools = registerCapiTools;
@@ -131277,6 +131471,7 @@ const CLOUDBASE_CONTROL_PLANE_DOC_URL = "https://cloud.tencent.com/document/prod
 const CLOUDBASE_DEPENDENCY_API_DOC_URL = "https://cloud.tencent.com/document/product/876/34808";
 const ALLOWED_SERVICES = [
     "tcb",
+    "tcbr",
     "scf",
     "sts",
     "cam",
@@ -131284,6 +131479,31 @@ const ALLOWED_SERVICES = [
     "cdn",
     "vpc",
 ];
+/**
+ * tcb 旧版小租户云托管（CloudBase Run）API 族，统一禁用。
+ *
+ * 云托管一律走 tcbr 新逻辑（CreateCloudRunEnv / CreateCloudRunServer）。tcb 的
+ * CreateCloudBaseRunResource 是 2018 旧小租户开通接口：在无大租户记录的环境上调用
+ * 会把服务创建到小租户，产生错误的服务与版本（2026-08-13 用户实测，ATO 调研
+ * efec7cc5 结论）。同族 Describe/Delete 一并拦截，避免 AI 误以为与 tcbr 环境相关。
+ */
+const TCB_CLOUDRUN_FORBIDDEN_ACTIONS = [
+    "CreateCloudBaseRunResource",
+    "DescribeCloudBaseRunResource",
+    "DeleteCloudBaseRunResource",
+];
+const TCB_CLOUDRUN_FORBIDDEN_HINT = `云托管（CloudBase Run）统一走 tcbr 新逻辑（CreateCloudRunEnv / CreateCloudRunServer），` +
+    `不要使用 tcb 旧小租户接口（${TCB_CLOUDRUN_FORBIDDEN_ACTIONS.join(" / ")}）。` +
+    `新环境请先初始化云托管：callCloudApi(service="tcbr", version="2022-02-17", action="CreateCloudRunEnv", params={EnvId:"..."})，` +
+    `再通过 manageCloudRun(action="deploy") 创建服务；查询单个环境基础信息/是否已开通云托管用 callCloudApi(service="tcbr", version="2022-02-17", action="DescribeEnvBaseInfo", params={EnvId:"..."})，查询环境列表/资源信息用 DescribeCloudRunEnvs。`;
+/**
+ * 拒绝 tcb 旧版小租户云托管 API。命中黑名单时抛出带 tcbr 引导的错误。
+ */
+function assertTcbCloudRunActionAllowed(service, action) {
+    if (service === "tcb" && TCB_CLOUDRUN_FORBIDDEN_ACTIONS.includes(action)) {
+        throw new Error(`[${service}/${action}] 已禁用：${TCB_CLOUDRUN_FORBIDDEN_HINT}`);
+    }
+}
 function levenshteinDistance(left, right) {
     const rows = left.length + 1;
     const cols = right.length + 1;
@@ -131359,7 +131579,7 @@ function formatTcbParamsTypeHint(action) {
     return `参数类型参考：\n\`\`\`ts\n${entry.paramsType}\n\`\`\``;
 }
 function buildCapiDocGuidance(service) {
-    if (service === "tcb" || service === "lowcode" || service === "scf") {
+    if (service === "tcb" || service === "tcbr" || service === "lowcode" || service === "scf") {
         return `优先查阅 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。`;
     }
     return `请优先核对对应官方云 API 文档；若你的场景其实是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请优先使用 OpenAPI / Swagger 或 searchKnowledgeBase(mode="openapi")，不要继续猜测管控面 Action。`;
@@ -131449,15 +131669,21 @@ function registerCapiTools(server) {
 **云函数**: \`DescribeFunctions\`、\`CreateFunction\`、\`UpdateFunctionCode\`、\`DeleteFunction\`
 **数据库**: \`CreateMySQLInstance\`、\`DescribeMySQLInstances\`、\`DestroyMySQLInstance\`
 
+⚠️ 云托管（CloudBase Run）统一走 tcbr service（CreateCloudRunEnv / CreateCloudRunServer / DescribeEnvBaseInfo / DescribeCloudRunEnvs，version="2022-02-17"），tcb 旧小租户接口 CreateCloudBaseRunResource 等已被禁用；部署请用 manageCloudRun。查询单个环境基础信息/是否已开通云托管用 DescribeEnvBaseInfo（EnvId 必填），查询环境列表及资源信息用 DescribeCloudRunEnvs（EnvId 可选过滤）。
+
 销毁环境时，常见做法是至少带上 \`EnvId\` 和 \`BypassCheck: true\`，如果环境已经处于隔离期再按文档补 \`IsForce: true\`。`,
         inputSchema: {
             service: zod_1.z
                 .enum(ALLOWED_SERVICES)
-                .describe("选择要访问的服务。可选：tcb、scf、sts、cam、lowcode、cdn、vpc。对于 tcb / scf / lowcode 等 CloudBase 管控面 Action，请优先查官方文档，不要直接猜测 Action。"),
+                .describe("选择要访问的服务。可选：tcb、tcbr、scf、sts、cam、lowcode、cdn、vpc。对于 tcb / scf / lowcode 等 CloudBase 管控面 Action，请优先查官方文档，不要直接猜测 Action。云托管统一走 tcbr（version 需传 2022-02-17）。"),
             action: zod_1.z
                 .string()
                 .min(1)
-                .describe("具体 Action 名称，需符合对应服务的官方 API 定义。若不确定正确 Action，请先查官方文档；不要用近义词或历史命名进行猜测。tcb 常用 Action：环境管理 CreateEnv/ModifyEnv/DescribeEnvs/DestroyEnv、用户管理 CreateUser/ModifyUser/DescribeUserList/DeleteUsers、认证配置 EditAuthConfig、云函数 DescribeFunctions/CreateFunction、数据库 CreateMySQLInstance 等。"),
+                .describe("具体 Action 名称，需符合对应服务的官方 API 定义。若不确定正确 Action，请先查官方文档；不要用近义词或历史命名进行猜测。tcb 常用 Action：环境管理 CreateEnv/ModifyEnv/DescribeEnvs/DestroyEnv、用户管理 CreateUser/ModifyUser/DescribeUserList/DeleteUsers、认证配置 EditAuthConfig、云函数 DescribeFunctions/CreateFunction、数据库 CreateMySQLInstance 等。tcbr 常用 Action：CreateCloudRunEnv（初始化云托管）、DescribeEnvBaseInfo（查询单个环境基础信息，EnvId 必填）、DescribeCloudRunEnvs（查询环境列表/资源信息，EnvId 可选过滤）、CreateCloudRunServer/DescribeCloudRunServers。"),
+            version: zod_1.z
+                .string()
+                .optional()
+                .describe("API 版本（可选）。缺省时按 service 使用 SDK 内置默认版本；tcbr 必须传 \"2022-02-17\"（否则请求缺少 X-TC-Version 会失败）。示例：service=\"tcbr\", version=\"2022-02-17\", action=\"CreateCloudRunEnv\", params={EnvId:\"env-xxx\",PackageType:\"Standard\"}。"),
