@cloudbase/cloudbase-mcp 2.34.6 → 2.34.8

package/dist/index.cjs

@@ -199407,6 +199407,7 @@ exports.getLoginState = getLoginState;
 exports.logout = logout;
 const toolbox_1 = __webpack_require__(23233);
 const logger_js_1 = __webpack_require__(40781);
+const project_config_js_1 = __webpack_require__(39175);
 const site_map_js_1 = __webpack_require__(34533);
 const auth = toolbox_1.AuthSupervisor.getInstance({});
 const authProgressState = {
@@ -199811,8 +199812,7 @@ async function peekLoginState(options) {
         if ('_type' in envVarLoginState && envVarLoginState._type === 'api_key') {
             (0, logger_js_1.debug)("peekLoginState: detected CLOUDBASE_API_KEY env var");
             try {
-                // 优先使用 IDE 注入的工作目录，其次 process.cwd()
-                const projectCwd = process.env.WORKSPACE_FOLDER_PATHS || process.cwd();
+                const projectCwd = (0, project_config_js_1.requireProjectRoot)();
                 // 换取网关按站点选型：显式 intl → ap-singapore；domestic/歧义 → toolbox 默认
                 // ap-shanghai（国内站多地域环境均经其全局路由，详见 resolveApiKeyExchangeRegion）
                 const exchangeRegion = (0, site_map_js_1.resolveApiKeyExchangeRegion)({
@@ -199969,7 +199969,7 @@ async function logout(options) {
         await toolbox_1.authStore.set("credential", slotted);
     }
     else if (site === LEGACY_SITE) {
-        const cwd = process.env.WORKSPACE_FOLDER_PATHS || process.cwd();
+        const cwd = (0, project_config_js_1.requireProjectRoot)();
         await auth.logout({ cwd });
     }
     resetAuthProgressState();
@@ -200009,6 +200009,7 @@ const logger_js_1 = __webpack_require__(40781);
 const tool_result_js_1 = __webpack_require__(69645);
 const site_map_js_1 = __webpack_require__(34533);
 const project_config_js_1 = __webpack_require__(39175);
+const local_endpoint_js_1 = __webpack_require__(16156);
 // Timeout for envId auto-resolution flow.
 // 10 minutes (600 seconds) - matches InteractiveServer timeout
 const ENV_ID_TIMEOUT = 600000;
@@ -200170,7 +200171,7 @@ async function listAvailableEnvCandidates(options) {
         }
         // When CLOUDBASE_ENV_ID is set and credentials are not explicit, skip DescribeEnvs.
         const hasExplicitCredentials = !!(cloudBaseOptions?.secretId && cloudBaseOptions?.secretKey);
-        if (process.env.CLOUDBASE_ENV_ID && !hasExplicitCredentials) {
+        if (process.env.CLOUDBASE_ENV_ID && !hasExplicitCredentials && !cloudBaseOptions?.requestFn && !process.env.CLOUDBASE_LOCAL_ENDPOINT) {
             return [{
                     envId: process.env.CLOUDBASE_ENV_ID,
                 }];
@@ -200181,7 +200182,7 @@ async function listAvailableEnvCandidates(options) {
         ...(regionOverride ? { region: regionOverride } : {}),
     }).region;
     let cloudbase;
-    if (cloudBaseOptions?.secretId && cloudBaseOptions?.secretKey) {
+    if (cloudBaseOptions?.requestFn || (cloudBaseOptions?.secretId && cloudBaseOptions?.secretKey)) {
         cloudbase = createCloudBaseManagerWithOptions({
             ...cloudBaseOptions,
             region,
@@ -200364,6 +200365,14 @@ class EnvironmentManager {
                 this._setCachedEnvId(loginState.envId);
                 return loginState.envId;
             }
+            // 3.1 未登录必须交回 AUTH_REQUIRED，不能继续往下走「选环境」。
+            // 未登录时拿不到任何环境候选，落到 throwEnvRequiredError 会输出
+            // 「当前已登录，但还没有可用环境」——把「没登录」误诊成「登录了但缺环境」。
+            // 调用方读到这句会去 set_env 选环境，而候选列表永远为空，只能原样重试。
+            // 与 getCloudBaseManager 的登录态分流保持同构。
+            if (!loginState) {
+                throwAuthRequiredError();
+            }
             // 4. 单环境自动绑定；多环境时返回结构化引导，不再触发交互弹窗
             const envCandidates = await listAvailableEnvCandidates({ loginState });
             if (envCandidates.length === 1) {
@@ -200412,11 +200421,13 @@ const envManager = new EnvironmentManager();
 exports.envManager = envManager;
 // 导出环境ID获取函数
 async function getEnvId(cloudBaseOptions) {
-    // 如果传入了 cloudBaseOptions 且包含 envId，直接返回
     if (cloudBaseOptions?.envId) {
         (0, logger_js_1.debug)('使用传入的 envId:', { envId: cloudBaseOptions.envId });
         return cloudBaseOptions.envId;
     }
+    if ((0, local_endpoint_js_1.resolveLocalEndpoint)()) {
+        return 'local';
+    }
     const cachedEnvId = envManager.getCachedEnvId() || process.env.CLOUDBASE_ENV_ID;
     if (cachedEnvId) {
         (0, logger_js_1.debug)('使用缓存中的 envId:', { envId: cachedEnvId });
@@ -200521,7 +200532,16 @@ async function getDatabaseInstanceId(options) {
  * 每次都实时获取最新的 token/secretId/secretKey
  */
 async function getCloudBaseManager(options = {}) {
-    const { requireEnvId = true, cloudBaseOptions, authStrategy = 'fail_fast', } = options;
+    const { requireEnvId = true, authStrategy = 'fail_fast', } = options;
+    let cloudBaseOptions = options.cloudBaseOptions;
+    const localEndpoint = (0, local_endpoint_js_1.resolveLocalEndpoint)();
+    if (localEndpoint && !cloudBaseOptions?.requestFn) {
+        cloudBaseOptions = {
+            ...cloudBaseOptions,
+            envId: cloudBaseOptions?.envId || 'local',
+            requestFn: (0, local_endpoint_js_1.createLocalCloudApiRequestFn)(localEndpoint),
+        };
+    }
     const hasDirectCredentials = !!(cloudBaseOptions?.secretId && cloudBaseOptions?.secretKey);
     const hasRequestFn = !!(cloudBaseOptions?.requestFn);
     // 如果传入了完整凭据或 requestFn，优先使用显式 CloudBase 配置
@@ -201626,6 +201646,7 @@ const msgPush_js_1 = __webpack_require__(26191);
 const setup_js_1 = __webpack_require__(8707);
 const envSetup_js_1 = __webpack_require__(57148);
 const interactive_js_1 = __webpack_require__(91838);
+const feedback_js_1 = __webpack_require__(99391);
 exports.en = {
     env: env_js_1.env.en,
     storage: storage_js_1.storage.en,
@@ -201655,6 +201676,7 @@ exports.en = {
     setup: setup_js_1.setup.en,
     envSetup: envSetup_js_1.envSetup.en,
     interactive: interactive_js_1.interactive.en,
+    feedback: feedback_js_1.feedback.en,
 };
 
 
@@ -201797,7 +201819,7 @@ const types_js_1 = __webpack_require__(89921);
 exports.apps = (0, types_js_1.defineModule)({
     queryTitle: "查询 CloudBase 应用部署状态",
     queryDescription: "查询 CloudBase 应用部署的应用和版本。可查应用列表/详情、版本列表/详情；部署后用 getAppVersion 按 buildId 轮询构建状态；getBuildLog 可查询构建日志用于诊断失败原因。\n" +
-        "action=getUploadUrl（只读）可获取预签名上传 URL：无本地文件系统时（cloud mode），先拿到 uploadUrl 自行 PUT 代码 zip，再用返回的 unixTimestamp 调 manageApps(action=deployApp, cosTimestamp) 触发部署。",
+        "action=getUploadUrl（只读）可获取预签名上传 URL：无本地文件系统时（cloud mode），先拿到 uploadUrl 自行 PUT 代码 zip，再用返回的 unixTimestamp 调 manageApps(action=deployApp, cosTimestamp) 触发部署。uploadUrl 是一次性上传凭据，不要外传或写进工单。",
     manageTitle: "部署应用到 CloudBase（独立子域名）",
     manageDescription: "部署 Web 应用到 CloudBase（构建前后端，部署到独立子域名）。\n" +
         "云端上传通道（cloud mode，无本地文件系统）：queryApps(action=getUploadUrl) 或 manageApps(action=getUploadUrl) 获取预签名上传 URL → agent 自行 PUT 代码 zip 到 uploadUrl（带 uploadHeaders 与 Content-Type: application/zip）→ 用返回的 unixTimestamp 作为 cosTimestamp 调 deployApp 触发部署。\n" +
@@ -201830,7 +201852,7 @@ exports.apps = (0, types_js_1.defineModule)({
     uploadStep1: "1. 将代码打包为 zip（排除 node_modules/.git）",
     uploadStep2: "2. 用 PUT 方法把 zip 上传到 uploadUrl，请求头带 Content-Type: application/zip 以及 uploadHeaders 中的每个 header",
     uploadStep3: "3. 调用 manageApps(action=\"deployApp\", serviceName=\"{serviceName}\", cosTimestamp=<unixTimestamp>) 触发部署",
-    getUploadUrlSuccess: "预签名上传 URL 获取成功。请将代码 zip PUT 上传到 uploadUrl（携带 uploadHeaders 与 Content-Type: application/zip），然后用返回的 unixTimestamp 作为 cosTimestamp 调用 manageApps(action=deployApp) 触发部署。",
+    getUploadUrlSuccess: "预签名上传 URL 获取成功。请将代码 zip PUT 上传到 uploadUrl（携带 uploadHeaders 与 Content-Type: application/zip），然后用返回的 unixTimestamp 作为 cosTimestamp 调用 manageApps(action=deployApp) 触发部署。uploadUrl 是一次性上传凭据，不要外传或写进工单。",
     getSuccess: "CloudBase 应用详情查询成功",
     listVersionsSuccess: "CloudBase 应用版本列表查询成功",
     buildIdRequired: "action=getBuildLog 时必须提供 buildId",
@@ -201893,7 +201915,7 @@ exports.apps = (0, types_js_1.defineModule)({
 }, {
     queryTitle: "Query CloudBase app deployment status",
     queryDescription: "Query CloudBase deployed apps and versions. Supports app list/detail and version list/detail; after deployment, poll build status by buildId with getAppVersion; getBuildLog retrieves build logs to diagnose failures.\n" +
-        "action=getUploadUrl (read-only) returns a pre-signed upload URL: without a local filesystem (cloud mode), fetch the uploadUrl, PUT the code zip yourself, then call manageApps(action=deployApp, cosTimestamp) with the returned unixTimestamp to trigger deployment.",
+        "action=getUploadUrl (read-only) returns a pre-signed upload URL: without a local filesystem (cloud mode), fetch the uploadUrl, PUT the code zip yourself, then call manageApps(action=deployApp, cosTimestamp) with the returned unixTimestamp to trigger deployment. The uploadUrl is a one-time upload credential; do not forward it or paste it into tickets.",
     manageTitle: "Deploy app to CloudBase (dedicated subdomain)",
     manageDescription: "Deploy web apps to CloudBase (builds frontend and backend, deploys to a dedicated subdomain).\n" +
         "Cloud upload channel (cloud mode, no local filesystem): queryApps(action=getUploadUrl) or manageApps(action=getUploadUrl) returns a pre-signed upload URL → agent PUTs the code zip to uploadUrl itself (with uploadHeaders and Content-Type: application/zip) → call deployApp with the returned unixTimestamp as cosTimestamp to trigger deployment.\n" +
@@ -201926,7 +201948,7 @@ exports.apps = (0, types_js_1.defineModule)({
     uploadStep1: "1. Pack the code into a zip (exclude node_modules/.git)",
     uploadStep2: "2. PUT the zip to uploadUrl with header Content-Type: application/zip and every header from uploadHeaders",
     uploadStep3: "3. Call manageApps(action=\"deployApp\", serviceName=\"{serviceName}\", cosTimestamp=<unixTimestamp>) to trigger deployment",
-    getUploadUrlSuccess: "Pre-signed upload URL obtained. PUT the code zip to uploadUrl (with uploadHeaders and Content-Type: application/zip), then call manageApps(action=deployApp) with the returned unixTimestamp as cosTimestamp to trigger deployment.",
+    getUploadUrlSuccess: "Pre-signed upload URL obtained. PUT the code zip to uploadUrl (with uploadHeaders and Content-Type: application/zip), then call manageApps(action=deployApp) with the returned unixTimestamp as cosTimestamp to trigger deployment. The uploadUrl is a one-time upload credential; do not forward it or paste it into tickets.",
     getSuccess: "CloudBase app details retrieved successfully",
     listVersionsSuccess: "CloudBase app version list retrieved successfully",
     buildIdRequired: "buildId is required when action=getBuildLog",
@@ -202008,7 +202030,7 @@ exports.capi = (0, types_js_1.defineModule)({
     docGuidanceCloudbase: "优先查阅 CloudBase API 概览 {controlPlaneUrl} 与云开发依赖资源接口指引 {dependencyUrl}。",
     docGuidanceMonitor: "请优先核对云监控（腾讯云可观测平台）官方 API 文档：API 概览 https://cloud.tencent.com/document/product/649/30343 ，单 Action 详细文档在 https://cloud.tencent.com/document/api/248/ 产品线下。",
