@cloudbase/cloudbase-mcp 2.34.5 → 2.34.7

package/dist/index.cjs

@@ -199407,6 +199407,7 @@ exports.getLoginState = getLoginState;
 exports.logout = logout;
 const toolbox_1 = __webpack_require__(23233);
 const logger_js_1 = __webpack_require__(40781);
+const project_config_js_1 = __webpack_require__(39175);
 const site_map_js_1 = __webpack_require__(34533);
 const auth = toolbox_1.AuthSupervisor.getInstance({});
 const authProgressState = {
@@ -199811,8 +199812,7 @@ async function peekLoginState(options) {
         if ('_type' in envVarLoginState && envVarLoginState._type === 'api_key') {
             (0, logger_js_1.debug)("peekLoginState: detected CLOUDBASE_API_KEY env var");
             try {
-                // 优先使用 IDE 注入的工作目录，其次 process.cwd()
-                const projectCwd = process.env.WORKSPACE_FOLDER_PATHS || process.cwd();
+                const projectCwd = (0, project_config_js_1.requireProjectRoot)();
                 // 换取网关按站点选型：显式 intl → ap-singapore；domestic/歧义 → toolbox 默认
                 // ap-shanghai（国内站多地域环境均经其全局路由，详见 resolveApiKeyExchangeRegion）
                 const exchangeRegion = (0, site_map_js_1.resolveApiKeyExchangeRegion)({
@@ -199969,7 +199969,7 @@ async function logout(options) {
         await toolbox_1.authStore.set("credential", slotted);
     }
     else if (site === LEGACY_SITE) {
-        const cwd = process.env.WORKSPACE_FOLDER_PATHS || process.cwd();
+        const cwd = (0, project_config_js_1.requireProjectRoot)();
         await auth.logout({ cwd });
     }
     resetAuthProgressState();
@@ -200364,6 +200364,14 @@ class EnvironmentManager {
                 this._setCachedEnvId(loginState.envId);
                 return loginState.envId;
             }
+            // 3.1 未登录必须交回 AUTH_REQUIRED，不能继续往下走「选环境」。
+            // 未登录时拿不到任何环境候选，落到 throwEnvRequiredError 会输出
+            // 「当前已登录，但还没有可用环境」——把「没登录」误诊成「登录了但缺环境」。
+            // 调用方读到这句会去 set_env 选环境，而候选列表永远为空，只能原样重试。
+            // 与 getCloudBaseManager 的登录态分流保持同构。
+            if (!loginState) {
+                throwAuthRequiredError();
+            }
             // 4. 单环境自动绑定；多环境时返回结构化引导，不再触发交互弹窗
             const envCandidates = await listAvailableEnvCandidates({ loginState });
             if (envCandidates.length === 1) {
@@ -201626,6 +201634,7 @@ const msgPush_js_1 = __webpack_require__(26191);
 const setup_js_1 = __webpack_require__(8707);
 const envSetup_js_1 = __webpack_require__(57148);
 const interactive_js_1 = __webpack_require__(91838);
+const feedback_js_1 = __webpack_require__(99391);
 exports.en = {
     env: env_js_1.env.en,
     storage: storage_js_1.storage.en,
@@ -201655,6 +201664,7 @@ exports.en = {
     setup: setup_js_1.setup.en,
     envSetup: envSetup_js_1.envSetup.en,
     interactive: interactive_js_1.interactive.en,
+    feedback: feedback_js_1.feedback.en,
 };
 
 
@@ -202008,7 +202018,7 @@ exports.capi = (0, types_js_1.defineModule)({
     docGuidanceCloudbase: "优先查阅 CloudBase API 概览 {controlPlaneUrl} 与云开发依赖资源接口指引 {dependencyUrl}。",
     docGuidanceMonitor: "请优先核对云监控（腾讯云可观测平台）官方 API 文档：API 概览 https://cloud.tencent.com/document/product/649/30343 ，单 Action 详细文档在 https://cloud.tencent.com/document/api/248/ 产品线下。",
     docGuidanceGeneric: "请优先核对对应官方云 API 文档；若你的场景其实是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请优先使用 OpenAPI / Swagger 或 searchKnowledgeBase(mode=\"openapi\")，不要继续猜测管控面 Action。",
-    camAuthGuidance: "这通常是 CAM 权限不足（常见于 API Key 登录仅授权数据面：DB/函数/存储）。请任选其一：1) 改用 device code 登录管控面：auth(action=\"start_auth\", authMode=\"device\")；2) 或使用腾讯云 SecretId/SecretKey（确认子账号已授 CAM 策略，如 QcloudTCBFullAccess、QcloudVPCReadOnlyAccess）；3) 确认目标资源属于当前登录账号。",
+    camAuthGuidance: "这是 CAM 权限不足。先分清是谁缺权限，再决定怎么补：用 auth(action=\"status\") 看 credential_scope，用 callCloudApi(service=\"sts\", action=\"GetCallerIdentity\") 看实际调用者（Type=CAMRole 表示角色扮演身份，UserId 里带角色名）。若缺权限的是角色（如 TCB_QcsRole），补的是挂在**角色**上的策略 —— 给用户一条 cam/role/grant 一键授权链接，拼法与 principal 取值见 skill cloud-api-operations 的 §3.2；若是账号级身份本人，则由主账号给这个身份追加策略（用腾讯云 SecretId/SecretKey 登录时，调用者就是该身份）。环境级 API Key 只能访问绑定环境的数据面，跨产品调用需改用账号级凭据：auth(action=\"start_auth\", authMode=\"device\")。另请确认目标资源确实属于当前账号。",
     errorInvalidAction: "Action `{action}` 可能不存在或不对外开放。请不要继续猜测 Action 名称，先确认 service=`{service}` 下该 Action 在当前 API 版本是否真实存在。",
     errorSuggestedActions: "可能的 tcb Action：{candidates}。",
     errorRegionParam: "Region 不是 Action body 参数。请使用 callCloudApi 顶层参数 region（例如 region=\"ap-singapore\"），对应 X-TC-Region。",
@@ -202042,7 +202052,7 @@ exports.capi = (0, types_js_1.defineModule)({
     docGuidanceCloudbase: "Prefer the CloudBase API overview {controlPlaneUrl} and the dependent-resource API guide {dependencyUrl}.",
     docGuidanceMonitor: "Check the official Cloud Monitor (Tencent Cloud Observability Platform) API docs first: API overview https://cloud.tencent.com/document/product/649/30343 , per-Action docs live under https://cloud.tencent.com/document/api/248/ .",
     docGuidanceGeneric: "Check the corresponding official cloud API docs first; if your scenario is actually integrating CloudBase business APIs such as auth/functions/cloudrun/storage/mysqldb over HTTP, prefer OpenAPI / Swagger or searchKnowledgeBase(mode=\"openapi\") instead of guessing control-plane Actions.",
-    camAuthGuidance: "This is usually insufficient CAM permission (common with API Key logins that only grant the data plane: DB/functions/storage). Pick one: 1) switch to device code login for the control plane: auth(action=\"start_auth\", authMode=\"device\"); 2) or use Tencent Cloud SecretId/SecretKey (ensure the sub-account has CAM policies such as QcloudTCBFullAccess, QcloudVPCReadOnlyAccess); 3) confirm the target resource belongs to the logged-in account.",
+    camAuthGuidance: "This is a CAM permission gap. Work out who is missing it before choosing a fix: auth(action=\"status\") shows credential_scope, and callCloudApi(service=\"sts\", action=\"GetCallerIdentity\") shows the actual caller (Type=CAMRole means an assumed role; the UserId carries the role name). When the role is the one missing permission (e.g. TCB_QcsRole), the fix is a policy attached to that role — give the user a cam/role/grant authorization link, built as described in the cloud-api-operations skill, section 3.2. When an account-level identity is the caller, the main account attaches the policy to it (signing in with a Tencent Cloud SecretId/SecretKey makes the caller that identity). An environment-level API Key can only reach the bound environment's data plane; for cross-product calls switch to account-level credentials: auth(action=\"start_auth\", authMode=\"device\"). Also confirm the target resource belongs to the current account.",
     errorInvalidAction: "Action `{action}` may not exist or is not publicly available. Do not keep guessing Action names; first confirm the Action actually exists under service=`{service}` in the current API version.",
     errorSuggestedActions: "Possible tcb Actions: {candidates}.",
     errorRegionParam: "Region is not an Action body parameter. Use the callCloudApi top-level region parameter (e.g. region=\"ap-singapore\"), which maps to X-TC-Region.",
@@ -202086,7 +202096,7 @@ exports.cloudrun = (0, types_js_1.defineModule)({
     "manage.description": "管理云托管服务，按开发顺序支持：开通云托管环境（initEnv）、初始化项目（可从模板开始，模板列表可通过 queryCloudRun 查询）、下载服务代码、本地运行（仅函数型服务）、部署代码、仅更新配置（updateConfig，无需重新上传代码）、删除服务。deploy 支持两种方式：1) 源码构建（传入 targetPath，本地代码打包上传，默认路径）；2) 已有镜像部署（传入 imageUrl，如 ccr.ccs.tencentyun.com/ns/img:v1，走 DeployType=image 容器型部署，targetPath 可省略）。deploy 语义为「触发部署 + 轻量等待任务注册」（最多约 45s；不需要 buildId 时可传 waitRegistration=false 跳过等待）。源码构建返回 buildId，用 getDeployLog 轮询构建进度后再 getProcessLog；镜像部署（imageUrl）BuildId 常为 0，跳过 getDeployLog，返回 runId/next_step 引导 getProcessLog（或先 getDeployRecords 取 RunId）。若用户明确指定镜像或无需重新构建，必须传 imageUrl，不要仅因本地有源码目录就回退到源码构建。deploy 对已存在服务会先读取远程配置再合并（保留 VpcConf/EnvParams/OpenAccessTypes）。updateConfig 对齐控制台服务设置页。删除操作需要确认，建议设置force=true。新环境首次部署前若提示未开通云托管，先调用 initEnv 开通（异步、幂等）。",
     "error.managerInitFailed": "CloudBase Manager 初始化失败，请检查凭据与环境配置。",
     "error.unsupportedAction": "不支持的操作：{action}",
-    "error.pathOutsideCwd": "路径必须在当前工作目录内：{cwd}",
+    "error.pathOutsideCwd": "路径必须在当前工作目录内：{cwd}。允许：`{cwd}` 下的路径，或传入项目目录的绝对路径（相对路径不能通过 `../` 逃逸 CWD）。收到的解析路径：{resolvedPath}。建议：将 targetPath 设为项目绝对路径（deploy/download/init）。",
     "error.commonServiceQueryEnv": "当前 CloudBase Manager 不支持 commonService，无法查询云托管环境开通状态。",
     "error.commonServiceInitEnv": "当前 CloudBase Manager 不支持 commonService，无法初始化云托管环境。",
     "error.commonServiceSubmitDiff": "当前 CloudBase Manager 不支持 commonService，无法调用 SubmitServerConfigChangeDiff。",
@@ -202276,7 +202286,7 @@ exports.cloudrun = (0, types_js_1.defineModule)({
     "manage.description": "Manage CloudRun services, in development order: provision the CloudRun env (initEnv), initialize a project (optionally from a template; list templates via queryCloudRun), download service code, run locally (function services only), deploy code, update config only (updateConfig, no code upload needed), and delete the service. deploy supports two modes: 1) source build (pass targetPath; local code is packaged and uploaded, the default); 2) existing image deploy (pass imageUrl, e.g. ccr.ccs.tencentyun.com/ns/img:v1; DeployType=image container deploy, targetPath optional). deploy means \"trigger deploy + lightweight wait for task registration\" (up to ~45s; pass waitRegistration=false to skip the wait when you don't need the buildId). Source builds return buildId — poll getDeployLog for build progress, then getProcessLog; image deploys (imageUrl) usually have BuildId=0 — getDeployLog is skipped, and runId/next_step guide you to getProcessLog (or getDeployRecords first for RunId). If the user explicitly specifies an image or no rebuild is needed, you must pass imageUrl instead of falling back to a source build just because a local source directory exists. For existing services, deploy reads the remote config first and merges (preserving VpcConf/EnvParams/OpenAccessTypes). updateConfig aligns with the console service settings page. Deletion requires confirmation; set force=true. If a new env reports CloudRun not provisioned before the first deploy, call initEnv first (async, idempotent).",
     "error.managerInitFailed": "Failed to initialize CloudBase manager. Please check your credentials and environment configuration.",
     "error.unsupportedAction": "Unsupported action: {action}",
-    "error.pathOutsideCwd": "Path must be within current working directory: {cwd}",
+    "error.pathOutsideCwd": "Path must be within current working directory: {cwd}. Allowed: paths under `{cwd}`, or pass an absolute path to the project directory (relative paths cannot escape CWD via `../`). Received resolved path: {resolvedPath}. Suggestion: set targetPath to the absolute project path (deploy/download/init).",
     "error.commonServiceQueryEnv": "Current CloudBase Manager does not support commonService; cannot query CloudRun env status.",
     "error.commonServiceInitEnv": "Current CloudBase Manager does not support commonService; cannot initialize CloudRun env.",
     "error.commonServiceSubmitDiff": "Current CloudBase Manager does not support commonService; cannot call SubmitServerConfigChangeDiff.",
@@ -203215,11 +203225,28 @@ exports.databaseSQL = (0, types_js_1.defineModule)({
     "gate.pgOnlyMode": "当前环境（{envId}）已开通 PostgreSQL，MySQL 不可用。请改用 managePgDatabase / queryPgDatabase，而不是 manageMysqlDatabase / queryMysqlDatabase。",
     "gate.useManagePg": "请使用 managePgDatabase 执行 PostgreSQL 操作",
     "queryMysqlDatabase.title": "查询 CloudBase MySQL 数据库状态或执行只读 SQL",
-    "queryMysqlDatabase.description": "查询 CloudBase MySQL 数据库信息。支持执行只读 SQL、查询 MySQL 开通结果、查询 MySQL 任务状态，以及获取当前实例生命周期上下文。标准 getInstanceInfo/describeInstance 不返回连接凭据；仅 getConnectionInfo 透传原始连接/集群载荷（含可能的凭据），且仅用于显式 TCP 迁移。业务 CRUD 优先使用 SDK 或 runQuery/runStatement。",
-    "schema.query.action": "runQuery=执行只读 SQL；describeCreateResult=查询 CreateMySQL 结果；describeTaskStatus=查询 MySQL 任务状态；getInstanceInfo=获取不含连接凭据的生命周期上下文；describeInstance=getInstanceInfo 的别名；getConnectionInfo=透传可能包含凭据的原始连接/集群载荷（仅限 TCP 迁移例外场景）",
+    "queryMysqlDatabase.description": "查询 CloudBase MySQL 数据库信息。支持执行只读 SQL、查询 MySQL 开通结果、查询 MySQL 任务状态、获取当前实例生命周期上下文，以及查询实例慢查询/错误日志（对齐 Manager SDK describeInstanceSlowQueries / describeInstanceErrorLogs）。标准 getInstanceInfo/describeInstance 不返回连接凭据；仅 getConnectionInfo 透传原始连接/集群载荷（含可能的凭据），且仅用于显式 TCP 迁移。业务 CRUD 优先使用 SDK 或 runQuery/runStatement。",
+    "schema.query.action": "runQuery=执行只读 SQL；describeCreateResult=查询 CreateMySQL 结果；describeTaskStatus=查询 MySQL 任务状态；getInstanceInfo=获取不含连接凭据的生命周期上下文；describeInstance=getInstanceInfo 的别名；getConnectionInfo=透传可能包含凭据的原始连接/集群载荷（仅限 TCP 迁移例外场景）；describeInstanceSlowQueries=查询实例慢查询日志；describeInstanceErrorLogs=查询实例错误日志",
     "schema.query.sql": "action=runQuery 使用的只读 SQL",
-    "schema.query.request": "describeCreateResult/describeTaskStatus 使用的官方请求载荷",
-    "schema.query.dbInstance": "runQuery 可选的 SQL 数据库实例上下文",
+    "schema.query.request": "describeCreateResult/describeTaskStatus/describeInstanceSlowQueries/describeInstanceErrorLogs 使用的官方请求载荷（可含 InstanceId 等）",
+    "schema.query.dbInstance": "runQuery / 慢查/错误日志可选的 SQL 数据库实例上下文",
+    "schema.query.startTime": "慢查/错误日志查询开始时间（YYYY-MM-DD HH:mm:ss）",
+    "schema.query.endTime": "慢查/错误日志查询结束时间（YYYY-MM-DD HH:mm:ss）",
+    "schema.query.limit": "慢查/错误日志返回条数限制",
+    "schema.query.offset": "慢查/错误日志分页偏移",
+    "schema.query.username": "慢查过滤：用户名",
+    "schema.query.host": "慢查过滤：客户端 host",
+    "schema.query.database": "慢查过滤：数据库名",
+    "schema.query.orderBy": "排序字段。慢查支持 QueryTime/LockTime/RowsExamined/RowsSent；错误日志支持 Timestamp",
+    "schema.query.orderByType": "排序方向：asc/desc（大小写均可）",
+    "schema.query.sqlText": "慢查过滤：SQL 文本片段",
+    "schema.query.logLevels": "错误日志等级过滤，可选值：error / warning / note",
+    "schema.query.keyWords": "错误日志关键字模糊搜索列表",
+    "instanceLogs.notProvisioned": "MySQL 尚未开通，无法查询实例慢查/错误日志。",
+    "instanceLogs.instanceIdRequired": "无法解析 CynosDB InstanceId。请先 getInstanceInfo，或通过 dbInstance.instanceId / request.InstanceId 传入。",
+    "instanceLogs.resolveInstanceId": "先查询实例信息以获取可用的 InstanceId。",
+    "instanceLogs.slowQueriesSuccess": "MySQL 实例慢查询日志检索成功。",
+    "instanceLogs.errorLogsSuccess": "MySQL 实例错误日志检索成功。",
     "manageMysqlDatabase.title": "管理 CloudBase MySQL 数据库生命周期或执行写入 SQL",
     "manageMysqlDatabase.description": "管理 CloudBase MySQL 数据库资源。支持开通 MySQL、销毁 MySQL、执行写入 SQL/DDL，以及初始化数据库 Schema。注意：必须先开通 MySQL（action=provisionMySQL，confirm=true）才能执行 runStatement 或 initializeSchema。若 MySQL 尚未开通，工具会返回 MYSQL_NOT_CREATED 并给出开通的 nextAction 提示。",
     "schema.manage.action": "provisionMySQL=创建 MySQL 实例；destroyMySQL=销毁 MySQL 实例；runStatement=执行写入 SQL 或 DDL；initializeSchema=按顺序执行 Schema 初始化语句",
@@ -203290,11 +203317,28 @@ exports.databaseSQL = (0, types_js_1.defineModule)({
     "gate.pgOnlyMode": "This environment ({envId}) has PostgreSQL enabled but MySQL is NOT available. Use managePgDatabase / queryPgDatabase instead of manageMysqlDatabase / queryMysqlDatabase.",
     "gate.useManagePg": "Use managePgDatabase for PostgreSQL operations",
     "queryMysqlDatabase.title": "Query CloudBase MySQL database status or run read-only SQL",
-    "queryMysqlDatabase.description": "Query CloudBase MySQL database information. Supports running read-only SQL, checking the MySQL provisioning result, querying MySQL task status, and getting the current instance lifecycle context. Standard getInstanceInfo/describeInstance never returns connection credentials; only getConnectionInfo passes through the raw connection/cluster payload (possibly including credentials), and only for explicit TCP migration. Prefer the SDK or runQuery/runStatement for business CRUD.",
-    "schema.query.action": "runQuery=execute read-only SQL; describeCreateResult=query CreateMySQL result; describeTaskStatus=query MySQL task status; getInstanceInfo=get lifecycle context without connection credentials; describeInstance=alias of getInstanceInfo; getConnectionInfo=passthrough raw connection/cluster payload including possible credentials (TCP migration exception only)",
+    "queryMysqlDatabase.description": "Query CloudBase MySQL database information. Supports running read-only SQL, checking the MySQL provisioning result, querying MySQL task status, getting the current instance lifecycle context, and querying instance slow queries / error logs (aligned with Manager SDK describeInstanceSlowQueries / describeInstanceErrorLogs). Standard getInstanceInfo/describeInstance never returns connection credentials; only getConnectionInfo passes through the raw connection/cluster payload (possibly including credentials), and only for explicit TCP migration. Prefer the SDK or runQuery/runStatement for business CRUD.",
+    "schema.query.action": "runQuery=execute read-only SQL; describeCreateResult=query CreateMySQL result; describeTaskStatus=query MySQL task status; getInstanceInfo=get lifecycle context without connection credentials; describeInstance=alias of getInstanceInfo; getConnectionInfo=passthrough raw connection/cluster payload including possible credentials (TCP migration exception only); describeInstanceSlowQueries=query instance slow query logs; describeInstanceErrorLogs=query instance error logs",
     "schema.query.sql": "Read-only SQL used by action=runQuery",
-    "schema.query.request": "Official request payload used by describeCreateResult/describeTaskStatus",
-    "schema.query.dbInstance": "Optional SQL database instance context for runQuery",
+    "schema.query.request": "Official request payload used by describeCreateResult/describeTaskStatus/describeInstanceSlowQueries/describeInstanceErrorLogs (may include InstanceId, etc.)",
+    "schema.query.dbInstance": "Optional SQL database instance context for runQuery / slow-query / error-log actions",
+    "schema.query.startTime": "Slow-query / error-log query start time (YYYY-MM-DD HH:mm:ss)",
+    "schema.query.endTime": "Slow-query / error-log query end time (YYYY-MM-DD HH:mm:ss)",
+    "schema.query.limit": "Max rows for slow-query / error-log results",
+    "schema.query.offset": "Pagination offset for slow-query / error-log results",
+    "schema.query.username": "Slow-query filter: username",
+    "schema.query.host": "Slow-query filter: client host",
+    "schema.query.database": "Slow-query filter: database name",
+    "schema.query.orderBy": "Sort field. Slow queries: QueryTime/LockTime/RowsExamined/RowsSent; error logs: Timestamp",
+    "schema.query.orderByType": "Sort direction: asc/desc (case-insensitive)",
+    "schema.query.sqlText": "Slow-query filter: SQL text fragment",
+    "schema.query.logLevels": "Error log level filter. Allowed values: error / warning / note",
+    "schema.query.keyWords": "Error log keyword fuzzy-search list",
+    "instanceLogs.notProvisioned": "MySQL is not provisioned yet, so instance slow/error logs cannot be queried.",
+    "instanceLogs.instanceIdRequired": "Unable to resolve CynosDB InstanceId. Call getInstanceInfo first, or pass dbInstance.instanceId / request.InstanceId.",
+    "instanceLogs.resolveInstanceId": "Query instance info first to obtain a usable InstanceId.",
+    "instanceLogs.slowQueriesSuccess": "MySQL instance slow query logs retrieved successfully.",
+    "instanceLogs.errorLogsSuccess": "MySQL instance error logs retrieved successfully.",
     "manageMysqlDatabase.title": "Manage CloudBase MySQL database lifecycle or run write SQL",
     "manageMysqlDatabase.description": "Manage CloudBase MySQL database resources. Supports provisioning MySQL, destroying MySQL, running write SQL/DDL, and initializing the database schema. Note: MySQL must be provisioned first (action=provisionMySQL, confirm=true) before runStatement or initializeSchema can run. If MySQL is not provisioned, the tool returns MYSQL_NOT_CREATED with a provisioning nextAction hint.",
     "schema.manage.action": "provisionMySQL=create MySQL instance; destroyMySQL=destroy MySQL instance; runStatement=execute write SQL or DDL; initializeSchema=run ordered schema initialization statements",
@@ -204104,6 +204148,49 @@ exports.envSetup = (0, types_js_1.defineModule)({
 });
 
 
+/***/ },
+
+/***/ 99391
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.feedback = void 0;
+const types_js_1 = __webpack_require__(89921);
+exports.feedback = (0, types_js_1.defineModule)({
+    title: "整理本次开发反馈",
+    description: "把当前这次 CloudBase 开发整理成用户可以自己提交的反馈。" +
+        "作品做出来了，用它生成案例，方便展示；开发不顺利，用它生成复盘，方便把卡点反馈给平台。" +
+        "\n\n**什么时候用**：" +
+        "\n- `channel=\"case\"`：部署或发布已经成功，用户愿意把作品放到案例墙时使用。返回案例草稿；用户确认后附上预填好的新建 issue 链接。" +
+        "\n- `channel=\"retrospective\"`：用户表示这次开发不顺利、想反馈时使用。根据本会话里真实的工具调用失败生成复盘草稿；用户确认后同样附上预填链接。" +
+        "\n\n**怎么用**：" +
+        "\n- 第一次不要传 `confirmed`。先把返回的草稿全文给用户看。" +
+        "\n- 用户明确同意后，再以 `confirmed=true` 调用。这时才会返回可打开的链接。" +
+        "\n- 本工具不会替用户提交。链接里的正文就是本次返回的 draft，不要改写成另一份再让用户提交。" +
+        "\n- 不采集对话轮次，不要编造轮次、作品名、简介或公网地址。" +
+        "\n- 国际站是英文草稿和 GitHub 链接（body 参数）。国内站是中文草稿，链接指向 CNB 上公开的 CloudBase-AI-ToolKit 仓库，正文放在模板字段 session。若页面没自动填上，把 draft 粘贴到「本次会话记录」。",
+    "schema.channel": "反馈用途：`case` 是把已完成的作品整理成案例；`retrospective` 是把这次不顺利的开发整理成复盘。",
+    "schema.confirmed": "用户是否已经看过草稿全文并明确同意提交。省略或 false 时只返回草稿、不给链接。",
+}, {
+    title: "Prepare feedback for this session",
+    description: "Turn this CloudBase session into feedback the user can submit themselves. " +
+        "Use it to showcase a finished work, or to report a session that was hard to finish." +
+        "\n\n**When to use**:" +
+        "\n- `channel=\"case\"`: the deploy or publish already succeeded and the user wants the work on the case wall. Returns a case draft, and a prefilled new-issue link after the user confirms." +
+        "\n- `channel=\"retrospective\"`: the user says this session went badly and wants to report it. Builds the retrospective from tool failures that actually happened in this session, and adds a prefilled link after confirmation." +
+        "\n\n**How to use**:" +
+        "\n- Do not pass `confirmed` on the first call. Show the returned draft to the user in full." +
+        "\n- Call again with `confirmed=true` only after the user explicitly agrees. That call returns the link." +
+        "\n- This tool does not submit the issue. The link body is the draft in this response. Do not rewrite it and ask the user to submit the rewrite." +
+        "\n- Conversation turns are not collected. Do not invent a turn count, title, summary, or public URL." +
+        "\n- International site: English draft and a GitHub link (body parameter). China site: Chinese draft and a link to the public CloudBase-AI-ToolKit repo on CNB. The draft is placed in the template field id session. If the page does not fill it, paste the draft into that field.",
+    "schema.channel": "What the feedback is for: `case` turns a finished work into a showcase entry; `retrospective` turns a difficult session into a write-up.",
+    "schema.confirmed": "Whether the user has read the full draft and agreed to submit it. Omit or pass false to return the draft only, with no link.",
+});
+
+
 /***/ },
 