             params: zod_1.z
                 .record(zod_1.z.any())
                 .optional()
@@ -131470,10 +131696,11 @@ function registerCapiTools(server) {
             openWorldHint: true,
             category: CATEGORY,
         },
-    }, async ({ service, action, params, }) => {
+    }, async ({ service, action, params, version, }) => {
         if (!ALLOWED_SERVICES.includes(service)) {
             throw new Error(`Service ${service} is not allowed. Allowed services: ${ALLOWED_SERVICES.join(", ")}`);
         }
+        assertTcbCloudRunActionAllowed(service, action);
         const cloudbase = await getManager();
         if (['1', 'true'].includes(process.env.CLOUDBASE_EVALUATE_MODE ?? '')) {
             if (service === 'lowcode') {
@@ -131502,7 +131729,7 @@ function registerCapiTools(server) {
         let result;
         try {
             const cleanedParams = params ? removeEmptyStringParams(params) : {};
-            result = await cloudbase.commonService(service).call({
+            result = await cloudbase.commonService(service, version).call({
                 Action: action,
                 Param: cleanedParams,
             });
@@ -142128,7 +142355,7 @@ class TelemetryReporter {
         const arch = os_1.default.arch(); // 系统架构
         // Build-time injected version; guard for vitest / non-webpack runtimes.
         const mcpVersion = process.env.npm_package_version ||
-            ( true ? "2.25.10" : 0);
+            ( true ? "2.27.0" : 0);
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -218225,6 +218452,127 @@ TransportStream.prototype._nop = function _nop() {
 };
 
 
+/***/ }),
+
+/***/ 68107:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.SITE_IDS = exports.SITE_REGION_MAP = void 0;
+exports.isSiteId = isSiteId;
+exports.normalizeSite = normalizeSite;
+exports.getSite = getSite;
+exports.resolveSite = resolveSite;
+exports.resolveSiteAndRegion = resolveSiteAndRegion;
+const project_config_js_1 = __webpack_require__(68445);
+exports.SITE_REGION_MAP = {
+    domestic: {
+        id: "domestic",
+        label: "国内站",
+        authHost: "tcb.cloud.tencent.com",
+        consoleHost: "tcb.cloud.tencent.com",
+        defaultRegion: "ap-shanghai",
+        regions: ["ap-shanghai", "ap-guangzhou", "ap-singapore"],
+        capabilities: { noSql: true },
+    },
+    intl: {
+        id: "intl",
+        label: "国际站",
+        authHost: "tcb.tencentcloud.com",
+        consoleHost: "tcb.tencentcloud.com",
+        defaultRegion: "ap-singapore",
+        regions: ["ap-singapore"],
+        capabilities: { noSql: false },
+    },
+};
+exports.SITE_IDS = Object.keys(exports.SITE_REGION_MAP);
+function isSiteId(value) {
+    return value === "domestic" || value === "intl";
+}
+function normalizeSite(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "intl" || normalized === "international") {
+        return "intl";
+    }
+    if (normalized === "domestic" || normalized === "cn") {
+        return "domestic";
+    }
+    return undefined;
+}
+/**
+ * 根据 region 与显式 site 解析站点。
+ *
+ * - 显式 site 优先（`domestic`/`intl`，兼容 `cn`/`international` 别名）
+ * - 否则查 SITE_REGION_MAP：region 只属于一个站点时返回该站点
+ * - 当 region 同时存在于多个站点（如 ap-singapore）时返回 `ambiguous`，由上层决定
+ * - 未知 region 或未提供 region 时回退 domestic（全局默认）
+ */
+function getSite(region, explicitSite) {
+    const explicit = normalizeSite(explicitSite);
+    if (explicit) {
+        return explicit;
+    }
+    if (!region) {
+        return "domestic";
+    }
+    const matches = exports.SITE_IDS.filter((site) => exports.SITE_REGION_MAP[site].regions.includes(region));
+    if (matches.length === 1) {
+        return matches[0];
+    }
+    if (matches.length > 1) {
+        return "ambiguous";
+    }
+    return "domestic";
+}
+/**
+ * 认证/路由场景下解析站点：歧义（如 ap-singapore 未配 site）时默认 intl，保持既有国际站行为。
+ */
+function resolveSite(region, explicitSite) {
+    const site = getSite(region, explicitSite);
+    return site === "ambiguous" ? "intl" : site;
+}
+/**
+ * 统一 site/region 解析入口（收敛各调用点分散的 region fallback）。
+ *
+ * 优先级：显式参数 > 环境变量（TCB_SITE/TCB_REGION）> 项目配置（.cloudbase/project.json）> 全局默认
+ * （site=domestic, region=ap-shanghai）。
+ *
+ * 当仅指定 region 且该 region 在多个 site 的地域列表中都存在（如 ap-singapore）时，
+ * 返回 site=intl 并标记 ambiguous=true（兼容既有国际站行为），调用方可用 ambiguous 提示用户显式指定 site。
+ */
+function resolveSiteAndRegion(opts = {}) {
+    const projectConfig = (0, project_config_js_1.readProjectConfig)();
+    const explicitSite = normalizeSite(opts.site) ??