     docGuidanceGeneric: "请优先核对对应官方云 API 文档；若你的场景其实是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请优先使用 OpenAPI / Swagger 或 searchKnowledgeBase(mode=\"openapi\")，不要继续猜测管控面 Action。",
-    camAuthGuidance: "这通常是 CAM 权限不足（常见于 API Key 登录仅授权数据面：DB/函数/存储）。请任选其一：1) 改用 device code 登录管控面：auth(action=\"start_auth\", authMode=\"device\")；2) 或使用腾讯云 SecretId/SecretKey（确认子账号已授 CAM 策略，如 QcloudTCBFullAccess、QcloudVPCReadOnlyAccess）；3) 确认目标资源属于当前登录账号。",
+    camAuthGuidance: "这是 CAM 权限不足。先分清是谁缺权限，再决定怎么补：用 auth(action=\"status\") 看 credential_scope，用 callCloudApi(service=\"sts\", action=\"GetCallerIdentity\") 看实际调用者（Type=CAMRole 表示角色扮演身份，UserId 里带角色名）。若缺权限的是角色（如 TCB_QcsRole），补的是挂在**角色**上的策略 —— 给用户一条 cam/role/grant 一键授权链接，拼法与 principal 取值见 skill cloud-api-operations 的 §3.2；若是账号级身份本人，则由主账号给这个身份追加策略（用腾讯云 SecretId/SecretKey 登录时，调用者就是该身份）。环境级 API Key 只能访问绑定环境的数据面，跨产品调用需改用账号级凭据：auth(action=\"start_auth\", authMode=\"device\")。另请确认目标资源确实属于当前账号。",
     errorInvalidAction: "Action `{action}` 可能不存在或不对外开放。请不要继续猜测 Action 名称，先确认 service=`{service}` 下该 Action 在当前 API 版本是否真实存在。",
     errorSuggestedActions: "可能的 tcb Action：{candidates}。",
     errorRegionParam: "Region 不是 Action body 参数。请使用 callCloudApi 顶层参数 region（例如 region=\"ap-singapore\"），对应 X-TC-Region。",
@@ -202042,7 +202064,7 @@ exports.capi = (0, types_js_1.defineModule)({
     docGuidanceCloudbase: "Prefer the CloudBase API overview {controlPlaneUrl} and the dependent-resource API guide {dependencyUrl}.",
     docGuidanceMonitor: "Check the official Cloud Monitor (Tencent Cloud Observability Platform) API docs first: API overview https://cloud.tencent.com/document/product/649/30343 , per-Action docs live under https://cloud.tencent.com/document/api/248/ .",
     docGuidanceGeneric: "Check the corresponding official cloud API docs first; if your scenario is actually integrating CloudBase business APIs such as auth/functions/cloudrun/storage/mysqldb over HTTP, prefer OpenAPI / Swagger or searchKnowledgeBase(mode=\"openapi\") instead of guessing control-plane Actions.",
-    camAuthGuidance: "This is usually insufficient CAM permission (common with API Key logins that only grant the data plane: DB/functions/storage). Pick one: 1) switch to device code login for the control plane: auth(action=\"start_auth\", authMode=\"device\"); 2) or use Tencent Cloud SecretId/SecretKey (ensure the sub-account has CAM policies such as QcloudTCBFullAccess, QcloudVPCReadOnlyAccess); 3) confirm the target resource belongs to the logged-in account.",
+    camAuthGuidance: "This is a CAM permission gap. Work out who is missing it before choosing a fix: auth(action=\"status\") shows credential_scope, and callCloudApi(service=\"sts\", action=\"GetCallerIdentity\") shows the actual caller (Type=CAMRole means an assumed role; the UserId carries the role name). When the role is the one missing permission (e.g. TCB_QcsRole), the fix is a policy attached to that role — give the user a cam/role/grant authorization link, built as described in the cloud-api-operations skill, section 3.2. When an account-level identity is the caller, the main account attaches the policy to it (signing in with a Tencent Cloud SecretId/SecretKey makes the caller that identity). An environment-level API Key can only reach the bound environment's data plane; for cross-product calls switch to account-level credentials: auth(action=\"start_auth\", authMode=\"device\"). Also confirm the target resource belongs to the current account.",
     errorInvalidAction: "Action `{action}` may not exist or is not publicly available. Do not keep guessing Action names; first confirm the Action actually exists under service=`{service}` in the current API version.",
     errorSuggestedActions: "Possible tcb Actions: {candidates}.",
     errorRegionParam: "Region is not an Action body parameter. Use the callCloudApi top-level region parameter (e.g. region=\"ap-singapore\"), which maps to X-TC-Region.",
@@ -202086,7 +202108,7 @@ exports.cloudrun = (0, types_js_1.defineModule)({
     "manage.description": "管理云托管服务，按开发顺序支持：开通云托管环境（initEnv）、初始化项目（可从模板开始，模板列表可通过 queryCloudRun 查询）、下载服务代码、本地运行（仅函数型服务）、部署代码、仅更新配置（updateConfig，无需重新上传代码）、删除服务。deploy 支持两种方式：1) 源码构建（传入 targetPath，本地代码打包上传，默认路径）；2) 已有镜像部署（传入 imageUrl，如 ccr.ccs.tencentyun.com/ns/img:v1，走 DeployType=image 容器型部署，targetPath 可省略）。deploy 语义为「触发部署 + 轻量等待任务注册」（最多约 45s；不需要 buildId 时可传 waitRegistration=false 跳过等待）。源码构建返回 buildId，用 getDeployLog 轮询构建进度后再 getProcessLog；镜像部署（imageUrl）BuildId 常为 0，跳过 getDeployLog，返回 runId/next_step 引导 getProcessLog（或先 getDeployRecords 取 RunId）。若用户明确指定镜像或无需重新构建，必须传 imageUrl，不要仅因本地有源码目录就回退到源码构建。deploy 对已存在服务会先读取远程配置再合并（保留 VpcConf/EnvParams/OpenAccessTypes）。updateConfig 对齐控制台服务设置页。删除操作需要确认，建议设置force=true。新环境首次部署前若提示未开通云托管，先调用 initEnv 开通（异步、幂等）。",
     "error.managerInitFailed": "CloudBase Manager 初始化失败，请检查凭据与环境配置。",
     "error.unsupportedAction": "不支持的操作：{action}",
-    "error.pathOutsideCwd": "路径必须在当前工作目录内：{cwd}",
+    "error.pathOutsideCwd": "路径必须在当前工作目录内：{cwd}。允许：`{cwd}` 下的路径，或传入项目目录的绝对路径（相对路径不能通过 `../` 逃逸 CWD）。收到的解析路径：{resolvedPath}。建议：将 targetPath 设为项目绝对路径（deploy/download/init）。",
     "error.commonServiceQueryEnv": "当前 CloudBase Manager 不支持 commonService，无法查询云托管环境开通状态。",
     "error.commonServiceInitEnv": "当前 CloudBase Manager 不支持 commonService，无法初始化云托管环境。",
     "error.commonServiceSubmitDiff": "当前 CloudBase Manager 不支持 commonService，无法调用 SubmitServerConfigChangeDiff。",
@@ -202276,7 +202298,7 @@ exports.cloudrun = (0, types_js_1.defineModule)({
     "manage.description": "Manage CloudRun services, in development order: provision the CloudRun env (initEnv), initialize a project (optionally from a template; list templates via queryCloudRun), download service code, run locally (function services only), deploy code, update config only (updateConfig, no code upload needed), and delete the service. deploy supports two modes: 1) source build (pass targetPath; local code is packaged and uploaded, the default); 2) existing image deploy (pass imageUrl, e.g. ccr.ccs.tencentyun.com/ns/img:v1; DeployType=image container deploy, targetPath optional). deploy means \"trigger deploy + lightweight wait for task registration\" (up to ~45s; pass waitRegistration=false to skip the wait when you don't need the buildId). Source builds return buildId — poll getDeployLog for build progress, then getProcessLog; image deploys (imageUrl) usually have BuildId=0 — getDeployLog is skipped, and runId/next_step guide you to getProcessLog (or getDeployRecords first for RunId). If the user explicitly specifies an image or no rebuild is needed, you must pass imageUrl instead of falling back to a source build just because a local source directory exists. For existing services, deploy reads the remote config first and merges (preserving VpcConf/EnvParams/OpenAccessTypes). updateConfig aligns with the console service settings page. Deletion requires confirmation; set force=true. If a new env reports CloudRun not provisioned before the first deploy, call initEnv first (async, idempotent).",
     "error.managerInitFailed": "Failed to initialize CloudBase manager. Please check your credentials and environment configuration.",
     "error.unsupportedAction": "Unsupported action: {action}",
-    "error.pathOutsideCwd": "Path must be within current working directory: {cwd}",
+    "error.pathOutsideCwd": "Path must be within current working directory: {cwd}. Allowed: paths under `{cwd}`, or pass an absolute path to the project directory (relative paths cannot escape CWD via `../`). Received resolved path: {resolvedPath}. Suggestion: set targetPath to the absolute project path (deploy/download/init).",
     "error.commonServiceQueryEnv": "Current CloudBase Manager does not support commonService; cannot query CloudRun env status.",
     "error.commonServiceInitEnv": "Current CloudBase Manager does not support commonService; cannot initialize CloudRun env.",
     "error.commonServiceSubmitDiff": "Current CloudBase Manager does not support commonService; cannot call SubmitServerConfigChangeDiff.",
@@ -203215,11 +203237,28 @@ exports.databaseSQL = (0, types_js_1.defineModule)({
     "gate.pgOnlyMode": "当前环境（{envId}）已开通 PostgreSQL，MySQL 不可用。请改用 managePgDatabase / queryPgDatabase，而不是 manageMysqlDatabase / queryMysqlDatabase。",
     "gate.useManagePg": "请使用 managePgDatabase 执行 PostgreSQL 操作",
     "queryMysqlDatabase.title": "查询 CloudBase MySQL 数据库状态或执行只读 SQL",
-    "queryMysqlDatabase.description": "查询 CloudBase MySQL 数据库信息。支持执行只读 SQL、查询 MySQL 开通结果、查询 MySQL 任务状态，以及获取当前实例生命周期上下文。标准 getInstanceInfo/describeInstance 不返回连接凭据；仅 getConnectionInfo 透传原始连接/集群载荷（含可能的凭据），且仅用于显式 TCP 迁移。业务 CRUD 优先使用 SDK 或 runQuery/runStatement。",
-    "schema.query.action": "runQuery=执行只读 SQL；describeCreateResult=查询 CreateMySQL 结果；describeTaskStatus=查询 MySQL 任务状态；getInstanceInfo=获取不含连接凭据的生命周期上下文；describeInstance=getInstanceInfo 的别名；getConnectionInfo=透传可能包含凭据的原始连接/集群载荷（仅限 TCP 迁移例外场景）",
+    "queryMysqlDatabase.description": "查询 CloudBase MySQL 数据库信息。支持执行只读 SQL、查询 MySQL 开通结果、查询 MySQL 任务状态、获取当前实例生命周期上下文，以及查询实例慢查询/错误日志（对齐 Manager SDK describeInstanceSlowQueries / describeInstanceErrorLogs）。标准 getInstanceInfo/describeInstance 不返回连接凭据；仅 getConnectionInfo 透传原始连接/集群载荷（含可能的凭据），且仅用于显式 TCP 迁移。业务 CRUD 优先使用 SDK 或 runQuery/runStatement。",
+    "schema.query.action": "runQuery=执行只读 SQL；describeCreateResult=查询 CreateMySQL 结果；describeTaskStatus=查询 MySQL 任务状态；getInstanceInfo=获取不含连接凭据的生命周期上下文；describeInstance=getInstanceInfo 的别名；getConnectionInfo=透传可能包含凭据的原始连接/集群载荷（仅限 TCP 迁移例外场景）；describeInstanceSlowQueries=查询实例慢查询日志；describeInstanceErrorLogs=查询实例错误日志",
     "schema.query.sql": "action=runQuery 使用的只读 SQL",
-    "schema.query.request": "describeCreateResult/describeTaskStatus 使用的官方请求载荷",
-    "schema.query.dbInstance": "runQuery 可选的 SQL 数据库实例上下文",
+    "schema.query.request": "describeCreateResult/describeTaskStatus/describeInstanceSlowQueries/describeInstanceErrorLogs 使用的官方请求载荷（可含 InstanceId 等）",
+    "schema.query.dbInstance": "runQuery / 慢查/错误日志可选的 SQL 数据库实例上下文",
+    "schema.query.startTime": "慢查/错误日志查询开始时间（YYYY-MM-DD HH:mm:ss）",
+    "schema.query.endTime": "慢查/错误日志查询结束时间（YYYY-MM-DD HH:mm:ss）",
+    "schema.query.limit": "慢查/错误日志返回条数限制",
+    "schema.query.offset": "慢查/错误日志分页偏移",
+    "schema.query.username": "慢查过滤：用户名",
+    "schema.query.host": "慢查过滤：客户端 host",
+    "schema.query.database": "慢查过滤：数据库名",
+    "schema.query.orderBy": "排序字段。慢查支持 QueryTime/LockTime/RowsExamined/RowsSent；错误日志支持 Timestamp",
+    "schema.query.orderByType": "排序方向：asc/desc（大小写均可）",
+    "schema.query.sqlText": "慢查过滤：SQL 文本片段",
+    "schema.query.logLevels": "错误日志等级过滤，可选值：error / warning / note",
+    "schema.query.keyWords": "错误日志关键字模糊搜索列表",
+    "instanceLogs.notProvisioned": "MySQL 尚未开通，无法查询实例慢查/错误日志。",
+    "instanceLogs.instanceIdRequired": "无法解析 CynosDB InstanceId。请先 getInstanceInfo，或通过 dbInstance.instanceId / request.InstanceId 传入。",
+    "instanceLogs.resolveInstanceId": "先查询实例信息以获取可用的 InstanceId。",
+    "instanceLogs.slowQueriesSuccess": "MySQL 实例慢查询日志检索成功。",