 /***/ 28015
@@ -204343,8 +204430,8 @@ const types_js_1 = __webpack_require__(89921);
 exports.functions = (0, types_js_1.defineModule)({
     // ---- 工具 meta ----
     queryTitle: "查询 CloudBase 云函数",
-    queryDescription: "CloudBase 云函数统一只读入口。通过更自解释的 action 查询 CloudBase 云函数列表、函数详情、执行日志、层、触发器和代码下载地址。" +
-        "\n\n**分页说明**：`listFunctions`、`listLayers` 支持 `limit` 和 `offset` 参数。" +
+    queryDescription: "CloudBase 云函数统一只读入口。通过更自解释的 action 查询 CloudBase 云函数列表、函数详情、执行日志、层、触发器、代码下载地址、已发布版本与流量别名。" +
+        "\n\n**分页说明**：`listFunctions`、`listLayers`、`listVersionByFunction` 支持 `limit` 和 `offset` 参数。" +
         "\n- `limit`: 分页数量，默认值由后端决定" +
         "\n- `offset`: 分页偏移，从 0 开始" +
         "\n- 示例：`queryFunctions(action=\"listFunctions\", offset=10, limit=10)`" +
@@ -204352,6 +204439,7 @@ exports.functions = (0, types_js_1.defineModule)({
         "\n- 示例：`queryFunctions(action=\"listFunctionLogs\", functionName=\"my-function\")`" +
         "\n- 如需查看日志详情：`queryFunctions(action=\"getFunctionLogDetail\", requestId=\"xxx\")`" +
         "\n\n**定时任务 / cron / 定时跑**：使用 `listFunctionTriggers` 查询函数的 timer 触发器配置。" +
+        "\n\n**版本与流量路由**：`listVersionByFunction` 列出已发布版本（对齐 tcb fn list-function-versions）；`getFunctionAlias` 查看别名/灰度配置（对齐 tcb fn get-route，aliasName 默认 `$DEFAULT`）。" +
         "\n\n**层（Layer）说明**：" +
         "\n- 层为 SCF 账号级共享命名空间：不同环境创建同名层会共享同一层的版本序列；删除某版本会影响所有绑定该版本的环境的函数" +
         "\n- 创建层必须用带环境标识的唯一层名，固定格式：`{layerName}_{当前envId}`（如 `common_cloud1-d9ghadgak3edf6b36`）。不要在不同环境使用相同裸层名，创建前先 `listLayers` 查重" +
@@ -204360,8 +204448,9 @@ exports.functions = (0, types_js_1.defineModule)({
         "\n- 本工具用于查询特定 CloudBase 云函数的执行日志" +
         "\n- `queryLogs` 工具用于搜索 CLS 日志服务（跨服务日志聚合）",
     manageTitle: "管理 CloudBase 云函数",
-    manageDescription: "CloudBase 云函数统一写入口。支持创建函数、更新代码、更新配置、调用函数、管理定时跑 / 定时任务 / scheduled job 的 timer 触发器和层绑定。" +
+    manageDescription: "CloudBase 云函数统一写入口。支持创建函数、更新代码、更新配置、调用函数、发布版本、配置流量别名、管理定时跑 / 定时任务 / scheduled job 的 timer 触发器和层绑定。" +
         "如果要创建 cron 定时任务，先用 createFunction 创建函数，再用 createFunctionTrigger 创建 timer 触发器（支持7段cron表达式），deleteFunctionTrigger 删除触发器。" +
+        "版本发布：`publishVersion` 对齐 tcb fn publish-version / SDK publishVersion；灰度/切流：`updateFunctionAliasConfig` 对齐 tcb fn config-route / SDK updateFunctionAliasConfig（aliasName 默认 `$DEFAULT`）。" +
         "HTTP 云函数镜像构建部署：createFunction / updateFunctionCode 通过 func.buildStrategy 区分。" +
         "func.buildStrategy=image（已有镜像，填 func.imageConfig.imageUri）直接创建/更新 HTTP 函数；" +
         "func.buildStrategy=local（本地 Docker 构建推送）、cloud（CloudApp 云端构建）走镜像构建部署编排（需要 func.imageConfig；build 非必填，缺省仓库坐标自动补齐：namespace 默认 envId、repository 默认函数名），" +
@@ -204411,7 +204500,7 @@ exports.functions = (0, types_js_1.defineModule)({
     "opErr.default": "请检查函数名、目录结构和环境中的函数状态后重试。",
     "opErr.prefix": "[{operation}] {message}\n建议：",
     confirmRequired: "{action} 是危险操作，请显式传入 confirm=true 后再执行",
-    "cloudMode.localOnly": "{action} 在 cloud mode 下不可用，因为该操作依赖本地函数代码目录。请改用本地模式执行，或使用镜像部署（runtime=CustomImage + imageConfig）。",
+    "cloudMode.localOnly": "{action} 在 cloud mode 下不可用，因为该操作依赖本地函数代码目录。可用出路：1) 使用镜像部署（runtime=CustomImage + imageConfig）；2) 使用 ZIP 两段式部署：先 queryFunctions action=getFunctionUploadUrl 获取预签名上传地址，PUT 代码 zip 后通过 manageFunctions 的 code 入参部署（阶段 B 同样不依赖本地目录）。",
     "cloudMode.contentPathUnsupported": "createLayerVersion 在 cloud mode 下不支持 contentPath，本地文件内容请改为 base64Content 或改用本地模式执行。",
     offsetLimitTooLarge: "offset+limit 不能大于 10000",
     startTimeInvalid: "startTime 格式错误: \"{value}\"。必须使用 YYYY-MM-DD HH:mm:ss 格式（如 2024-01-01 00:00:00）",
@@ -204424,6 +204513,8 @@ exports.functions = (0, types_js_1.defineModule)({
     "deployStatus.cloudMode": "{action} 在 cloud mode 下不可用：异步部署任务只由 buildStrategy=cloud/local 的真实部署创建，而这两种策略的真实执行在 cloud mode 下都不支持（需要读取本地构建上下文或本地 Docker），因此不会存在任何 taskId。buildStrategy=image 走同步部署，直接在 manageFunctions 的返回里拿结果，也不需要查询部署状态。如需异步镜像构建部署，请改用本地 MCP 模式。",
     deployTaskNotFound: "未找到部署任务 {taskId}；部署任务不存在，可能已过期、不属于当前环境 {envId}，或 MCP Server 已重启（任务仅保存在 MCP 进程内存中）。",
     unsupportedAction: "不支持的操作类型: {action}",
+    storageMissing: "当前环境没有可用的对象存储桶（DescribeEnvs 未返回 Storages），无法使用 COS 两段式部署。请检查环境存储配置，或改用本地模式部署。共享存储桶（ExternalStorage）环境同样不支持该通道。",
+    credentialMissing: "当前凭据缺少 SecretId/SecretKey（如 IDE 代理模式），无法本地铸造 COS 预签名上传地址。请改用本地模式或包含永久密钥/临时密钥的登录方式。",
     // ---- nextActions reasons ----
     "reason.continuePolling": "继续查询云函数部署状态",
     "reason.getDetail": "查看单个函数详情",
@@ -204462,8 +204553,15 @@ exports.functions = (0, types_js_1.defineModule)({
     "reason.imageFnReady": "确认镜像函数已就绪（Active）",
     "reason.imageUpdateReady": "确认镜像更新后函数已就绪（Active）",
     "reason.imageNextIteration": "后续迭代只需用新镜像 tag 调用 updateFunctionCode 更新镜像",
+    "reason.cosCreate": "把 PUT 好的代码 zip 通过 code 入参部署为函数（两段式阶段 B）",
     "reason.imageGatewayRoute": "如需通过 URL 访问镜像 HTTP 函数，显式创建 Domain/Route 访问入口并传 type=\"HTTP\"（映射 WEB_SCF）",
     "reason.latestConfig": "确认最新函数配置",
+    "reason.publishVersion": "发布函数新版本（对齐 tcb fn publish-version）",
+    "reason.getFunctionAlias": "查看函数流量别名配置（对齐 tcb fn get-route）",
+    "reason.updateFunctionAlias": "更新函数流量别名/灰度路由（对齐 tcb fn config-route）",
+    "reason.listVersions": "查看函数已发布版本列表（对齐 tcb fn list-function-versions）",
+    "reason.routeTraffic": "将流量切到新版本或配置灰度权重",
+    "reason.confirmAlias": "确认别名与流量配置已生效",
     // ---- 成功 message ----
     listedFunctions: "已获取 {count} 个云函数",
     gotFunctionDetail: "已获取函数 {fnName} 的详情",
@@ -204475,8 +204573,15 @@ exports.functions = (0, types_js_1.defineModule)({
     gotLayerVersionDetail: "已获取层 {layerName} 版本 {layerVersion} 的详情",
     gotFunctionTriggers: "已获取函数 {fnName} 的触发器列表",
     gotDownloadUrl: "已获取函数 {fnName} 的代码下载链接",
+    gotUploadUrl: "已生成函数代码包上传地址（{seconds} 秒内有效）。下一步：PUT 代码 zip 到 uploadUrl（uploadHeaders 非空时须随请求携带），再调用 manageFunctions createFunction/updateFunctionCode 并传入 code 三元组（cosBucketName/cosObjectName/cosBucketRegion）完成部署",
+    gotFunctionVersions: "已获取函数 {fnName} 的版本列表",
+    gotFunctionAlias: "已获取函数 {fnName} 的别名 {aliasName}",
+    publishedVersion: "已发布函数 {fnName} 的新版本 {version}",
+    updatedFunctionAlias: "已更新函数 {fnName} 别名 {aliasName}（主版本 {version}）",
     createdHttpFunctionMessage: "已创建 HTTP 函数 {fnName}。如果后续需要通过 URL 访问，请显式调用 manageGateway(action=\"createRoute\")，并把 upstreamResourceType=\"WEB_SCF\" 一起传入，再按实际路径和鉴权需求创建访问入口。评测或其他外部调用方可能会以匿名身份访问，而且失败后不一定会把 EXCEED_AUTHORITY 再反馈给 AI；交付前请主动确认访问路径和函数安全规则，若已出现 EXCEED_AUTHORITY，请先调用 queryPermissions(action=\"getResourcePermission\", resourceType=\"function\", resourceId=\"{fnName}\") 查看当前规则，再按需要使用 managePermissions(action=\"updateResourcePermission\") 调整权限。",
     createdFunction: "已创建函数 {fnName}",
+    cosCreatedMessage: "已基于环境 COS 桶中的代码包（deployMode=cos）创建函数 {fnName}。部署后可用 queryFunctions(action=\"getFunctionDetail\") 确认函数已就绪。",
+    cosUpdatedMessage: "已用环境 COS 桶中的新代码包（deployMode=cos）更新函数 {fnName} 的代码。部署后可用 queryFunctions(action=\"getFunctionDetail\") 确认函数已就绪（Active）。",
     imageCreatedMessage: "已基于镜像 {imageUri} 创建 HTTP 函数 {fnName}。请确认 TCR、SCF 与构建管道处于同一地域；如需通过 URL 访问，请显式调用 manageGateway(action=\"createRoute\", upstreamResourceType=\"WEB_SCF\") 并按需调整函数安全规则。部署后可用 queryFunctions(action=\"getFunctionDetail\") 确认函数已就绪。",
     imageUpdatedMessage: "已将函数 {fnName} 的镜像更新为 {imageUri}。部署后可用 queryFunctions(action=\"getFunctionDetail\") 确认函数已就绪（Active）。",
     updatedCode: "已更新函数 {fnName} 的代码",
@@ -204542,12 +204647,12 @@ exports.functions = (0, types_js_1.defineModule)({
     "schema.create.layers": "Layer 配置",
     "schema.manageLayer.name": "层名称",
     "schema.manageLayer.version": "层版本号",
-    "schema.query.action": "只读操作类型：\n- `listFunctions`: 列出所有 CloudBase 云函数\n- `getFunctionDetail`: 获取 CloudBase 云函数详情（需要 functionName）\n- `listFunctionLogs`: 查询 CloudBase 云函数执行日志（需要 functionName）\n- `getFunctionLogDetail`: 获取日志详情（需要 requestId）\n- `listFunctionLayers`: 列出函数绑定的层\n- `listLayers`: 列出所有层（账号级视图，含其他环境创建的层）\n- `listLayerVersions`: 列出层的版本（注意：是 Versions 不是 Version；账号级视图）\n- `getLayerVersionDetail`: 获取层版本详情（账号级视图）\n- `listFunctionTriggers`: 列出函数触发器（用于查看定时任务 / cron / timer 配置）\n- `getFunctionDownloadUrl`: 获取函数代码下载地址\n- `getFunctionDeployStatus`: 按 taskId 查询异步部署状态、阶段进度和最终结果。返回 data.build（构建子状态）、data.deploy（部署子状态）、data.progress（阶段事件）；status=running 时 data.result 与 data.error 一律为 null，不得报告部署完成。调用方必须持续轮询直到 status=succeeded/failed；status=expired 表示任务超过最长保留时间（2 小时）被终结，云端可能仍在部署，需用 getFunctionDetail 确认。任务只保存在 MCP 进程内存中，过期或 MCP Server 重启后返回 errorCode=DEPLOY_TASK_NOT_FOUND；任务按环境隔离，只能查到当前环境自己发起的部署。cloud mode 下本 action 不可用：异步任务只由 buildStrategy=cloud/local 的真实部署创建，而这两种策略在 cloud mode 下都不支持真实执行，image 策略则走同步部署不产生 taskId。",
-    "schema.query.functionName": "CloudBase 云函数名称。`getFunctionDetail`、`listFunctionLogs`、`listFunctionLayers`、`listFunctionTriggers`、`getFunctionDownloadUrl` 时必填",
+    "schema.query.action": "只读操作类型：\n- `listFunctions`: 列出所有 CloudBase 云函数\n- `getFunctionDetail`: 获取 CloudBase 云函数详情（需要 functionName）\n- `listFunctionLogs`: 查询 CloudBase 云函数执行日志（需要 functionName）\n- `getFunctionLogDetail`: 获取日志详情（需要 requestId）\n- `listFunctionLayers`: 列出函数绑定的层\n- `listLayers`: 列出所有层（账号级视图，含其他环境创建的层）\n- `listLayerVersions`: 列出层的版本（注意：是 Versions 不是 Version；账号级视图）\n- `getLayerVersionDetail`: 获取层版本详情（账号级视图）\n- `listFunctionTriggers`: 列出函数触发器（用于查看定时任务 / cron / timer 配置）\n- `getFunctionDownloadUrl`: 获取函数代码下载地址\n- `getFunctionDeployStatus`: 按 taskId 查询异步部署状态、阶段进度和最终结果。返回 data.build（构建子状态）、data.deploy（部署子状态）、data.progress（阶段事件）；status=running 时 data.result 与 data.error 一律为 null，不得报告部署完成。调用方必须持续轮询直到 status=succeeded/failed；status=expired 表示任务超过最长保留时间（2 小时）被终结，云端可能仍在部署，需用 getFunctionDetail 确认。任务只保存在 MCP 进程内存中，过期或 MCP Server 重启后返回 errorCode=DEPLOY_TASK_NOT_FOUND；任务按环境隔离，只能查到当前环境自己发起的部署。cloud mode 下本 action 不可用：异步任务只由 buildStrategy=cloud/local 的真实部署创建，而这两种策略在 cloud mode 下都不支持真实执行，image 策略则走同步部署不产生 taskId。\n- `listVersionByFunction`: 列出函数已发布版本（对齐 tcb fn list-function-versions / SDK listVersionByFunction；需要 functionName）\n- `getFunctionAlias`: 查询函数别名与流量路由（对齐 tcb fn get-route / SDK getFunctionAlias；需要 functionName；aliasName 默认 $DEFAULT）\n- `getFunctionUploadUrl`: 获取函数代码包的 COS 预签名上传地址（ZIP 两段式部署阶段 A）：PUT 代码 zip 到 uploadUrl（uploadHeaders 非空时须随请求携带对应请求头），再调用 manageFunctions 的 createFunction/updateFunctionCode 并传 code 三元组（阶段 B）。functionName 可选，仅用于生成上传对象 key。返回的 uploadUrl 含凭据签名，不得写入日志或持久化",
+    "schema.query.functionName": "CloudBase 云函数名称。`getFunctionDetail`、`listFunctionLogs`、`listFunctionLayers`、`listFunctionTriggers`、`getFunctionDownloadUrl`、`listVersionByFunction`、`getFunctionAlias` 时必填；`getFunctionUploadUrl` 可选（仅用于生成上传对象 key）",
     "schema.query.limit": "分页数量（limit）。列表类 action 可选，默认值由后端决定",
     "schema.query.offset": "分页偏移（offset）。列表类 action 可选，默认 0",
     "schema.query.codeSecret": "代码保护密钥，用于解密函数代码",
-    "schema.query.revealEnvValues": "getFunctionDetail / listFunctionTriggers 时是否返回环境变量明文值。默认 false：Value 脱敏为 ***，仅保留 Key 与 ValueLength，足以确认配置了哪些变量及变更是否生效；true 时返回明文，敏感变量会进入模型上下文，谨慎使用。如需查看明文，建议优先使用控制台或 CLI",
+    "schema.query.revealEnvValues": "getFunctionDetail / listFunctionTriggers / listFunctionLayers 时是否返回环境变量明文值。默认 false：Value 脱敏为 ***，仅保留 Key 与 ValueLength，足以确认配置了哪些变量及变更是否生效；true 时返回明文，敏感变量会进入模型上下文，谨慎使用。如需查看明文，建议优先使用控制台或 CLI",
     "schema.query.startTime": "日志查询开始时间，格式必须为 YYYY-MM-DD HH:mm:ss（如 2024-01-01 00:00:00）。与 endTime 间隔不能超过一天。不传时默认查询最近一天",
     "schema.query.endTime": "日志查询结束时间，格式必须为 YYYY-MM-DD HH:mm:ss（如 2024-01-01 23:59:59）。与 startTime 间隔不能超过一天。不传时默认为当前时间",
     "schema.query.requestId": "日志请求 ID。`getFunctionLogDetail` 操作必填，可从 `listFunctionLogs` 结果中获取",
@@ -204557,12 +204662,19 @@ exports.functions = (0, types_js_1.defineModule)({
     "schema.query.layerName": "层名称。`listLayerVersions`、`getLayerVersionDetail` 操作必填。层为账号级共享命名空间；推荐固定格式 `{layerName}_{当前envId}`（如 common_cloud1-d9ghadgak3edf6b36）",
     "schema.query.layerVersion": "层版本号。`getLayerVersionDetail` 操作必填",
     "schema.query.taskId": "`getFunctionDeployStatus` 操作时的异步部署任务 ID（由 manageFunctions 的 wait=false 返回）。任务仅保存在当前 MCP 进程内存中：终态任务保留约 30 分钟，运行中任务最长保留 2 小时。",
-    "schema.manage.action": "写操作类型，例如 createFunction、updateFunctionCode、incrementalDeployFunction、invokeFunction、deleteFunction、createFunctionTrigger（定时任务 / cron / timer）、deleteFunctionTrigger、createLayerVersion、deleteLayerVersion、attachLayer、detachLayer、updateFunctionLayers。层名推荐固定格式 `{layerName}_{当前envId}`（如 common_cloud1-d9ghadgak3edf6b36）",
+    "schema.query.order": "`listVersionByFunction` 排序方向，如 ASC / DESC",
+    "schema.query.orderBy": "`listVersionByFunction` 排序字段，如 AddTime / ModTime",
+    "schema.query.aliasName": "`getFunctionAlias` 的别名名称。省略时默认 `$DEFAULT`（与 tcb fn get-route 一致）",
+    "schema.manage.action": "写操作类型，例如 createFunction、updateFunctionCode、incrementalDeployFunction、invokeFunction、deleteFunction、createFunctionTrigger（定时任务 / cron / timer）、deleteFunctionTrigger、createLayerVersion、deleteLayerVersion、attachLayer、detachLayer、updateFunctionLayers、publishVersion（发布新版本，对齐 tcb fn publish-version）、updateFunctionAliasConfig（更新别名/流量路由，对齐 tcb fn config-route）。层名推荐固定格式 `{layerName}_{当前envId}`（如 common_cloud1-d9ghadgak3edf6b36）",
     "schema.manage.func": "createFunction / updateFunctionCode 的函数配置。镜像/构建部署通过 func.buildStrategy（zip/cloud/local/image）区分，镜像相关字段收敛在 func.imageConfig 命名空间下。",
     "schema.manage.functionRootPath": "创建或更新函数代码时默认推荐的本地目录方式。必须是直接包含函数文件夹的目录绝对路径（如 /abs/path/cloudfunctions 或 /abs/path/functions），不要传项目根目录（如 /abs/path），也不要传到函数名子目录（如 /abs/path/cloudfunctions/hello）。本地应按 cloudfunctions/<functionName>/index.js 或 functions/<functionName>/index.js 布局，此参数传 cloudfunctions 或 functions 目录的绝对路径。SDK 会自动拼接函数名子目录，无需预先压缩 zip 或 base64 编码。",
     "schema.manage.force": "createFunction 时是否覆盖",
-    "schema.manage.functionName": "目标函数名称（顶层）。updateFunctionCode / updateFunctionConfig / invokeFunction 等 action 使用此字段。不要只写在 func.name：createFunction 用 func.name，其它 action 用顶层 functionName。若误传 func.name，也会被识别为 functionName。",
+    "schema.manage.functionName": "目标函数名称（顶层）。updateFunctionCode / updateFunctionConfig / invokeFunction / publishVersion / updateFunctionAliasConfig 等 action 使用此字段。不要只写在 func.name：createFunction 用 func.name，其它 action 用顶层 functionName。若误传 func.name，也会被识别为 functionName。",
     "schema.manage.zipFile": "仅兼容特殊场景：预先准备好的代码包 base64 编码。普通 createFunction/updateFunctionCode 默认不要先压缩 zip，优先使用 functionRootPath。",
+    "schema.manage.code": "ZIP 两段式部署阶段 B：代码包已通过 queryFunctions action=getFunctionUploadUrl 上传到环境 COS 桶。三元组（cosBucketName/cosObjectName/cosBucketRegion）直接使用 getFunctionUploadUrl 返回值原样透传。传入 code 后 createFunction/updateFunctionCode 不再读取本地目录（functionRootPath/zipFile 均不需要），默认不触发云端依赖安装（可用 func.installDependency 覆盖）。",
+    "schema.code.cosBucketName": "环境存储桶短名（不含 -appid 后缀），直接使用 getFunctionUploadUrl 返回的 cosBucketName，不要自填",
+    "schema.code.cosObjectName": "上传对象 key，直接使用 getFunctionUploadUrl 返回的 cosObjectName",
+    "schema.code.cosBucketRegion": "存储桶地域，省略时自动使用当前环境存储桶地域",
     "schema.manage.handler": "函数入口",
     "schema.manage.timeout": "配置更新时的超时时间",
     "schema.manage.envVariables": "配置更新时要合并的环境变量。若含 DATABASE_URL / MYSQL_* / POSTGRES_* / REDIS_* 等 TCP 连库变量，必须同时提供真实 vpc（或函数已绑定完整 VPC）。禁止猜测 vpcId/subnetId。",
@@ -204575,7 +204687,7 @@ exports.functions = (0, types_js_1.defineModule)({
     "schema.manage.contentPath": "层内容路径，可为目录或 ZIP 文件",
     "schema.manage.base64Content": "层内容的 base64 编码",
     "schema.manage.runtimes": "层适用的运行时列表",
-    "schema.manage.description": "层版本描述",
+    "schema.manage.description": "描述信息。createLayerVersion 时为层版本描述；publishVersion / updateFunctionAliasConfig 时为版本或别名描述",
     "schema.manage.licenseInfo": "层许可证信息",
     "schema.manage.layers": "updateFunctionLayers 的目标层列表，顺序即最终顺序",
     "schema.manage.codeSecret": "层绑定时的代码保护密钥",
@@ -204584,11 +204696,22 @@ exports.functions = (0, types_js_1.defineModule)({
     "schema.manage.autoGrant": "镜像部署是否允许 manager-node 自动补齐固定白名单 CAM 策略。默认 false；仅在明确确认权限变更时设为 true。",
     "schema.manage.confirm": "危险操作确认开关。deleteFunction、deleteFunctionTrigger、deleteLayerVersion、detachLayer 等删除类操作以及镜像构建部署（func.buildStrategy=cloud/local）真实执行需要显式传入 confirm=true",
     "schema.manage.incrementalFile": "incrementalDeployFunction 增量部署时的变更文件路径",
+    "schema.manage.aliasName": "`updateFunctionAliasConfig` 的别名名称。省略时默认 `$DEFAULT`（与 tcb fn config-route 一致）",
+    "schema.manage.functionVersion": "`updateFunctionAliasConfig` 的主版本。可为具体版本号或 `$LATEST`",
+    "schema.manage.routingConfig": "`updateFunctionAliasConfig` 的流量路由配置。AdditionalVersionWeights 用于灰度权重；AddtionVersionMatchs 为 SCF/SDK 历史字段名（含拼写）",
+    "schema.routing.version": "附加流量版本号",
+    "schema.routing.weight": "附加流量权重（0-1 或百分比，按 SCF 约定）",
+    "schema.routing.matchVersion": "匹配规则指向的版本号",
+    "schema.routing.matchKey": "匹配规则的 Header/Query Key",
+    "schema.routing.matchMethod": "匹配方法，如 Exact / Regex",
+    "schema.routing.matchExpression": "匹配表达式",
+    "schema.routing.additionalWeights": "附加版本权重列表（灰度发布）",
+    "schema.routing.additionalMatches": "附加版本匹配规则列表（字段名保持 SCF AddtionVersionMatchs）",
 }, {
     // ---- Tool meta ----
     queryTitle: "Query CloudBase Cloud Functions",
-    queryDescription: "Unified read-only entry for CloudBase cloud functions. Query function lists, function details, execution logs, layers, triggers, and code download URLs through self-explanatory actions." +
-        "\n\n**Pagination**: `listFunctions` and `listLayers` support `limit` and `offset` parameters." +
+    queryDescription: "Unified read-only entry for CloudBase cloud functions. Query function lists, function details, execution logs, layers, triggers, code download URLs, published versions, and traffic aliases through self-explanatory actions." +
+        "\n\n**Pagination**: `listFunctions`, `listLayers`, and `listVersionByFunction` support `limit` and `offset` parameters." +
         "\n- `limit`: page size, the default is decided by the backend" +
         "\n- `offset`: pagination offset, starting from 0" +
         "\n- Example: `queryFunctions(action=\"listFunctions\", offset=10, limit=10)`" +
@@ -204596,6 +204719,7 @@ exports.functions = (0, types_js_1.defineModule)({
         "\n- Example: `queryFunctions(action=\"listFunctionLogs\", functionName=\"my-function\")`" +
         "\n- To view log details: `queryFunctions(action=\"getFunctionLogDetail\", requestId=\"xxx\")`" +
         "\n\n**Scheduled tasks / cron / timers**: use `listFunctionTriggers` to query a function's timer trigger configuration." +
+        "\n\n**Versions and traffic routing**: `listVersionByFunction` lists published versions (aligns with tcb fn list-function-versions); `getFunctionAlias` views alias / canary config (aligns with tcb fn get-route; aliasName defaults to `$DEFAULT`)." +
         "\n\n**Layers**:" +
         "\n- Layers are account-level shared namespaces in SCF: same-named layers created in different environments share one version sequence; deleting a version affects functions in every environment bound to it" +
         "\n- When creating a layer, use a unique name with the environment suffix, in the fixed format `{layerName}_{current envId}` (e.g. `common_cloud1-d9ghadgak3edf6b36`). Do not reuse the same bare layer name across environments; check with `listLayers` before creating" +
@@ -204604,8 +204728,9 @@ exports.functions = (0, types_js_1.defineModule)({
         "\n- This tool queries execution logs of a specific CloudBase cloud function" +
         "\n- The `queryLogs` tool searches the CLS log service (cross-service log aggregation)",
     manageTitle: "Manage CloudBase Cloud Functions",
-    manageDescription: "Unified write entry for CloudBase cloud functions. Supports creating functions, updating code, updating configuration, invoking functions, and managing timer triggers (scheduled jobs / cron) and layer bindings." +
+    manageDescription: "Unified write entry for CloudBase cloud functions. Supports creating functions, updating code, updating configuration, invoking functions, publishing versions, configuring traffic aliases, and managing timer triggers (scheduled jobs / cron) and layer bindings." +
         " To create a cron scheduled task, first create the function with createFunction, then create the timer trigger with createFunctionTrigger (7-field cron expression supported), and delete triggers with deleteFunctionTrigger." +
+        " Version publish: `publishVersion` aligns with tcb fn publish-version / SDK publishVersion; canary / traffic shift: `updateFunctionAliasConfig` aligns with tcb fn config-route / SDK updateFunctionAliasConfig (aliasName defaults to `$DEFAULT`)." +
         " HTTP function image build & deploy: createFunction / updateFunctionCode distinguish via func.buildStrategy." +
         " func.buildStrategy=image (existing image, set func.imageConfig.imageUri) creates/updates the HTTP function directly;" +
         " func.buildStrategy=local (local Docker build & push) and cloud (CloudApp cloud build) go through the image build/deploy orchestration (func.imageConfig required; build optional — missing registry coordinates are auto-filled: namespace defaults to envId, repository defaults to the function name)," +
@@ -204655,7 +204780,7 @@ exports.functions = (0, types_js_1.defineModule)({
     "opErr.default": "Please check the function name, directory structure, and the function status in the environment, then retry.",
     "opErr.prefix": "[{operation}] {message}\nSuggestions: ",
     confirmRequired: "{action} is a dangerous operation; pass confirm=true explicitly before executing",
-    "cloudMode.localOnly": "{action} is unavailable in cloud mode because the operation depends on a local function code directory. Run it in local mode, or use image deployment (runtime=CustomImage + imageConfig).",
+    "cloudMode.localOnly": "{action} is unavailable in cloud mode because the operation depends on a local function code directory. Options: 1) use image deployment (runtime=CustomImage + imageConfig); 2) use two-phase ZIP deployment: first call queryFunctions action=getFunctionUploadUrl to get a presigned upload URL, PUT the code zip, then deploy via the manageFunctions code parameter (phase B also needs no local directory).",
     "cloudMode.contentPathUnsupported": "createLayerVersion does not support contentPath in cloud mode; switch local file content to base64Content or run in local mode.",
     offsetLimitTooLarge: "offset+limit must not be greater than 10000",
     startTimeInvalid: "Invalid startTime: \"{value}\". It must use the YYYY-MM-DD HH:mm:ss format (e.g. 2024-01-01 00:00:00)",
@@ -204668,6 +204793,8 @@ exports.functions = (0, types_js_1.defineModule)({
     "deployStatus.cloudMode": "{action} is unavailable in cloud mode: async deployment tasks are only created by real deployments with buildStrategy=cloud/local, and real execution of both strategies is unsupported in cloud mode (they need the local build context or local Docker), so no taskId can exist. buildStrategy=image uses synchronous deployment and returns the result directly from manageFunctions, so no deployment status query is needed. For async image build deployment, switch to local MCP mode.",
     deployTaskNotFound: "Deployment task {taskId} not found; the task does not exist — it may have expired, belong to a different environment than {envId}, or the MCP Server was restarted (tasks are only kept in MCP process memory).",
     unsupportedAction: "Unsupported action: {action}",
+    storageMissing: "The current environment has no usable object storage bucket (DescribeEnvs returned no Storages), so COS two-phase deployment is unavailable. Check the environment storage configuration, or deploy in local mode. Environments with a shared bucket (ExternalStorage) are not supported either.",
+    credentialMissing: "The current credential lacks SecretId/SecretKey (e.g. IDE proxy mode), so a COS presigned upload URL cannot be minted locally. Use local mode or a login method with permanent/temporary keys.",
     // ---- nextActions reasons ----
     "reason.continuePolling": "Keep polling the cloud function deployment status",
     "reason.getDetail": "View details of a single function",
@@ -204706,8 +204833,15 @@ exports.functions = (0, types_js_1.defineModule)({
     "reason.imageFnReady": "Confirm the image function is ready (Active)",
     "reason.imageUpdateReady": "Confirm the function is ready (Active) after the image update",
     "reason.imageNextIteration": "For later iterations, just call updateFunctionCode with the new image tag to update the image",
+    "reason.cosCreate": "Deploy the uploaded code zip as a function via the code parameter (two-phase deployment phase B)",
     "reason.imageGatewayRoute": "To access the image HTTP function via URL, explicitly create a Domain/Route access entry and pass type=\"HTTP\" (mapped to WEB_SCF)",
     "reason.latestConfig": "Confirm the latest function configuration",
+    "reason.publishVersion": "Publish a new function version (aligns with tcb fn publish-version)",
+    "reason.getFunctionAlias": "View function traffic alias config (aligns with tcb fn get-route)",
+    "reason.updateFunctionAlias": "Update function traffic alias / canary routing (aligns with tcb fn config-route)",
+    "reason.listVersions": "List published function versions (aligns with tcb fn list-function-versions)",
+    "reason.routeTraffic": "Shift traffic to the new version or configure canary weights",
+    "reason.confirmAlias": "Confirm the alias and traffic config have taken effect",
     // ---- Success messages ----
     listedFunctions: "Retrieved {count} cloud functions",
     gotFunctionDetail: "Retrieved details of function {fnName}",
@@ -204719,8 +204853,15 @@ exports.functions = (0, types_js_1.defineModule)({
     gotLayerVersionDetail: "Retrieved details of layer {layerName} version {layerVersion}",
     gotFunctionTriggers: "Retrieved the trigger list of function {fnName}",
     gotDownloadUrl: "Retrieved the code download URL of function {fnName}",
+    gotUploadUrl: "Generated the code package upload URL (valid for {seconds} seconds). Next: PUT the code zip to uploadUrl (include the uploadHeaders when non-empty), then call manageFunctions createFunction/updateFunctionCode with the code triplet (cosBucketName/cosObjectName/cosBucketRegion) to deploy",
+    gotFunctionVersions: "Retrieved the version list of function {fnName}",
+    gotFunctionAlias: "Retrieved alias {aliasName} of function {fnName}",
+    publishedVersion: "Published new version {version} of function {fnName}",
+    updatedFunctionAlias: "Updated alias {aliasName} of function {fnName} (primary version {version})",
     createdHttpFunctionMessage: "Created HTTP function {fnName} from the image. If URL access is needed later, explicitly call manageGateway(action=\"createRoute\") with upstreamResourceType=\"WEB_SCF\", then create the access entry according to the actual path and auth requirements. Evaluators or other external callers may access anonymously, and failures may not feed EXCEED_AUTHORITY back to the AI; before delivery, proactively confirm the access path and the function security rules. If EXCEED_AUTHORITY has already appeared, first call queryPermissions(action=\"getResourcePermission\", resourceType=\"function\", resourceId=\"{fnName}\") to view the current rules, then adjust permissions with managePermissions(action=\"updateResourcePermission\") as needed.",
     createdFunction: "Created function {fnName}",
+    cosCreatedMessage: "Created function {fnName} from the code package in the environment COS bucket (deployMode=cos). Use queryFunctions(action=\"getFunctionDetail\") after deployment to confirm the function is ready.",
+    cosUpdatedMessage: "Updated the code of function {fnName} with the new package in the environment COS bucket (deployMode=cos). Use queryFunctions(action=\"getFunctionDetail\") after deployment to confirm the function is ready (Active).",
     imageCreatedMessage: "Created HTTP function {fnName} from image {imageUri}. Please confirm TCR, SCF, and the build pipeline are in the same region; for URL access, explicitly call manageGateway(action=\"createRoute\", upstreamResourceType=\"WEB_SCF\") and adjust the function security rules as needed. After deployment, use queryFunctions(action=\"getFunctionDetail\") to confirm the function is ready.",
     imageUpdatedMessage: "Updated the image of function {fnName} to {imageUri}. After deployment, use queryFunctions(action=\"getFunctionDetail\") to confirm the function is ready (Active).",
     updatedCode: "Updated the code of function {fnName}",
@@ -204786,12 +204927,12 @@ exports.functions = (0, types_js_1.defineModule)({
     "schema.create.layers": "Layer configuration",
     "schema.manageLayer.name": "Layer name",
     "schema.manageLayer.version": "Layer version number",
-    "schema.query.action": "Read-only action type:\n- `listFunctions`: list all CloudBase cloud functions\n- `getFunctionDetail`: get function details (requires functionName)\n- `listFunctionLogs`: query function execution logs (requires functionName)\n- `getFunctionLogDetail`: get log details (requires requestId)\n- `listFunctionLayers`: list layers bound to a function\n- `listLayers`: list all layers (account-level view, including layers from other environments)\n- `listLayerVersions`: list layer versions (Versions, not Version; account-level view)\n- `getLayerVersionDetail`: get layer version details (account-level view)\n- `listFunctionTriggers`: list function triggers (scheduled task / cron / timer configuration)\n- `getFunctionDownloadUrl`: get the function code download URL\n- `getFunctionDeployStatus`: query async deployment status, stage progress, and final result by taskId. Returns data.build, data.deploy, and data.progress. While status=running, data.result and data.error are null and deployment must not be reported as complete. Keep polling until status=succeeded/failed. status=expired means the task exceeded the 2-hour retention limit; cloud deployment may still be running, so confirm with getFunctionDetail. Tasks exist only in MCP process memory; expired tasks or a restarted MCP Server return errorCode=DEPLOY_TASK_NOT_FOUND. Tasks are isolated by environment. This action is unavailable in cloud mode because real cloud/local builds cannot run there, while image deployment is synchronous and creates no taskId.",
-    "schema.query.functionName": "CloudBase cloud function name. Required for `getFunctionDetail`, `listFunctionLogs`, `listFunctionLayers`, `listFunctionTriggers`, and `getFunctionDownloadUrl`.",
+    "schema.query.action": "Read-only action type:\n- `listFunctions`: list all CloudBase cloud functions\n- `getFunctionDetail`: get function details (requires functionName)\n- `listFunctionLogs`: query function execution logs (requires functionName)\n- `getFunctionLogDetail`: get log details (requires requestId)\n- `listFunctionLayers`: list layers bound to a function\n- `listLayers`: list all layers (account-level view, including layers from other environments)\n- `listLayerVersions`: list layer versions (Versions, not Version; account-level view)\n- `getLayerVersionDetail`: get layer version details (account-level view)\n- `listFunctionTriggers`: list function triggers (scheduled task / cron / timer configuration)\n- `getFunctionDownloadUrl`: get the function code download URL\n- `getFunctionDeployStatus`: query async deployment status, stage progress, and final result by taskId. Returns data.build, data.deploy, and data.progress. While status=running, data.result and data.error are null and deployment must not be reported as complete. Keep polling until status=succeeded/failed. status=expired means the task exceeded the 2-hour retention limit; cloud deployment may still be running, so confirm with getFunctionDetail. Tasks exist only in MCP process memory; expired tasks or a restarted MCP Server return errorCode=DEPLOY_TASK_NOT_FOUND. Tasks are isolated by environment. This action is unavailable in cloud mode because real cloud/local builds cannot run there, while image deployment is synchronous and creates no taskId.\n- `listVersionByFunction`: list published function versions (aligns with tcb fn list-function-versions / SDK listVersionByFunction; requires functionName)\n- `getFunctionAlias`: get function alias and traffic routing (aligns with tcb fn get-route / SDK getFunctionAlias; requires functionName; aliasName defaults to $DEFAULT)\n- `getFunctionUploadUrl`: get a COS presigned upload URL for a function code package (two-phase ZIP deployment phase A): PUT the code zip to uploadUrl (include the corresponding request headers when uploadHeaders is non-empty), then call manageFunctions createFunction/updateFunctionCode with the code triplet (phase B). functionName is optional and only shapes the upload object key. The uploadUrl carries credential-bound signatures; never log or persist it",
+    "schema.query.functionName": "CloudBase cloud function name. Required for `getFunctionDetail`, `listFunctionLogs`, `listFunctionLayers`, `listFunctionTriggers`, `getFunctionDownloadUrl`, `listVersionByFunction`, and `getFunctionAlias`. Optional for `getFunctionUploadUrl` (only used to generate the upload object key).",
     "schema.query.limit": "Page size (limit). Optional for list actions; the backend determines the default.",
     "schema.query.offset": "Pagination offset. Optional for list actions; defaults to 0.",
     "schema.query.codeSecret": "Code protection secret used to decrypt function code.",
-    "schema.query.revealEnvValues": "Whether `getFunctionDetail` / `listFunctionTriggers` returns plaintext environment variable values. Defaults to false: Value is masked as ***, while Key and ValueLength remain, which is sufficient to verify configured variables and changes. true returns plaintext and may expose secrets to the model context; use cautiously. Prefer the console or CLI for plaintext values.",
+    "schema.query.revealEnvValues": "Whether `getFunctionDetail` / `listFunctionTriggers` / `listFunctionLayers` returns plaintext environment variable values. Defaults to false: Value is masked as ***, while Key and ValueLength remain, which is sufficient to verify configured variables and changes. true returns plaintext and may expose secrets to the model context; use cautiously. Prefer the console or CLI for plaintext values.",
     "schema.query.startTime": "Log query start time in YYYY-MM-DD HH:mm:ss format (for example, 2024-01-01 00:00:00). The interval to endTime must not exceed one day. Defaults to the most recent day when omitted.",
     "schema.query.endTime": "Log query end time in YYYY-MM-DD HH:mm:ss format (for example, 2024-01-01 23:59:59). The interval from startTime must not exceed one day. Defaults to the current time when omitted.",
     "schema.query.requestId": "Log request ID. Required for `getFunctionLogDetail`; obtain it from `listFunctionLogs`.",
@@ -204801,12 +204942,19 @@ exports.functions = (0, types_js_1.defineModule)({
     "schema.query.layerName": "Layer name. Required for `listLayerVersions` and `getLayerVersionDetail`. Layers use an account-level shared namespace; use the fixed format `{layerName}_{current envId}` (for example, common_cloud1-d9ghadgak3edf6b36).",
     "schema.query.layerVersion": "Layer version number. Required for `getLayerVersionDetail`.",
     "schema.query.taskId": "Async deployment task ID for `getFunctionDeployStatus` (returned by manageFunctions with wait=false). Tasks exist only in current MCP process memory: terminal tasks are retained for about 30 minutes and running tasks for at most 2 hours.",
-    "schema.manage.action": "Write action type, such as createFunction, updateFunctionCode, incrementalDeployFunction, invokeFunction, deleteFunction, createFunctionTrigger (scheduled task / cron / timer), deleteFunctionTrigger, createLayerVersion, deleteLayerVersion, attachLayer, detachLayer, or updateFunctionLayers. Use the fixed layer naming format `{layerName}_{current envId}` (for example, common_cloud1-d9ghadgak3edf6b36).",
+    "schema.query.order": "Sort direction for `listVersionByFunction`, such as ASC / DESC.",
+    "schema.query.orderBy": "Sort field for `listVersionByFunction`, such as AddTime / ModTime.",
+    "schema.query.aliasName": "Alias name for `getFunctionAlias`. Defaults to `$DEFAULT` when omitted (same as tcb fn get-route).",
+    "schema.manage.action": "Write action type, such as createFunction, updateFunctionCode, incrementalDeployFunction, invokeFunction, deleteFunction, createFunctionTrigger (scheduled task / cron / timer), deleteFunctionTrigger, createLayerVersion, deleteLayerVersion, attachLayer, detachLayer, updateFunctionLayers, publishVersion (publish a new version; aligns with tcb fn publish-version), or updateFunctionAliasConfig (update alias / traffic routing; aligns with tcb fn config-route). Use the fixed layer naming format `{layerName}_{current envId}` (for example, common_cloud1-d9ghadgak3edf6b36).",
     "schema.manage.func": "Function configuration for createFunction / updateFunctionCode. Image/build deployment is selected by func.buildStrategy (zip/cloud/local/image), with image fields under func.imageConfig.",
     "schema.manage.functionRootPath": "Recommended local-directory input for creating or updating function code. It must be the absolute directory that directly contains function folders (for example, /abs/path/cloudfunctions or /abs/path/functions), not the project root or the function subdirectory. Local layout should be cloudfunctions/<functionName>/index.js or functions/<functionName>/index.js. Pass the absolute cloudfunctions/functions directory; the SDK appends the function subdirectory. Do not precompress ZIP or base64 content.",
     "schema.manage.force": "Whether createFunction overwrites an existing function.",
-    "schema.manage.functionName": "Target function name at the top level. Used by updateFunctionCode, updateFunctionConfig, invokeFunction, and similar actions. createFunction uses func.name; other actions use top-level functionName. A mistakenly supplied func.name is also recognized as functionName.",
+    "schema.manage.functionName": "Target function name at the top level. Used by updateFunctionCode, updateFunctionConfig, invokeFunction, publishVersion, updateFunctionAliasConfig, and similar actions. createFunction uses func.name; other actions use top-level functionName. A mistakenly supplied func.name is also recognized as functionName.",
     "schema.manage.zipFile": "Compatibility only: base64-encoded prebuilt code package. For ordinary createFunction/updateFunctionCode, do not create a ZIP first; prefer functionRootPath.",
+    "schema.manage.code": "Two-phase ZIP deployment phase B: the code package has been uploaded to the environment COS bucket via queryFunctions action=getFunctionUploadUrl. Pass the triplet (cosBucketName/cosObjectName/cosBucketRegion) through unchanged from the getFunctionUploadUrl response. With code provided, createFunction/updateFunctionCode no longer reads local directories (functionRootPath/zipFile are unnecessary), and cloud dependency installation is skipped by default (override with func.installDependency).",
+    "schema.code.cosBucketName": "Environment bucket short name (without the -appid suffix); pass through the cosBucketName returned by getFunctionUploadUrl, do not invent one",
+    "schema.code.cosObjectName": "Uploaded object key; pass through the cosObjectName returned by getFunctionUploadUrl",
+    "schema.code.cosBucketRegion": "Bucket region; defaults to the current environment bucket region when omitted",
     "schema.manage.handler": "Function entry point",
     "schema.manage.timeout": "Timeout used for configuration updates.",
     "schema.manage.envVariables": "Environment variables to merge during a configuration update. If they contain TCP database variables such as DATABASE_URL, MYSQL_*, POSTGRES_*, or REDIS_*, also provide a real vpc (or ensure the function already has a complete VPC binding). Never guess vpcId/subnetId.",
@@ -204819,7 +204967,7 @@ exports.functions = (0, types_js_1.defineModule)({
     "schema.manage.contentPath": "Layer content path, either a directory or ZIP file.",
     "schema.manage.base64Content": "Base64-encoded layer content.",
     "schema.manage.runtimes": "Runtimes supported by the layer.",
-    "schema.manage.description": "Layer version description.",
+    "schema.manage.description": "Description. Layer version description for createLayerVersion; version or alias description for publishVersion / updateFunctionAliasConfig.",
     "schema.manage.licenseInfo": "Layer license information.",
     "schema.manage.layers": "Target layer list for updateFunctionLayers; array order becomes final order.",
     "schema.manage.codeSecret": "Code protection secret used when binding a layer.",
@@ -204828,6 +204976,17 @@ exports.functions = (0, types_js_1.defineModule)({
     "schema.manage.autoGrant": "Whether manager-node may automatically add the fixed allowlist of CAM policies for image deployment. Defaults to false; set true only after explicitly confirming permission changes.",
     "schema.manage.confirm": "Dangerous-operation confirmation. deleteFunction, deleteFunctionTrigger, deleteLayerVersion, detachLayer, other delete actions, and real image build deployment (func.buildStrategy=cloud/local) require confirm=true.",
     "schema.manage.incrementalFile": "Changed-file path for incrementalDeployFunction incremental deployment.",
+    "schema.manage.aliasName": "Alias name for `updateFunctionAliasConfig`. Defaults to `$DEFAULT` when omitted (same as tcb fn config-route).",
+    "schema.manage.functionVersion": "Primary version for `updateFunctionAliasConfig`. May be a concrete version number or `$LATEST`.",
+    "schema.manage.routingConfig": "Traffic routing config for `updateFunctionAliasConfig`. AdditionalVersionWeights is used for canary weights; AddtionVersionMatchs keeps the SCF/SDK historical field name (including the typo).",
+    "schema.routing.version": "Additional traffic version number",
+    "schema.routing.weight": "Additional traffic weight (0-1 or percentage per SCF convention)",
+    "schema.routing.matchVersion": "Version targeted by a match rule",
+    "schema.routing.matchKey": "Header/Query key for a match rule",
+    "schema.routing.matchMethod": "Match method, such as Exact / Regex",
+    "schema.routing.matchExpression": "Match expression",
+    "schema.routing.additionalWeights": "Additional version weight list (canary release)",
+    "schema.routing.additionalMatches": "Additional version match rules (field name keeps SCF AddtionVersionMatchs)",
 });
 