+        normalizeSite(process.env.TCB_SITE) ??
+        normalizeSite(projectConfig?.site);
+    const explicitRegion = opts.region ?? process.env.TCB_REGION ?? projectConfig?.region;
+    let site = explicitSite;
+    let ambiguous = false;
+    if (!site && explicitRegion) {
+        const inferred = getSite(explicitRegion);
+        if (inferred === "ambiguous") {
+            site = "intl";
+            ambiguous = true;
+        }
+        else if (inferred !== "domestic") {
+            site = inferred;
+        }
+    }
+    const resolvedSite = site ?? "domestic";
+    const region = explicitRegion ?? exports.SITE_REGION_MAP[resolvedSite].defaultRegion;
+    return {
+        site: resolvedSite,
+        region,
+        ...(ambiguous ? { ambiguous: true } : {}),
+    };
+}
+
+
 /***/ }),
 
 /***/ 68182:
@@ -218316,6 +218664,44 @@ function parseEffectsDef(_def, refs) {
 exports.parseEffectsDef = parseEffectsDef;
 
 
+/***/ }),
+
+/***/ 68445:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.readProjectConfig = readProjectConfig;
+const node_fs_1 = __webpack_require__(89971);
+const node_path_1 = __webpack_require__(26743);
+/**
+ * 读取项目级配置 `.cloudbase/project.json`。
+ *
+ * 该文件是 site/region/envId 的可选持久化来源，让"打开项目即连对服务"
+ * （对齐 Vercel `.vercel/project.json` 的三级回退）。读取失败/文件不存在
+ * 返回 undefined，不阻塞调用方。
+ */
+function readProjectConfig(cwd) {
+    try {
+        const projectRoot = cwd ?? process.env.WORKSPACE_FOLDER_PATHS ?? process.cwd();
+        const configPath = (0, node_path_1.join)(projectRoot, ".cloudbase", "project.json");
+        if (!(0, node_fs_1.existsSync)(configPath)) {
+            return undefined;
+        }
+        const raw = (0, node_fs_1.readFileSync)(configPath, "utf-8");
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object") {
+            return undefined;
+        }
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+
+
 /***/ }),
 
 /***/ 68599:
@@ -223544,7 +223930,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || ( true ? "2.25.10" : 0)}
+- MCP 版本：${process.env.npm_package_version || ( true ? "2.27.0" : 0)}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -223625,7 +224011,7 @@ function createWrappedHandler(name, handler, server) {
                 requestId: (typeof error === 'object' && error && 'requestId' in error) ? error.requestId : '',
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const mcpVersion =  true ? "2.25.10" : 0;
+            const mcpVersion =  true ? "2.27.0" : 0;
             const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
             const enhancedErrorMessage = `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息
@@ -240845,7 +241231,7 @@ function registerSetupTools(server) {
     server.registerTool("downloadTemplate", {
         title: "下载项目模板",
         description: `自动下载并部署CloudBase项目模板。
-**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.25.10" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.27.0" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])
@@ -242259,6 +242645,7 @@ module.exports.sync = path => {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.buildVerificationUriComplete = buildVerificationUriComplete;
 exports.buildDeviceAuthChallengePayload = buildDeviceAuthChallengePayload;
+exports.getCloudBaseApiKeyFromEnv = getCloudBaseApiKeyFromEnv;
 exports.getAuthProgressStateSync = getAuthProgressStateSync;
 exports.getAuthProgressState = getAuthProgressState;
 exports.resolveAuthOptions = resolveAuthOptions;
@@ -242274,7 +242661,7 @@ exports.getLoginState = getLoginState;
 exports.logout = logout;
 const toolbox_1 = __webpack_require__(25901);
 const logger_js_1 = __webpack_require__(13039);
-const tencent_cloud_js_1 = __webpack_require__(21454);
+const site_map_js_1 = __webpack_require__(68107);
 const auth = toolbox_1.AuthSupervisor.getInstance({});
 const authProgressState = {
     status: "IDLE",
@@ -242360,16 +242747,24 @@ function updateAuthProgressState(partial) {
     });
     return getAuthProgressStateSync();
 }
+/**
+ * Resolve CloudBase API Key from env.
+ * Prefer CLOUDBASE_API_KEY; fall back to CLOUDBASE_APIKEY (js-sdk / node-sdk convention).