+    "instanceLogs.errorLogsSuccess": "MySQL 实例错误日志检索成功。",
     "manageMysqlDatabase.title": "管理 CloudBase MySQL 数据库生命周期或执行写入 SQL",
     "manageMysqlDatabase.description": "管理 CloudBase MySQL 数据库资源。支持开通 MySQL、销毁 MySQL、执行写入 SQL/DDL，以及初始化数据库 Schema。注意：必须先开通 MySQL（action=provisionMySQL，confirm=true）才能执行 runStatement 或 initializeSchema。若 MySQL 尚未开通，工具会返回 MYSQL_NOT_CREATED 并给出开通的 nextAction 提示。",
     "schema.manage.action": "provisionMySQL=创建 MySQL 实例；destroyMySQL=销毁 MySQL 实例；runStatement=执行写入 SQL 或 DDL；initializeSchema=按顺序执行 Schema 初始化语句",
@@ -203290,11 +203329,28 @@ exports.databaseSQL = (0, types_js_1.defineModule)({
     "gate.pgOnlyMode": "This environment ({envId}) has PostgreSQL enabled but MySQL is NOT available. Use managePgDatabase / queryPgDatabase instead of manageMysqlDatabase / queryMysqlDatabase.",
     "gate.useManagePg": "Use managePgDatabase for PostgreSQL operations",
     "queryMysqlDatabase.title": "Query CloudBase MySQL database status or run read-only SQL",
-    "queryMysqlDatabase.description": "Query CloudBase MySQL database information. Supports running read-only SQL, checking the MySQL provisioning result, querying MySQL task status, and getting the current instance lifecycle context. Standard getInstanceInfo/describeInstance never returns connection credentials; only getConnectionInfo passes through the raw connection/cluster payload (possibly including credentials), and only for explicit TCP migration. Prefer the SDK or runQuery/runStatement for business CRUD.",
-    "schema.query.action": "runQuery=execute read-only SQL; describeCreateResult=query CreateMySQL result; describeTaskStatus=query MySQL task status; getInstanceInfo=get lifecycle context without connection credentials; describeInstance=alias of getInstanceInfo; getConnectionInfo=passthrough raw connection/cluster payload including possible credentials (TCP migration exception only)",
+    "queryMysqlDatabase.description": "Query CloudBase MySQL database information. Supports running read-only SQL, checking the MySQL provisioning result, querying MySQL task status, getting the current instance lifecycle context, and querying instance slow queries / error logs (aligned with Manager SDK describeInstanceSlowQueries / describeInstanceErrorLogs). Standard getInstanceInfo/describeInstance never returns connection credentials; only getConnectionInfo passes through the raw connection/cluster payload (possibly including credentials), and only for explicit TCP migration. Prefer the SDK or runQuery/runStatement for business CRUD.",
+    "schema.query.action": "runQuery=execute read-only SQL; describeCreateResult=query CreateMySQL result; describeTaskStatus=query MySQL task status; getInstanceInfo=get lifecycle context without connection credentials; describeInstance=alias of getInstanceInfo; getConnectionInfo=passthrough raw connection/cluster payload including possible credentials (TCP migration exception only); describeInstanceSlowQueries=query instance slow query logs; describeInstanceErrorLogs=query instance error logs",
     "schema.query.sql": "Read-only SQL used by action=runQuery",
-    "schema.query.request": "Official request payload used by describeCreateResult/describeTaskStatus",
-    "schema.query.dbInstance": "Optional SQL database instance context for runQuery",
+    "schema.query.request": "Official request payload used by describeCreateResult/describeTaskStatus/describeInstanceSlowQueries/describeInstanceErrorLogs (may include InstanceId, etc.)",
+    "schema.query.dbInstance": "Optional SQL database instance context for runQuery / slow-query / error-log actions",
+    "schema.query.startTime": "Slow-query / error-log query start time (YYYY-MM-DD HH:mm:ss)",
+    "schema.query.endTime": "Slow-query / error-log query end time (YYYY-MM-DD HH:mm:ss)",
+    "schema.query.limit": "Max rows for slow-query / error-log results",
+    "schema.query.offset": "Pagination offset for slow-query / error-log results",
+    "schema.query.username": "Slow-query filter: username",
+    "schema.query.host": "Slow-query filter: client host",
+    "schema.query.database": "Slow-query filter: database name",
+    "schema.query.orderBy": "Sort field. Slow queries: QueryTime/LockTime/RowsExamined/RowsSent; error logs: Timestamp",
+    "schema.query.orderByType": "Sort direction: asc/desc (case-insensitive)",
+    "schema.query.sqlText": "Slow-query filter: SQL text fragment",
+    "schema.query.logLevels": "Error log level filter. Allowed values: error / warning / note",
+    "schema.query.keyWords": "Error log keyword fuzzy-search list",
+    "instanceLogs.notProvisioned": "MySQL is not provisioned yet, so instance slow/error logs cannot be queried.",
+    "instanceLogs.instanceIdRequired": "Unable to resolve CynosDB InstanceId. Call getInstanceInfo first, or pass dbInstance.instanceId / request.InstanceId.",
+    "instanceLogs.resolveInstanceId": "Query instance info first to obtain a usable InstanceId.",
+    "instanceLogs.slowQueriesSuccess": "MySQL instance slow query logs retrieved successfully.",
+    "instanceLogs.errorLogsSuccess": "MySQL instance error logs retrieved successfully.",
     "manageMysqlDatabase.title": "Manage CloudBase MySQL database lifecycle or run write SQL",
     "manageMysqlDatabase.description": "Manage CloudBase MySQL database resources. Supports provisioning MySQL, destroying MySQL, running write SQL/DDL, and initializing the database schema. Note: MySQL must be provisioned first (action=provisionMySQL, confirm=true) before runStatement or initializeSchema can run. If MySQL is not provisioned, the tool returns MYSQL_NOT_CREATED with a provisioning nextAction hint.",
     "schema.manage.action": "provisionMySQL=create MySQL instance; destroyMySQL=destroy MySQL instance; runStatement=execute write SQL or DDL; initializeSchema=run ordered schema initialization statements",
@@ -204104,6 +204160,49 @@ exports.envSetup = (0, types_js_1.defineModule)({
 });
 
 
+/***/ },
+
+/***/ 99391
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.feedback = void 0;
+const types_js_1 = __webpack_require__(89921);
+exports.feedback = (0, types_js_1.defineModule)({
+    title: "整理本次开发反馈",
+    description: "把当前这次 CloudBase 开发整理成用户可以自己提交的反馈。" +
+        "作品做出来了，用它生成案例，方便展示；开发不顺利，用它生成复盘，方便把卡点反馈给平台。" +
+        "\n\n**什么时候用**：" +
+        "\n- `channel=\"case\"`：部署或发布已经成功，用户愿意把作品放到案例墙时使用。返回案例草稿；用户确认后附上预填好的新建 issue 链接。" +
+        "\n- `channel=\"retrospective\"`：用户表示这次开发不顺利、想反馈时使用。根据本会话里真实的工具调用失败生成复盘草稿；用户确认后同样附上预填链接。" +
+        "\n\n**怎么用**：" +
+        "\n- 第一次不要传 `confirmed`。先把返回的草稿全文给用户看。" +
+        "\n- 用户明确同意后，再以 `confirmed=true` 调用。这时才会返回可打开的链接。" +
+        "\n- 本工具不会替用户提交。链接里的正文就是本次返回的 draft，不要改写成另一份再让用户提交。" +
+        "\n- 不采集对话轮次，不要编造轮次、作品名、简介或公网地址。" +
+        "\n- 国际站是英文草稿和 GitHub 链接（body 参数）。国内站是中文草稿，链接指向 CNB 上公开的 CloudBase-AI-ToolKit 仓库，正文放在模板字段 session。若页面没自动填上，把 draft 粘贴到「本次会话记录」。",
+    "schema.channel": "反馈用途：`case` 是把已完成的作品整理成案例；`retrospective` 是把这次不顺利的开发整理成复盘。",
+    "schema.confirmed": "用户是否已经看过草稿全文并明确同意提交。省略或 false 时只返回草稿、不给链接。",
+}, {
+    title: "Prepare feedback for this session",
+    description: "Turn this CloudBase session into feedback the user can submit themselves. " +
+        "Use it to showcase a finished work, or to report a session that was hard to finish." +
+        "\n\n**When to use**:" +
+        "\n- `channel=\"case\"`: the deploy or publish already succeeded and the user wants the work on the case wall. Returns a case draft, and a prefilled new-issue link after the user confirms." +
+        "\n- `channel=\"retrospective\"`: the user says this session went badly and wants to report it. Builds the retrospective from tool failures that actually happened in this session, and adds a prefilled link after confirmation." +
+        "\n\n**How to use**:" +
+        "\n- Do not pass `confirmed` on the first call. Show the returned draft to the user in full." +
+        "\n- Call again with `confirmed=true` only after the user explicitly agrees. That call returns the link." +
+        "\n- This tool does not submit the issue. The link body is the draft in this response. Do not rewrite it and ask the user to submit the rewrite." +
+        "\n- Conversation turns are not collected. Do not invent a turn count, title, summary, or public URL." +
+        "\n- International site: English draft and a GitHub link (body parameter). China site: Chinese draft and a link to the public CloudBase-AI-ToolKit repo on CNB. The draft is placed in the template field id session. If the page does not fill it, paste the draft into that field.",
+    "schema.channel": "What the feedback is for: `case` turns a finished work into a showcase entry; `retrospective` turns a difficult session into a write-up.",
+    "schema.confirmed": "Whether the user has read the full draft and agreed to submit it. Omit or pass false to return the draft only, with no link.",
+});
+
+
 /***/ },
 
 /***/ 28015
@@ -204413,7 +204512,7 @@ exports.functions = (0, types_js_1.defineModule)({
     "opErr.default": "请检查函数名、目录结构和环境中的函数状态后重试。",
     "opErr.prefix": "[{operation}] {message}\n建议：",
     confirmRequired: "{action} 是危险操作，请显式传入 confirm=true 后再执行",
-    "cloudMode.localOnly": "{action} 在 cloud mode 下不可用，因为该操作依赖本地函数代码目录。请改用本地模式执行，或使用镜像部署（runtime=CustomImage + imageConfig）。",
+    "cloudMode.localOnly": "{action} 在 cloud mode 下不可用，因为该操作依赖本地函数代码目录。可用出路：1) 使用镜像部署（runtime=CustomImage + imageConfig）；2) 使用 ZIP 两段式部署：先 queryFunctions action=getFunctionUploadUrl 获取预签名上传地址，PUT 代码 zip 后通过 manageFunctions 的 code 入参部署（阶段 B 同样不依赖本地目录）。",
     "cloudMode.contentPathUnsupported": "createLayerVersion 在 cloud mode 下不支持 contentPath，本地文件内容请改为 base64Content 或改用本地模式执行。",
     offsetLimitTooLarge: "offset+limit 不能大于 10000",
     startTimeInvalid: "startTime 格式错误: \"{value}\"。必须使用 YYYY-MM-DD HH:mm:ss 格式（如 2024-01-01 00:00:00）",
@@ -204426,6 +204525,9 @@ exports.functions = (0, types_js_1.defineModule)({
     "deployStatus.cloudMode": "{action} 在 cloud mode 下不可用：异步部署任务只由 buildStrategy=cloud/local 的真实部署创建，而这两种策略的真实执行在 cloud mode 下都不支持（需要读取本地构建上下文或本地 Docker），因此不会存在任何 taskId。buildStrategy=image 走同步部署，直接在 manageFunctions 的返回里拿结果，也不需要查询部署状态。如需异步镜像构建部署，请改用本地 MCP 模式。",
     deployTaskNotFound: "未找到部署任务 {taskId}；部署任务不存在，可能已过期、不属于当前环境 {envId}，或 MCP Server 已重启（任务仅保存在 MCP 进程内存中）。",
     unsupportedAction: "不支持的操作类型: {action}",
+    storageMissing: "当前环境没有可用的对象存储桶（DescribeEnvs 未返回 Storages），无法使用 COS 两段式部署。请检查环境存储配置，或改用本地模式部署。共享存储桶（ExternalStorage）环境同样不支持该通道。",
+    credentialMissing: "当前凭据缺少 SecretId/SecretKey（如 IDE 代理模式），无法本地铸造 COS 预签名上传地址。请改用本地模式或包含永久密钥/临时密钥的登录方式。",
+    uploadTargetNotFound: "代码包上传目标不在本进程的登记里：{objectName}。ZIP 两段式部署要求 code 三元组来自本进程刚返回的 getFunctionUploadUrl（同一个 MCP 进程、同一个环境）；MCP Server 已重启、换了环境、或自行拼装 cosObjectName / cosBucketName 都会落到这里。请重新调用 queryFunctions action=getFunctionUploadUrl 取地址，按返回值上传代码包，再用返回的三元组调用本 action。",
     // ---- nextActions reasons ----
     "reason.continuePolling": "继续查询云函数部署状态",
     "reason.getDetail": "查看单个函数详情",
@@ -204464,6 +204566,7 @@ exports.functions = (0, types_js_1.defineModule)({