 
@@ -205161,10 +205320,11 @@ exports.hosting = (0, types_js_1.defineModule)({
     queryDescription: "查询 CloudBase 静态托管的只读信息。适合 AI 先做发现再决定下一步：action=websiteConfig 查询首页/错误页/路由规则与站点域名信息；action=status 查询托管服务状态；action=findFiles 按前缀查找文件；action=listFiles 列出全部托管文件；action=domainStatus 查询自定义域名的当前状态与配置。该工具不会产生任何副作用。",
     manageTitle: "管理 CloudBase 静态托管",
     manageDescription: "管理 CloudBase 静态托管的变更操作。action=upload 上传本地构建产物到共享域名（域名格式：<envId>-<appId>.tcloudbaseapp.com/<cloudPath>）；action=delete 删除托管文件或目录（必须 confirm=true）；action=setWebsiteDocument 设置首页/错误页/路由规则；action=enableService 开通静态托管；action=bindDomain / unbindDomain / updateDomain 管理自定义域名；action=downloadFile / downloadDirectory 下载托管内容到本地。⚠️ 底层每次托管操作都会请求 DescribeStaticStore 管控接口（20 次/秒 QPS 限制）：批量删除多个文件请逐次调用并保持间隔（建议每秒不超过 10 次），同一目录下多个文件可优先用 isDir=true 一次删除整个目录；若报错含 \"frequency limit\" 说明触发了限流，请等待 1-2 秒后重试，不要连续快速重试。⚠️ 本工具没有关闭默认域名（*.tcloudbaseapp.com）的 action；要禁用该默认公网域名，请用 manageGateway(action=\"disableRoute\", domain=该 STATIC_STORE IsDefault 域名, path=\"/\")（底层 ModifyHTTPServiceRoute，不是 ModifyGatewayRoute）。⚠️ 新项目部署优先使用 manageApps（部署到独立子域名），本工具适合已有老项目继续使用或作为 manageApps 的 fallback。manageApps 与 manageHosting 域名不同，切换会导致老链接失效。若任务只是查看配置、文件或域名状态，请改用 queryHosting。",
+    manageDescriptionCloud: "管理 CloudBase 静态托管的变更操作（cloud mode 版本）。⚠️ 依赖本地文件路径的 action 在 cloud mode 下不可用：action=upload / downloadFile / downloadDirectory 会直接报错，请勿调用。部署静态站点请改用 manageApps 云端链路：queryApps(action=\"getUploadUrl\", serviceName=\"<应用名>\") 获取预签名上传 URL → 将代码 zip PUT 上传到 uploadUrl（带 uploadHeaders 与 Content-Type: application/zip）→ manageApps(action=\"deployApp\", serviceName, cosTimestamp=<返回的 unixTimestamp>) 触发部署。可正常使用的远端管理操作：action=delete 删除托管文件或目录（必须 confirm=true）；action=setWebsiteDocument 设置首页/错误页/路由规则；action=enableService 开通静态托管；action=bindDomain / unbindDomain / updateDomain 管理自定义域名。⚠️ 底层每次托管操作都会请求 DescribeStaticStore 管控接口（20 次/秒 QPS 限制）：批量删除多个文件请逐次调用并保持间隔（建议每秒不超过 10 次）；若报错含 \"frequency limit\" 说明触发了限流，请等待 1-2 秒后重试。若任务只是查看配置、文件或域名状态，请改用 queryHosting。",
     commonServiceUnsupported: "当前 CloudBase Manager 实例不支持 commonService.call，无法执行 {action}。",
     managerUnavailable: "CloudBase Manager 实例不可用。",
     hostingStoreMissing: "当前环境 {envId} 未发现静态托管资源配置，无法上传文件。请先确认 MCP 已绑定到已开通静态托管的 CloudBase 环境；如需切换环境，请调用 auth(action=\"set_env\", envId=\"目标环境ID\") 后重试。",
-    cloudModeLocalActionUnavailable: "manageHosting(action=\"{action}\") 在 cloud mode 下不可用，因为该操作依赖本地文件路径。请改用本地模式执行；若只需要远端管理静态托管，可继续使用 delete / setWebsiteDocument / enableService / bindDomain / unbindDomain / updateDomain。",
+    cloudModeLocalActionUnavailable: "manageHosting(action=\"{action}\") 在 cloud mode 下不可用，因为该操作依赖本地文件路径。若需要部署静态站点，请改用 manageApps 云端链路：queryApps(action=\"getUploadUrl\", serviceName=\"<应用名>\") 获取预签名上传 URL → 将代码 zip PUT 上传到 uploadUrl（带 uploadHeaders 与 Content-Type: application/zip）→ manageApps(action=\"deployApp\", serviceName, cosTimestamp=<返回的 unixTimestamp>) 触发部署；若只是要上传/下载已有托管文件且无本地文件系统，该操作在云端没有替代路径，请改用本地模式执行。远端管理操作（delete / setWebsiteDocument / enableService / bindDomain / unbindDomain / updateDomain）不受影响，可继续使用。",
     uploadArgsRequired: "manageHosting(action=\"upload\") 需要提供 localPath + cloudPath，或提供 files 多文件上传列表。",
     uploadSuccess: "静态托管文件上传成功。若需要校验上传结果，请继续调用 queryHosting(action=\"findFiles\") 或 queryHosting(action=\"listFiles\")。",
     uploadRouteDisabledWithFallback: "静态托管文件上传成功。默认静态托管域名的网关路由已禁用（访问会返回 GATEWAY_ROUTE_DISABLED），已改用其他可达域名作为 accessUrl。可用 manageGateway(action=\"updateRoute\", route.enable=true) 重新启用默认域路由。",
@@ -205264,10 +205424,11 @@ exports.hosting = (0, types_js_1.defineModule)({
     queryDescription: "Read-only information about CloudBase static hosting. Lets the AI discover state first and then decide the next step: action=websiteConfig queries the index/error document, routing rules, and site domain info; action=status queries the hosting service status; action=findFiles finds files by prefix; action=listFiles lists all hosted files; action=domainStatus queries the current status and configuration of custom domains. This tool has no side effects.",
     manageTitle: "Manage CloudBase static hosting",
     manageDescription: "Mutation operations for CloudBase static hosting. action=upload uploads local build artifacts to the shared domain (domain format: <envId>-<appId>.tcloudbaseapp.com/<cloudPath>); action=delete deletes hosted files or directories (confirm=true required); action=setWebsiteDocument sets the index/error document and routing rules; action=enableService enables static hosting; action=bindDomain / unbindDomain / updateDomain manage custom domains; action=downloadFile / downloadDirectory download hosted content to local disk. ⚠️ Every hosting operation calls the DescribeStaticStore control-plane API underneath (20 req/s QPS limit): when deleting multiple files, call sequentially with intervals (no more than 10 calls per second recommended); for multiple files in the same directory, prefer isDir=true to delete the whole directory in one call. If the error contains \"frequency limit\", rate limiting was triggered — wait 1-2 seconds and retry; do not retry in rapid succession. ⚠️ This tool has no action to disable the default domain (*.tcloudbaseapp.com); to disable that default public domain, use manageGateway(action=\"disableRoute\", domain=the STATIC_STORE IsDefault domain, path=\"/\") (backed by ModifyHTTPServiceRoute, not ModifyGatewayRoute). ⚠️ For new projects prefer manageApps (deploys to a dedicated subdomain); this tool suits existing legacy projects or as a fallback for manageApps. manageApps and manageHosting use different domains, so switching invalidates old links. If the task is only inspecting config, files, or domain status, use queryHosting instead.",
+    manageDescriptionCloud: "Mutation operations for CloudBase static hosting (cloud mode variant). ⚠️ Actions that depend on local file paths are unavailable in cloud mode: action=upload / downloadFile / downloadDirectory will fail immediately — do not call them. To deploy a static site, use the manageApps cloud path instead: queryApps(action=\"getUploadUrl\", serviceName=\"<app name>\") to get a presigned upload URL → PUT the code zip to uploadUrl (with uploadHeaders and Content-Type: application/zip) → manageApps(action=\"deployApp\", serviceName, cosTimestamp=<returned unixTimestamp>) to trigger deployment. Remote-only management actions remain available: action=delete deletes hosted files or directories (confirm=true required); action=setWebsiteDocument sets the index/error document and routing rules; action=enableService enables static hosting; action=bindDomain / unbindDomain / updateDomain manage custom domains. ⚠️ Every hosting operation calls the DescribeStaticStore control-plane API underneath (20 req/s QPS limit): when deleting multiple files, call sequentially with intervals (no more than 10 calls per second recommended); if the error contains \"frequency limit\", rate limiting was triggered — wait 1-2 seconds and retry. If the task is only inspecting config, files, or domain status, use queryHosting instead.",
     commonServiceUnsupported: "The current CloudBase Manager instance does not support commonService.call; cannot execute {action}.",
     managerUnavailable: "CloudBase manager is unavailable.",
     hostingStoreMissing: "No static hosting storage config found for environment {envId}; cannot upload files. Make sure MCP is bound to a CloudBase environment with static hosting enabled; to switch environments, call auth(action=\"set_env\", envId=\"<target env ID>\") and retry.",
-    cloudModeLocalActionUnavailable: "manageHosting(action=\"{action}\") is unavailable in cloud mode because the operation depends on local file paths. Run MCP in local mode instead; for remote-only static hosting management, you can still use delete / setWebsiteDocument / enableService / bindDomain / unbindDomain / updateDomain.",
+    cloudModeLocalActionUnavailable: "manageHosting(action=\"{action}\") is unavailable in cloud mode because the operation depends on local file paths. To deploy a static site, use the manageApps cloud path instead: queryApps(action=\"getUploadUrl\", serviceName=\"<app name>\") to get a presigned upload URL → PUT the code zip to uploadUrl (with uploadHeaders and Content-Type: application/zip) → manageApps(action=\"deployApp\", serviceName, cosTimestamp=<returned unixTimestamp>) to trigger deployment. If you only need to upload/download existing hosted files and there is no local filesystem, there is no cloud alternative for this action — run MCP in local mode instead. Remote-only management actions (delete / setWebsiteDocument / enableService / bindDomain / unbindDomain / updateDomain) are unaffected and remain available.",
     uploadArgsRequired: "manageHosting(action=\"upload\") requires localPath + cloudPath, or a files list for multi-file upload.",
     uploadSuccess: "Static hosting files uploaded. To verify the upload result, call queryHosting(action=\"findFiles\") or queryHosting(action=\"listFiles\").",
     uploadRouteDisabledWithFallback: "Static hosting files uploaded. The gateway route for the default static hosting domain is disabled (access returns GATEWAY_ROUTE_DISABLED); another reachable domain is used as accessUrl. Use manageGateway(action=\"updateRoute\", route.enable=true) to re-enable the default domain route.",
@@ -205422,6 +205583,7 @@ exports.logs = (0, types_js_1.defineModule)({
         "\n\n**重要区分**：" +
         "\n- 查询云函数日志：使用 `queryFunctions(action=\"listFunctionLogs\", functionName=\"xxx\")`" +
         "\n- 查询 CLS 日志（跨服务日志聚合）：使用本工具 `queryLogs(action=\"searchLogs\")`" +
+        "\n- 开通 CLS 日志服务：使用 `manageLogs(action=\"createLogService\", confirm=true)`" +
         "\n\n**适用场景**：" +
         "\n- 检查 CLS 日志服务是否开通：`action=\"checkLogService\"`" +
         "\n- 跨服务日志搜索（如搜索所有 ERROR 日志）：`action=\"searchLogs\"`" +
@@ -205467,12 +205629,28 @@ exports.logs = (0, types_js_1.defineModule)({
     "schema.limit": "返回日志条数限制，默认 20",
     "schema.context": "翻页上下文，用于继续上一次查询",
     "schema.sort": "按时间排序：`asc` 升序，`desc` 降序",
+    "manage.title": "管理 CloudBase 日志服务",
+    "manage.description": "CloudBase 日志域写入入口。用于开通 CLS 日志服务（对齐 Manager SDK `log.createLogService` / CreateEnvResource Resources=['log']）。" +
+        "\n\n**适用场景**：" +
+        "\n- 开通 CLS 日志服务：`action=\"createLogService\", confirm=true`" +
+        "\n\n开通为异步操作：接口成功不代表立即可用，请随后用 `queryLogs(action=\"checkLogService\")` 轮询确认。",
+    "manage.schema.action": "操作类型：" +
+        "\n- `createLogService`: 开通 CLS 日志服务（需 `confirm=true`）",
+    "manage.schema.confirm": "开通日志服务前的显式确认。必须传 `confirm=true`；未传时返回 CONFIRM_REQUIRED。",
+    "manage.create.confirmRequired": "开通日志服务会创建 CLS 日志资源。请使用 `confirm: true` 重新执行以继续。",
+    "manage.create.needsConfirmation": "开通日志服务前需要显式确认。",
+    "manage.create.alreadyEnabled": "当前环境日志服务已开通，无需重复开通。",
+    "manage.create.submitted": "日志服务开通请求已提交。请使用 queryLogs(action=\"checkLogService\") 轮询直至 enabled=true。",
+    "manage.create.nextCheck": "轮询日志服务是否已就绪。",
+    "manage.create.nextSearch": "日志服务已就绪，可开始搜索 CLS 日志。",
+    "manage.unsupportedAction": "不支持的日志管理 action：{action}",
 }, {
     title: "Query CloudBase log service",
     description: "Unified read-only entry for the CloudBase logs domain. Supports checking log service status and searching CLS logs." +
         "\n\n**Important distinction**:" +
         "\n- Query cloud function logs: use `queryFunctions(action=\"listFunctionLogs\", functionName=\"xxx\")`" +
         "\n- Query CLS logs (cross-service log aggregation): use this tool `queryLogs(action=\"searchLogs\")`" +
+        "\n- Enable the CLS log service: use `manageLogs(action=\"createLogService\", confirm=true)`" +
         "\n\n**Use cases**:" +
         "\n- Check whether the CLS log service is enabled: `action=\"checkLogService\"`" +
         "\n- Cross-service log search (e.g. find all ERROR logs): `action=\"searchLogs\"`" +
@@ -205518,6 +205696,21 @@ exports.logs = (0, types_js_1.defineModule)({
     "schema.limit": "Maximum number of log entries to return; defaults to 20.",
     "schema.context": "Pagination context used to continue the previous query.",
     "schema.sort": "Time sort order: `asc` for ascending or `desc` for descending.",
+    "manage.title": "Manage CloudBase log service",
+    "manage.description": "Write entry for the CloudBase logs domain. Enables the CLS log service (aligned with Manager SDK `log.createLogService` / CreateEnvResource Resources=['log'])." +
+        "\n\n**Use cases**:" +
+        "\n- Enable CLS log service: `action=\"createLogService\", confirm=true`" +
+        "\n\nProvisioning is asynchronous: API success does not mean the service is immediately ready. Poll with `queryLogs(action=\"checkLogService\")` afterward.",
+    "manage.schema.action": "Operation type:" +
+        "\n- `createLogService`: Enable the CLS log service (requires `confirm=true`)",
+    "manage.schema.confirm": "Explicit confirmation before enabling the log service. Must pass `confirm=true`; omitting it returns CONFIRM_REQUIRED.",
+    "manage.create.confirmRequired": "Enabling the log service creates CLS log resources. Re-run with `confirm: true` to continue.",
+    "manage.create.needsConfirmation": "Explicit confirmation is required before enabling the log service.",
+    "manage.create.alreadyEnabled": "The log service is already enabled for this environment; no need to enable again.",
+    "manage.create.submitted": "Log service enablement request submitted. Poll with queryLogs(action=\"checkLogService\") until enabled=true.",
+    "manage.create.nextCheck": "Poll whether the log service is ready.",
+    "manage.create.nextSearch": "Log service is ready; you can start searching CLS logs.",
+    "manage.unsupportedAction": "Unsupported log manage action: {action}",
 });
 