+ */
+function getCloudBaseApiKeyFromEnv() {
+    return process.env.CLOUDBASE_API_KEY || process.env.CLOUDBASE_APIKEY || undefined;
+}
 function normalizeLoginStateFromEnvVars(options) {
     if (options?.ignoreEnvVars) {
         return null;
     }
-    // 优先检查 CloudBase API Key（优先级高于 TENCENTCLOUD_*）
-    const { CLOUDBASE_API_KEY, CLOUDBASE_ENV_ID: CLOUDBASE_ENV, } = process.env;
-    if (CLOUDBASE_API_KEY && CLOUDBASE_ENV) {
+    // Prefer CloudBase API Key over TENCENTCLOUD_*
+    const apiKey = getCloudBaseApiKeyFromEnv();
+    const CLOUDBASE_ENV = process.env.CLOUDBASE_ENV_ID;
+    if (apiKey && CLOUDBASE_ENV) {
         return {
             _type: 'api_key',
-            apiKey: CLOUDBASE_API_KEY,
+            apiKey,
             envId: CLOUDBASE_ENV,
         };
     }
@@ -242515,6 +242910,98 @@ function resetAuthProgressState() {
         lastError: undefined,
     });
 }
+const LEGACY_SITE = "domestic";
+function isSlottedCredential(value) {
+    if (!value || typeof value !== "object") {
+        return false;
+    }
+    return "domestic" in value || "intl" in value;
+}
+async function readStoredCredentialRaw() {
+    return toolbox_1.authStore.get("credential");
+}
+/**
+ * 读取指定 site 槽位的原始凭证；旧格式（单槽 flat）视为 domestic 槽位。
+ */
+async function readSiteCredentialRaw(site) {
+    const raw = await readStoredCredentialRaw();
+    if (!raw) {
+        return undefined;
+    }
+    if (isSlottedCredential(raw)) {
+        return raw[site];
+    }
+    return site === LEGACY_SITE ? raw : undefined;
+}
+/**
+ * 将凭证写入指定 site 槽位，保留其他槽位数据。
+ * base 缺省时读取当前存储；旧单槽数据会被迁移为 domestic 槽位（写回时升级分槽）。
+ */
+async function writeSiteCredential(site, credential, base) {
+    const current = base ?? (await readStoredCredentialRaw());
+    const slotted = current && isSlottedCredential(current)
+        ? { ...current }
+        : { domestic: current ?? {} };
+    slotted[site] = credential ?? {};
+    await toolbox_1.authStore.set("credential", slotted);
+}
+/**
+ * 确保存储已为分槽格式并返回槽位快照。
+ * 用于登录前迁移旧单槽数据，避免 @cloudbase/toolbox 内部误命中旧凭证而跳过新站点登录。
+ */
+async function ensureSlottedCredential() {
+    const raw = await readStoredCredentialRaw();
+    if (raw && isSlottedCredential(raw)) {
+        return { ...raw };
+    }
+    const slotted = { domestic: raw ?? {} };
+    await toolbox_1.authStore.set("credential", slotted);
+    return slotted;
+}
+function isSlotTokenExpired(credential, gap = 120) {
+    return (!!credential.accessTokenExpired &&
+        Number(credential.accessTokenExpired) < Date.now() + gap * 1000);
+}
+/**
+ * 读取并解析指定 site 的登录态，必要时走 refreshToken 续期（镜像 @cloudbase/toolbox 行为）。
+ */
+async function resolveSiteLoginState(site) {
+    const raw = await readSiteCredentialRaw(site);
+    if (!raw) {
+        return null;
+    }
+    const credential = (0, toolbox_1.resolveCredential)(raw);
+    if (!credential?.secretId || !credential?.secretKey) {
+        return null;
+    }
+    if (credential.refreshToken) {
+        if (!isSlotTokenExpired(credential)) {
+            return credential;
+        }
+        if (Date.now() < Number(credential.expired)) {
+            try {
+                const refreshed = await (0, toolbox_1.refreshTmpToken)(credential);
+                await writeSiteCredential(site, refreshed ?? {});
+                const resolved = (0, toolbox_1.resolveCredential)(refreshed ?? {});
+                return resolved?.secretId ? resolved : null;
+            }
+            catch (e) {
+                const code = e?.code;
+                if (code === "AUTH_FAIL" || code === "InternalError.GetRoleError") {
+                    return null;
+                }
+                throw e;
+            }
+        }
+        return null;
+    }
+    return credential;
+}
+function isUsableCredential(value) {
+    return (!!value &&
+        typeof value === "object" &&
+        Object.keys(value).length > 0);
+}
 async function peekLoginState(options) {
     const envVarLoginState = normalizeLoginStateFromEnvVars(options);
     if (envVarLoginState) {
@@ -242536,14 +243023,25 @@ async function peekLoginState(options) {
         (0, logger_js_1.debug)("loginByApiSecret");
         return envVarLoginState;
     }
-    // 尝试从 toolbox 本地存储读取（包括项目级 API Key 凭证）
-    return auth.getLoginState();
+    // 按 site 读取分槽凭证（缺省按 TCB_SITE/region 解析站点，默认 domestic）
+    const site = (0, site_map_js_1.normalizeSite)(options?.site) ?? (0, site_map_js_1.resolveSite)(options?.region, process.env.TCB_SITE);
+    const slotLoginState = await resolveSiteLoginState(site);
+    if (slotLoginState) {
+        return slotLoginState;
+    }
+    // 兼容旧单槽数据（视为 domestic），走 toolbox 读取/续期
+    if (site === LEGACY_SITE) {
+        return auth.getLoginState();
+    }
+    return null;
 }
 async function ensureLogin(options) {
     (0, logger_js_1.debug)("TENCENTCLOUD_SECRETID", { hasSecretId: !!process.env.TENCENTCLOUD_SECRETID });
-    (0, logger_js_1.debug)("CLOUDBASE_API_KEY", { hasApiKey: !!process.env.CLOUDBASE_API_KEY });
+    (0, logger_js_1.debug)("CLOUDBASE_API_KEY", { hasApiKey: !!getCloudBaseApiKeyFromEnv() });
     const loginState = await peekLoginState({
         ignoreEnvVars: options?.ignoreEnvVars,
+        site: options?.site,
+        region: options?.region,
     });
     if (!loginState) {
         const resolvedAuthOptions = resolveAuthOptions({
@@ -242559,21 +243057,31 @@ async function ensureLogin(options) {
             throw new Error(validationError);
         }
         const mode = resolvedAuthOptions.authMode;
+        // 按显式 site > TCB_SITE > region 映射表解析站点（ap-singapore 歧义默认 intl，兼容既有国际站行为）
+        const resolvedSite = (0, site_map_js_1.resolveSite)(options?.region, options?.site ?? process.env.TCB_SITE);
         const loginOptions = { flow: mode };
         if (mode === "web") {
             loginOptions.getAuthUrl =
-                options?.fromCloudBaseLoginPage && !(0, tencent_cloud_js_1.isInternationalRegion)(options?.region)
+                options?.fromCloudBaseLoginPage && resolvedSite === "domestic"
                     ? (url) => {
                         const separator = url.includes("?") ? "&" : "?";
                         const urlWithParam = `${url}${separator}allowNoEnv=true`;