     "reason.imageFnReady": "确认镜像函数已就绪（Active）",
     "reason.imageUpdateReady": "确认镜像更新后函数已就绪（Active）",
     "reason.imageNextIteration": "后续迭代只需用新镜像 tag 调用 updateFunctionCode 更新镜像",
+    "reason.cosCreate": "把 PUT 好的代码 zip 通过 code 入参部署为函数（两段式阶段 B）",
     "reason.imageGatewayRoute": "如需通过 URL 访问镜像 HTTP 函数，显式创建 Domain/Route 访问入口并传 type=\"HTTP\"（映射 WEB_SCF）",
     "reason.latestConfig": "确认最新函数配置",
     "reason.publishVersion": "发布函数新版本（对齐 tcb fn publish-version）",
@@ -204483,12 +204586,15 @@ exports.functions = (0, types_js_1.defineModule)({
     gotLayerVersionDetail: "已获取层 {layerName} 版本 {layerVersion} 的详情",
     gotFunctionTriggers: "已获取函数 {fnName} 的触发器列表",
     gotDownloadUrl: "已获取函数 {fnName} 的代码下载链接",
+    gotUploadUrl: "已生成函数代码包上传地址（{seconds} 秒内有效）。下一步：PUT 代码 zip 到 uploadUrl（uploadHeaders 非空时须随请求携带），再调用 manageFunctions createFunction/updateFunctionCode 并传入 code 三元组（cosBucketName/cosObjectName/cosBucketRegion）完成部署。该 uploadUrl 等同一次性上传凭据，不要外传或写进工单；若上传前已过期，重新调用 getFunctionUploadUrl 取新地址",
     gotFunctionVersions: "已获取函数 {fnName} 的版本列表",
     gotFunctionAlias: "已获取函数 {fnName} 的别名 {aliasName}",
     publishedVersion: "已发布函数 {fnName} 的新版本 {version}",
     updatedFunctionAlias: "已更新函数 {fnName} 别名 {aliasName}（主版本 {version}）",
     createdHttpFunctionMessage: "已创建 HTTP 函数 {fnName}。如果后续需要通过 URL 访问，请显式调用 manageGateway(action=\"createRoute\")，并把 upstreamResourceType=\"WEB_SCF\" 一起传入，再按实际路径和鉴权需求创建访问入口。评测或其他外部调用方可能会以匿名身份访问，而且失败后不一定会把 EXCEED_AUTHORITY 再反馈给 AI；交付前请主动确认访问路径和函数安全规则，若已出现 EXCEED_AUTHORITY，请先调用 queryPermissions(action=\"getResourcePermission\", resourceType=\"function\", resourceId=\"{fnName}\") 查看当前规则，再按需要使用 managePermissions(action=\"updateResourcePermission\") 调整权限。",
     createdFunction: "已创建函数 {fnName}",
+    cosCreatedMessage: "已基于环境 COS 桶中的代码包（deployMode=cos）创建函数 {fnName}。部署后可用 queryFunctions(action=\"getFunctionDetail\") 确认函数已就绪。",
+    cosUpdatedMessage: "已用环境 COS 桶中的新代码包（deployMode=cos）更新函数 {fnName} 的代码。部署后可用 queryFunctions(action=\"getFunctionDetail\") 确认函数已就绪（Active）。",
     imageCreatedMessage: "已基于镜像 {imageUri} 创建 HTTP 函数 {fnName}。请确认 TCR、SCF 与构建管道处于同一地域；如需通过 URL 访问，请显式调用 manageGateway(action=\"createRoute\", upstreamResourceType=\"WEB_SCF\") 并按需调整函数安全规则。部署后可用 queryFunctions(action=\"getFunctionDetail\") 确认函数已就绪。",
     imageUpdatedMessage: "已将函数 {fnName} 的镜像更新为 {imageUri}。部署后可用 queryFunctions(action=\"getFunctionDetail\") 确认函数已就绪（Active）。",
     updatedCode: "已更新函数 {fnName} 的代码",
@@ -204554,12 +204660,12 @@ exports.functions = (0, types_js_1.defineModule)({
     "schema.create.layers": "Layer 配置",
     "schema.manageLayer.name": "层名称",
     "schema.manageLayer.version": "层版本号",
-    "schema.query.action": "只读操作类型：\n- `listFunctions`: 列出所有 CloudBase 云函数\n- `getFunctionDetail`: 获取 CloudBase 云函数详情（需要 functionName）\n- `listFunctionLogs`: 查询 CloudBase 云函数执行日志（需要 functionName）\n- `getFunctionLogDetail`: 获取日志详情（需要 requestId）\n- `listFunctionLayers`: 列出函数绑定的层\n- `listLayers`: 列出所有层（账号级视图，含其他环境创建的层）\n- `listLayerVersions`: 列出层的版本（注意：是 Versions 不是 Version；账号级视图）\n- `getLayerVersionDetail`: 获取层版本详情（账号级视图）\n- `listFunctionTriggers`: 列出函数触发器（用于查看定时任务 / cron / timer 配置）\n- `getFunctionDownloadUrl`: 获取函数代码下载地址\n- `getFunctionDeployStatus`: 按 taskId 查询异步部署状态、阶段进度和最终结果。返回 data.build（构建子状态）、data.deploy（部署子状态）、data.progress（阶段事件）；status=running 时 data.result 与 data.error 一律为 null，不得报告部署完成。调用方必须持续轮询直到 status=succeeded/failed；status=expired 表示任务超过最长保留时间（2 小时）被终结，云端可能仍在部署，需用 getFunctionDetail 确认。任务只保存在 MCP 进程内存中，过期或 MCP Server 重启后返回 errorCode=DEPLOY_TASK_NOT_FOUND；任务按环境隔离，只能查到当前环境自己发起的部署。cloud mode 下本 action 不可用：异步任务只由 buildStrategy=cloud/local 的真实部署创建，而这两种策略在 cloud mode 下都不支持真实执行，image 策略则走同步部署不产生 taskId。\n- `listVersionByFunction`: 列出函数已发布版本（对齐 tcb fn list-function-versions / SDK listVersionByFunction；需要 functionName）\n- `getFunctionAlias`: 查询函数别名与流量路由（对齐 tcb fn get-route / SDK getFunctionAlias；需要 functionName；aliasName 默认 $DEFAULT）",
-    "schema.query.functionName": "CloudBase 云函数名称。`getFunctionDetail`、`listFunctionLogs`、`listFunctionLayers`、`listFunctionTriggers`、`getFunctionDownloadUrl`、`listVersionByFunction`、`getFunctionAlias` 时必填",
+    "schema.query.action": "只读操作类型：\n- `listFunctions`: 列出所有 CloudBase 云函数\n- `getFunctionDetail`: 获取 CloudBase 云函数详情（需要 functionName）\n- `listFunctionLogs`: 查询 CloudBase 云函数执行日志（需要 functionName）\n- `getFunctionLogDetail`: 获取日志详情（需要 requestId）\n- `listFunctionLayers`: 列出函数绑定的层\n- `listLayers`: 列出所有层（账号级视图，含其他环境创建的层）\n- `listLayerVersions`: 列出层的版本（注意：是 Versions 不是 Version；账号级视图）\n- `getLayerVersionDetail`: 获取层版本详情（账号级视图）\n- `listFunctionTriggers`: 列出函数触发器（用于查看定时任务 / cron / timer 配置）\n- `getFunctionDownloadUrl`: 获取函数代码下载地址\n- `getFunctionDeployStatus`: 按 taskId 查询异步部署状态、阶段进度和最终结果。返回 data.build（构建子状态）、data.deploy（部署子状态）、data.progress（阶段事件）；status=running 时 data.result 与 data.error 一律为 null，不得报告部署完成。调用方必须持续轮询直到 status=succeeded/failed；status=expired 表示任务超过最长保留时间（2 小时）被终结，云端可能仍在部署，需用 getFunctionDetail 确认。任务只保存在 MCP 进程内存中，过期或 MCP Server 重启后返回 errorCode=DEPLOY_TASK_NOT_FOUND；任务按环境隔离，只能查到当前环境自己发起的部署。cloud mode 下本 action 不可用：异步任务只由 buildStrategy=cloud/local 的真实部署创建，而这两种策略在 cloud mode 下都不支持真实执行，image 策略则走同步部署不产生 taskId。\n- `listVersionByFunction`: 列出函数已发布版本（对齐 tcb fn list-function-versions / SDK listVersionByFunction；需要 functionName）\n- `getFunctionAlias`: 查询函数别名与流量路由（对齐 tcb fn get-route / SDK getFunctionAlias；需要 functionName；aliasName 默认 $DEFAULT）\n- `getFunctionUploadUrl`: 获取函数代码包的 COS 预签名上传地址（ZIP 两段式部署阶段 A）：PUT 代码 zip 到 uploadUrl（uploadHeaders 非空时须随请求携带对应请求头），再调用 manageFunctions 的 createFunction/updateFunctionCode 并传 code 三元组（阶段 B）。functionName 可选，仅用于生成上传对象 key。返回的 uploadUrl 含凭据签名，不得写入日志或持久化；阶段 A 与阶段 B 必须落在同一个 MCP 进程（MCP Server 重启后需重新取地址并重新上传）；地址默认 300 秒内有效",
+    "schema.query.functionName": "CloudBase 云函数名称。`getFunctionDetail`、`listFunctionLogs`、`listFunctionLayers`、`listFunctionTriggers`、`getFunctionDownloadUrl`、`listVersionByFunction`、`getFunctionAlias` 时必填；`getFunctionUploadUrl` 可选（仅用于生成上传对象 key）",
     "schema.query.limit": "分页数量（limit）。列表类 action 可选，默认值由后端决定",
     "schema.query.offset": "分页偏移（offset）。列表类 action 可选，默认 0",
     "schema.query.codeSecret": "代码保护密钥，用于解密函数代码",
-    "schema.query.revealEnvValues": "getFunctionDetail / listFunctionTriggers 时是否返回环境变量明文值。默认 false：Value 脱敏为 ***，仅保留 Key 与 ValueLength，足以确认配置了哪些变量及变更是否生效；true 时返回明文，敏感变量会进入模型上下文，谨慎使用。如需查看明文，建议优先使用控制台或 CLI",
+    "schema.query.revealEnvValues": "getFunctionDetail / listFunctionTriggers / listFunctionLayers 时是否返回环境变量明文值。默认 false：Value 脱敏为 ***，仅保留 Key 与 ValueLength，足以确认配置了哪些变量及变更是否生效；true 时返回明文，敏感变量会进入模型上下文，谨慎使用。如需查看明文，建议优先使用控制台或 CLI",
     "schema.query.startTime": "日志查询开始时间，格式必须为 YYYY-MM-DD HH:mm:ss（如 2024-01-01 00:00:00）。与 endTime 间隔不能超过一天。不传时默认查询最近一天",
     "schema.query.endTime": "日志查询结束时间，格式必须为 YYYY-MM-DD HH:mm:ss（如 2024-01-01 23:59:59）。与 startTime 间隔不能超过一天。不传时默认为当前时间",
     "schema.query.requestId": "日志请求 ID。`getFunctionLogDetail` 操作必填，可从 `listFunctionLogs` 结果中获取",
@@ -204578,6 +204684,10 @@ exports.functions = (0, types_js_1.defineModule)({
     "schema.manage.force": "createFunction 时是否覆盖",
     "schema.manage.functionName": "目标函数名称（顶层）。updateFunctionCode / updateFunctionConfig / invokeFunction / publishVersion / updateFunctionAliasConfig 等 action 使用此字段。不要只写在 func.name：createFunction 用 func.name，其它 action 用顶层 functionName。若误传 func.name，也会被识别为 functionName。",
     "schema.manage.zipFile": "仅兼容特殊场景：预先准备好的代码包 base64 编码。普通 createFunction/updateFunctionCode 默认不要先压缩 zip，优先使用 functionRootPath。",
+    "schema.manage.code": "ZIP 两段式部署阶段 B：代码包已通过 queryFunctions action=getFunctionUploadUrl 上传到环境 COS 桶。三元组（cosBucketName/cosObjectName/cosBucketRegion）直接使用 getFunctionUploadUrl 返回值原样透传。传入 code 后 createFunction/updateFunctionCode 不再读取本地目录（functionRootPath/zipFile 均不需要），默认不触发云端依赖安装（可用 func.installDependency 覆盖）。code 三元组必须是同一个 MCP 进程的 getFunctionUploadUrl 刚返回的那一组（该 process 会在阶段 A 登记上传目标），自行拼装或跨环境复用会被拒绝并要求重新取地址。",
+    "schema.code.cosBucketName": "环境存储桶短名（不含 -appid 后缀），直接使用 getFunctionUploadUrl 返回的 cosBucketName，不要自填",
+    "schema.code.cosObjectName": "上传对象 key，直接使用 getFunctionUploadUrl 返回的 cosObjectName",
+    "schema.code.cosBucketRegion": "存储桶地域，省略时自动使用当前环境存储桶地域",
     "schema.manage.handler": "函数入口",
     "schema.manage.timeout": "配置更新时的超时时间",
     "schema.manage.envVariables": "配置更新时要合并的环境变量。若含 DATABASE_URL / MYSQL_* / POSTGRES_* / REDIS_* 等 TCP 连库变量，必须同时提供真实 vpc（或函数已绑定完整 VPC）。禁止猜测 vpcId/subnetId。",
@@ -204683,7 +204793,7 @@ exports.functions = (0, types_js_1.defineModule)({
     "opErr.default": "Please check the function name, directory structure, and the function status in the environment, then retry.",
     "opErr.prefix": "[{operation}] {message}\nSuggestions: ",
     confirmRequired: "{action} is a dangerous operation; pass confirm=true explicitly before executing",
-    "cloudMode.localOnly": "{action} is unavailable in cloud mode because the operation depends on a local function code directory. Run it in local mode, or use image deployment (runtime=CustomImage + imageConfig).",
+    "cloudMode.localOnly": "{action} is unavailable in cloud mode because the operation depends on a local function code directory. Options: 1) use image deployment (runtime=CustomImage + imageConfig); 2) use two-phase ZIP deployment: first call queryFunctions action=getFunctionUploadUrl to get a presigned upload URL, PUT the code zip, then deploy via the manageFunctions code parameter (phase B also needs no local directory).",
     "cloudMode.contentPathUnsupported": "createLayerVersion does not support contentPath in cloud mode; switch local file content to base64Content or run in local mode.",
     offsetLimitTooLarge: "offset+limit must not be greater than 10000",
     startTimeInvalid: "Invalid startTime: \"{value}\". It must use the YYYY-MM-DD HH:mm:ss format (e.g. 2024-01-01 00:00:00)",
@@ -204696,6 +204806,9 @@ exports.functions = (0, types_js_1.defineModule)({
     "deployStatus.cloudMode": "{action} is unavailable in cloud mode: async deployment tasks are only created by real deployments with buildStrategy=cloud/local, and real execution of both strategies is unsupported in cloud mode (they need the local build context or local Docker), so no taskId can exist. buildStrategy=image uses synchronous deployment and returns the result directly from manageFunctions, so no deployment status query is needed. For async image build deployment, switch to local MCP mode.",
     deployTaskNotFound: "Deployment task {taskId} not found; the task does not exist — it may have expired, belong to a different environment than {envId}, or the MCP Server was restarted (tasks are only kept in MCP process memory).",
     unsupportedAction: "Unsupported action: {action}",
+    storageMissing: "The current environment has no usable object storage bucket (DescribeEnvs returned no Storages), so COS two-phase deployment is unavailable. Check the environment storage configuration, or deploy in local mode. Environments with a shared bucket (ExternalStorage) are not supported either.",