 
@@ -205811,19 +206004,19 @@ exports.permissions = (0, types_js_1.defineModule)({
         "或 securityRule='{\"invoke\":true}'（放通所有云函数）。" +
         "底层错误：{message}",
     mustBeArray: "{label} 必须是数组",
-    roleLookupNote: "如果你需要 app-level admin override（例如 CMS 中 admin 可编辑所有文章，而 editor 只能编辑自己的文章），CUSTOM 规则通常是必要的。一个已验证可用的模式是：角色集合文档主键就是 auth.uid，并在文章权限里写 get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid。若现有 schema 已经有 users / profiles / user_roles 其一，请复用已存在且能通过 _id == auth.uid 直接 get() 到的那一份；不要把 where({ uid }) 查询得到的集合误写成 get('database.users.' + auth.uid)。",
-    recommendedClientWritePattern: "对于 CMS 文章这类使用 app-level admin override 的 CUSTOM 规则，前端可继续使用 db.collection('{resourceId}').doc(id).update(...) / remove(...)。关键是安全规则要采用已验证模式：get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid，并且文章文档中要真实写入 authorId。",
+    roleLookupNote: "如果你需要 app-level admin override（例如 CMS 中 admin 可编辑所有文章，而 editor 只能编辑自己的文章），CUSTOM 规则通常是必要的。一个已验证可用的模式是：角色集合文档主键就是 auth.uid，并在文章权限里写 get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid。若现有 schema 已经有 users / profiles / user_roles 其一，请复用已存在且能通过 _id == auth.uid 直接 get() 到的那一份；不要把 where({ uid }) 查询得到的集合误写成 get(`database.users.${auth.uid}`)。",
+    recommendedClientWritePattern: "对于 CMS 文章这类使用 app-level admin override 的 CUSTOM 规则，前端可继续使用 db.collection('{resourceId}').doc(id).update(...) / remove(...)。关键是安全规则要采用已验证模式：get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid，并且文章文档中要真实写入 authorId。",
     createRuleSummary: "create 规则不应引用 doc.*，因为 create 时文档尚未存在。",
     createRuleDetail: "CloudBase 的 create 规则验证的是写入数据（request.data），此时文档尚不存在，doc.* 不可用。" +
         "请将 create 规则改为仅使用 auth.* 检查（如 auth.uid != null && auth.loginType != 'ANONYMOUS'），" +
         "或在写入时将 owner 字段（如 _openid / authorId）写入 request.data，然后在 create 规则中用 request.data._openid == auth.openid 做校验。" +
         "read / update / delete 规则可以使用 doc.* 引用已有文档字段，且客户端查询条件必须是规则约束的子集（如 _openid: '{openid}'）。",
     docIdWriteSummary: "当前安全规则在 document-id 写入场景下可能被后端直接拒绝。",
-    docIdWriteDetail: "这类规则经常在 owner-only 集合里被写错，但对于 CMS 文章这种“admin 可编辑所有文章、editor 只能编辑自己的文章”的场景，已验证可用的做法是保留 doc.authorId，并通过独立角色集合做 admin override：get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid。不要默认改成 where(...)，也不要把同集合 owner 判断重写成 get('database.collection.' + doc._id)。",
+    docIdWriteDetail: "这类规则经常在 owner-only 集合里被写错，但对于 CMS 文章这种“admin 可编辑所有文章、editor 只能编辑自己的文章”的场景，已验证可用的做法是保留 doc.authorId，并通过独立角色集合做 admin override：get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid。不要默认改成 where(...)，也不要把同集合 owner 判断重写成 ``get(`database.collection.${doc._id}`)``。",
     invalidGetPathSummary: "get() 的 path 只应包含 collection 和 documentId，不应把字段名拼进 path 字符串。",
-    invalidGetPathDetail: "请写成 get('database.collection.' + doc._id).fieldName，而不是 get('database.collection.' + doc._id + '.fieldName')。但在 CMS 文章权限里，不要把 get('database.collection.' + doc._id) 当成默认首选方案；更稳的已验证模式是读取单独的角色集合：get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid。",
-    templateLiteralSummary: "CloudBase security rule 表达式不支持把 ${...} 当作 JS 模板字符串插值。",
-    templateLiteralDetail: "在 securityRule 字符串里，请使用表达式拼接，例如 get('database.user_roles.' + auth.uid).role，而不是 get('database.user_roles.${auth.uid}').role。对于 CMS 文章这类需要 app-level admin override 的规则，请优先使用已验证的 user_roles + doc.authorId 模式。",
+    invalidGetPathDetail: "请写成 ``get(`database.collection.${doc._id}`).fieldName``，而不是把字段名拼进 path。安全规则的表达式不支持用 + 拼接 get() 的 path 参数——形如 get('database.collection.' + doc._id) 的规则在保存时就会被判 rule invalid，请改用反引号模板字符串。但在 CMS 文章权限里，不要把同集合文档当成默认首选方案；更稳的模式是读取单独的角色集合：``get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid``。",
+    templateLiteralSummary: "${...} 出现在引号字符串里也能被引擎识别，但官方形态是反引号模板字符串。",
+    templateLiteralDetail: "推荐统一写成 ``get(`database.user_roles.${auth.uid}`).role == 'admin'``。真正会被拒绝的不是 ${...}，而是另外两种写法：不含 ${...} 的裸引号字面量（如 get('database.admin_locks.article_lock')，请求时会返回 500），以及用 + 拼接的 get(`database.user_roles.${auth.uid}`)（保存规则时判 rule invalid）。对于 CMS 文章这类需要 app-level admin override 的规则，请优先使用 user_roles + doc.authorId 模式。",
     bucketMissing: "存储 Bucket {bucket} 不存在",
     bucketsMissing: "以下存储 Bucket 不存在: {buckets}",
     paramRequired: "action={action} 时必须提供 {param}",
@@ -205892,19 +206085,19 @@ exports.permissions = (0, types_js_1.defineModule)({
         "(package authz.user) or securityRule='{\"invoke\":true}' for public functions. " +
         "Underlying error: {message}",
     mustBeArray: "{label} must be an array",
-    roleLookupNote: "If you need app-level admin override (e.g. in a CMS, admins can edit all articles while editors can only edit their own), a CUSTOM rule is usually required. A verified pattern is: make the role collection's document primary key auth.uid itself, and in the article permission write get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid. If the existing schema already has users / profiles / user_roles, reuse the one that exists and can be fetched directly via _id == auth.uid with get(); do not mistakenly write the collection obtained by a where({ uid }) query as get('database.users.' + auth.uid).",
-    recommendedClientWritePattern: "For CMS articles using CUSTOM rules with app-level admin override, the frontend can keep using db.collection('{resourceId}').doc(id).update(...) / remove(...). The key is that the security rule uses the verified pattern: get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid, and the article document must actually contain the authorId field.",
+    roleLookupNote: "If you need app-level admin override (e.g. in a CMS, admins can edit all articles while editors can only edit their own), a CUSTOM rule is usually required. A verified pattern is: make the role collection's document primary key auth.uid itself, and in the article permission write get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid. If the existing schema already has users / profiles / user_roles, reuse the one that exists and can be fetched directly via _id == auth.uid with get(); do not mistakenly write the collection obtained by a where({ uid }) query as get(`database.users.${auth.uid}`).",
+    recommendedClientWritePattern: "For CMS articles using CUSTOM rules with app-level admin override, the frontend can keep using db.collection('{resourceId}').doc(id).update(...) / remove(...). The key is that the security rule uses the verified pattern: get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid, and the article document must actually contain the authorId field.",
     createRuleSummary: "The create rule should not reference doc.*, because the document does not exist yet at create time.",
     createRuleDetail: "CloudBase's create rule validates the written data (request.data); the document does not exist yet, so doc.* is unavailable. " +
         "Change the create rule to use only auth.* checks (e.g. auth.uid != null && auth.loginType != 'ANONYMOUS'), " +
         "or write the owner field (e.g. _openid / authorId) into request.data at write time, then validate with request.data._openid == auth.openid in the create rule. " +
         "read / update / delete rules may use doc.* to reference existing document fields, and the client's query conditions must be a subset of the rule constraints (e.g. _openid: '{openid}').",
     docIdWriteSummary: "The current security rule may be rejected by the backend in document-id write scenarios.",
-    docIdWriteDetail: "Such rules are often written incorrectly in owner-only collections, but for the CMS article scenario where \"admins can edit all articles and editors can only edit their own\", the verified approach is to keep doc.authorId and do admin override through a separate role collection: get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid. Do not default to where(...), and do not rewrite the same-collection owner check as get('database.collection.' + doc._id).",
+    docIdWriteDetail: "Such rules are often written incorrectly in owner-only collections, but for the CMS article scenario where \"admins can edit all articles and editors can only edit their own\", the verified approach is to keep doc.authorId and do admin override through a separate role collection: get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid. Do not default to where(...), and do not rewrite the same-collection owner check as ``get(`database.collection.${doc._id}`)``.",
     invalidGetPathSummary: "The get() path should only contain the collection and documentId; do not concatenate field names into the path string.",
-    invalidGetPathDetail: "Write get('database.collection.' + doc._id).fieldName instead of get('database.collection.' + doc._id + '.fieldName'). However, for CMS article permissions, do not treat get('database.collection.' + doc._id) as the default first choice; the more robust verified pattern is reading a separate role collection: get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid.",
-    templateLiteralSummary: "CloudBase security rule expressions do not support ${...} as JS template string interpolation.",
-    templateLiteralDetail: "In the securityRule string, use expression concatenation, e.g. get('database.user_roles.' + auth.uid).role, instead of get('database.user_roles.${auth.uid}').role. For rules needing app-level admin override like CMS articles, prefer the verified user_roles + doc.authorId pattern.",
+    invalidGetPathDetail: "Write ``get(`database.collection.${doc._id}`).fieldName`` instead of embedding the field name in the path. Security rule expressions do not support concatenating the get() path with +: a rule such as get('database.collection.' + doc._id) is rejected with rule invalid when the rule is saved, so use a backtick template literal. However, for CMS article permissions, do not treat a same-collection document as the default first choice; the more robust pattern is reading a separate role collection: ``get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid``.",
+    templateLiteralSummary: "${...} inside a quoted string is understood by the engine, but the official form is a backtick template literal.",
+    templateLiteralDetail: "Prefer ``get(`database.user_roles.${auth.uid}`).role == 'admin'``. What actually breaks is not ${...} but two other spellings: a bare quoted literal with no ${...} (e.g. get('database.admin_locks.article_lock'), which returns 500 at request time), and a concatenated path such as get(`database.user_roles.${auth.uid}`) (rejected with rule invalid when the rule is saved). For rules needing app-level admin override like CMS articles, prefer the user_roles + doc.authorId pattern.",
     bucketMissing: "Storage bucket {bucket} does not exist",
     bucketsMissing: "The following storage buckets do not exist: {buckets}",
     paramRequired: "{param} is required when action={action}",
@@ -205996,6 +206189,8 @@ exports.rag = (0, types_js_1.defineModule)({
     findByNameSuccess: "CloudBase 文档查找成功",
     readDocSuccess: "CloudBase 文档读取成功",
     readDocNotMarkdown: "文档 {docPath} 没有可用的 Markdown 版本（站点对该路径返回了 HTML 页面）。请用 action=searchDocs 或 action=findByName 确认正确地址后重试；也可以直接抓取网页版：{pageUrl}",
+    readDocUrlNotAllowed: "readDoc 只读取 CloudBase 官方文档站（{host}）上的文档，不接受其他主机的地址：{docPath}。请改传站内相对路径（如 /quick-start），或该文档站上的地址。",
+    readDocPathEmpty: "readDoc 需要一个具体文档路径，{docPath} 里没有路径部分。例如传 /quick-start，或传 action=findByName / action=searchDocs 返回的文档地址。",
     searchDocsSuccess: "CloudBase 文档搜索成功",
     skillNotFound: "未找到技能文档 \"{skillName}\"。可用技能文档：{available}。{remoteHint}",
     skillRemoteHint: " 你也可以直接从这个地址获取技能文档：{url}",
@@ -206016,7 +206211,7 @@ exports.rag = (0, types_js_1.defineModule)({
     "schema.action": "仅 mode=docs 时指定；mode=openapi 不要传 action。CloudBase 文档操作类型：listModules=列出所有文档模块，listModuleDocs=获取指定模块的目录结构，findByName=按名称/路径/URL 智能查找，readDoc=读取指定文档 Markdown，searchDocs=全文搜索官方文档。",
     "schema.moduleName": "mode=docs 且 action=listModuleDocs 时指定。模块名称。",
     "schema.input": "mode=docs 且 action=findByName 时指定。支持模块名、文档标题、层级路径或 URL。",
-    "schema.docPath": "mode=docs 且 action=readDoc 时指定。文档相对路径或完整 URL。",
+    "schema.docPath": "mode=docs 且 action=readDoc 时指定。站内相对路径（如 /quick-start），或 action=findByName / action=searchDocs 返回的文档地址 —— 传地址时只取其中的路径，主机部分一律忽略。",
     "schema.query": "mode=docs 且 action=searchDocs 时指定。全文检索关键词。",
 }, {
     title: "CloudBase knowledge base search",
@@ -206052,6 +206247,8 @@ exports.rag = (0, types_js_1.defineModule)({
     findByNameSuccess: "CloudBase doc lookup succeeded",
     readDocSuccess: "CloudBase doc read successfully",
     readDocNotMarkdown: "No Markdown version is available for {docPath} (the site returned an HTML page for it). Use action=searchDocs or action=findByName to confirm the correct address and retry; you can also fetch the rendered page directly: {pageUrl}",
+    readDocUrlNotAllowed: "readDoc only reads documents on the official CloudBase docs site ({host}); other hosts are not accepted: {docPath}. Pass a site-relative path such as /quick-start, or an address on that docs site.",
+    readDocPathEmpty: "readDoc needs a concrete document path; {docPath} carries no path. For example pass /quick-start, or a document address returned by action=findByName / action=searchDocs.",
     searchDocsSuccess: "CloudBase doc search succeeded",
     skillNotFound: "Skill document \"{skillName}\" not found. Available skill docs: {available}.{remoteHint}",
     skillRemoteHint: " You can also try fetching the skill doc directly from: {url}",
@@ -206072,7 +206269,7 @@ exports.rag = (0, types_js_1.defineModule)({
     "schema.action": "Only for mode=docs; do not pass action with mode=openapi. CloudBase documentation action: listModules lists all documentation modules; listModuleDocs gets the catalog for a module; findByName searches intelligently by name, path, or URL; readDoc reads document Markdown; searchDocs performs a full-text search of the official documentation.",
     "schema.moduleName": "Required when mode=docs and action=listModuleDocs. The module name.",
     "schema.input": "Required when mode=docs and action=findByName. Accepts a module name, document title, hierarchical path, or URL.",
-    "schema.docPath": "Required when mode=docs and action=readDoc. A relative document path or full URL.",
+    "schema.docPath": "Required when mode=docs and action=readDoc. A site-relative path such as /quick-start, or a document address returned by action=findByName / action=searchDocs — only the path is used; any host is ignored.",
     "schema.query": "Required when mode=docs and action=searchDocs. Full-text search keywords.",
 });
 