-                        return `https://tcb.cloud.tencent.com/login?_redirect_uri=${encodeURIComponent(urlWithParam)}`;
+                        return `https://${site_map_js_1.SITE_REGION_MAP.domestic.authHost}/login?_redirect_uri=${encodeURIComponent(urlWithParam)}`;
                     }
                     : (url) => {
-                        if ((0, tencent_cloud_js_1.isInternationalRegion)(options?.region)) {
-                            url = url.replace("cloud.tencent.com", "tencentcloud.com");
+                        let finalUrl = url;
+                        if (resolvedSite === "intl") {
+                            try {
+                                const parsed = new URL(url);
+                                parsed.host = site_map_js_1.SITE_REGION_MAP.intl.authHost;
+                                finalUrl = parsed.toString();
+                            }
+                            catch {
+                                finalUrl = url.replace("cloud.tencent.com", "tencentcloud.com");
+                            }
                         }
-                        const separator = url.includes("?") ? "&" : "?";
-                        return `${url}${separator}allowNoEnv=true`;
+                        const separator = finalUrl.includes("?") ? "&" : "?";
+                        return `${finalUrl}${separator}allowNoEnv=true`;
                     };
         }
         else {
@@ -242594,8 +243102,23 @@ async function ensureLogin(options) {
             }
         }
         (0, logger_js_1.debug)("beforeloginByWebAuth", { loginOptions });
+        // 登录前迁移旧单槽数据为分槽格式，避免 toolbox 内部命中旧凭证而跳过新站点登录
+        const slotsBefore = await ensureSlottedCredential();
         try {
-            await auth.loginByWebAuth(loginOptions);
+            const loginResult = await auth.loginByWebAuth(loginOptions);
+            // toolbox 将新凭证写入 flat 'credential'，将其并入对应 site 槽位，保留其他槽位
+            const newRaw = await readStoredCredentialRaw();
+            let credentialToSlot = loginResult;
+            if (isSlottedCredential(newRaw)) {
+                credentialToSlot = newRaw[resolvedSite] ?? newRaw.domestic;
+            }
+            else if (newRaw) {
+                credentialToSlot = newRaw;
+            }
+            if (isUsableCredential(credentialToSlot)) {
+                const merged = { ...slotsBefore, [resolvedSite]: credentialToSlot };
+                await toolbox_1.authStore.set("credential", merged);
+            }
             resolveAuthProgressState();
         }
         catch (error) {
@@ -242604,6 +243127,8 @@ async function ensureLogin(options) {
         }
         const loginState = await peekLoginState({
             ignoreEnvVars: options?.ignoreEnvVars,
+            site: options?.site,
+            region: options?.region,
         });
         (0, logger_js_1.debug)("loginByWebAuth", { mode, hasLoginState: !!loginState });
         return loginState;
@@ -242616,11 +243141,19 @@ async function ensureLogin(options) {
 async function getLoginState(options) {
     return ensureLogin(options);
 }
-async function logout() {
-    const cwd = process.env.WORKSPACE_FOLDER_PATHS || process.cwd();
-    const result = await auth.logout({ cwd });
+async function logout(options) {
+    const site = (0, site_map_js_1.normalizeSite)(options?.site) ?? "domestic";
+    const raw = await readStoredCredentialRaw();
+    if (raw && isSlottedCredential(raw)) {
+        const slotted = { ...raw };
+        delete slotted[site];
+        await toolbox_1.authStore.set("credential", slotted);
+    }
+    else if (site === LEGACY_SITE) {
+        const cwd = process.env.WORKSPACE_FOLDER_PATHS || process.cwd();
+        await auth.logout({ cwd });
+    }
     resetAuthProgressState();
-    return result;
 }
 
 
@@ -263813,6 +264346,8 @@ const MANAGE_GATEWAY_ACTIONS = [
     "createRoute",
     "updateRoute",
     "deleteRoute",
+    "enableRoute",
+    "disableRoute",
     "bindCustomDomain",
     "deleteCustomDomain",
     "enableService",
@@ -263885,6 +264420,7 @@ function registerGatewayTools(server) {
             Domain: route.Domain,
             Path: route.Path,
             IsDefault: route.IsDefault,
+            Enable: typeof route.Enable === "boolean" ? route.Enable : undefined,
             UpstreamResourceType: route.UpstreamResourceType,
             UpstreamResourceName: route.UpstreamResourceName,
         }));
@@ -263895,16 +264431,26 @@ function registerGatewayTools(server) {
             Domain: route.Domain,
             Path: route.Path,
             IsDefault: route.IsDefault,
+            Enable: typeof route.Enable === "boolean" ? route.Enable : undefined,
             UpstreamResourceType: route.UpstreamResourceType,
             UpstreamResourceName: route.UpstreamResourceName,
         }));
-        const envelope = (0, gateway_access_urls_js_1.toAccessUrlEnvelope)((0, gateway_access_urls_js_1.rankGatewayAccessUrls)(candidates));
+        const disabledAccessUrls = (0, gateway_access_urls_js_1.rankGatewayAccessUrls)(candidates, {
+            includeDisabled: true,
+        })
+            .filter((item) => !item.enabled)
+            .map((item) => item.url);
+        const envelope = (0, gateway_access_urls_js_1.toAccessUrlEnvelope)((0, gateway_access_urls_js_1.rankGatewayAccessUrls)(candidates), disabledAccessUrls);
         return {
             ...(envelope.accessUrl ? { accessUrl: envelope.accessUrl } : {}),
             accessUrls: envelope.accessUrls,
             ...(envelope.accessUrlSource
                 ? { accessUrlSource: envelope.accessUrlSource }
                 : {}),
+            accessUrlReachable: Boolean(envelope.accessUrl),
+            ...(disabledAccessUrls.length > 0
+                ? { disabledAccessUrls, routeDisabled: true }
+                : {}),
         };
     };
     const pickUsableDefaultDomain = (domains) => {
@@ -263994,6 +264540,15 @@ function registerGatewayTools(server) {
             : input.enablePathTransmission !== undefined
                 ? input.enablePathTransmission
                 : undefined;
+        // Route enable: prefer route.enable. For updateRoute only, top-level
+        // enable also maps to Route.Enable (enableService/authSwitch use the
+        // same field name but different actions).