+    credentialMissing: "The current credential lacks SecretId/SecretKey (e.g. IDE proxy mode), so a COS presigned upload URL cannot be minted locally. Use local mode or a login method with permanent/temporary keys.",
+    uploadTargetNotFound: "The code package upload target is not registered in this process: {objectName}. Two-phase ZIP deployment requires the code triplet to come from a getFunctionUploadUrl response minted by this same MCP process and environment; a restarted MCP Server, a different environment, or a hand-built cosObjectName / cosBucketName all land here. Call queryFunctions action=getFunctionUploadUrl again, upload the code package to the returned address, then call this action with the returned triplet.",
     // ---- nextActions reasons ----
     "reason.continuePolling": "Keep polling the cloud function deployment status",
     "reason.getDetail": "View details of a single function",
@@ -204734,6 +204847,7 @@ exports.functions = (0, types_js_1.defineModule)({
     "reason.imageFnReady": "Confirm the image function is ready (Active)",
     "reason.imageUpdateReady": "Confirm the function is ready (Active) after the image update",
     "reason.imageNextIteration": "For later iterations, just call updateFunctionCode with the new image tag to update the image",
+    "reason.cosCreate": "Deploy the uploaded code zip as a function via the code parameter (two-phase deployment phase B)",
     "reason.imageGatewayRoute": "To access the image HTTP function via URL, explicitly create a Domain/Route access entry and pass type=\"HTTP\" (mapped to WEB_SCF)",
     "reason.latestConfig": "Confirm the latest function configuration",
     "reason.publishVersion": "Publish a new function version (aligns with tcb fn publish-version)",
@@ -204753,12 +204867,15 @@ exports.functions = (0, types_js_1.defineModule)({
     gotLayerVersionDetail: "Retrieved details of layer {layerName} version {layerVersion}",
     gotFunctionTriggers: "Retrieved the trigger list of function {fnName}",
     gotDownloadUrl: "Retrieved the code download URL of function {fnName}",
+    gotUploadUrl: "Generated the code package upload URL (valid for {seconds} seconds). Next: PUT the code zip to uploadUrl (include the uploadHeaders when non-empty), then call manageFunctions createFunction/updateFunctionCode with the code triplet (cosBucketName/cosObjectName/cosBucketRegion) to deploy. Treat the uploadUrl as a one-time upload credential: do not forward it or paste it into tickets; if it expires before the upload, call getFunctionUploadUrl again for a fresh address",
     gotFunctionVersions: "Retrieved the version list of function {fnName}",
     gotFunctionAlias: "Retrieved alias {aliasName} of function {fnName}",
     publishedVersion: "Published new version {version} of function {fnName}",
     updatedFunctionAlias: "Updated alias {aliasName} of function {fnName} (primary version {version})",
     createdHttpFunctionMessage: "Created HTTP function {fnName} from the image. If URL access is needed later, explicitly call manageGateway(action=\"createRoute\") with upstreamResourceType=\"WEB_SCF\", then create the access entry according to the actual path and auth requirements. Evaluators or other external callers may access anonymously, and failures may not feed EXCEED_AUTHORITY back to the AI; before delivery, proactively confirm the access path and the function security rules. If EXCEED_AUTHORITY has already appeared, first call queryPermissions(action=\"getResourcePermission\", resourceType=\"function\", resourceId=\"{fnName}\") to view the current rules, then adjust permissions with managePermissions(action=\"updateResourcePermission\") as needed.",
     createdFunction: "Created function {fnName}",
+    cosCreatedMessage: "Created function {fnName} from the code package in the environment COS bucket (deployMode=cos). Use queryFunctions(action=\"getFunctionDetail\") after deployment to confirm the function is ready.",
+    cosUpdatedMessage: "Updated the code of function {fnName} with the new package in the environment COS bucket (deployMode=cos). Use queryFunctions(action=\"getFunctionDetail\") after deployment to confirm the function is ready (Active).",
     imageCreatedMessage: "Created HTTP function {fnName} from image {imageUri}. Please confirm TCR, SCF, and the build pipeline are in the same region; for URL access, explicitly call manageGateway(action=\"createRoute\", upstreamResourceType=\"WEB_SCF\") and adjust the function security rules as needed. After deployment, use queryFunctions(action=\"getFunctionDetail\") to confirm the function is ready.",
     imageUpdatedMessage: "Updated the image of function {fnName} to {imageUri}. After deployment, use queryFunctions(action=\"getFunctionDetail\") to confirm the function is ready (Active).",
     updatedCode: "Updated the code of function {fnName}",
@@ -204824,12 +204941,12 @@ exports.functions = (0, types_js_1.defineModule)({
     "schema.create.layers": "Layer configuration",
     "schema.manageLayer.name": "Layer name",
     "schema.manageLayer.version": "Layer version number",
-    "schema.query.action": "Read-only action type:\n- `listFunctions`: list all CloudBase cloud functions\n- `getFunctionDetail`: get function details (requires functionName)\n- `listFunctionLogs`: query function execution logs (requires functionName)\n- `getFunctionLogDetail`: get log details (requires requestId)\n- `listFunctionLayers`: list layers bound to a function\n- `listLayers`: list all layers (account-level view, including layers from other environments)\n- `listLayerVersions`: list layer versions (Versions, not Version; account-level view)\n- `getLayerVersionDetail`: get layer version details (account-level view)\n- `listFunctionTriggers`: list function triggers (scheduled task / cron / timer configuration)\n- `getFunctionDownloadUrl`: get the function code download URL\n- `getFunctionDeployStatus`: query async deployment status, stage progress, and final result by taskId. Returns data.build, data.deploy, and data.progress. While status=running, data.result and data.error are null and deployment must not be reported as complete. Keep polling until status=succeeded/failed. status=expired means the task exceeded the 2-hour retention limit; cloud deployment may still be running, so confirm with getFunctionDetail. Tasks exist only in MCP process memory; expired tasks or a restarted MCP Server return errorCode=DEPLOY_TASK_NOT_FOUND. Tasks are isolated by environment. This action is unavailable in cloud mode because real cloud/local builds cannot run there, while image deployment is synchronous and creates no taskId.\n- `listVersionByFunction`: list published function versions (aligns with tcb fn list-function-versions / SDK listVersionByFunction; requires functionName)\n- `getFunctionAlias`: get function alias and traffic routing (aligns with tcb fn get-route / SDK getFunctionAlias; requires functionName; aliasName defaults to $DEFAULT)",
-    "schema.query.functionName": "CloudBase cloud function name. Required for `getFunctionDetail`, `listFunctionLogs`, `listFunctionLayers`, `listFunctionTriggers`, `getFunctionDownloadUrl`, `listVersionByFunction`, and `getFunctionAlias`.",
+    "schema.query.action": "Read-only action type:\n- `listFunctions`: list all CloudBase cloud functions\n- `getFunctionDetail`: get function details (requires functionName)\n- `listFunctionLogs`: query function execution logs (requires functionName)\n- `getFunctionLogDetail`: get log details (requires requestId)\n- `listFunctionLayers`: list layers bound to a function\n- `listLayers`: list all layers (account-level view, including layers from other environments)\n- `listLayerVersions`: list layer versions (Versions, not Version; account-level view)\n- `getLayerVersionDetail`: get layer version details (account-level view)\n- `listFunctionTriggers`: list function triggers (scheduled task / cron / timer configuration)\n- `getFunctionDownloadUrl`: get the function code download URL\n- `getFunctionDeployStatus`: query async deployment status, stage progress, and final result by taskId. Returns data.build, data.deploy, and data.progress. While status=running, data.result and data.error are null and deployment must not be reported as complete. Keep polling until status=succeeded/failed. status=expired means the task exceeded the 2-hour retention limit; cloud deployment may still be running, so confirm with getFunctionDetail. Tasks exist only in MCP process memory; expired tasks or a restarted MCP Server return errorCode=DEPLOY_TASK_NOT_FOUND. Tasks are isolated by environment. This action is unavailable in cloud mode because real cloud/local builds cannot run there, while image deployment is synchronous and creates no taskId.\n- `listVersionByFunction`: list published function versions (aligns with tcb fn list-function-versions / SDK listVersionByFunction; requires functionName)\n- `getFunctionAlias`: get function alias and traffic routing (aligns with tcb fn get-route / SDK getFunctionAlias; requires functionName; aliasName defaults to $DEFAULT)\n- `getFunctionUploadUrl`: get a COS presigned upload URL for a function code package (two-phase ZIP deployment phase A): PUT the code zip to uploadUrl (include the corresponding request headers when uploadHeaders is non-empty), then call manageFunctions createFunction/updateFunctionCode with the code triplet (phase B). functionName is optional and only shapes the upload object key. The uploadUrl carries credential-bound signatures; never log or persist it; phase A and phase B must run in the same MCP process (after an MCP Server restart, fetch a new address and upload again); the address is valid for 300 seconds by default",
+    "schema.query.functionName": "CloudBase cloud function name. Required for `getFunctionDetail`, `listFunctionLogs`, `listFunctionLayers`, `listFunctionTriggers`, `getFunctionDownloadUrl`, `listVersionByFunction`, and `getFunctionAlias`. Optional for `getFunctionUploadUrl` (only used to generate the upload object key).",
     "schema.query.limit": "Page size (limit). Optional for list actions; the backend determines the default.",
     "schema.query.offset": "Pagination offset. Optional for list actions; defaults to 0.",
     "schema.query.codeSecret": "Code protection secret used to decrypt function code.",
-    "schema.query.revealEnvValues": "Whether `getFunctionDetail` / `listFunctionTriggers` returns plaintext environment variable values. Defaults to false: Value is masked as ***, while Key and ValueLength remain, which is sufficient to verify configured variables and changes. true returns plaintext and may expose secrets to the model context; use cautiously. Prefer the console or CLI for plaintext values.",
+    "schema.query.revealEnvValues": "Whether `getFunctionDetail` / `listFunctionTriggers` / `listFunctionLayers` returns plaintext environment variable values. Defaults to false: Value is masked as ***, while Key and ValueLength remain, which is sufficient to verify configured variables and changes. true returns plaintext and may expose secrets to the model context; use cautiously. Prefer the console or CLI for plaintext values.",