@@ -206151,6 +206348,7 @@ exports.setup = (0, types_js_1.defineModule)({
     "schema.template": "要下载的模板类型",
     "schema.ide": "指定要下载的IDE类型。",
     "schema.overwrite": "是否覆盖已存在的文件，默认为false（不覆盖）",
+    "projectRoot.hostConfigDir": "拒绝把 {dir} 当作项目根目录。这是宿主配置目录，不是项目。请由宿主设置 WORKSPACE_FOLDER_PATHS 为项目目录后再试。",
 }, {
     "downloadTemplate.title": "Download project template",
     "downloadTemplate.description": "Automatically downloads and deploys CloudBase project templates.\n**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\nSupported templates:\n- react: React + CloudBase full-stack app template\n- vue: Vue + CloudBase full-stack app template\n- miniprogram: WeChat Mini Program + CloudBase template\n- uniapp: UniApp + CloudBase cross-platform app template\n- rules: AI editor configuration files only (includes configurations for all mainstream editors such as Cursor, WindSurf, and CodeBuddy), suitable for adding AI editor configuration to an existing project\n\nSupported IDE types:\n- all: download configurations for all IDEs\n- cursor: Cursor AI editor\n- see the list below for other IDE types\n\nNote: if the ide parameter is not provided and the IDE cannot be detected from environment variables, an error will be returned asking for the ide parameter\n- windsurf: WindSurf AI editor\n- codebuddy: CodeBuddy AI editor\n- claude-code: Claude Code AI editor\n- cline: Cline AI editor\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI editor\n- qwen-code: Tongyi Lingma\n- baidu-comate: Baidu Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI editor\n- tongyi-lingma: Tongyi Lingma\n- trae: Trae AI editor\n- qoder: Qoder AI editor\n- antigravity: Google Antigravity AI editor\n- vscode: Visual Studio Code\n- kiro: Kiro AI editor\n- aider: Aider AI editor\n\nNotes:\n- the rules template automatically embeds the current MCP version for future maintenance and version tracking\n- when downloading the rules template, if a README.md file already exists in the project, the system protects it from being overwritten (unless overwrite=true is set)",
@@ -206215,6 +206413,7 @@ exports.setup = (0, types_js_1.defineModule)({
     "schema.template": "The type of template to download",
     "schema.ide": "The IDE type whose configuration should be downloaded.",
     "schema.overwrite": "Whether to overwrite existing files. Defaults to false (do not overwrite).",
+    "projectRoot.hostConfigDir": "Refusing to use {dir} as the project root. That directory belongs to the host, not a project. Set WORKSPACE_FOLDER_PATHS to the project directory and retry.",
 });
 
 
@@ -206422,6 +206621,7 @@ const msgPush_js_1 = __webpack_require__(26191);
 const setup_js_1 = __webpack_require__(8707);
 const envSetup_js_1 = __webpack_require__(57148);
 const interactive_js_1 = __webpack_require__(91838);
+const feedback_js_1 = __webpack_require__(99391);
 exports.zh = {
     env: env_js_1.env.zh,
     storage: storage_js_1.storage.zh,
@@ -206451,6 +206651,7 @@ exports.zh = {
     setup: setup_js_1.setup.zh,
     envSetup: envSetup_js_1.envSetup.zh,
     interactive: interactive_js_1.interactive.zh,
+    feedback: feedback_js_1.feedback.zh,
 };
 
 
@@ -206630,6 +206831,7 @@ const apps_js_1 = __webpack_require__(38267);
 const logs_js_1 = __webpack_require__(61628);
 const permissions_js_1 = __webpack_require__(52639);
 const msg_push_js_1 = __webpack_require__(87707);
+const feedback_js_1 = __webpack_require__(6332);
 const index_js_1 = __webpack_require__(24908);
 const schema_js_1 = __webpack_require__(56273);
 const cloud_mode_js_1 = __webpack_require__(88694);
@@ -206659,6 +206861,7 @@ const DEFAULT_PLUGINS = [
     "logs",
     "agents",
     "capi",
+    "feedback",
 ];
 function registerDatabase(server) {
     // NoSQL 数据库按站点能力集合注册（国际站默认不支持 NoSQL）
@@ -206708,6 +206911,7 @@ const AVAILABLE_PLUGINS = {
     deploy: { name: "deploy", register: deploy_js_1.registerDeployTools },
     capi: { name: "capi", register: capi_js_1.registerCapiTools },
     "msg-push": { name: "msg-push", register: msg_push_js_1.registerMsgPushTools },
+    feedback: { name: "feedback", register: feedback_js_1.registerFeedbackTools },
 };
 const PLUGIN_ALIASES = {
     "access-control": "permissions",
@@ -208535,6 +208739,8 @@ exports.SERVICE_VERSIONS = {
     tag: ["2018-08-13"],
     billing: ["2018-07-09"],
     region: ["2022-06-27"],
+    // 备案
+    ba: ["2020-07-20"],
     // 计算 / 容器 / 存储
     cvm: ["2017-03-12"],
     lighthouse: ["2020-03-24"],
@@ -209191,6 +209397,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.CLOUDRUN_ENV_TYPE = exports.CLOUDRUN_DEPLOY_REGISTRATION_INTERVAL_MS = exports.CLOUDRUN_DEPLOY_REGISTRATION_MAX_WAIT_MS = exports.MASKED_CLOUDRUN_ENV_VALUE = exports.CLOUDRUN_PACKAGE_TYPES = exports.CLOUDRUN_ACCESS_TYPES = exports.CLOUDRUN_SERVICE_TYPES = void 0;
 exports.maskCloudRunDetailEnvParams = maskCloudRunDetailEnvParams;
+exports.validateAndNormalizePath = validateAndNormalizePath;
 exports.resolveCloudRunProjectDir = resolveCloudRunProjectDir;
 exports.buildManageCloudRunErrorMessage = buildManageCloudRunErrorMessage;
 exports.isValidCloudRunBuildId = isValidCloudRunBuildId;
@@ -209217,6 +209424,7 @@ const zod_1 = __webpack_require__(21504);
 const cloudbase_manager_js_1 = __webpack_require__(33109);
 const index_js_1 = __webpack_require__(24908);
 const logger_js_1 = __webpack_require__(40781);
+const project_config_js_1 = __webpack_require__(39175);
 const gateway_access_urls_js_1 = __webpack_require__(84173);
 const notification_js_1 = __webpack_require__(4718);
 const capi_js_1 = __webpack_require__(88900);
@@ -209421,31 +209629,20 @@ function checkIfAgentProject(projectPath) {
     }
 }
 /**
- * Validate and normalize file path.
- * Accepts absolute paths as-is; for relative paths, resolves against CWD and
- * ensures the result does not escape the CWD (path-traversal protection).
- * @param inputPath User provided path
- * @returns Absolute path
+ * Validate and normalize a file path.
+ * Absolute paths are accepted as-is. Relative paths resolve against the project
+ * root and must stay inside it.
  */
 function validateAndNormalizePath(inputPath) {
-    const normalizedPath = path_1.default.resolve(inputPath);
-    // On Windows, path.resolve may return a path on a different drive/UNC share.
-    // That is safe — the user explicitly provided an absolute path there.
-    // Only apply the traversal check when the resolved path shares the same root
-    // as CWD (i.e. the path was relative or on the same drive).
-    const cwd = process.cwd();
-    const cwdRoot = path_1.default.parse(cwd).root;
-    const pathRoot = path_1.default.parse(normalizedPath).root;
-    if (cwdRoot === pathRoot) {
-        // Same filesystem root — ensure the resolved path is still inside CWD
-        // (or is exactly CWD) to block "../" traversal.
-        const prefix = cwd.endsWith(path_1.default.sep) ? cwd : cwd + path_1.default.sep;
-        if (!normalizedPath.startsWith(prefix) && normalizedPath !== cwd) {
-            throw new Error((0, index_js_1.t)("cloudrun.error.pathOutsideCwd", { cwd }));
-        }
-    }
-    // Cross-root absolute paths (e.g. D:\ on Windows when CWD is C:\) are
-    // allowed — the user own the machine and the path is explicitly absolute.
+    if (path_1.default.isAbsolute(inputPath)) {
+        return path_1.default.resolve(inputPath);
+    }
+    const projectRoot = (0, project_config_js_1.requireProjectRoot)();
+    const normalizedPath = path_1.default.resolve(projectRoot, inputPath);
+    const prefix = projectRoot.endsWith(path_1.default.sep) ? projectRoot : projectRoot + path_1.default.sep;
+    if (!normalizedPath.startsWith(prefix) && normalizedPath !== projectRoot) {
+        throw new Error((0, index_js_1.t)("cloudrun.error.pathOutsideCwd", { cwd: projectRoot, resolvedPath: normalizedPath }));
+    }
     return normalizedPath;
 }
 /**
@@ -213875,6 +214072,7 @@ const zod_1 = __webpack_require__(21504);
 const cloudbase_manager_js_1 = __webpack_require__(33109);
 const env_js_1 = __webpack_require__(56504);
 const index_js_1 = __webpack_require__(24908);
+const project_config_js_1 = __webpack_require__(39175);
 const tool_result_js_1 = __webpack_require__(69645);
 const sql_risk_js_1 = __webpack_require__(29885);
 const CATEGORY = "PostgreSQL database";
@@ -214159,19 +214357,7 @@ function validateMigrationName(name, actionLabel) {
     return null;
 }
 function getMigrationProjectRoot() {
-    const fromEnv = process.env.WORKSPACE_FOLDER_PATHS ||
-        process.env.PROJECT_ROOT ||
-        process.env.GITHUB_WORKSPACE ||
-        process.env.CI_PROJECT_DIR ||
-        process.env.BUILD_SOURCESDIRECTORY;
-    if (fromEnv && fromEnv.trim()) {
-        // IDEs may inject multiple folders separated by path.delimiter.
-        const first = fromEnv.split(path.delimiter).map((p) => p.trim()).find(Boolean);
-        if (first) {
-            return first;
-        }
-    }
-    return process.cwd();
+    return (0, project_config_js_1.requireProjectRoot)();
 }
 function buildLocalMigrationFileName(version, name) {
     return `${version}_${name}.sql`;
@@ -216546,7 +216732,17 @@ const QUERY_ACTIONS = [
     "getInstanceInfo",
     "describeInstance",
     "getConnectionInfo",
+    "describeInstanceSlowQueries",
+    "describeInstanceErrorLogs",
+];
+const SLOW_QUERY_ORDER_BY = [
+    "QueryTime",
+    "LockTime",
+    "RowsExamined",
+    "RowsSent",
 ];
+const ERROR_LOG_LEVELS = ["error", "warning", "note"];
+const ORDER_BY_TYPE = ["asc", "desc", "ASC", "DESC"];
 const MANAGE_ACTIONS = [
     "provisionMySQL",
     "destroyMySQL",
@@ -217053,6 +217249,138 @@ async function handleGetConnectionInfo(context) {
         ],
     });
 }
+function resolveMysqlInstanceId(instanceInfo, args) {
+    const fromRequest = typeof args.request?.InstanceId === "string"
+        ? args.request.InstanceId
+        : undefined;
+    const fromDbInstance = args.dbInstance?.instanceId;
+    const candidate = fromRequest || fromDbInstance || instanceInfo.instanceId;
+    if (!candidate || candidate === "default") {
+        return null;
+    }
+    return candidate;
+}
+async function requireReadyMysqlInstance(args, context) {
+    const instanceInfo = await getSqlInstanceInfo(context);
+    if (!instanceInfo.exists) {
+        return {
+            ok: false,
+            payload: buildSqlToolResult({
+                success: false,
+                errorCode: "MYSQL_NOT_CREATED",
+                data: sanitizeInstanceInfo(instanceInfo),
+                message: (0, index_js_1.t)("databaseSQL.instanceLogs.notProvisioned"),
+                nextActions: [
+                    buildNextAction(MANAGE_MYSQL_DATABASE, "provisionMySQL", (0, index_js_1.t)("databaseSQL.next.provisionBeforeSql"), { action: "provisionMySQL", confirm: true }),
+                ],
+            }),
+        };
+    }
+    const instanceId = resolveMysqlInstanceId(instanceInfo, args);
+    if (!instanceId) {
+        return {
+            ok: false,
+            payload: buildSqlToolResult({
+                success: false,
+                errorCode: "MYSQL_INSTANCE_ID_REQUIRED",
+                data: sanitizeInstanceInfo(instanceInfo),
+                message: (0, index_js_1.t)("databaseSQL.instanceLogs.instanceIdRequired"),
+                nextActions: [
+                    buildNextAction(QUERY_MYSQL_DATABASE, "getInstanceInfo", (0, index_js_1.t)("databaseSQL.instanceLogs.resolveInstanceId"), { action: "getInstanceInfo" }),
+                ],
+            }),
+        };
+    }
+    return { ok: true, instanceInfo, instanceId };
+}
+async function handleDescribeInstanceSlowQueries(args, context) {
+    const ready = await requireReadyMysqlInstance(args, context);
+    if (!ready.ok) {
+        return ready.payload;
+    }
+    const request = args.request || {};
+    const cloudbase = await context.getManager();
+    const result = await cloudbase.mysql.describeInstanceSlowQueries({
+        InstanceId: ready.instanceId,
+        StartTime: (typeof request.StartTime === "string" ? request.StartTime : undefined) ??
+            args.startTime,
+        EndTime: (typeof request.EndTime === "string" ? request.EndTime : undefined) ??
+            args.endTime,
+        Limit: (typeof request.Limit === "number" ? request.Limit : undefined) ??
+            args.limit,
+        Offset: (typeof request.Offset === "number" ? request.Offset : undefined) ??
+            args.offset,
+        Username: (typeof request.Username === "string" ? request.Username : undefined) ??
+            args.username,
+        Host: (typeof request.Host === "string" ? request.Host : undefined) ??
+            args.host,
+        Database: (typeof request.Database === "string" ? request.Database : undefined) ??
+            args.database,
+        OrderBy: (typeof request.OrderBy === "string" ? request.OrderBy : undefined) ??
+            args.orderBy,
+        OrderByType: (typeof request.OrderByType === "string"
+            ? request.OrderByType
+            : undefined) ?? args.orderByType,
+        SqlText: (typeof request.SqlText === "string" ? request.SqlText : undefined) ??
+            args.sqlText,
+    });
+    (0, cloudbase_manager_js_1.logCloudBaseResult)(context.server.logger, result);
+    return buildSqlToolResult({
+        success: true,
+        data: {
+            action: "describeInstanceSlowQueries",
+            instanceId: ready.instanceId,
+            totalCount: result.TotalCount ?? 0,
+            slowQueries: result.SlowQueries ?? [],
+            requestId: result.RequestId,
+            raw: result,
+        },
+        message: (0, index_js_1.t)("databaseSQL.instanceLogs.slowQueriesSuccess"),
+    });
+}
+async function handleDescribeInstanceErrorLogs(args, context) {
+    const ready = await requireReadyMysqlInstance(args, context);
+    if (!ready.ok) {
+        return ready.payload;
+    }
+    const request = args.request || {};
+    const cloudbase = await context.getManager();
+    const result = await cloudbase.mysql.describeInstanceErrorLogs({
+        InstanceId: ready.instanceId,
+        Limit: (typeof request.Limit === "number" ? request.Limit : undefined) ??
+            args.limit,
+        Offset: (typeof request.Offset === "number" ? request.Offset : undefined) ??
+            args.offset,
+        StartTime: (typeof request.StartTime === "string" ? request.StartTime : undefined) ??
+            args.startTime,
+        EndTime: (typeof request.EndTime === "string" ? request.EndTime : undefined) ??
+            args.endTime,
+        OrderBy: (typeof request.OrderBy === "string" ? request.OrderBy : undefined) ??
+            (args.orderBy === "Timestamp" ? args.orderBy : undefined),
+        OrderByType: (typeof request.OrderByType === "string"
+            ? request.OrderByType
+            : undefined) ?? args.orderByType,
+        LogLevels: (Array.isArray(request.LogLevels)
+            ? request.LogLevels
+            : undefined) ?? args.logLevels,
+        KeyWords: (Array.isArray(request.KeyWords)
+            ? request.KeyWords
+            : undefined) ?? args.keyWords,
+    });
+    (0, cloudbase_manager_js_1.logCloudBaseResult)(context.server.logger, result);
+    return buildSqlToolResult({
+        success: true,
+        data: {
+            action: "describeInstanceErrorLogs",
+            instanceId: ready.instanceId,
+            totalCount: result.TotalCount ?? 0,
+            errorLogs: result.ErrorLogs ?? [],
+            requestId: result.RequestId,
+            raw: result,
+        },
+        message: (0, index_js_1.t)("databaseSQL.instanceLogs.errorLogsSuccess"),
+    });
+}
 async function handleProvisionMySQL(args, context) {
     if (args.confirm !== true) {
         return buildSqlToolResult({
@@ -217423,6 +217751,54 @@ function registerSQLDatabaseTools(server) {
             })
                 .optional()
                 .describe("databaseSQL.schema.query.dbInstance"),
+            startTime: zod_1.z
+                .string()
+                .optional()
+                .describe("databaseSQL.schema.query.startTime"),
+            endTime: zod_1.z
+                .string()
+                .optional()
+                .describe("databaseSQL.schema.query.endTime"),
+            limit: zod_1.z
+                .number()
+                .optional()
+                .describe("databaseSQL.schema.query.limit"),
+            offset: zod_1.z
+                .number()
+                .optional()
+                .describe("databaseSQL.schema.query.offset"),
+            username: zod_1.z
+                .string()
+                .optional()
+                .describe("databaseSQL.schema.query.username"),
+            host: zod_1.z
+                .string()
+                .optional()
+                .describe("databaseSQL.schema.query.host"),
+            database: zod_1.z
+                .string()
+                .optional()
+                .describe("databaseSQL.schema.query.database"),
+            orderBy: zod_1.z
+                .enum([...SLOW_QUERY_ORDER_BY, "Timestamp"])
+                .optional()
+                .describe("databaseSQL.schema.query.orderBy"),
+            orderByType: zod_1.z
+                .enum(ORDER_BY_TYPE)
+                .optional()
+                .describe("databaseSQL.schema.query.orderByType"),
+            sqlText: zod_1.z
+                .string()
+                .optional()
+                .describe("databaseSQL.schema.query.sqlText"),
+            logLevels: zod_1.z
+                .array(zod_1.z.enum(ERROR_LOG_LEVELS))
+                .optional()
+                .describe("databaseSQL.schema.query.logLevels"),
+            keyWords: zod_1.z
+                .array(zod_1.z.string())
+                .optional()
+                .describe("databaseSQL.schema.query.keyWords"),
         },
         annotations: {
             readOnlyHint: true,
@@ -217446,6 +217822,10 @@ function registerSQLDatabaseTools(server) {
                 return handleGetInstanceInfo(context);
             case "getConnectionInfo":
                 return handleGetConnectionInfo(context);
+            case "describeInstanceSlowQueries":
+                return handleDescribeInstanceSlowQueries(args, context);
+            case "describeInstanceErrorLogs":
+                return handleDescribeInstanceErrorLogs(args, context);
             default:
                 throw new Error((0, index_js_1.t)("databaseSQL.unsupportedQueryAction", { action: args.action }));
         }
@@ -217543,6 +217923,7 @@ const zod_1 = __webpack_require__(21504);
 const cloudbase_manager_js_1 = __webpack_require__(33109);
 const index_js_1 = __webpack_require__(24908);
 const json_content_js_1 = __webpack_require__(18027);
+const project_config_js_1 = __webpack_require__(39175);
 const sql_risk_js_1 = __webpack_require__(29885);
 const hosting_build_utils_js_1 = __webpack_require__(27572);
 // 声明式部署可编排的资源类型，与 DeployOrchestrator 的部署顺序一致：
@@ -217807,7 +218188,7 @@ function registerDeployTools(server) {
         },
     }, async ({ cwd, mode }) => {
         try {
-            const projectRoot = cwd ?? process.cwd();
+            const projectRoot = (0, project_config_js_1.requireProjectRoot)(cwd);
             const config = await resolveDeployConfig({ cwd: projectRoot, mode });
             assertConfigValid(config);
             const hostingItems = Array.isArray(config.hosting)
@@ -217879,7 +218260,7 @@ function registerDeployTools(server) {
         },
     }, async ({ cwd, mode, envId: envIdInput, only, skip, yes, }) => {
         try {
-            const projectRoot = cwd ?? process.cwd();
+            const projectRoot = (0, project_config_js_1.requireProjectRoot)(cwd);
             const config = await resolveDeployConfig({ cwd: projectRoot, mode });
             assertConfigValid(config);
             const envId = await resolveDeployEnvId({
@@ -217963,7 +218344,7 @@ function registerDeployTools(server) {
             if (confirm !== true) {
                 throw new DeployError(exports.DEPLOY_ERROR_CODES.CONFIRM_REQUIRED, (0, index_js_1.t)("deploy.confirmRequired"));
             }
-            const projectRoot = cwd ?? process.cwd();
+            const projectRoot = (0, project_config_js_1.requireProjectRoot)(cwd);
             const config = await resolveDeployConfig({ cwd: projectRoot, mode });
             assertConfigValid(config);
             const envId = await resolveDeployEnvId({
@@ -221900,6 +222281,507 @@ function registerEnvTools(server) {
 }
 