+        const routeEnable = input.route?.enable !== undefined
+            ? input.route.enable
+            : input.action === "updateRoute" &&
+                typeof input.enable === "boolean"
+                ? input.enable
+                : undefined;
         const route = {
             Path: path,
             UpstreamResourceType: upstreamResourceType,
@@ -264003,6 +264558,9 @@ function registerGatewayTools(server) {
         if (enablePathTransmission !== undefined) {
             route.EnablePathTransmission = enablePathTransmission;
         }
+        if (routeEnable !== undefined) {
+            route.Enable = routeEnable;
+        }
         return {
             EnvId: await resolveEnvId(),
             Domain: {
@@ -264016,9 +264574,46 @@ function registerGatewayTools(server) {
                 upstreamResourceName,
                 enableAuth,
                 enablePathTransmission,
+                enable: routeEnable,
             },
         };
     };
+    const resolveExistingRouteForToggle = async (input) => {
+        const routePath = input.routePath ?? input.path;
+        if (!routePath) {
+            throw new Error("action=enableRoute/disableRoute 时必须提供 path 或 route.path（例如 \"/\" 或 \"/api\"）");
+        }
+        const normalizedPath = normalizeAccessPath(routePath);
+        const preferredDomain = input.domain;
+        const result = await listHttpServiceRoutes(preferredDomain ? { domain: preferredDomain } : undefined);
+        const upstreamName = input.routeServiceName ?? input.targetName;
+        const matches = flattenRoutes(result).filter((item) => {
+            if (preferredDomain &&
+                item.Domain !== preferredDomain) {
+                return false;
+            }
+            if (normalizeAccessPath(String(item.Path ?? "")) !== normalizedPath) {
+                return false;
+            }
+            if (upstreamName && item.UpstreamResourceName !== upstreamName) {
+                return false;
+            }
+            return true;
+        });
+        if (matches.length === 0) {
+            throw new Error(`未找到路径 ${normalizedPath} 的路由` +
+                (preferredDomain ? `（域名 ${preferredDomain}）` : "") +
+                (upstreamName ? `（上游 ${upstreamName}）` : "") +
+                "。请先用 queryGateway(action=\"listRoutes\") 确认 Domain / Path，再调用 enableRoute/disableRoute。" +
+                "关闭静态托管默认域名（*.tcloudbaseapp.com）时，请显式传 domain=该 STATIC_STORE IsDefault 域名，并通常 path=\"/\"。");
+        }
+        if (matches.length > 1) {
+            const domains = [...new Set(matches.map((item) => item.Domain))];
+            throw new Error(`路径 ${normalizedPath} 匹配到 ${matches.length} 条路由（域名：${domains.join(", ")}）。` +
+                "请补充 domain（必要时再加 targetName/route.serviceName）精确定位后再 enableRoute/disableRoute。");
+        }
+        return matches[0];
+    };
     const routeMutationNextActions = (targetName) => [
         {
             tool: "queryGateway",
@@ -264222,6 +264817,10 @@ function registerGatewayTools(server) {
                     Domain: payload.Domain,
                 });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                const routeEnabled = payload.resolved.enable !== false;
+                const accessUrl = routeEnabled
+                    ? `https://${payload.resolved.domain}${payload.resolved.path}`
+                    : undefined;
                 return buildEnvelope({
                     action: input.action,
                     model: "httpServiceRoute",
@@ -264231,13 +264830,31 @@ function registerGatewayTools(server) {
                     upstreamResourceName: payload.resolved.upstreamResourceName,
                     auth: payload.resolved.enableAuth ?? null,
                     enablePathTransmission: payload.resolved.enablePathTransmission ?? null,
-                    accessUrl: `https://${payload.resolved.domain}${payload.resolved.path}`,
-                    accessUrls: [`https://${payload.resolved.domain}${payload.resolved.path}`],
+                    enable: payload.resolved.enable ?? null,
+                    ...(accessUrl
+                        ? {
+                            accessUrl,
+                            accessUrls: [accessUrl],
+                            accessUrlReachable: true,
+                        }
+                        : {
+                            accessUrls: [],
+                            accessUrlReachable: false,
+                            routeDisabled: true,
+                            disabledAccessUrls: [
+                                `https://${payload.resolved.domain}${payload.resolved.path}`,
+                            ],
+                        }),
                     accessUrlSource: input.domain && input.domain === payload.resolved.domain
                         ? "gateway.custom"
                         : "gateway.default",
                     raw: result,
                 }, `HTTP 路由更新成功（${payload.resolved.domain}${payload.resolved.path}` +
+                    (payload.resolved.enable === false
+                        ? "，路由已禁用 Enable=false"
+                        : payload.resolved.enable === true
+                            ? "，路由已启用 Enable=true"
+                            : "") +
                     (payload.resolved.enablePathTransmission === true
                         ? "，路径透传=开启"
                         : payload.resolved.enablePathTransmission === false
@@ -264245,6 +264862,102 @@ function registerGatewayTools(server) {
                             : "") +
                     `）`, routeMutationNextActions(payload.resolved.upstreamResourceName));
             }
+            case "enableRoute":
+            case "disableRoute": {
+                const enable = input.action === "enableRoute";
+                const existing = await resolveExistingRouteForToggle({
+                    path: input.path,
+                    routePath: input.route?.path,
+                    domain: input.domain,
+                    targetName: input.targetName,
+                    routeServiceName: input.route?.serviceName,
+                });
+                const upstreamResourceType = resolveUpstreamResourceType({
+                    upstreamResourceType: input.upstreamResourceType ??