     "schema.query.startTime": "Log query start time in YYYY-MM-DD HH:mm:ss format (for example, 2024-01-01 00:00:00). The interval to endTime must not exceed one day. Defaults to the most recent day when omitted.",
     "schema.query.endTime": "Log query end time in YYYY-MM-DD HH:mm:ss format (for example, 2024-01-01 23:59:59). The interval from startTime must not exceed one day. Defaults to the current time when omitted.",
     "schema.query.requestId": "Log request ID. Required for `getFunctionLogDetail`; obtain it from `listFunctionLogs`.",
@@ -204848,6 +204965,10 @@ exports.functions = (0, types_js_1.defineModule)({
     "schema.manage.force": "Whether createFunction overwrites an existing function.",
     "schema.manage.functionName": "Target function name at the top level. Used by updateFunctionCode, updateFunctionConfig, invokeFunction, publishVersion, updateFunctionAliasConfig, and similar actions. createFunction uses func.name; other actions use top-level functionName. A mistakenly supplied func.name is also recognized as functionName.",
     "schema.manage.zipFile": "Compatibility only: base64-encoded prebuilt code package. For ordinary createFunction/updateFunctionCode, do not create a ZIP first; prefer functionRootPath.",
+    "schema.manage.code": "Two-phase ZIP deployment phase B: the code package has been uploaded to the environment COS bucket via queryFunctions action=getFunctionUploadUrl. Pass the triplet (cosBucketName/cosObjectName/cosBucketRegion) through unchanged from the getFunctionUploadUrl response. With code provided, createFunction/updateFunctionCode no longer reads local directories (functionRootPath/zipFile are unnecessary), and cloud dependency installation is skipped by default (override with func.installDependency). The code triplet must be the one just returned by getFunctionUploadUrl in the same MCP process (that process registers the upload target in phase A); hand-built triplets or cross-environment reuse are rejected and require fetching a new address.",
+    "schema.code.cosBucketName": "Environment bucket short name (without the -appid suffix); pass through the cosBucketName returned by getFunctionUploadUrl, do not invent one",
+    "schema.code.cosObjectName": "Uploaded object key; pass through the cosObjectName returned by getFunctionUploadUrl",
+    "schema.code.cosBucketRegion": "Bucket region; defaults to the current environment bucket region when omitted",
     "schema.manage.handler": "Function entry point",
     "schema.manage.timeout": "Timeout used for configuration updates.",
     "schema.manage.envVariables": "Environment variables to merge during a configuration update. If they contain TCP database variables such as DATABASE_URL, MYSQL_*, POSTGRES_*, or REDIS_*, also provide a real vpc (or ensure the function already has a complete VPC binding). Never guess vpcId/subnetId.",
@@ -205476,6 +205597,7 @@ exports.logs = (0, types_js_1.defineModule)({
         "\n\n**重要区分**：" +
         "\n- 查询云函数日志：使用 `queryFunctions(action=\"listFunctionLogs\", functionName=\"xxx\")`" +
         "\n- 查询 CLS 日志（跨服务日志聚合）：使用本工具 `queryLogs(action=\"searchLogs\")`" +
+        "\n- 开通 CLS 日志服务：使用 `manageLogs(action=\"createLogService\", confirm=true)`" +
         "\n\n**适用场景**：" +
         "\n- 检查 CLS 日志服务是否开通：`action=\"checkLogService\"`" +
         "\n- 跨服务日志搜索（如搜索所有 ERROR 日志）：`action=\"searchLogs\"`" +
@@ -205521,12 +205643,28 @@ exports.logs = (0, types_js_1.defineModule)({
     "schema.limit": "返回日志条数限制，默认 20",
     "schema.context": "翻页上下文，用于继续上一次查询",
     "schema.sort": "按时间排序：`asc` 升序，`desc` 降序",
+    "manage.title": "管理 CloudBase 日志服务",
+    "manage.description": "CloudBase 日志域写入入口。用于开通 CLS 日志服务（对齐 Manager SDK `log.createLogService` / CreateEnvResource Resources=['log']）。" +
+        "\n\n**适用场景**：" +
+        "\n- 开通 CLS 日志服务：`action=\"createLogService\", confirm=true`" +
+        "\n\n开通为异步操作：接口成功不代表立即可用，请随后用 `queryLogs(action=\"checkLogService\")` 轮询确认。",
+    "manage.schema.action": "操作类型：" +
+        "\n- `createLogService`: 开通 CLS 日志服务（需 `confirm=true`）",
+    "manage.schema.confirm": "开通日志服务前的显式确认。必须传 `confirm=true`；未传时返回 CONFIRM_REQUIRED。",
+    "manage.create.confirmRequired": "开通日志服务会创建 CLS 日志资源。请使用 `confirm: true` 重新执行以继续。",
+    "manage.create.needsConfirmation": "开通日志服务前需要显式确认。",
+    "manage.create.alreadyEnabled": "当前环境日志服务已开通，无需重复开通。",
+    "manage.create.submitted": "日志服务开通请求已提交。请使用 queryLogs(action=\"checkLogService\") 轮询直至 enabled=true。",
+    "manage.create.nextCheck": "轮询日志服务是否已就绪。",
+    "manage.create.nextSearch": "日志服务已就绪，可开始搜索 CLS 日志。",
+    "manage.unsupportedAction": "不支持的日志管理 action：{action}",
 }, {
     title: "Query CloudBase log service",
     description: "Unified read-only entry for the CloudBase logs domain. Supports checking log service status and searching CLS logs." +
         "\n\n**Important distinction**:" +
         "\n- Query cloud function logs: use `queryFunctions(action=\"listFunctionLogs\", functionName=\"xxx\")`" +
         "\n- Query CLS logs (cross-service log aggregation): use this tool `queryLogs(action=\"searchLogs\")`" +
+        "\n- Enable the CLS log service: use `manageLogs(action=\"createLogService\", confirm=true)`" +
         "\n\n**Use cases**:" +
         "\n- Check whether the CLS log service is enabled: `action=\"checkLogService\"`" +
         "\n- Cross-service log search (e.g. find all ERROR logs): `action=\"searchLogs\"`" +
@@ -205572,6 +205710,21 @@ exports.logs = (0, types_js_1.defineModule)({
     "schema.limit": "Maximum number of log entries to return; defaults to 20.",
     "schema.context": "Pagination context used to continue the previous query.",
     "schema.sort": "Time sort order: `asc` for ascending or `desc` for descending.",
+    "manage.title": "Manage CloudBase log service",
+    "manage.description": "Write entry for the CloudBase logs domain. Enables the CLS log service (aligned with Manager SDK `log.createLogService` / CreateEnvResource Resources=['log'])." +
+        "\n\n**Use cases**:" +
+        "\n- Enable CLS log service: `action=\"createLogService\", confirm=true`" +
+        "\n\nProvisioning is asynchronous: API success does not mean the service is immediately ready. Poll with `queryLogs(action=\"checkLogService\")` afterward.",
+    "manage.schema.action": "Operation type:" +
+        "\n- `createLogService`: Enable the CLS log service (requires `confirm=true`)",
+    "manage.schema.confirm": "Explicit confirmation before enabling the log service. Must pass `confirm=true`; omitting it returns CONFIRM_REQUIRED.",
+    "manage.create.confirmRequired": "Enabling the log service creates CLS log resources. Re-run with `confirm: true` to continue.",
+    "manage.create.needsConfirmation": "Explicit confirmation is required before enabling the log service.",
+    "manage.create.alreadyEnabled": "The log service is already enabled for this environment; no need to enable again.",
+    "manage.create.submitted": "Log service enablement request submitted. Poll with queryLogs(action=\"checkLogService\") until enabled=true.",
+    "manage.create.nextCheck": "Poll whether the log service is ready.",
+    "manage.create.nextSearch": "Log service is ready; you can start searching CLS logs.",
+    "manage.unsupportedAction": "Unsupported log manage action: {action}",
 });
 
 
@@ -205865,19 +206018,19 @@ exports.permissions = (0, types_js_1.defineModule)({
         "或 securityRule='{\"invoke\":true}'（放通所有云函数）。" +
         "底层错误：{message}",
     mustBeArray: "{label} 必须是数组",
-    roleLookupNote: "如果你需要 app-level admin override（例如 CMS 中 admin 可编辑所有文章，而 editor 只能编辑自己的文章），CUSTOM 规则通常是必要的。一个已验证可用的模式是：角色集合文档主键就是 auth.uid，并在文章权限里写 get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid。若现有 schema 已经有 users / profiles / user_roles 其一，请复用已存在且能通过 _id == auth.uid 直接 get() 到的那一份；不要把 where({ uid }) 查询得到的集合误写成 get('database.users.' + auth.uid)。",
-    recommendedClientWritePattern: "对于 CMS 文章这类使用 app-level admin override 的 CUSTOM 规则，前端可继续使用 db.collection('{resourceId}').doc(id).update(...) / remove(...)。关键是安全规则要采用已验证模式：get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid，并且文章文档中要真实写入 authorId。",
+    roleLookupNote: "如果你需要 app-level admin override（例如 CMS 中 admin 可编辑所有文章，而 editor 只能编辑自己的文章），CUSTOM 规则通常是必要的。一个已验证可用的模式是：角色集合文档主键就是 auth.uid，并在文章权限里写 get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid。若现有 schema 已经有 users / profiles / user_roles 其一，请复用已存在且能通过 _id == auth.uid 直接 get() 到的那一份；不要把 where({ uid }) 查询得到的集合误写成 get(`database.users.${auth.uid}`)。",
+    recommendedClientWritePattern: "对于 CMS 文章这类使用 app-level admin override 的 CUSTOM 规则，前端可继续使用 db.collection('{resourceId}').doc(id).update(...) / remove(...)。关键是安全规则要采用已验证模式：get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid，并且文章文档中要真实写入 authorId。",
     createRuleSummary: "create 规则不应引用 doc.*，因为 create 时文档尚未存在。",
     createRuleDetail: "CloudBase 的 create 规则验证的是写入数据（request.data），此时文档尚不存在，doc.* 不可用。" +
         "请将 create 规则改为仅使用 auth.* 检查（如 auth.uid != null && auth.loginType != 'ANONYMOUS'），" +
         "或在写入时将 owner 字段（如 _openid / authorId）写入 request.data，然后在 create 规则中用 request.data._openid == auth.openid 做校验。" +
         "read / update / delete 规则可以使用 doc.* 引用已有文档字段，且客户端查询条件必须是规则约束的子集（如 _openid: '{openid}'）。",
     docIdWriteSummary: "当前安全规则在 document-id 写入场景下可能被后端直接拒绝。",
-    docIdWriteDetail: "这类规则经常在 owner-only 集合里被写错，但对于 CMS 文章这种“admin 可编辑所有文章、editor 只能编辑自己的文章”的场景，已验证可用的做法是保留 doc.authorId，并通过独立角色集合做 admin override：get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid。不要默认改成 where(...)，也不要把同集合 owner 判断重写成 get('database.collection.' + doc._id)。",
+    docIdWriteDetail: "这类规则经常在 owner-only 集合里被写错，但对于 CMS 文章这种“admin 可编辑所有文章、editor 只能编辑自己的文章”的场景，已验证可用的做法是保留 doc.authorId，并通过独立角色集合做 admin override：get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid。不要默认改成 where(...)，也不要把同集合 owner 判断重写成 ``get(`database.collection.${doc._id}`)``。",
     invalidGetPathSummary: "get() 的 path 只应包含 collection 和 documentId，不应把字段名拼进 path 字符串。",
-    invalidGetPathDetail: "请写成 get('database.collection.' + doc._id).fieldName，而不是 get('database.collection.' + doc._id + '.fieldName')。但在 CMS 文章权限里，不要把 get('database.collection.' + doc._id) 当成默认首选方案；更稳的已验证模式是读取单独的角色集合：get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid。",
-    templateLiteralSummary: "CloudBase security rule 表达式不支持把 ${...} 当作 JS 模板字符串插值。",
-    templateLiteralDetail: "在 securityRule 字符串里，请使用表达式拼接，例如 get('database.user_roles.' + auth.uid).role，而不是 get('database.user_roles.${auth.uid}').role。对于 CMS 文章这类需要 app-level admin override 的规则，请优先使用已验证的 user_roles + doc.authorId 模式。",
+    invalidGetPathDetail: "请写成 ``get(`database.collection.${doc._id}`).fieldName``，而不是把字段名拼进 path。安全规则的表达式不支持用 + 拼接 get() 的 path 参数——形如 get('database.collection.' + doc._id) 的规则在保存时就会被判 rule invalid，请改用反引号模板字符串。但在 CMS 文章权限里，不要把同集合文档当成默认首选方案；更稳的模式是读取单独的角色集合：``get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid``。",