 
+/***/ },
+
+/***/ 6332
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.FEEDBACK_PREFILL_URL_LIMIT = exports.FEEDBACK_ISSUE_NEW_URL = exports.FEEDBACK_TOOL_NAME = void 0;
+exports.resolveMcpVersion = resolveMcpVersion;
+exports.buildFeedbackIssueUrl = buildFeedbackIssueUrl;
+exports.buildFeedbackIssueLink = buildFeedbackIssueLink;
+exports.buildFeedbackPayload = buildFeedbackPayload;
+exports.registerFeedbackTools = registerFeedbackTools;
+const zod_1 = __webpack_require__(21504);
+const feedback_session_js_1 = __webpack_require__(23379);
+const json_content_js_1 = __webpack_require__(18027);
+const site_map_js_1 = __webpack_require__(34533);
+/**
+ * Not a CloudBase resource, so this does not use the query* / manage* pair.
+ * The feedback plugin is in the default set and always registers this tool.
+ */
+exports.FEEDBACK_TOOL_NAME = "prepareFeedback";
+const CASE_TEMPLATE_FILE = "1-case-showcase.yml";
+const RETROSPECTIVE_TEMPLATE_FILE = "2-dev-retrospective.yml";
+/** Fixed new-issue pages. Intl uses GitHub. Domestic uses the CNB CloudBase-AI-ToolKit repo. */
+exports.FEEDBACK_ISSUE_NEW_URL = {
+    intl: "https://github.com/TencentCloudBase/CloudBase-AI-ToolKit/issues/new",
+    domestic: "https://cnb.cool/tencent/cloud/cloudbase/CloudBase-AI-ToolKit/-/issues/new",
+};
+const RESOURCE_BY_TOOL = {
+    queryHosting: { zh: "静态托管", en: "Static hosting" },
+    manageHosting: { zh: "静态托管", en: "Static hosting" },
+    readNoSqlDatabaseStructure: { zh: "云数据库（文档型）", en: "Document database" },
+    writeNoSqlDatabaseStructure: { zh: "云数据库（文档型）", en: "Document database" },
+    readNoSqlDatabaseContent: { zh: "云数据库（文档型）", en: "Document database" },
+    writeNoSqlDatabaseContent: { zh: "云数据库（文档型）", en: "Document database" },
+    queryMysqlDatabase: { zh: "云数据库（MySQL）", en: "MySQL" },
+    manageMysqlDatabase: { zh: "云数据库（MySQL）", en: "MySQL" },
+    queryPgDatabase: { zh: "云数据库（PostgreSQL）", en: "PostgreSQL" },
+    managePgDatabase: { zh: "云数据库（PostgreSQL）", en: "PostgreSQL" },
+    queryFunctions: { zh: "云函数", en: "Cloud functions" },
+    manageFunctions: { zh: "云函数", en: "Cloud functions" },
+    queryStorage: { zh: "云存储", en: "Cloud storage" },
+    manageStorage: { zh: "云存储", en: "Cloud storage" },
+    queryPgStorage: { zh: "云存储", en: "Cloud storage" },
+    queryAppAuth: { zh: "身份认证", en: "Auth" },
+    manageAppAuth: { zh: "身份认证", en: "Auth" },
+    queryCloudRun: { zh: "CloudRun", en: "CloudRun" },
+    manageCloudRun: { zh: "CloudRun", en: "CloudRun" },
+};
+/** Stay under common browser and proxy URL limits. Longer drafts are pasted by the user. */
+exports.FEEDBACK_PREFILL_URL_LIMIT = 6000;
+function resolveMcpVersion(declared, packageVersion) {
+    const fromBuild = typeof declared === "string" ? declared.trim() : "";
+    if (fromBuild) {
+        return fromBuild;
+    }
+    const fromPackage = typeof packageVersion === "string" ? packageVersion.trim() : "";
+    return fromPackage;
+}
+function readDeclaredMcpVersion() {
+    return  true ? "2.34.7" : 0;
+}
+function blank(value, lang) {
+    return value.trim().length > 0 ? value.trim() : (lang === "en" ? "blank" : "留空");
+}
+function feedbackSite(server) {
+    return (0, site_map_js_1.resolveSiteAndRegion)({
+        site: server.cloudBaseOptions?.site,
+        region: server.cloudBaseOptions?.region,
+    }).site;
+}
+function feedbackLang(site) {
+    return site === "intl" ? "en" : "zh";
+}
+function uniqueJoin(parts) {
+    const seen = new Set();
+    const ordered = [];
+    for (const part of parts) {
+        const trimmed = part.trim();
+        if (!trimmed || seen.has(trimmed)) {
+            continue;
+        }
+        seen.add(trimmed);
+        ordered.push(trimmed);
+    }
+    return ordered.join(" / ");
+}
+function readAgentLabel(server) {
+    const ide = server.ide || process.env.INTEGRATION_IDE || "";
+    const client = server.client || process.env.CLOUDBASE_MCP_CLIENT || "";
+    return uniqueJoin([ide, client]);
+}
+function toLocalIso(iso) {
+    const date = new Date(iso);
+    if (Number.isNaN(date.getTime())) {
+        return "";
+    }
+    const pad = (value) => String(value).padStart(2, "0");
+    const offsetMinutes = -date.getTimezoneOffset();
+    const sign = offsetMinutes >= 0 ? "+" : "-";
+    const absolute = Math.abs(offsetMinutes);
+    return (`${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}` +
+        `T${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}` +
+        `${sign}${pad(Math.floor(absolute / 60))}:${pad(absolute % 60)}`);
+}
+function resourceTypesFrom(outcomes, lang) {
+    const seen = new Set();
+    const types = [];
+    for (const outcome of outcomes) {
+        if (outcome.failed) {
+            continue;
+        }
+        const resourceType = RESOURCE_BY_TOOL[outcome.toolName]?.[lang];
+        if (!resourceType || seen.has(resourceType)) {
+            continue;
+        }
+        seen.add(resourceType);
+        types.push(resourceType);
+    }
+    return types;
+}
+function formatDeployDuration(outcomes, lang) {
+    const build = outcomes.filter((item) => !item.failed && item.toolName === "deployBuild");
+    const apply = outcomes.filter((item) => !item.failed && item.toolName === "deployApply");
+    if (build.length === 0 && apply.length === 0) {
+        return "";
+    }
+    const sum = (items) => items.reduce((total, item) => total + item.durationMs, 0);
+    const parts = [];
+    if (build.length > 0) {
+        parts.push(`deployBuild ${sum(build)}ms`);
+    }
+    if (apply.length > 0) {
+        parts.push(`deployApply ${sum(apply)}ms`);
+    }
+    const joined = parts.join(lang === "en" ? "; " : "；");
+    return lang === "en"
+        ? `${joined}. Cloud build time and end-to-end time cannot be separated from these tool names.`
+        : `${joined}。无法区分云端构建与端到端，只记录上述工具耗时，未补另一项`;
+}
+function latestDeployTime(outcomes) {
+    const deployOutcomes = outcomes.filter((item) => !item.failed && (item.toolName === "deployBuild" || item.toolName === "deployApply"));
+    if (deployOutcomes.length === 0) {
+        return "";
+    }
+    const latest = deployOutcomes.reduce((current, item) => (item.at > current.at ? item : current));
+    return toLocalIso(latest.at);
+}
+function failureLines(server, outcomes, lang) {
+    const counts = new Map();
+    for (const outcome of outcomes) {
+        if (!outcome.failed) {
+            continue;
+        }
+        counts.set(outcome.toolName, (counts.get(outcome.toolName) ?? 0) + 1);
+    }
+    const lines = [];
+    for (const [toolName, count] of counts) {
+        lines.push(lang === "en"
+            ? `- Verified: tool call failed ${toolName} ×${count}`
+            : `- 可验证事实：工具调用失败 ${toolName} ×${count}`);
+    }
+    const repeatPeak = (0, feedback_session_js_1.readRepeatPeak)(server);
+    if (repeatPeak > 0) {
+        lines.push(lang === "en"
+            ? `- Verified: peak consecutive identical structured errors ${repeatPeak}`
+            : `- 可验证事实：连续相同结构化错误峰值 ${repeatPeak}`);
+    }
+    return lines;
+}
+function collectSecretValues(server) {
+    const options = server.cloudBaseOptions;
+    return [options?.envId, options?.secretId, options?.secretKey, options?.token].filter((value) => typeof value === "string" && value.trim().length >= 6);
+}
+function redact(text, secrets) {
+    let redacted = text;
+    for (const secret of secrets) {
+        redacted = redacted.split(secret).join("");
+    }
+    return redacted;
+}
+function buildCaseDraft(server, outcomes, lang) {
+    const resources = resourceTypesFrom(outcomes, lang);
+    const empty = blank("", lang);
+    const resourceText = resources.length > 0 ? resources.join(lang === "en" ? ", " : "、") : empty;
+    const version = blank(resolveMcpVersion(readDeclaredMcpVersion(), process.env.npm_package_version), lang);
+    if (lang === "en") {
+        return [
+            "This issue will be public. Do not add an environment ID, secrets, or user data.",
+            `Work name: ${empty}`,
+            `One-line summary: ${empty}`,
+            `Public URL: ${empty}`,
+            `Cover / screenshot: ${empty}`,
+            `Agent / CLI: ${blank(readAgentLabel(server), lang)}`,
+            `Model: ${empty}`,
+            `MCP version: ${version}`,
+            `Deploy duration: ${blank(formatDeployDuration(outcomes, lang), lang)}`,
+            `Cloud resources: ${resourceText}`,
+            `Deploy time: ${blank(latestDeployTime(outcomes), lang)}`,
+            `Author: ${empty}`,
+            `Pitfalls: ${empty}`,
+            `Other notes: ${empty}`,
+        ].join("\n");
+    }
+    return [
+        "这条 Issue 会公开。不要补充环境 ID、密钥或用户数据。",
+        `作品名称：${empty}`,
+        `一句话简介：${empty}`,
+        `公网访问地址：${empty}`,
+        `封面 / 截图地址：${empty}`,
+        `Agent / CLI：${blank(readAgentLabel(server), lang)}`,
+        `所用模型：${empty}`,
+        `MCP 版本：${version}`,
+        `部署耗时：${blank(formatDeployDuration(outcomes, lang), lang)}`,
+        `用到的云资源：${resourceText}`,
+        `部署时间：${blank(latestDeployTime(outcomes), lang)}`,
+        `作者署名 / 主页：${empty}`,
+        `开发过程中踩到的坑：${empty}`,
+        `其他补充：${empty}`,
+    ].join("\n");
+}
+function buildRetrospectiveDraft(server, outcomes, lang) {
+    const resources = resourceTypesFrom(outcomes, lang);
+    const failures = failureLines(server, outcomes, lang);
+    const empty = blank("", lang);
+    if (lang === "en") {
+        const failureBlock = failures.length > 0
+            ? failures.join("\n")
+            : "No tool failures recorded in this session.";
+        const resourceBlock = resources.length > 0
+            ? resources.join(", ")
+            : empty;
+        return [
+            "This issue will be public. Do not add an environment ID, secrets, collection names, or function names.",
+            "Conversation turns are not collected. Do not invent a turn count.",
+            "",
+            "Tool failures:",
+            failureBlock,
+            "",
+            "Cloud resources:",
+            resourceBlock,
+        ].join("\n");
+    }
+    const failureBlock = failures.length > 0
+        ? failures.join("\n")
+        : "本次会话没有记录到工具失败。";
+    const resourceBlock = resources.length > 0
+        ? resources.join("、")
+        : empty;
+    return [
+        "这条 Issue 会公开。不要补充环境 ID、密钥、集合名或函数名。",
+        "不采集对话轮次。不要把失败次数写成轮次，也不要补一个数字。",
+        "",
+        "工具失败：",
+        failureBlock,
+        "",
+        "云资源：",
+        resourceBlock,
+    ].join("\n");
+}
+function buildFeedbackIssueUrl(site, channel, draft) {
+    return buildFeedbackIssueLink(site, channel, draft).url;
+}
+function buildFeedbackIssueLink(site, channel, draft) {
+    const title = site === "intl"
+        ? (channel === "case" ? "[case] " : "[retrospective] ")
+        : (channel === "case" ? "[案例] " : "[复盘] ");
+    const base = exports.FEEDBACK_ISSUE_NEW_URL[site];
+    const draftQuery = site === "intl"
+        ? `body=${encodeURIComponent(draft)}`
+        : `session=${encodeURIComponent(draft)}`;
+    const head = site === "intl"
+        ? `${base}?title=${encodeURIComponent(title)}`
+        : `${base}?template=${encodeURIComponent(channel === "case" ? CASE_TEMPLATE_FILE : RETROSPECTIVE_TEMPLATE_FILE)}&title=${encodeURIComponent(title)}`;
+    const prefilled = `${head}&${draftQuery}`;
+    if (prefilled.length <= exports.FEEDBACK_PREFILL_URL_LIMIT) {
+        return { url: prefilled, prefilled: true };
+    }
+    return { url: head, prefilled: false };
+}
+function buildFeedbackPayload(input) {
+    const site = feedbackSite(input.server);
+    const lang = feedbackLang(site);
+    const outcomes = (0, feedback_session_js_1.readToolOutcomes)(input.server);
+    const secrets = collectSecretValues(input.server);
+    const draft = redact(input.channel === "case"
+        ? buildCaseDraft(input.server, outcomes, lang)
+        : buildRetrospectiveDraft(input.server, outcomes, lang), secrets);
+    if (!input.confirmed) {
+        return {
+            success: true,
+            channel: input.channel,
+            confirmed: false,
+            submittable: false,
+            draft,
+            nextStep: lang === "en"
+                ? "Show this draft to the user unchanged. Do not give a submission link before they explicitly confirm. Do not rewrite it into a different write-up."
+                : "把这份 draft 原样给用户看。用户明确确认之前，不要给出提交链接，也不要改写成另一份说明。",
+        };
+    }
+    const link = buildFeedbackIssueLink(site, input.channel, draft);
+    const pasteHint = link.prefilled
+        ? ""
+        : (lang === "en"
+            ? " The link does not include the draft because the URL would be too long. Paste the draft into the session field."
+            : " 链接没有带上正文，因为地址过长。请把 draft 粘贴到「本次会话记录」。");
+    return {
+        success: true,
+        channel: input.channel,
+        confirmed: true,
+        submittable: true,
+        draft,
+        url: link.url,
+        nextStep: (lang === "en"
+            ? "The user confirmed. The link body is this draft. Do not submit a rewritten version, and do not submit it for them."
+            : "用户已确认。链接里的正文就是这份 draft。不要另写一版再提交，也不要代为提交。") + pasteHint,
+    };
+}
+function registerFeedbackTools(server) {
+    server.registerTool(exports.FEEDBACK_TOOL_NAME, {
+        title: "feedback.title",
+        description: "feedback.description",
+        inputSchema: {
+            channel: zod_1.z
+                .enum(["case", "retrospective"])
+                .describe("feedback.schema.channel"),
+            confirmed: zod_1.z
+                .boolean()
+                .optional()
+                .describe("feedback.schema.confirmed"),
+        },
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            openWorldHint: false,
+            category: "feedback",
+        },
+    }, async ({ channel, confirmed }) => {
+        return (0, json_content_js_1.jsonContent)(buildFeedbackPayload({
+            server,
+            channel,
+            confirmed: confirmed === true,
+        }));
+    });
+}
+
+
+/***/ },
+
+/***/ 65735
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+/**
+ * 云函数 ZIP 两段式部署·阶段 A：生成 COS 预签名上传地址。
+ *
+ * 通道来源（R1 探针实测裁决，见 output/2026-09-23-functions-zip-two-phase-design.md §4）：
+ * - DescribeBuildServiceCosInfo / build-service 上传 / GetTempCosInfo 三条通道全部判死
+ *   （CosTimestamp 稳定 InternalError；SCF 拉代码强制给桶名拼 -appid 后缀，共享 build 桶
+ *   永远拉不到；tempcos 桶全 region 404）。
+ * - 活通道：用环境自有存储桶（DescribeEnvs → Storages[0].Bucket/Region）+ 用户凭据
+ *   本地铸 COS q-sign 预签名 PUT URL。CloudBase 临时凭据可直接用于 COS（manager-node
+ *   storage 同款 SecretId+SecretKey+token 范式），但必须把 x-cos-security-token 纳入
+ *   签名 Headers 且请求时携带同名头。
+ *
+ * 设计约束：
+ * - 纯函数、零第三方依赖（node:crypto 即可）：签名算法从 cos-nodejs-sdk-v5 getAuth
+ *   逐行复刻，测试里与 SDK 真实现做黄金值对照，防止复刻漂移。
+ * - 预签名是本地 HMAC 计算：CAM 零新增权限、不暴露 appId（URL 用全桶名，阶段 B 回传
+ *   TCB 的 CosBucketName 用短名）、国际站天然可用。
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.stripAppIdSuffix = stripAppIdSuffix;
+exports.camSafeUrlEncode = camSafeUrlEncode;
+exports.buildCosPutAuthorization = buildCosPutAuthorization;
+exports.buildFunctionZipUpload = buildFunctionZipUpload;
+const crypto_1 = __webpack_require__(55511);
+/** 环境存储桶全名形如 `mybucket-1258016615`；TCB CosBucketName 只收短名（不带 -appid 后缀）。 */
+function stripAppIdSuffix(bucket) {
+    return bucket.replace(/-\d+$/, "");
+}
+/** 复刻 cos-nodejs-sdk-v5 util.camSafeUrlEncode：encodeURIComponent 强制编码 !'()* 五个字符。 */
+function camSafeUrlEncode(str) {
+    return encodeURIComponent(str)
+        .replace(/!/g, "%21")
+        .replace(/'/g, "%27")
+        .replace(/\(/g, "%28")
+        .replace(/\)/g, "%29")
+        .replace(/\*/g, "%2A");
+}
+/** 复刻 SDK getObjectKeys：原始 key 按小写比较排序（排序在编码之前）。 */
+function sortedKeys(obj) {
+    return Object.keys(obj).sort((a, b) => {
+        a = a.toLowerCase();
+        b = b.toLowerCase();
+        return a === b ? 0 : a > b ? 1 : -1;
+    });
+}
+/** 复刻 SDK obj2str(obj, true)：key 编码后小写、value 编码，按 key 升序以 & 连接。 */
+function encodeKv(obj) {
+    return sortedKeys(obj)
+        .map((key) => {
+        const k = camSafeUrlEncode(key).toLowerCase();
+        const v = camSafeUrlEncode(obj[key] ?? "");
+        return `${k}=${v}`;
+    })
+        .join("&");
+}
+/**
+ * 生成 COS q-sign 预签名授权串（PUT 方法）。
+ * 算法逐行复刻 cos-nodejs-sdk-v5 getAuth：
+ *   signKey      = HMAC-SHA1(SecretKey, KeyTime)
+ *   formatString = method \n pathname \n query-str \n header-str \n
+ *   stringToSign = sha1 \n KeyTime \n sha1(formatString) \n
+ *   signature    = HMAC-SHA1(signKey, stringToSign)
+ * Host 头始终签入（对齐 SDK ForceSignHost 默认 true），query 为空故 q-url-param-list 为空。
+ */
+function buildCosPutAuthorization(options) {
+    const { secretId, secretKey, bucket, region, objectKey, securityToken, expiresInSeconds = 3600, } = options;
+    if (!secretId)
+        throw new Error("missing param SecretId");
+    if (!secretKey)
+        throw new Error("missing param SecretKey");
+    if (!bucket)
+        throw new Error("missing param Bucket");
+    if (!region)
+        throw new Error("missing param Region");
+    if (!objectKey)
+        throw new Error("missing param objectKey");
+    const headers = {
+        host: `${bucket}.cos.${region}.myqcloud.com`,
+    };
+    if (securityToken) {
+        headers["x-cos-security-token"] = securityToken;
+    }
+    const keyTime = options.keyTime ??
+        (() => {
+            const now = options.now ?? Math.floor(Date.now() / 1000);
+            return `${now - 1};${now + expiresInSeconds}`;
+        })();
+    // 与请求 URL 一致的编码路径（对象 key 仅允许安全字符时与原始 key 相同）。
+    const pathname = `/${objectKey.split("/").map(encodeURIComponent).join("/")}`;
+    const signKey = (0, crypto_1.createHmac)("sha1", secretKey).update(keyTime).digest("hex");
+    const formatString = ["put", pathname, "", encodeKv(headers), ""].join("\n");
+    const stringToSign = [
+        "sha1",
+        keyTime,
+        (0, crypto_1.createHash)("sha1").update(Buffer.from(formatString, "utf8")).digest("hex"),
+        "",
+    ].join("\n");
+    const signature = (0, crypto_1.createHmac)("sha1", signKey).update(stringToSign).digest("hex");
+    const headerList = sortedKeys(headers)
+        .map((key) => camSafeUrlEncode(key).toLowerCase())
+        .join(";");
+    return [
+        "q-sign-algorithm=sha1",
+        `q-ak=${secretId}`,
+        `q-sign-time=${keyTime}`,
+        `q-key-time=${keyTime}`,
+        `q-header-list=${headerList}`,
+        "q-url-param-list=",
+        `q-signature=${signature}`,
+    ].join("&");
+}
+/**
+ * 生成两段式部署阶段 A 的完整返回体：预签名 PUT URL + 阶段 B 所需的 COS 三元组。
+ * 对象 key 形如 `fnzip-upload/{ts}-{rand}/{functionName|code}.zip`，全部为 COS 签名
+ * 安全字符（字母数字与 -_. /），保证签名 pathname 与请求 URL 一致。
+ */
+function buildFunctionZipUpload(params) {
+    const { storage, credential, functionName } = params;
+    const expiresIn = params.expiresIn ?? 3600;
+    const ts = params.now ?? Math.floor(Date.now() / 1000);
+    const rand = params.randomSuffix ?? (0, crypto_1.randomBytes)(8).toString("hex");
+    const objectKey = `fnzip-upload/${ts}-${rand}/${functionName || "code"}.zip`;
+    const keyTime = params.keyTime ?? `${ts - 1};${ts + expiresIn}`;
+    const authorization = buildCosPutAuthorization({
+        secretId: credential.secretId,
+        secretKey: credential.secretKey,
+        bucket: storage.bucket,
+        region: storage.region,
+        objectKey,
+        securityToken: credential.token || undefined,
+        keyTime,
+    });
+    return {
+        uploadUrl: `https://${storage.bucket}.cos.${storage.region}.myqcloud.com/${objectKey}?${authorization}`,
+        uploadHeaders: credential.token
+            ? [{ Key: "x-cos-security-token", Value: credential.token }]
+            : [],
+        cosBucketName: stripAppIdSuffix(storage.bucket),
+        cosBucketRegion: storage.region,
+        cosObjectName: objectKey,
+        expiresInSeconds: expiresIn,
+    };
+}
+
+
 /***/ },
 