+                        existing.UpstreamResourceType,
+                    routeUpstreamResourceType: input.route?.upstreamResourceType,
+                });
+                const upstreamResourceName = input.route?.serviceName ??
+                    input.targetName ??
+                    String(existing.UpstreamResourceName ?? "");
+                if (!upstreamResourceName) {
+                    throw new Error(`action=${input.action} 无法解析上游资源名；请用 queryGateway(listRoutes) 确认后传入 targetName 或 route.serviceName。`);
+                }
+                const normalizedPath = normalizeAccessPath(String(existing.Path ?? input.route?.path ?? input.path ?? "/"));
+                const domain = existing.Domain;
+                const enableAuth = input.route?.auth !== undefined
+                    ? input.route.auth
+                    : input.auth !== undefined
+                        ? input.auth
+                        : existing.EnableAuth;
+                const enablePathTransmission = input.route?.enablePathTransmission !== undefined
+                    ? input.route.enablePathTransmission
+                    : input.enablePathTransmission !== undefined
+                        ? input.enablePathTransmission
+                        : existing.EnablePathTransmission;
+                const route = {
+                    Path: normalizedPath,
+                    UpstreamResourceType: upstreamResourceType,
+                    UpstreamResourceName: upstreamResourceName,
+                    Enable: enable,
+                };
+                if (enableAuth !== undefined) {
+                    route.EnableAuth = enableAuth;
+                }
+                if (enablePathTransmission !== undefined) {
+                    route.EnablePathTransmission = enablePathTransmission;
+                }
+                const cloudbase = await getManager();
+                const result = await cloudbase.env.modifyHttpServiceRoute({
+                    EnvId: await resolveEnvId(),
+                    Domain: {
+                        Domain: domain,
+                        Routes: [route],
+                    },
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                const verb = enable ? "启用" : "禁用";
+                const accessUrl = enable
+                    ? `https://${domain}${normalizedPath}`
+                    : undefined;
+                return buildEnvelope({
+                    action: input.action,
+                    model: "httpServiceRoute",
+                    domain,
+                    path: normalizedPath,
+                    upstreamResourceType,
+                    upstreamResourceName,
+                    enable,
+                    auth: enableAuth ?? null,
+                    enablePathTransmission: enablePathTransmission ?? null,
+                    ...(accessUrl
+                        ? {
+                            accessUrl,
+                            accessUrls: [accessUrl],
+                            accessUrlReachable: true,
+                        }
+                        : {
+                            accessUrls: [],
+                            accessUrlReachable: false,
+                            routeDisabled: true,
+                            disabledAccessUrls: [`https://${domain}${normalizedPath}`],
+                        }),
+                    accessUrlSource: existing.IsDefault
+                        ? "gateway.default"
+                        : "gateway.custom",
+                    raw: result,
+                }, `HTTP 路由已${verb}（${domain}${normalizedPath}，Enable=${enable}）。` +
+                    (enable
+                        ? "启用后通常数秒到约 30 秒内可访问；请用 queryGateway(getRoute) 或探测 accessUrl 确认。"
+                        : "禁用后该路径将不可公网访问（GATEWAY_ROUTE_DISABLED）；关闭静态托管默认域名（*.tcloudbaseapp.com）时，请确认 DomainType=STATIC_STORE 且 IsDefault=true。") +
+                    " 底层对应 tcb ModifyHTTPServiceRoute（不是 ModifyGatewayRoute）。", [
+                    {
+                        tool: "queryGateway",
+                        action: "getRoute",
+                        reason: `复核路由 Enable=${enable} 是否已生效`,
+                    },
+                ]);
+            }
             case "deleteRoute": {
                 const routePath = input.route?.path ?? input.path;
                 if (!routePath) {
@@ -264452,8 +265165,11 @@ function registerGatewayTools(server) {
     }, async (input) => withEnvelope(() => handleQueryGateway(input)));
     server.registerTool?.("manageGateway", {
         title: "管理 CloudBase 网关",
-        description: "CloudBase HTTP 网关统一写入口（Domain/Route）。createRoute/updateRoute/deleteRoute 把域名下的 path 转到上游；未传 domain 时用 DomainType=HTTPSERVICE 的 IsDefault 默认 HTTP 域名（形如 *.{region}.app.tcloudbase.com），不会使用静态托管 CDN 域名（*.tcloudbaseapp.com，DomainType=STATIC_STORE）。" +
+        description: "CloudBase HTTP 网关统一写入口（Domain/Route）。createRoute/updateRoute/deleteRoute 把域名下的 path 转到上游；" +
+            "enableRoute/disableRoute 启用或禁用已有路由（底层 ModifyHTTPServiceRoute 的 Routes[].Enable，不是 ModifyGatewayRoute）。" +