+    templateLiteralSummary: "${...} 出现在引号字符串里也能被引擎识别，但官方形态是反引号模板字符串。",
+    templateLiteralDetail: "推荐统一写成 ``get(`database.user_roles.${auth.uid}`).role == 'admin'``。真正会被拒绝的不是 ${...}，而是另外两种写法：不含 ${...} 的裸引号字面量（如 get('database.admin_locks.article_lock')，请求时会返回 500），以及用 + 拼接的 get(`database.user_roles.${auth.uid}`)（保存规则时判 rule invalid）。对于 CMS 文章这类需要 app-level admin override 的规则，请优先使用 user_roles + doc.authorId 模式。",
     bucketMissing: "存储 Bucket {bucket} 不存在",
     bucketsMissing: "以下存储 Bucket 不存在: {buckets}",
     paramRequired: "action={action} 时必须提供 {param}",
@@ -205946,19 +206099,19 @@ exports.permissions = (0, types_js_1.defineModule)({
         "(package authz.user) or securityRule='{\"invoke\":true}' for public functions. " +
         "Underlying error: {message}",
     mustBeArray: "{label} must be an array",
-    roleLookupNote: "If you need app-level admin override (e.g. in a CMS, admins can edit all articles while editors can only edit their own), a CUSTOM rule is usually required. A verified pattern is: make the role collection's document primary key auth.uid itself, and in the article permission write get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid. If the existing schema already has users / profiles / user_roles, reuse the one that exists and can be fetched directly via _id == auth.uid with get(); do not mistakenly write the collection obtained by a where({ uid }) query as get('database.users.' + auth.uid).",
-    recommendedClientWritePattern: "For CMS articles using CUSTOM rules with app-level admin override, the frontend can keep using db.collection('{resourceId}').doc(id).update(...) / remove(...). The key is that the security rule uses the verified pattern: get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid, and the article document must actually contain the authorId field.",
+    roleLookupNote: "If you need app-level admin override (e.g. in a CMS, admins can edit all articles while editors can only edit their own), a CUSTOM rule is usually required. A verified pattern is: make the role collection's document primary key auth.uid itself, and in the article permission write get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid. If the existing schema already has users / profiles / user_roles, reuse the one that exists and can be fetched directly via _id == auth.uid with get(); do not mistakenly write the collection obtained by a where({ uid }) query as get(`database.users.${auth.uid}`).",
+    recommendedClientWritePattern: "For CMS articles using CUSTOM rules with app-level admin override, the frontend can keep using db.collection('{resourceId}').doc(id).update(...) / remove(...). The key is that the security rule uses the verified pattern: get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid, and the article document must actually contain the authorId field.",
     createRuleSummary: "The create rule should not reference doc.*, because the document does not exist yet at create time.",
     createRuleDetail: "CloudBase's create rule validates the written data (request.data); the document does not exist yet, so doc.* is unavailable. " +
         "Change the create rule to use only auth.* checks (e.g. auth.uid != null && auth.loginType != 'ANONYMOUS'), " +
         "or write the owner field (e.g. _openid / authorId) into request.data at write time, then validate with request.data._openid == auth.openid in the create rule. " +
         "read / update / delete rules may use doc.* to reference existing document fields, and the client's query conditions must be a subset of the rule constraints (e.g. _openid: '{openid}').",
     docIdWriteSummary: "The current security rule may be rejected by the backend in document-id write scenarios.",
-    docIdWriteDetail: "Such rules are often written incorrectly in owner-only collections, but for the CMS article scenario where \"admins can edit all articles and editors can only edit their own\", the verified approach is to keep doc.authorId and do admin override through a separate role collection: get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid. Do not default to where(...), and do not rewrite the same-collection owner check as get('database.collection.' + doc._id).",
+    docIdWriteDetail: "Such rules are often written incorrectly in owner-only collections, but for the CMS article scenario where \"admins can edit all articles and editors can only edit their own\", the verified approach is to keep doc.authorId and do admin override through a separate role collection: get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid. Do not default to where(...), and do not rewrite the same-collection owner check as ``get(`database.collection.${doc._id}`)``.",
     invalidGetPathSummary: "The get() path should only contain the collection and documentId; do not concatenate field names into the path string.",
-    invalidGetPathDetail: "Write get('database.collection.' + doc._id).fieldName instead of get('database.collection.' + doc._id + '.fieldName'). However, for CMS article permissions, do not treat get('database.collection.' + doc._id) as the default first choice; the more robust verified pattern is reading a separate role collection: get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid.",
-    templateLiteralSummary: "CloudBase security rule expressions do not support ${...} as JS template string interpolation.",
-    templateLiteralDetail: "In the securityRule string, use expression concatenation, e.g. get('database.user_roles.' + auth.uid).role, instead of get('database.user_roles.${auth.uid}').role. For rules needing app-level admin override like CMS articles, prefer the verified user_roles + doc.authorId pattern.",
+    invalidGetPathDetail: "Write ``get(`database.collection.${doc._id}`).fieldName`` instead of embedding the field name in the path. Security rule expressions do not support concatenating the get() path with +: a rule such as get('database.collection.' + doc._id) is rejected with rule invalid when the rule is saved, so use a backtick template literal. However, for CMS article permissions, do not treat a same-collection document as the default first choice; the more robust pattern is reading a separate role collection: ``get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid``.",
+    templateLiteralSummary: "${...} inside a quoted string is understood by the engine, but the official form is a backtick template literal.",
+    templateLiteralDetail: "Prefer ``get(`database.user_roles.${auth.uid}`).role == 'admin'``. What actually breaks is not ${...} but two other spellings: a bare quoted literal with no ${...} (e.g. get('database.admin_locks.article_lock'), which returns 500 at request time), and a concatenated path such as get(`database.user_roles.${auth.uid}`) (rejected with rule invalid when the rule is saved). For rules needing app-level admin override like CMS articles, prefer the user_roles + doc.authorId pattern.",
     bucketMissing: "Storage bucket {bucket} does not exist",
     bucketsMissing: "The following storage buckets do not exist: {buckets}",
     paramRequired: "{param} is required when action={action}",
@@ -206209,6 +206362,7 @@ exports.setup = (0, types_js_1.defineModule)({
     "schema.template": "要下载的模板类型",
     "schema.ide": "指定要下载的IDE类型。",
     "schema.overwrite": "是否覆盖已存在的文件，默认为false（不覆盖）",
+    "projectRoot.hostConfigDir": "拒绝把 {dir} 当作项目根目录。这是宿主配置目录，不是项目。请由宿主设置 WORKSPACE_FOLDER_PATHS 为项目目录后再试。",
 }, {
     "downloadTemplate.title": "Download project template",
     "downloadTemplate.description": "Automatically downloads and deploys CloudBase project templates.\n**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\nSupported templates:\n- react: React + CloudBase full-stack app template\n- vue: Vue + CloudBase full-stack app template\n- miniprogram: WeChat Mini Program + CloudBase template\n- uniapp: UniApp + CloudBase cross-platform app template\n- rules: AI editor configuration files only (includes configurations for all mainstream editors such as Cursor, WindSurf, and CodeBuddy), suitable for adding AI editor configuration to an existing project\n\nSupported IDE types:\n- all: download configurations for all IDEs\n- cursor: Cursor AI editor\n- see the list below for other IDE types\n\nNote: if the ide parameter is not provided and the IDE cannot be detected from environment variables, an error will be returned asking for the ide parameter\n- windsurf: WindSurf AI editor\n- codebuddy: CodeBuddy AI editor\n- claude-code: Claude Code AI editor\n- cline: Cline AI editor\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI editor\n- qwen-code: Tongyi Lingma\n- baidu-comate: Baidu Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI editor\n- tongyi-lingma: Tongyi Lingma\n- trae: Trae AI editor\n- qoder: Qoder AI editor\n- antigravity: Google Antigravity AI editor\n- vscode: Visual Studio Code\n- kiro: Kiro AI editor\n- aider: Aider AI editor\n\nNotes:\n- the rules template automatically embeds the current MCP version for future maintenance and version tracking\n- when downloading the rules template, if a README.md file already exists in the project, the system protects it from being overwritten (unless overwrite=true is set)",
@@ -206273,6 +206427,7 @@ exports.setup = (0, types_js_1.defineModule)({
     "schema.template": "The type of template to download",
     "schema.ide": "The IDE type whose configuration should be downloaded.",
     "schema.overwrite": "Whether to overwrite existing files. Defaults to false (do not overwrite).",
+    "projectRoot.hostConfigDir": "Refusing to use {dir} as the project root. That directory belongs to the host, not a project. Set WORKSPACE_FOLDER_PATHS to the project directory and retry.",
 });
 
 
@@ -206480,6 +206635,7 @@ const msgPush_js_1 = __webpack_require__(26191);
 const setup_js_1 = __webpack_require__(8707);
 const envSetup_js_1 = __webpack_require__(57148);
 const interactive_js_1 = __webpack_require__(91838);
+const feedback_js_1 = __webpack_require__(99391);
 exports.zh = {
     env: env_js_1.env.zh,
     storage: storage_js_1.storage.zh,
@@ -206509,6 +206665,7 @@ exports.zh = {
     setup: setup_js_1.setup.zh,
     envSetup: envSetup_js_1.envSetup.zh,
     interactive: interactive_js_1.interactive.zh,
+    feedback: feedback_js_1.feedback.zh,
 };
 
 
@@ -206653,6 +206810,107 @@ async function getInteractiveServerAsync() {
 }
 
 
+/***/ },
+
+/***/ 16156
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.assertLocalEndpoint = assertLocalEndpoint;
+exports.resolveLocalEndpoint = resolveLocalEndpoint;
+exports.createLocalCloudApiRequestFn = createLocalCloudApiRequestFn;
+const logger_js_1 = __webpack_require__(40781);
+/** Loopback hosts only. WHATWG URL keeps the brackets on IPv6 hostnames. */
+const ALLOWED_HOSTS = new Set(['127.0.0.1', '[::1]', 'localhost']);
+/** Upper bound for one cloud API call, so a hung endpoint cannot block a tool call forever. */
+const ENDPOINT_TIMEOUT_MS = 30_000;
+let announcedEndpoint;
+/**
+ * Validate and normalise CLOUDBASE_LOCAL_ENDPOINT.