 /***/ 84931
@@ -223270,7 +224152,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.CUSTOM_IMAGE_RUNTIME = exports.MASKED_ENV_VALUE = exports.LAYER_SOFT_WARN = exports.MANAGE_FUNCTION_ACTIONS = exports.QUERY_FUNCTION_ACTIONS = exports.TRIGGER_CONFIG_EXAMPLES = exports.SUPPORTED_TRIGGER_TYPES = exports.DEFAULT_NODEJS_RUNTIME = exports.SUPPORTED_NODEJS_RUNTIMES = exports.RECOMMENDED_RUNTIMES = exports.DEFAULT_RUNTIME = exports.ALL_SUPPORTED_RUNTIMES = exports.SUPPORTED_RUNTIMES = void 0;
+exports.CUSTOM_IMAGE_RUNTIME = exports.MASKED_ENV_VALUE = exports.LAYER_SOFT_WARN = exports.DEFAULT_FUNCTION_ALIAS = exports.MANAGE_FUNCTION_ACTIONS = exports.QUERY_FUNCTION_ACTIONS = exports.TRIGGER_CONFIG_EXAMPLES = exports.SUPPORTED_TRIGGER_TYPES = exports.DEFAULT_NODEJS_RUNTIME = exports.SUPPORTED_NODEJS_RUNTIMES = exports.RECOMMENDED_RUNTIMES = exports.DEFAULT_RUNTIME = exports.ALL_SUPPORTED_RUNTIMES = exports.SUPPORTED_RUNTIMES = void 0;
 exports.formatRuntimeList = formatRuntimeList;
 exports.layerNameIncludesEnvId = layerNameIncludesEnvId;
 exports.buildCreateLayerNameWarning = buildCreateLayerNameWarning;
@@ -223290,6 +224172,7 @@ const logger_js_1 = __webpack_require__(40781);
 const tool_result_js_1 = __webpack_require__(69645);
 const function_deploy_js_1 = __webpack_require__(39151);
 const function_deploy_schema_js_1 = __webpack_require__(76427);
+const function_cos_upload_js_1 = __webpack_require__(65735);
 const function_updating_js_1 = __webpack_require__(70326);
 const index_js_1 = __webpack_require__(24908);
 const fs_1 = __webpack_require__(29021);
@@ -223369,6 +224252,9 @@ exports.QUERY_FUNCTION_ACTIONS = [
     "listFunctionTriggers",
     "getFunctionDownloadUrl",
     "getFunctionDeployStatus",
+    "listVersionByFunction",
+    "getFunctionAlias",
+    "getFunctionUploadUrl",
 ];
 exports.MANAGE_FUNCTION_ACTIONS = [
     "createFunction",
@@ -223383,8 +224269,12 @@ exports.MANAGE_FUNCTION_ACTIONS = [
     "attachLayer",
     "detachLayer",
     "updateFunctionLayers",
+    "publishVersion",
+    "updateFunctionAliasConfig",
     "incrementalDeployFunction", // 增量部署，需通过 pluginOptions.functions 注入实现
 ];
+/** Default SCF traffic alias used by CloudBase CLI `fn get-route` / `fn config-route`. */
+exports.DEFAULT_FUNCTION_ALIAS = "$DEFAULT";
 /** Layer soft-warn copy — account-scoped SCF LayerName guidance (no hard fail). */
 exports.LAYER_SOFT_WARN = {
     createNameFormat: (envId) => (0, index_js_1.t)("functions.layerWarn.createNameFormat", { envId }),
@@ -223544,6 +224434,46 @@ const MANAGE_LAYER_SCHEMA = zod_1.z.object({
     layerName: zod_1.z.string().describe("functions.schema.manageLayer.name"),
     layerVersion: zod_1.z.number().describe("functions.schema.manageLayer.version"),
 });
+/**
+ * ZIP 两段式部署阶段 B 的 code 入参（camelCase，映射为 SDK 的 PascalCase code 三元组）。
+ * 三件套均来自 queryFunctions getFunctionUploadUrl 的返回体，原样透传即可。
+ * strict：拼错字段名直接报错，而不是被静默丢弃后按本地目录语义执行。
+ */
+const FUNCTION_CODE_SCHEMA = zod_1.z
+    .object({
+    cosBucketName: zod_1.z
+        .string()
+        .describe("functions.schema.code.cosBucketName"),
+    cosObjectName: zod_1.z
+        .string()
+        .describe("functions.schema.code.cosObjectName"),
+    cosBucketRegion: zod_1.z
+        .string()
+        .optional()
+        .describe("functions.schema.code.cosBucketRegion"),
+})
+    .strict();
+const FUNCTION_VERSION_WEIGHT_SCHEMA = zod_1.z.object({
+    Version: zod_1.z.string().describe("functions.schema.routing.version"),
+    Weight: zod_1.z.number().describe("functions.schema.routing.weight"),
+});
+const FUNCTION_VERSION_MATCH_SCHEMA = zod_1.z.object({
+    Version: zod_1.z.string().describe("functions.schema.routing.matchVersion"),
+    Key: zod_1.z.string().describe("functions.schema.routing.matchKey"),
+    Method: zod_1.z.string().describe("functions.schema.routing.matchMethod"),
+    Expression: zod_1.z.string().describe("functions.schema.routing.matchExpression"),
+});
+const FUNCTION_ROUTING_CONFIG_SCHEMA = zod_1.z.object({
+    AdditionalVersionWeights: zod_1.z
+        .array(FUNCTION_VERSION_WEIGHT_SCHEMA)
+        .optional()
+        .describe("functions.schema.routing.additionalWeights"),
+    // Keep SCF/SDK historical field name (typo included) as the public contract.
+    AddtionVersionMatchs: zod_1.z
+        .array(FUNCTION_VERSION_MATCH_SCHEMA)
+        .optional()
+        .describe("functions.schema.routing.additionalMatches"),
+});
 /**
  * Prefer top-level functionName; fall back to func.name for the common
  * mistake of nesting the target name under func (createFunction shape).
@@ -223722,6 +224652,48 @@ function registerFunctionTools(server) {
             throw new Error((0, index_js_1.t)("functions.confirmRequired", { action }));
         }
     };
+    /**
+     * 解析当前环境的自有存储桶（DescribeEnvs → Storages[0]）。
+     * 两段式部署的上传桶必须用环境自己的桶：共享 build 桶会被 SCF 拉
+     * 代码时的 -appid 拼接判死（R1 探针实测）。无存储的环境直接报错引导。
+     *
+     * DescribeEnvs 是账号级动作，环境级凭据（如 API Key 换取的 STS，
+     * remote MCP 临时 API Key 即此类）调用会被网关拒绝（invalid token），
+     * 此时回退到环境级的 DescribeEnvInfo —— 其 EnvBaseInfo.Storages 与
+     * DescribeEnvs 的 Storages 同构（实测两者均含 Bucket/Region/Status）。
+     */
+    const resolveEnvFunctionCosStorage = async () => {
+        const cloudbase = await getManager();
+        const envId = cloudBaseOptions?.envId ?? (await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions));
+        const tcbService = cloudbase.commonService("tcb", "2018-06-08");
+        const fetchStorages = async () => {
+            try {
+                const envsResult = (await tcbService.call({
+                    Action: "DescribeEnvs",
+                    Param: { EnvId: envId },
+                }));
+                const storages = envsResult?.EnvList?.[0]?.Storages ?? envsResult?.EnvInfo?.Storages ?? [];
+                if (storages.length > 0) {
+                    return storages;
+                }
+            }
+            catch (e) {
+                (0, logger_js_1.debug)("resolveEnvFunctionCosStorage: DescribeEnvs failed, falling back to DescribeEnvInfo", { envId, error: e instanceof Error ? e.message : String(e) });
+            }
+            const infoResult = (await tcbService.call({
+                Action: "DescribeEnvInfo",
+                Param: { EnvId: envId },
+            }));
+            return infoResult?.EnvInfo?.EnvBaseInfo?.Storages ?? [];
+        };
+        const storages = await fetchStorages();
+        const bucket = storages[0]?.Bucket ?? "";
+        const region = storages[0]?.Region ?? "";
+        if (!bucket || !region) {
+            throw new Error((0, index_js_1.t)("functions.storageMissing"));
+        }
+        return { bucket, region };
+    };
     const ensureActionAllowedInCloudMode = (input) => {
         if (!(0, cloud_mode_js_1.isCloudMode)()) {
             return;
@@ -223736,6 +224708,11 @@ function registerFunctionTools(server) {
             if (hasImageDeploy) {
                 return;
             }
+            // 两段式部署阶段 B：代码包已上传到环境 COS 桶，全程不依赖本地目录，
+            // 与镜像部署同属可在 cloud mode 下真实执行的路径。
+            if (Boolean(input.code)) {
+                return;
+            }
             throw new Error((0, index_js_1.t)("functions.cloudMode.localOnly", { action: input.action }));
         }
         if (input.action === "createLayerVersion" && input.contentPath) {
@@ -223954,7 +224931,13 @@ function registerFunctionTools(server) {
                 }
                 const cloudbase = await getManager();
                 const result = await cloudbase.functions.getFunctionDetail(input.functionName, input.codeSecret);
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                // 与 getFunctionDetail / listFunctionTriggers 一致：本 action 只想取 Layers，
+                // 但 getFunctionDetail 的返回里带着环境变量明文，日志与 raw 都必须脱敏 ——
+                // 否则一个只读的「看层」动作会把明文环境变量带进模型上下文与持久化日志。
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, maskFunctionDetailEnvValues(result));
+                const detail = input.revealEnvValues === true
+                    ? result
+                    : maskFunctionDetailEnvValues(result);
                 const layers = normalizeFunctionLayers(result.Layers);
                 return buildEnvelope({
                     action: input.action,
@@ -223962,7 +224945,7 @@ function registerFunctionTools(server) {
                     layers,
                     count: layers.length,
                     requestId: result.RequestId,
-                    raw: result,
+                    raw: detail,
                 }, (0, index_js_1.t)("functions.gotFunctionLayers", { fnName: input.functionName }), [
                     {
                         tool: "manageFunctions",
@@ -224110,6 +225093,116 @@ function registerFunctionTools(server) {
                     raw: result,
                 }, (0, index_js_1.t)("functions.gotDownloadUrl", { fnName: input.functionName }));
             }
+            case "listVersionByFunction": {
+                if (!input.functionName) {
+                    throw new Error((0, index_js_1.t)("functions.paramRequired", { action: input.action, param: "functionName" }));
+                }
+                const cloudbase = await getManager();
+                const result = await cloudbase.functions.listVersionByFunction({
+                    functionName: input.functionName,
+                    offset: input.offset,
+                    limit: input.limit,
+                    order: input.order,
+                    orderBy: input.orderBy,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action: input.action,
+                    functionName: input.functionName,
+                    functionVersions: result.FunctionVersion || [],
+                    versions: result.Versions || [],
+                    totalCount: result.TotalCount,
+                    requestId: result.RequestId,
+                    raw: result,
+                }, (0, index_js_1.t)("functions.gotFunctionVersions", { fnName: input.functionName }), [
+                    {
+                        tool: "manageFunctions",
+                        action: "publishVersion",
+                        reason: (0, index_js_1.t)("functions.reason.publishVersion"),
+                    },
+                    {
+                        tool: "queryFunctions",
+                        action: "getFunctionAlias",
+                        reason: (0, index_js_1.t)("functions.reason.getFunctionAlias"),
+                    },
+                ]);
+            }
+            case "getFunctionAlias": {
+                if (!input.functionName) {
+                    throw new Error((0, index_js_1.t)("functions.paramRequired", { action: input.action, param: "functionName" }));
+                }
+                const aliasName = input.aliasName || exports.DEFAULT_FUNCTION_ALIAS;
+                const cloudbase = await getManager();
+                const result = await cloudbase.functions.getFunctionAlias({
+                    functionName: input.functionName,
+                    name: aliasName,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action: input.action,
+                    functionName: input.functionName,
+                    aliasName,
+                    functionVersion: result.FunctionVersion,
+                    routingConfig: result.RoutingConfig,
+                    description: result.Description,
+                    addTime: result.AddTime,
+                    modTime: result.ModTime,
+                    requestId: result.RequestId,
+                    raw: result,
+                }, (0, index_js_1.t)("functions.gotFunctionAlias", {
+                    fnName: input.functionName,
+                    aliasName,
+                }), [
+                    {
+                        tool: "manageFunctions",
+                        action: "updateFunctionAliasConfig",
+                        reason: (0, index_js_1.t)("functions.reason.updateFunctionAlias"),
+                    },
+                    {
+                        tool: "queryFunctions",
+                        action: "listVersionByFunction",
+                        reason: (0, index_js_1.t)("functions.reason.listVersions"),
+                    },
+                ]);
+            }
+            case "getFunctionUploadUrl": {
+                // ZIP 两段式部署阶段 A：环境自有存储桶 + 用户凭据本地铸 COS 预签名 PUT URL。
+                // functionName 可选，仅用于生成可读的对象 key。
+                const cloudbase = await getManager();
+                const authConfig = cloudbase.currentEnvironment().getAuthConfig();
+                if (!authConfig?.secretId || !authConfig?.secretKey) {
+                    throw new Error((0, index_js_1.t)("functions.credentialMissing"));
+                }
+                const storage = await resolveEnvFunctionCosStorage();
+                const upload = (0, function_cos_upload_js_1.buildFunctionZipUpload)({
+                    storage,
+                    credential: {
+                        secretId: authConfig.secretId,
+                        secretKey: authConfig.secretKey,
+                        // 永久密钥时 token 为空串，转 undefined 才不签入 token 头
+                        token: authConfig.token || undefined,
+                    },
+                    functionName: input.functionName,
+                });
+                // uploadUrl 内含凭据绑定的签名（临时凭据还绑定 token），禁止落日志
+                (0, logger_js_1.debug)(`[getFunctionUploadUrl] envId=${authConfig.envId ?? "n/a"}, cosObjectName=${upload.cosObjectName}, expiresIn=${upload.expiresInSeconds}s`);
+                return buildEnvelope({
+                    action: input.action,
+                    ...(input.functionName ? { functionName: input.functionName } : {}),
+                    uploadUrl: upload.uploadUrl,
+                    uploadHeaders: upload.uploadHeaders,
+                    cosBucketName: upload.cosBucketName,
+                    cosBucketRegion: upload.cosBucketRegion,
+                    cosObjectName: upload.cosObjectName,
+                    expiresInSeconds: upload.expiresInSeconds,
+                }, (0, index_js_1.t)("functions.gotUploadUrl", { seconds: upload.expiresInSeconds }), [
+                    {
+                        tool: "manageFunctions",
+                        action: "createFunction",
+                        reason: (0, index_js_1.t)("functions.reason.cosCreate"),
+                    },
+                ]);
+            }
             default:
                 throw new Error((0, index_js_1.t)("functions.unsupportedAction", { action: input.action }));
         }
@@ -224366,6 +225459,63 @@ function registerFunctionTools(server) {
                         },
                     ]);
                 }
+                // code 入参（ZIP 两段式部署阶段 B）：代码包已由 getFunctionUploadUrl 上传到
+                // 环境 COS 桶，直接 deployMode=cos 提交，跳过本地目录 / 依赖安装逻辑。
+                if (input.code) {
+                    const storage = await resolveEnvFunctionCosStorage();
+                    const cosBucketName = (0, function_cos_upload_js_1.stripAppIdSuffix)(input.code.cosBucketName || storage.bucket);
+                    const cosBucketRegion = input.code.cosBucketRegion ?? storage.region;
+                    const codeFunc = { ...func };
+                    // 用户 zip 自带依赖语义（装没装由上传方决定），默认不触发云端依赖安装
+                    delete codeFunc.installDependency;
+                    if (input.func?.installDependency !== undefined) {
+                        codeFunc.installDependency = input.func.installDependency;
+                    }
+                    if (codeFunc.type !== "HTTP") {
+                        codeFunc.runtime = resolveEventFunctionRuntime(codeFunc.runtime);
+                    }
+                    let cosCreateResult;
+                    try {
+                        cosCreateResult = await cloudbase.functions.createFunction({
+                            func: codeFunc,
+                            code: {
+                                CosBucketName: cosBucketName,
+                                CosBucketRegion: cosBucketRegion,
+                                CosObjectName: input.code.cosObjectName,
+                            },
+                            deployMode: "cos",
+                            force: Boolean(input.force),
+                        });
+                    }
+                    catch (error) {
+                        throw wrapFunctionOperationError("createFunction", functionName, undefined, error);
+                    }
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, cosCreateResult);
+                    return buildEnvelope({
+                        action: input.action,
+                        functionName,
+                        deployMode: "cos",
+                        cosBucketName,
+                        cosBucketRegion,
+                        cosObjectName: input.code.cosObjectName,
+                        raw: cosCreateResult,
+                    }, (0, index_js_1.t)("functions.cosCreatedMessage", { fnName: functionName }), [
+                        {
+                            tool: "queryFunctions",
+                            action: "getFunctionDetail",
+                            reason: (0, index_js_1.t)("functions.reason.confirmConfig"),
+                        },
+                        ...(codeFunc.type === "HTTP"
+                            ? [
+                                {
+                                    tool: "manageGateway",
+                                    action: "createRoute",
+                                    reason: (0, index_js_1.t)("functions.reason.gatewayRouteForHttp"),
+                                },
+                            ]
+                            : []),
+                    ]);
+                }
                 if (func.type !== "HTTP") {
                     const originalRuntime = typeof func.runtime === "string" ? func.runtime : undefined;
                     func.runtime = resolveEventFunctionRuntime(func.runtime);
@@ -224574,6 +225724,58 @@ function registerFunctionTools(server) {
                         },
                     ]);
                 }
+                // code 入参（ZIP 两段式部署阶段 B）：zip 已在环境 COS 桶，直接 deployMode=cos
+                // 更新代码包，跳过 functionRootPath / zipFile 本地语义。
+                if (input.code) {
+                    const storage = await resolveEnvFunctionCosStorage();
+                    const cosBucketName = (0, function_cos_upload_js_1.stripAppIdSuffix)(input.code.cosBucketName || storage.bucket);
+                    const cosBucketRegion = input.code.cosBucketRegion ?? storage.region;
+                    let cosUpdateResult;
+                    try {
+                        cosUpdateResult = await cloudbase.functions.updateFunctionCode({
+                            func: {
+                                name: input.functionName,
+                                // 与 create 的 code 分支一致：默认不触发云端依赖安装，显式传参才覆盖
+                                ...(input.func?.installDependency !== undefined
+                                    ? { installDependency: input.func.installDependency }
+                                    : {}),
+                                ...(input.handler ? { handler: input.handler } : {}),
+                            },
+                            code: {
+                                CosBucketName: cosBucketName,
+                                CosBucketRegion: cosBucketRegion,
+                                CosObjectName: input.code.cosObjectName,
+                            },
+                            deployMode: "cos",
+                        });
+                    }
+                    catch (error) {
+                        if ((0, function_updating_js_1.isFunctionUpdatingError)(error)) {
+                            return (0, function_updating_js_1.buildFunctionUpdatingPayload)({
+                                action: "updateFunctionCode",
+                                functionName: input.functionName,
+                                rawMessage: (0, function_updating_js_1.getErrorMessage)(error),
+                            });
+                        }
+                        throw wrapFunctionOperationError("updateFunctionCode", input.functionName, undefined, error);
+                    }
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, cosUpdateResult);
+                    return buildEnvelope({
+                        action: input.action,
+                        functionName: input.functionName,
+                        deployMode: "cos",
+                        cosBucketName,
+                        cosBucketRegion,
+                        cosObjectName: input.code.cosObjectName,
+                        raw: cosUpdateResult,
+                    }, (0, index_js_1.t)("functions.cosUpdatedMessage", { fnName: input.functionName }), [
+                        {
+                            tool: "queryFunctions",
+                            action: "getFunctionDetail",
+                            reason: (0, index_js_1.t)("functions.reason.confirmConfig"),
+                        },
+                    ]);
+                }
                 const processedRootPath = processFunctionRootPath(input.functionRootPath, input.functionName);
                 const updateParams = {
                     func: {
@@ -224948,6 +226150,94 @@ function registerFunctionTools(server) {
                     },
                 ], bindWarnings);
             }
+            case "publishVersion": {
+                if (!input.functionName) {
+                    throw new Error((0, index_js_1.t)("functions.paramRequired", { action: input.action, param: "functionName" }));
+                }
+                const cloudbase = await getManager();
+                const result = await cloudbase.functions.publishVersion({
+                    functionName: input.functionName,
+                    description: input.description,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action: input.action,
+                    functionName: input.functionName,
+                    functionVersion: result.FunctionVersion,
+                    description: result.Description,
+                    codeSize: result.CodeSize,
+                    memorySize: result.MemorySize,
+                    handler: result.Handler,
+                    timeout: result.Timeout,
+                    runtime: result.Runtime,
+                    namespace: result.Namespace,
+                    requestId: result.RequestId,
+                    raw: result,
+                }, (0, index_js_1.t)("functions.publishedVersion", {
+                    fnName: input.functionName,
+                    version: result.FunctionVersion,
+                }), [
+                    {
+                        tool: "queryFunctions",
+                        action: "listVersionByFunction",
+                        reason: (0, index_js_1.t)("functions.reason.listVersions"),
+                    },
+                    {
+                        tool: "manageFunctions",
+                        action: "updateFunctionAliasConfig",
+                        reason: (0, index_js_1.t)("functions.reason.routeTraffic"),
+                        suggested_args: {
+                            functionName: input.functionName,
+                            functionVersion: result.FunctionVersion,
+                            aliasName: exports.DEFAULT_FUNCTION_ALIAS,
+                        },
+                    },
+                ]);
+            }
+            case "updateFunctionAliasConfig": {
+                if (!input.functionName) {
+                    throw new Error((0, index_js_1.t)("functions.paramRequired", { action: input.action, param: "functionName" }));
+                }
+                if (!input.functionVersion) {
+                    throw new Error((0, index_js_1.t)("functions.paramRequired", {
+                        action: input.action,
+                        param: "functionVersion",
+                    }));
+                }
+                const aliasName = input.aliasName || exports.DEFAULT_FUNCTION_ALIAS;
+                const cloudbase = await getManager();
+                const result = await cloudbase.functions.updateFunctionAliasConfig({
+                    functionName: input.functionName,
+                    name: aliasName,
+                    functionVersion: input.functionVersion,
+                    description: input.description,
+                    routingConfig: input.routingConfig,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action: input.action,
+                    functionName: input.functionName,
+                    aliasName,
+                    functionVersion: input.functionVersion,
+                    routingConfig: input.routingConfig,
+                    requestId: result.RequestId,
+                    raw: result,
+                }, (0, index_js_1.t)("functions.updatedFunctionAlias", {
+                    fnName: input.functionName,
+                    aliasName,
+                    version: input.functionVersion,
+                }), [
+                    {
+                        tool: "queryFunctions",
+                        action: "getFunctionAlias",
+                        reason: (0, index_js_1.t)("functions.reason.confirmAlias"),
+                        suggested_args: {
+                            functionName: input.functionName,
+                            aliasName,
+                        },
+                    },
+                ]);
+            }
             default:
                 // incrementalDeployFunction：无默认实现，必须通过 pluginOptions 注入
                 if (input.action === 'incrementalDeployFunction') {
@@ -225007,6 +226297,12 @@ function registerFunctionTools(server) {
                 .string()
                 .optional()
                 .describe("functions.schema.query.taskId"),
+            order: zod_1.z.string().optional().describe("functions.schema.query.order"),
+            orderBy: zod_1.z.string().optional().describe("functions.schema.query.orderBy"),
+            aliasName: zod_1.z
+                .string()
+                .optional()
+                .describe("functions.schema.query.aliasName"),
         },
         annotations: {
             readOnlyHint: true,
@@ -225030,6 +226326,7 @@ function registerFunctionTools(server) {
                 .optional()
                 .describe("functions.schema.manage.functionName"),
             zipFile: zod_1.z.string().optional().describe("functions.schema.manage.zipFile"),
+            code: FUNCTION_CODE_SCHEMA.optional().describe("functions.schema.manage.code"),
             handler: zod_1.z.string().optional().describe("functions.schema.manage.handler"),
             timeout: zod_1.z.number().optional().describe("functions.schema.manage.timeout"),
             envVariables: zod_1.z
@@ -225075,6 +226372,15 @@ function registerFunctionTools(server) {
                 .describe("functions.schema.manage.autoGrant"),
             confirm: zod_1.z.boolean().optional().describe("functions.schema.manage.confirm"),
             incrementalFile: zod_1.z.string().optional().describe("functions.schema.manage.incrementalFile"),
+            aliasName: zod_1.z
+                .string()
+                .optional()
+                .describe("functions.schema.manage.aliasName"),
+            functionVersion: zod_1.z
+                .string()
+                .optional()
+                .describe("functions.schema.manage.functionVersion"),
+            routingConfig: FUNCTION_ROUTING_CONFIG_SCHEMA.optional().describe("functions.schema.manage.routingConfig"),
         },
         annotations: {
             readOnlyHint: false,
@@ -227215,7 +228521,12 @@ function registerHostingTools(server) {
     });
     server.registerTool('manageHosting', {
         title: 'hosting.manageTitle',
-        description: 'hosting.manageDescription',
+        // cloud mode 下注册期即切换描述：upload/download 系 action 不可用、部署引导走
+        // manageApps 云端链路（getUploadUrl → PUT zip → deployApp(cosTimestamp)），
+        // 让 agent 在 tools/list 阶段就避开必败调用，而不是等报错后浪费一轮。
+        description: (0, cloud_mode_js_1.isCloudMode)()
+            ? 'hosting.manageDescriptionCloud'
+            : 'hosting.manageDescription',
         inputSchema: manageHostingInputSchema,
         annotations: {
             readOnlyHint: false,
@@ -227653,18 +228964,23 @@ const cloudbase_manager_js_1 = __webpack_require__(33109);
 const json_content_js_1 = __webpack_require__(18027);
 const index_js_1 = __webpack_require__(24908);
 const QUERY_LOG_ACTIONS = ["checkLogService", "searchLogs"];
-function buildEnvelope(data, message) {
+const MANAGE_LOG_ACTIONS = ["createLogService"];
+function buildEnvelope(data, message, extras) {
     return {
         success: true,
         data,
         message,
+        ...extras,
     };
 }
-function buildErrorEnvelope(error) {
+function buildErrorEnvelope(error, extras) {
     return {
         success: false,
-        data: {},
-        message: error instanceof Error ? error.message : String(error),
+        data: extras?.data ?? {},
+        message: extras?.message ??
+            (error instanceof Error ? error.message : String(error)),
+        errorCode: extras?.errorCode,
+        nextActions: extras?.nextActions,
     };
 }
 function registerLogTools(server) {
@@ -227737,6 +229053,89 @@ function registerLogTools(server) {
             return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
         }
     });
+    server.registerTool?.("manageLogs", {
+        title: "logs.manage.title",
+        description: "logs.manage.description",
+        inputSchema: {
+            action: zod_1.z
+                .enum(MANAGE_LOG_ACTIONS)
+                .describe("logs.manage.schema.action"),
+            confirm: zod_1.z
+                .boolean()
+                .optional()
+                .describe("logs.manage.schema.confirm"),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+            category: "logs",
+        },
+    }, async ({ action, confirm, }) => {
+        try {
+            if (action !== "createLogService") {
+                return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(new Error((0, index_js_1.t)("logs.manage.unsupportedAction", { action })), {
+                    errorCode: "UNSUPPORTED_ACTION",
+                }));
+            }
+            if (confirm !== true) {
+                return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(null, {
+                    errorCode: "CONFIRM_REQUIRED",
+                    message: (0, index_js_1.t)("logs.manage.create.confirmRequired"),
+                    data: { action },
+                    nextActions: [
+                        {
+                            tool: "manageLogs",
+                            action: "createLogService",
+                            suggested_args: { action: "createLogService", confirm: true },
+                            reason: (0, index_js_1.t)("logs.manage.create.needsConfirmation"),
+                        },
+                    ],
+                }));
+            }
+            const cloudbase = await getManager();
+            const enabled = await cloudbase.log.checkLogServiceEnabled();
+            if (enabled) {
+                return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                    action,
+                    enabled: true,
+                    alreadyEnabled: true,
+                }, (0, index_js_1.t)("logs.manage.create.alreadyEnabled"), {
+                    nextActions: [
+                        {
+                            tool: "queryLogs",
+                            action: "searchLogs",
+                            suggested_args: {
+                                action: "searchLogs",
+                                queryString: 'log:"ERROR"',
+                            },
+                            reason: (0, index_js_1.t)("logs.manage.create.nextSearch"),
+                        },
+                    ],
+                }));
+            }
+            const result = await cloudbase.log.createLogService();
+            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+            return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                action,
+                requestId: result.RequestId ?? null,
+                raw: result,
+            }, (0, index_js_1.t)("logs.manage.create.submitted"), {
+                nextActions: [
+                    {
+                        tool: "queryLogs",
+                        action: "checkLogService",
+                        suggested_args: { action: "checkLogService" },
+                        reason: (0, index_js_1.t)("logs.manage.create.nextCheck"),
+                    },
+                ],
+            }));
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    });
 }
 