+            "未传 domain 时用 DomainType=HTTPSERVICE 的 IsDefault 默认 HTTP 域名（形如 *.{region}.app.tcloudbase.com），不会使用静态托管 CDN 域名（*.tcloudbaseapp.com，DomainType=STATIC_STORE）。" +
             "这是网关默认域上的路径路由，不是 STATIC_STORE 上游绑定；STATIC_STORE 上游必须显式传 upstreamResourceType=STATIC_STORE。" +
+            "关闭静态托管默认域名（*.tcloudbaseapp.com）：先 queryGateway(listRoutes) 找到 DomainType=STATIC_STORE 且 IsDefault=true 的 domain，再 manageGateway(action=\"disableRoute\", domain=该域名, path=\"/\")；勿用 manageHosting。" +
             "创建后可用 queryGateway(action=\"listRoutes\") 核对 Domain / DomainType / Path / UpstreamResourceType。" +
             "上游类型只用一个参数 upstreamResourceType（也可写在 route.upstreamResourceType，route 优先）：" +
             "WEB_SCF=HTTP云函数，SCF=Event云函数，CBR=云托管，STATIC_STORE=静态托管，LH=轻量应用服务器；" +
@@ -264466,9 +265182,12 @@ function registerGatewayTools(server) {
         inputSchema: {
             action: zod_1.z
                 .enum(MANAGE_GATEWAY_ACTIONS)
-                .describe("写操作：createRoute/updateRoute/deleteRoute 管理路由；bindCustomDomain/deleteCustomDomain 管理自定义域名；" +
+                .describe("写操作：createRoute/updateRoute/deleteRoute 管理路由；enableRoute/disableRoute 启用或禁用已有路由（需 path，建议显式传 domain）；" +
+                "bindCustomDomain/deleteCustomDomain 管理自定义域名；" +
                 "enableService/authSwitch 开关 HTTP 网关总开关与访问鉴权（需配合 enable 参数）。" +
-                "createRoute/updateRoute 必须提供 upstreamResourceType。" +
+                "createRoute/updateRoute 必须提供 upstreamResourceType；enableRoute/disableRoute 会先 listRoutes 定位已有路由，通常不必重填上游。" +
+                "updateRoute 也可传 enable/route.enable 直接改 Routes[].Enable。" +
+                "关闭 *.tcloudbaseapp.com 默认静态托管域：disableRoute + domain=该 STATIC_STORE IsDefault 域名 + path=\"/\"。" +
                 "已有自定义域名时优先 createRoute(domain=已有域名) 实现访问，不必再次 bindCustomDomain / 传入 certificateId；" +
                 "bindCustomDomain 仅用于首次绑定新域名（需 certificateId；可选 accessType=DIRECT|CDN|CUSTOM，CUSTOM 需 customCname；普通场景用默认 DIRECT）。" +
                 "接入说明：https://docs.cloudbase.net/service/custom-domain"),
@@ -264517,16 +265236,25 @@ function registerGatewayTools(server) {
                     .boolean()
                     .optional()
                     .describe("同顶层 enablePathTransmission。route 内设置时优先于顶层。"),
+                enable: zod_1.z
+                    .boolean()
+                    .optional()
+                    .describe("路由级开关（Routes[].Enable / Route.Enable）。createRoute/updateRoute 可用：" +
+                    "enable=false 禁用该 Domain+Path（访问返回 GATEWAY_ROUTE_DISABLED）；" +
+                    "enable=true 重新启用。updateRoute 也可用顶层 enable 表达同一语义；" +
+                    "也可用专用 action enableRoute/disableRoute。route.enable 优先于顶层 enable。"),
             })
                 .optional()
                 .describe("路由对象（可选写法）。例：云函数 {upstreamResourceType:\"WEB_SCF\",serviceName:\"fn\",path:\"/api\"}；" +
                 "云托管 {upstreamResourceType:\"CBR\",serviceName:\"svc\",path:\"/api\"}；" +
-                "静态托管 {upstreamResourceType:\"STATIC_STORE\",serviceName:\"staticstore\",path:\"/\"}。"),
+                "静态托管 {upstreamResourceType:\"STATIC_STORE\",serviceName:\"staticstore\",path:\"/\"}；" +
+                "禁用路由 {path:\"/\",enable:false}（配合 updateRoute，或直接用 disableRoute）。"),
             domain: zod_1.z
                 .string()
                 .optional()
                 .describe("域名。省略时自动使用环境 DomainType=HTTPSERVICE 的 IsDefault 默认 HTTP 域名（*.{region}.app.tcloudbase.com），不会回退到静态托管 CDN 域名（*.tcloudbaseapp.com，DomainType=STATIC_STORE）；也不是 STATIC_STORE 上游绑定。" +
                 "可用 queryGateway(action=\"listRoutes\") 核对实际 Domain / DomainType。" +
+                "enableRoute/disableRoute 操作 *.tcloudbaseapp.com 时必须显式传入该域名。" +
                 "已有自定义域名时请显式传入该域名并 createRoute/updateRoute/deleteRoute，即可实现自定义域名访问且无需证书 ID；" +
                 "仅 bindCustomDomain 时表示要新绑定的域名。"),
             certificateId: zod_1.z
@@ -264549,9 +265277,11 @@ function registerGatewayTools(server) {
             enable: zod_1.z
                 .boolean()
                 .optional()
-                .describe("开关目标状态（enableService / authSwitch 必填）：enable=true 开启，enable=false 关闭。" +
-                "bindCustomDomain 可选：enable=false 表示绑定后禁用域名（默认启用）。" +
-                "省略或非布尔值会返回参数错误。"),
+                .describe("开关目标状态：enableService / authSwitch 必填（true 开启 / false 关闭）；" +
+                "bindCustomDomain 可选：enable=false 表示绑定后禁用域名（默认启用）；" +
+                "updateRoute 可选：映射到 Routes[].Enable（也可用 route.enable，route 优先；" +
+                "也可用专用 action enableRoute/disableRoute）。" +
+                "省略或非布尔值在 enableService/authSwitch 会返回参数错误。"),
         },
         annotations: {
             readOnlyHint: false,
@@ -274552,7 +275282,6 @@ function shouldRegisterTool(toolName) {
         'createFunction', // also involves local files
         // Download tools - local file downloads
         'downloadTemplate',
-        'downloadRemoteFile',
         // Setup tools - local config file operations
         'setupEnvironmentId',
         // CloudRun tools - local file operations