 
@@ -229083,7 +230482,7 @@ function extractRiskyDocFieldOperations(securityRule) {
             continue;
         }
         const referencesNonIdDocField = /doc\.(?!_id\b)[A-Za-z_][A-Za-z0-9_]*/.test(expression);
-        const usesGetByDocId = /get\('database\.[^']+'\s*\+\s*doc\._id\)/.test(expression);
+        const usesGetByDocId = /get\(('database\.[^']+'\s*\+\s*doc\._id|`database\.[^`]*\$\{\s*doc\._id\s*\})\)/.test(expression);
         if (referencesNonIdDocField && !usesGetByDocId) {
             operations.push(operation);
         }
@@ -229093,8 +230492,8 @@ function extractRiskyDocFieldOperations(securityRule) {
 function buildRecommendedOwnerWriteRule(resourceId) {
     return JSON.stringify({
         create: "auth.uid != null",
-        update: "auth.uid != null && (get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid)",
-        delete: "auth.uid != null && (get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid)",
+        update: "auth.uid != null && (get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid)",
+        delete: "auth.uid != null && (get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid)",
     });
 }
 function buildRoleLookupNote() {
@@ -229156,7 +230555,9 @@ function buildInvalidGetPathHint(securityRule, resourceId) {
     if (!securityRule) {
         return undefined;
     }
-    const hasFieldEmbeddedInsideGetPath = /get\('database\.[^']+'\s*\+\s*[^)]*\+\s*'\.[A-Za-z_][A-Za-z0-9_]*'\)/.test(securityRule);
+    // get() 的 path 里嵌了字段名：拼接形态，或反引号模板里在 ${} 之后又接字段
+    const hasFieldEmbeddedInsideGetPath = /get\('database\.[^']+'\s*\+\s*[^)]*\+\s*'\.[A-Za-z_][A-Za-z0-9_]*'\)/.test(securityRule) ||
+        /get\(`database\.[^`]*\.\$\{[^}]+\}\.[A-Za-z_][A-Za-z0-9_]*`\)/.test(securityRule);
     if (!hasFieldEmbeddedInsideGetPath) {
         return undefined;
     }
@@ -229176,7 +230577,9 @@ function buildTemplateLiteralRuleHint(securityRule, resourceId) {
     if (!securityRule) {
         return undefined;
     }
-    const usesTemplateLiteralPlaceholderInRule = /\$\{(?:auth\.uid|doc\._id|doc\.[A-Za-z_][A-Za-z0-9_]*)\}/.test(securityRule);
+    // 反引号模板字符串是官方形态，必须先剥掉再判——否则会把正确的写法误报成错误
+    const withoutTemplateLiterals = securityRule.replace(/`[^`]*`/g, '');
+    const usesTemplateLiteralPlaceholderInRule = /['"][^'"]*\$\{(?:auth\.uid|doc\._id|doc\.[A-Za-z_][A-Za-z0-9_]*)\}/.test(withoutTemplateLiterals);
     if (!usesTemplateLiteralPlaceholderInRule) {
         return undefined;
     }
@@ -229737,9 +231140,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.SKILL_REMOTE_BASE_URL = void 0;
+exports.DOCS_BASE_HOST = exports.SKILL_REMOTE_BASE_URL = void 0;
 exports.resolveSkillSearchRoots = resolveSkillSearchRoots;
 exports.resolveDocsMarkdownPath = resolveDocsMarkdownPath;
+exports.toSiteRelativeDocPath = toSiteRelativeDocPath;
+exports.assertNoHostInDocPath = assertNoHostInDocPath;
 exports.isDocsHtmlFallback = isDocsHtmlFallback;
 exports.registerRagTools = registerRagTools;
 exports.buildSkillRawUrl = buildSkillRawUrl;
@@ -230168,6 +231573,74 @@ function resolveDocsMarkdownPath(docPath) {
         : `${base.replace(/\/index$/i, "")}.md`;
     return `${normalized}${hash}`;
 }
+/**
+ * 交给 `DocsService.readDoc()` 的地址**永远不含 host**。
+ *
+ * Manager SDK 的 `DocsService.readDoc()` 见到 `http` 前缀就把入参原样 fetch、并把整段响应体
+ * 回显给调用方（`@cloudbase/manager-node/lib/docs/index.js:101`）。等于 docPath 是一条「由服务端
+ * 发起任意 HTTP 请求、把响应交给调用方」的通路：只要入参能带主机，`http://127.0.0.1/...`、
+ * `http://169.254.169.254/...`（云主机元数据）就能把工具变成 SSRF 原语。
+ *
+ * 而 docPath 收到完整 URL 是**主线用法**，不能靠「拒绝一切 URL」收口：`findByName` /
+ * `listModuleDocs` 的数据源 `category.json` 里 1016 个文档值全部是
+ * `https://docs.cloudbase.net/...` 形态，`searchDocs`（Algolia）返回的 `url` 也是完整地址，
+ * AI 拿到之后自然是原样喂回 readDoc。
+ *
+ * 所以这里的做法是**剥掉主机**：官方文档站的地址只取 pathname（+ 锚点），其余主机直接拒绝。
+ * 效果比白名单更强 —— 不是「允许的 host 恰好只有一个」，而是**没有任何 host 能走到 fetch**，
+ * 请求目标恒为 SDK 里的 `DOCS_BASE_URL`；顺带也让 `resolveDocsMarkdownPath` 的 `.md` 后缀
+ * 拼接不再可能作用在主机上（旧实现里裸主机名会被拼成 `docs.cloudbase.net.md`——`.md` 是
+ * 可被第三方注册的国家顶级域）。
+ */
+exports.DOCS_BASE_HOST = "docs.cloudbase.net";
+/** 带 scheme 的绝对地址（`//host/path` 这类 protocol-relative 也算「指定了主机」）。 */
+const ABSOLUTE_DOC_URL_PATTERN = /^[a-z][a-z0-9+.-]*:\/\//i;
+function parseAbsoluteDocUrl(value) {
+    const candidate = value.startsWith("//") ? `https:${value}` : value;
+    if (!ABSOLUTE_DOC_URL_PATTERN.test(candidate)) {
+        return null;
+    }
+    try {
+        return new URL(candidate);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * 把 docPath 折成站内相对路径：官方文档站地址**丢掉 host**只留路径，非首方主机直接拒绝。
+ *
+ * 查询串一并丢弃：站点用 `<路径>.md` 寻址，query 不属于寻址的一部分，留着只会拼出
+ * `.../x.md?foo` 这种畸形地址。锚点保留（`resolveDocsMarkdownPath` 本就支持 `#`）。
+ */
+function toSiteRelativeDocPath(docPath) {
+    const raw = docPath.trim();
+    const parsed = parseAbsoluteDocUrl(raw);
+    if (!parsed) {
+        return raw;
+    }
+    const host = parsed.hostname.toLowerCase().replace(/\.$/, "");
+    const isAllowedProtocol = parsed.protocol === "http:" || parsed.protocol === "https:";
+    if (!isAllowedProtocol || host !== exports.DOCS_BASE_HOST) {
+        throw new Error((0, index_js_1.t)("rag.readDocUrlNotAllowed", { docPath: raw, host: exports.DOCS_BASE_HOST }));
+    }
+    const sitePath = `${parsed.pathname}${parsed.hash}`;
+    if (!sitePath.replace(/^\/+|\/+$/g, "")) {
+        throw new Error((0, index_js_1.t)("rag.readDocPathEmpty", { docPath: raw }));
+    }
+    return sitePath;
+}
+/**
+ * invariant：走到 SDK 的地址不能含 host。
+ *
+ * 归一化之后再过一次，保证「fetch 目标恒为首方基址」这条性质不依赖
+ * `resolveDocsMarkdownPath` 的实现细节 —— 它以后改动了也漏不掉。
+ */
+function assertNoHostInDocPath(sitePath) {
+    if (parseAbsoluteDocUrl(sitePath.trim())) {
+        throw new Error((0, index_js_1.t)("rag.readDocUrlNotAllowed", { docPath: sitePath, host: exports.DOCS_BASE_HOST }));
+    }
+}
 /**
  * 识别 SPA 兜底页：站点对不存在的 markdown 路径同样返回 200，正文是站点 HTML 外壳。
  * 用于把「静默返回一坨 HTML」换成明确的失败信息。
@@ -230288,14 +231761,22 @@ async function registerRagTools(server) {
                 }
                 if (resolvedAction === "readDoc") {
                     const resolvedDocPath = requireStringParam(docPath, "docPath", resolvedAction);
-                    const markdownPath = resolveDocsMarkdownPath(resolvedDocPath);
+                    // 先剥掉 host（非首方主机直接拒绝），再做 `.md` 归一化，最后复核一遍不含 host。
+                    // 三者顺序不能换：归一化会给路径补后缀，若让它作用在主机上就会把
+                    // `docs.cloudbase.net` 拼成 `docs.cloudbase.net.md`（`.md` 是第三方可注册的 TLD）。
+                    const siteDocPath = toSiteRelativeDocPath(resolvedDocPath);
+                    const markdownPath = resolveDocsMarkdownPath(siteDocPath);
+                    assertNoHostInDocPath(markdownPath);
                     const markdown = await docsManager.readDoc(markdownPath);
                     // 站点对没有 markdown 的路径也返回 200 + HTML 外壳，必须显式判失败，
                     // 否则会把整页 HTML 当成文档正文交给模型（旧行为就是这样静默出错的）。
                     if (isDocsHtmlFallback(markdown)) {
+                        // 「网页版」退路必须是绝对地址：走到这里 markdownPath 已不含 host，只给路径
+                        // 调用方没法直接抓。
+                        const pageUrl = `https://${exports.DOCS_BASE_HOST}${markdownPath.replace(/\.md(?=#|$)/i, "")}`;
                         throw new Error((0, index_js_1.t)("rag.readDocNotMarkdown", {
                             docPath: markdownPath,
-                            pageUrl: markdownPath.replace(/\.md(?=#|$)/i, ""),
+                            pageUrl,
                         }));
                     }
                     return (0, json_content_js_1.jsonContent)(buildDocsEnvelope(resolvedAction, { docPath: resolvedDocPath, markdownPath, content: markdown }, (0, index_js_1.t)("rag.readDocSuccess")));
@@ -230634,6 +232115,7 @@ const url_1 = __webpack_require__(79551);
 const zod_1 = __webpack_require__(21504);
 const index_js_1 = __webpack_require__(24908);
 const remote_url_safety_js_1 = __webpack_require__(23694);
+const project_config_js_1 = __webpack_require__(39175);
 // CloudBase 模板配置
 const TEMPLATES = {
     react: {
@@ -231119,6 +232601,23 @@ function registerSetupTools(server) {
                 };
             }
             const resolvedIDE = ideResolution.resolvedIDE;
+            let workspaceFolder;
+            try {
+                workspaceFolder = (0, project_config_js_1.resolveProjectRoot)();
+            }
+            catch (error) {
+                if (error instanceof project_config_js_1.ProjectRootError) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: (0, index_js_1.t)("setup.projectRoot.hostConfigDir", { dir: error.dir }),
+                            },
+                        ],
+                    };
+                }
+                throw error;
+            }
             // 验证IDE类型
             const ideValidation = validateIDE(resolvedIDE);
             if (!ideValidation.valid) {
@@ -231156,7 +232655,6 @@ function registerSetupTools(server) {
             // 创建过滤后的目录结构（当选择特定IDE时）
             const workingDir = await createFilteredDirectory(extractDir, filteredFiles, resolvedIDE);
             // 检查是否需要复制到项目目录
-            const workspaceFolder = process.env.WORKSPACE_FOLDER_PATHS || process.cwd();
             let finalFiles = [];
             let createdCount = 0;
             let overwrittenCount = 0;
@@ -232361,6 +233859,143 @@ function resolveRequestId(error) {
 }
 
 
+/***/ },
+
+/***/ 23379
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+/**
+ * In-process log of tool outcomes for an explicitly requested feedback draft.
+ *
+ * Hosted gateways may construct a new server object per request. The log is
+ * therefore keyed by a hash of the credential when one is present, and only
+ * falls back to the server object when no credential is available. The cache
+ * is bounded. Arguments are never stored, and the raw credential is not stored.
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.FEEDBACK_CREDENTIAL_LIMIT = exports.FEEDBACK_SESSION_LIMIT = void 0;
+exports.recordToolOutcome = recordToolOutcome;
+exports.readToolOutcomes = readToolOutcomes;
+exports.noteRepeatCount = noteRepeatCount;
+exports.readRepeatPeak = readRepeatPeak;
+exports.clearToolOutcomes = clearToolOutcomes;
+exports.__resetFeedbackSessionsForTests = __resetFeedbackSessionsForTests;
+const node_crypto_1 = __webpack_require__(75305);
+const MAX_OUTCOMES = 200;
+const MAX_CREDENTIALS = 64;
+const MAX_TOOL_NAME_LENGTH = 80;
+const byCredential = new Map();
+const byServer = new WeakMap();
+function credentialKey(server) {
+    const options = server.cloudBaseOptions;
+    const secretId = typeof options?.secretId === "string" ? options.secretId.trim() : "";
+    if (!secretId) {
+        return undefined;
+    }
+    const token = typeof options?.token === "string" ? options.token.trim() : "";
+    const site = typeof options?.site === "string" ? options.site.trim() : "";
+    return (0, node_crypto_1.createHash)("sha256").update(`${site}\n${secretId}\n${token}`).digest("hex");
+}
+function emptyBucket() {
+    return { outcomes: [], repeatPeak: 0, touchedAt: Date.now() };
+}
+function evictOldestCredential() {
+    let oldestKey;
+    let oldestTouched = Number.POSITIVE_INFINITY;
+    for (const [key, bucket] of byCredential) {
+        if (bucket.touchedAt < oldestTouched) {
+            oldestTouched = bucket.touchedAt;
+            oldestKey = key;
+        }
+    }
+    if (oldestKey) {
+        byCredential.delete(oldestKey);
+    }
+}
+function bucketFor(server) {
+    if (!server || typeof server !== "object") {
+        return undefined;
+    }
+    const key = credentialKey(server);
+    if (key) {
+        let bucket = byCredential.get(key);
+        if (!bucket) {
+            if (byCredential.size >= MAX_CREDENTIALS) {
+                evictOldestCredential();
+            }
+            bucket = emptyBucket();
+            byCredential.set(key, bucket);
+        }
+        bucket.touchedAt = Date.now();
+        return bucket;
+    }
+    let bucket = byServer.get(server);
+    if (!bucket) {
+        bucket = emptyBucket();
+        byServer.set(server, bucket);
+    }
+    return bucket;
+}
+function recordToolOutcome(server, input) {
+    const bucket = bucketFor(server);
+    if (!bucket) {
+        return;
+    }
+    const toolName = typeof input.toolName === "string" ? input.toolName.trim() : "";
+    if (!toolName) {
+        return;
+    }
+    const durationMs = Number.isFinite(input.durationMs) && input.durationMs >= 0
+        ? Math.round(input.durationMs)
+        : 0;
+    const at = typeof input.at === "string" && input.at.length > 0
+        ? input.at
+        : new Date().toISOString();
+    bucket.outcomes.push({
+        toolName: toolName.slice(0, MAX_TOOL_NAME_LENGTH),
+        durationMs,
+        failed: input.failed === true,
+        at,
+    });
+    if (bucket.outcomes.length > MAX_OUTCOMES) {
+        bucket.outcomes.splice(0, bucket.outcomes.length - MAX_OUTCOMES);
+    }
+}
+function readToolOutcomes(server) {
+    return bucketFor(server)?.outcomes ?? [];
+}
+function noteRepeatCount(server, count) {
+    const bucket = bucketFor(server);
+    if (!bucket || !Number.isFinite(count) || count <= 0) {
+        return;
+    }
+    const rounded = Math.round(count);
+    if (rounded > bucket.repeatPeak) {
+        bucket.repeatPeak = rounded;
+    }
+}
+function readRepeatPeak(server) {
+    return bucketFor(server)?.repeatPeak ?? 0;
+}
+function clearToolOutcomes(server) {
+    const key = server && typeof server === "object" ? credentialKey(server) : undefined;
+    if (key) {
+        byCredential.delete(key);
+        return;
+    }
+    if (server && typeof server === "object") {
+        byServer.delete(server);
+    }
+}
+function __resetFeedbackSessionsForTests() {
+    byCredential.clear();
+}
+exports.FEEDBACK_SESSION_LIMIT = MAX_OUTCOMES;
+exports.FEEDBACK_CREDENTIAL_LIMIT = MAX_CREDENTIALS;
+
+
 /***/ },
 
 /***/ 84173
@@ -232826,14 +234461,101 @@ async function sendDeployNotification(server, notificationData) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.ProjectRootError = void 0;
+exports.resolveProjectRoot = resolveProjectRoot;
+exports.requireProjectRoot = requireProjectRoot;
 exports.readCloudbaseRcBinding = readCloudbaseRcBinding;
 exports.readProjectConfig = readProjectConfig;
 exports.readProjectEnvId = readProjectEnvId;
 exports.writeProjectConfig = writeProjectConfig;
 const node_fs_1 = __webpack_require__(89971);
+const node_os_1 = __webpack_require__(81258);
 const node_path_1 = __webpack_require__(26743);
 const toolbox_1 = __webpack_require__(23233);
+const index_js_1 = __webpack_require__(24908);
 const CLOUDBASE_RC_FILENAME = "cloudbaserc.json";
+const PROJECT_ROOT_ENV_KEYS = [
+    "WORKSPACE_FOLDER_PATHS",
+    "PROJECT_ROOT",
+    "GITHUB_WORKSPACE",
+    "CI_PROJECT_DIR",
+    "BUILD_SOURCESDIRECTORY",
+];
+/** Thrown when the resolved directory is a host config root, not a project. */
+class ProjectRootError extends Error {
+    dir;
+    constructor(dir) {
+        super("setup.projectRoot.hostConfigDir");
+        this.name = "ProjectRootError";
+        this.dir = dir;
+    }
+}
+exports.ProjectRootError = ProjectRootError;
+function firstPathSegment(value) {
+    return value
+        .split(node_path_1.delimiter)
+        .map((segment) => segment.trim())
+        .find((segment) => segment.length > 0);
+}
+function isUnderHostConfig(candidate) {
+    const hostRoot = (0, node_path_1.resolve)((0, node_os_1.homedir)(), ".dsh");
+    const resolved = (0, node_path_1.resolve)(candidate);
+    const rel = (0, node_path_1.relative)(hostRoot, resolved);
+    return rel === "" || (!rel.startsWith("..") && !(0, node_path_1.isAbsolute)(rel));
+}
+/**
+ * Project directory for reads and writes.
+ *
+ * Explicit path, then host-injected workspace env vars, then process.cwd().
+ * A result under ~/.dsh is refused so tools do not treat the host profile as a project.
+ */
+function resolveProjectRoot(explicit) {
+    const trimmed = explicit?.trim();
+    let chosen;
+    if (trimmed) {
+        chosen = (0, node_path_1.resolve)(trimmed);
+    }
+    else {
+        let fromEnv;
+        for (const key of PROJECT_ROOT_ENV_KEYS) {
+            const raw = process.env[key];
+            if (!raw?.trim())
+                continue;
+            const first = firstPathSegment(raw);
+            if (first) {
+                fromEnv = (0, node_path_1.resolve)(first);
+                break;
+            }
+        }
+        chosen = fromEnv ?? (0, node_path_1.resolve)(process.cwd());
+    }
+    if (isUnderHostConfig(chosen)) {
+        throw new ProjectRootError(chosen);
+    }
+    return chosen;
+}
+/** Same as resolveProjectRoot, with the refusal already translated for tool output. */
+function requireProjectRoot(explicit) {
+    try {
+        return resolveProjectRoot(explicit);
+    }
+    catch (error) {
+        if (error instanceof ProjectRootError) {
+            throw new Error((0, index_js_1.t)("setup.projectRoot.hostConfigDir", { dir: error.dir }));
+        }
+        throw error;
+    }
+}
+function projectRootForConfig(cwd) {
+    try {
+        return resolveProjectRoot(cwd);
+    }
+    catch (error) {
+        if (error instanceof ProjectRootError)
+            return undefined;
+        throw error;
+    }
+}
 /**
  * 解析 cloudbaserc.json 字段值用于绑定（fail-safe：解析不出一律返回 undefined 回落下一级）：
  * - 字面量 → trim 后直接返回
@@ -232891,7 +234613,9 @@ function resolveBindingValue(raw, projectRoot) {
  */
 function readCloudbaseRcBinding(cwd) {
     try {
-        const projectRoot = cwd ?? process.env.WORKSPACE_FOLDER_PATHS ?? process.cwd();
+        const projectRoot = projectRootForConfig(cwd);
+        if (!projectRoot)
+            return undefined;
         const configPath = (0, node_path_1.join)(projectRoot, CLOUDBASE_RC_FILENAME);
         if (!(0, node_fs_1.existsSync)(configPath)) {
             return undefined;
@@ -232925,7 +234649,9 @@ function readCloudbaseRcBinding(cwd) {
  */
 function readProjectConfig(cwd) {
     try {
-        const projectRoot = cwd ?? process.env.WORKSPACE_FOLDER_PATHS ?? process.cwd();
+        const projectRoot = projectRootForConfig(cwd);
+        if (!projectRoot)
+            return undefined;
         const configPath = (0, node_path_1.join)(projectRoot, ".cloudbase", "project.json");
         if (!(0, node_fs_1.existsSync)(configPath)) {
             return undefined;
@@ -232973,7 +234699,9 @@ function readProjectEnvId(cwd) {
  */
 function writeProjectConfig(patch, cwd) {
     try {
-        const projectRoot = cwd ?? process.env.WORKSPACE_FOLDER_PATHS ?? process.cwd();
+        const projectRoot = projectRootForConfig(cwd);
+        if (!projectRoot)
+            return false;
         const configPath = (0, node_path_1.join)(projectRoot, ".cloudbase", "project.json");
         let existing = {};
         if ((0, node_fs_1.existsSync)(configPath)) {
@@ -233199,6 +234927,7 @@ function getRemoteUrlSafetyErrorMessage() {
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.REPEAT_GUARD_THRESHOLD = void 0;
+exports.getRepeatGuardSnapshot = getRepeatGuardSnapshot;
 exports.applyRepeatGuardToPayload = applyRepeatGuardToPayload;
 exports.resetRepeatGuard = resetRepeatGuard;
 exports.__resetRepeatGuardForTests = __resetRepeatGuardForTests;
@@ -233217,6 +234946,13 @@ exports.REPEAT_GUARD_THRESHOLD = 3;
 const REPEAT_GUARD_KEY_MAX_LENGTH = 200;
 let lastKey = null;
 let consecutiveCount = 0;
+/**
+ * Live streak only. Does not expose the dedup key: that key contains the raw
+ * error message, which may include secrets or identifiers.
+ */
+function getRepeatGuardSnapshot() {
+    return { consecutiveCount };
+}
 function buildRepeatGuardKey(payload) {
     const code = typeof payload.code === "string" ? payload.code : "";
     const message = typeof payload.message === "string" ? payload.message : "";
@@ -233689,7 +235425,7 @@ class TelemetryReporter {
         const arch = os_1.default.arch(); // 系统架构
         // Build-time injected version; guard for vitest / non-webpack runtimes.
         const mcpVersion = process.env.npm_package_version ||
-            ( true ? "2.34.5" : 0);
+            ( true ? "2.34.7" : 0);
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -234337,6 +236073,7 @@ const logger_js_1 = __webpack_require__(40781);
 const telemetry_js_1 = __webpack_require__(5198);
 const tool_result_js_1 = __webpack_require__(69645);
 const repeat_error_guard_js_1 = __webpack_require__(13);
+const feedback_session_js_1 = __webpack_require__(23379);
 const error_guidance_js_1 = __webpack_require__(81194);
 /**
  * Mirror annotations.category into _meta.category.
@@ -234412,7 +236149,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${( true ? "2.34.5" : 0) || 0 || 0}
+- MCP 版本：${( true ? "2.34.7" : 0) || 0 || 0}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -234446,6 +236183,8 @@ function createWrappedHandler(name, handler, server) {
     return async (args) => {
         const startTime = Date.now();
         let success = false;
+        let businessFailed = false;
+        let repeatCountSeen = 0;
         let errorMessage;
         let requestId;
         try {
@@ -234457,7 +236196,11 @@ function createWrappedHandler(name, handler, server) {
             }
             // 执行原始处理函数
             const result = await handler(args);
+            // Returned { success: false } is a business failure for the local
+            // session log. The telemetry flag below stays on the existing path.
+            businessFailed = (0, tool_result_js_1.isBusinessFailureToolResult)(result);
             success = true;
+            repeatCountSeen = (0, repeat_error_guard_js_1.getRepeatGuardSnapshot)().consecutiveCount;
             // 任一工具成功说明重复错误循环已被打破，清零连续错误计数
             (0, repeat_error_guard_js_1.resetRepeatGuard)();
             requestId = extractRequestIdFromToolResult(result);
@@ -234490,8 +236233,11 @@ function createWrappedHandler(name, handler, server) {
             if ((0, tool_result_js_1.isToolPayloadError)(error)) {
                 // 连续相同结构化错误达到阈值时注入 repeat_guard 升级提示，
                 // 打断无头客户端的原样重试循环（不改写 message，保持遥测聚合稳定）
-                throw new tool_result_js_1.ToolPayloadError((0, repeat_error_guard_js_1.applyRepeatGuardToPayload)(error.payload));
+                const payload = (0, repeat_error_guard_js_1.applyRepeatGuardToPayload)(error.payload);
+                repeatCountSeen = (0, repeat_error_guard_js_1.getRepeatGuardSnapshot)().consecutiveCount;
+                throw new tool_result_js_1.ToolPayloadError(payload);
             }
+            repeatCountSeen = (0, repeat_error_guard_js_1.getRepeatGuardSnapshot)().consecutiveCount;
             // In tests, avoid any extra work that may block (envId lookup, issue link generation, etc.)
             if (isTestEnvironment) {
                 throw error instanceof Error ? error : new Error(String(error));
@@ -234501,7 +236247,7 @@ function createWrappedHandler(name, handler, server) {
                 requestId,
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const mcpVersion =  true ? "2.34.5" : 0;
+            const mcpVersion =  true ? "2.34.7" : 0;
             const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
             const enhancedErrorMessage = `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息
@@ -234517,6 +236263,20 @@ function createWrappedHandler(name, handler, server) {
             throw enhancedError;
         }
         finally {
+            try {
+                (0, feedback_session_js_1.noteRepeatCount)(server, repeatCountSeen);
+                (0, feedback_session_js_1.recordToolOutcome)(server, {
+                    toolName: name,
+                    durationMs: Date.now() - startTime,
+                    failed: Boolean(errorMessage) || businessFailed,
+                });
+            }
+            catch (recordError) {
+                (0, logger_js_1.debug)("feedback session record failed", {
+                    toolName: name,
+                    error: recordError instanceof Error ? recordError.message : String(recordError),
+                });
+            }
             // 上报工具调用数据（测试环境中跳过，避免阻塞）
             const isTestEnvironment =  false || process.env.VITEST === "true";
             if (!isTestEnvironment) {