+ *
+ * Setting this variable makes cloud API calls skip the login and credential
+ * checks, so it must never point off the local machine.
+ */
+function assertLocalEndpoint(endpoint) {
+    let parsed;
+    try {
+        parsed = new URL(endpoint);
+    }
+    catch {
+        throw new Error('CLOUDBASE_LOCAL_ENDPOINT is not a valid URL');
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error('CLOUDBASE_LOCAL_ENDPOINT must use http or https');
+    }
+    if (!ALLOWED_HOSTS.has(parsed.hostname)) {
+        throw new Error('CLOUDBASE_LOCAL_ENDPOINT must point at a loopback host');
+    }
+    return endpoint.replace(/\/+$/, '');
+}
+/**
+ * Read and validate CLOUDBASE_LOCAL_ENDPOINT. Returns undefined when unset.
+ *
+ * A malformed value throws instead of silently falling back, so a bad config
+ * surfaces as a config error rather than looking like an auth failure.
+ */
+function resolveLocalEndpoint() {
+    const raw = process.env.CLOUDBASE_LOCAL_ENDPOINT;
+    if (!raw) {
+        return undefined;
+    }
+    const base = assertLocalEndpoint(raw);
+    if (announcedEndpoint !== base) {
+        announcedEndpoint = base;
+        (0, logger_js_1.warn)(`CLOUDBASE_LOCAL_ENDPOINT is set: cloud API calls go to ${base} and the login/credential check is skipped`);
+    }
+    return base;
+}
+/**
+ * manager-node 5.8.8 routes both DatabaseService.executePGSql and
+ * commonService().call through CloudService.request. That method delegates
+ * to context.requestFn and skips TC3 when the function is set.
+ */
+function createLocalCloudApiRequestFn(endpoint) {
+    const base = assertLocalEndpoint(endpoint);
+    return async ({ service, action, version, region, payload }) => {
+        const response = await fetch(`${base}/capi`, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                'x-tc-action': action,
+                'x-tc-version': version,
+                'x-tc-region': region,
+                'x-tc-service': service,
+            },
+            body: JSON.stringify(payload ?? {}),
+            signal: AbortSignal.timeout(ENDPOINT_TIMEOUT_MS),
+            redirect: 'manual',
+        });
+        // With redirect: 'manual' a 3xx comes back as an opaque redirect (status 0)
+        // instead of being followed, so both shapes must be rejected explicitly.
+        if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400)) {
+            throw new Error('CLOUDBASE_LOCAL_ENDPOINT responded with a redirect; redirects are not followed');
+        }
+        const body = await response.json();
+        const inner = body.Response;
+        if (!inner) {
+            const error = new Error('missing Response');
+            error.code = 'InternalError';
+            throw error;
+        }
+        const apiError = inner.Error;
+        if (apiError) {
+            const error = new Error(apiError.Message || apiError.Code || 'cloud api error');
+            error.code = apiError.Code;
+            throw error;
+        }
+        return inner;
+    };
+}
+
+
 /***/ },
 
 /***/ 46324
@@ -206688,6 +206946,7 @@ const apps_js_1 = __webpack_require__(38267);
 const logs_js_1 = __webpack_require__(61628);
 const permissions_js_1 = __webpack_require__(52639);
 const msg_push_js_1 = __webpack_require__(87707);
+const feedback_js_1 = __webpack_require__(6332);
 const index_js_1 = __webpack_require__(24908);
 const schema_js_1 = __webpack_require__(56273);
 const cloud_mode_js_1 = __webpack_require__(88694);
@@ -206717,6 +206976,7 @@ const DEFAULT_PLUGINS = [
     "logs",
     "agents",
     "capi",
+    "feedback",
 ];
 function registerDatabase(server) {
     // NoSQL 数据库按站点能力集合注册（国际站默认不支持 NoSQL）
@@ -206766,6 +207026,7 @@ const AVAILABLE_PLUGINS = {
     deploy: { name: "deploy", register: deploy_js_1.registerDeployTools },
     capi: { name: "capi", register: capi_js_1.registerCapiTools },
     "msg-push": { name: "msg-push", register: msg_push_js_1.registerMsgPushTools },
+    feedback: { name: "feedback", register: feedback_js_1.registerFeedbackTools },
 };
 const PLUGIN_ALIASES = {
     "access-control": "permissions",
@@ -209251,6 +209512,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.CLOUDRUN_ENV_TYPE = exports.CLOUDRUN_DEPLOY_REGISTRATION_INTERVAL_MS = exports.CLOUDRUN_DEPLOY_REGISTRATION_MAX_WAIT_MS = exports.MASKED_CLOUDRUN_ENV_VALUE = exports.CLOUDRUN_PACKAGE_TYPES = exports.CLOUDRUN_ACCESS_TYPES = exports.CLOUDRUN_SERVICE_TYPES = void 0;
 exports.maskCloudRunDetailEnvParams = maskCloudRunDetailEnvParams;
+exports.validateAndNormalizePath = validateAndNormalizePath;
 exports.resolveCloudRunProjectDir = resolveCloudRunProjectDir;
 exports.buildManageCloudRunErrorMessage = buildManageCloudRunErrorMessage;
 exports.isValidCloudRunBuildId = isValidCloudRunBuildId;
@@ -209277,6 +209539,7 @@ const zod_1 = __webpack_require__(21504);
 const cloudbase_manager_js_1 = __webpack_require__(33109);
 const index_js_1 = __webpack_require__(24908);
 const logger_js_1 = __webpack_require__(40781);
+const project_config_js_1 = __webpack_require__(39175);
 const gateway_access_urls_js_1 = __webpack_require__(84173);
 const notification_js_1 = __webpack_require__(4718);
 const capi_js_1 = __webpack_require__(88900);
@@ -209481,31 +209744,20 @@ function checkIfAgentProject(projectPath) {
     }
 }
 /**
- * Validate and normalize file path.
- * Accepts absolute paths as-is; for relative paths, resolves against CWD and
- * ensures the result does not escape the CWD (path-traversal protection).
- * @param inputPath User provided path
- * @returns Absolute path
+ * Validate and normalize a file path.
+ * Absolute paths are accepted as-is. Relative paths resolve against the project
+ * root and must stay inside it.
  */
 function validateAndNormalizePath(inputPath) {
-    const normalizedPath = path_1.default.resolve(inputPath);
-    // On Windows, path.resolve may return a path on a different drive/UNC share.
-    // That is safe — the user explicitly provided an absolute path there.
-    // Only apply the traversal check when the resolved path shares the same root
-    // as CWD (i.e. the path was relative or on the same drive).
-    const cwd = process.cwd();
-    const cwdRoot = path_1.default.parse(cwd).root;
-    const pathRoot = path_1.default.parse(normalizedPath).root;
-    if (cwdRoot === pathRoot) {
-        // Same filesystem root — ensure the resolved path is still inside CWD
-        // (or is exactly CWD) to block "../" traversal.
-        const prefix = cwd.endsWith(path_1.default.sep) ? cwd : cwd + path_1.default.sep;
-        if (!normalizedPath.startsWith(prefix) && normalizedPath !== cwd) {
-            throw new Error((0, index_js_1.t)("cloudrun.error.pathOutsideCwd", { cwd }));
-        }
-    }
-    // Cross-root absolute paths (e.g. D:\ on Windows when CWD is C:\) are
-    // allowed — the user own the machine and the path is explicitly absolute.
+    if (path_1.default.isAbsolute(inputPath)) {
+        return path_1.default.resolve(inputPath);
+    }
+    const projectRoot = (0, project_config_js_1.requireProjectRoot)();
+    const normalizedPath = path_1.default.resolve(projectRoot, inputPath);
+    const prefix = projectRoot.endsWith(path_1.default.sep) ? projectRoot : projectRoot + path_1.default.sep;
+    if (!normalizedPath.startsWith(prefix) && normalizedPath !== projectRoot) {
+        throw new Error((0, index_js_1.t)("cloudrun.error.pathOutsideCwd", { cwd: projectRoot, resolvedPath: normalizedPath }));
+    }
     return normalizedPath;
 }
 /**
@@ -213935,6 +214187,7 @@ const zod_1 = __webpack_require__(21504);
 const cloudbase_manager_js_1 = __webpack_require__(33109);
 const env_js_1 = __webpack_require__(56504);
 const index_js_1 = __webpack_require__(24908);
+const project_config_js_1 = __webpack_require__(39175);
 const tool_result_js_1 = __webpack_require__(69645);
 const sql_risk_js_1 = __webpack_require__(29885);
 const CATEGORY = "PostgreSQL database";
@@ -214219,19 +214472,7 @@ function validateMigrationName(name, actionLabel) {
     return null;
 }
 function getMigrationProjectRoot() {
-    const fromEnv = process.env.WORKSPACE_FOLDER_PATHS ||
-        process.env.PROJECT_ROOT ||
-        process.env.GITHUB_WORKSPACE ||
-        process.env.CI_PROJECT_DIR ||
-        process.env.BUILD_SOURCESDIRECTORY;
-    if (fromEnv && fromEnv.trim()) {
-        // IDEs may inject multiple folders separated by path.delimiter.
-        const first = fromEnv.split(path.delimiter).map((p) => p.trim()).find(Boolean);
-        if (first) {
-            return first;
-        }
-    }
-    return process.cwd();
+    return (0, project_config_js_1.requireProjectRoot)();
 }
 function buildLocalMigrationFileName(version, name) {
     return `${version}_${name}.sql`;
@@ -216606,7 +216847,17 @@ const QUERY_ACTIONS = [
     "getInstanceInfo",
     "describeInstance",
     "getConnectionInfo",
+    "describeInstanceSlowQueries",
+    "describeInstanceErrorLogs",
 ];
+const SLOW_QUERY_ORDER_BY = [
+    "QueryTime",
+    "LockTime",
+    "RowsExamined",
+    "RowsSent",
+];
+const ERROR_LOG_LEVELS = ["error", "warning", "note"];
+const ORDER_BY_TYPE = ["asc", "desc", "ASC", "DESC"];
 const MANAGE_ACTIONS = [
     "provisionMySQL",
     "destroyMySQL",
@@ -217113,6 +217364,138 @@ async function handleGetConnectionInfo(context) {
         ],
     });
 }
+function resolveMysqlInstanceId(instanceInfo, args) {
+    const fromRequest = typeof args.request?.InstanceId === "string"
+        ? args.request.InstanceId
+        : undefined;
+    const fromDbInstance = args.dbInstance?.instanceId;
+    const candidate = fromRequest || fromDbInstance || instanceInfo.instanceId;
+    if (!candidate || candidate === "default") {
+        return null;
+    }
+    return candidate;
+}
+async function requireReadyMysqlInstance(args, context) {
+    const instanceInfo = await getSqlInstanceInfo(context);
+    if (!instanceInfo.exists) {
+        return {
+            ok: false,
+            payload: buildSqlToolResult({
+                success: false,
+                errorCode: "MYSQL_NOT_CREATED",
+                data: sanitizeInstanceInfo(instanceInfo),
+                message: (0, index_js_1.t)("databaseSQL.instanceLogs.notProvisioned"),
+                nextActions: [
+                    buildNextAction(MANAGE_MYSQL_DATABASE, "provisionMySQL", (0, index_js_1.t)("databaseSQL.next.provisionBeforeSql"), { action: "provisionMySQL", confirm: true }),
+                ],
+            }),
+        };
+    }
+    const instanceId = resolveMysqlInstanceId(instanceInfo, args);
+    if (!instanceId) {
+        return {
+            ok: false,
+            payload: buildSqlToolResult({
+                success: false,
+                errorCode: "MYSQL_INSTANCE_ID_REQUIRED",
+                data: sanitizeInstanceInfo(instanceInfo),
+                message: (0, index_js_1.t)("databaseSQL.instanceLogs.instanceIdRequired"),
+                nextActions: [
+                    buildNextAction(QUERY_MYSQL_DATABASE, "getInstanceInfo", (0, index_js_1.t)("databaseSQL.instanceLogs.resolveInstanceId"), { action: "getInstanceInfo" }),
+                ],
+            }),
+        };
+    }
+    return { ok: true, instanceInfo, instanceId };
+}
+async function handleDescribeInstanceSlowQueries(args, context) {
+    const ready = await requireReadyMysqlInstance(args, context);
+    if (!ready.ok) {
+        return ready.payload;
+    }
+    const request = args.request || {};
+    const cloudbase = await context.getManager();
+    const result = await cloudbase.mysql.describeInstanceSlowQueries({
+        InstanceId: ready.instanceId,
+        StartTime: (typeof request.StartTime === "string" ? request.StartTime : undefined) ??
+            args.startTime,
+        EndTime: (typeof request.EndTime === "string" ? request.EndTime : undefined) ??
+            args.endTime,
+        Limit: (typeof request.Limit === "number" ? request.Limit : undefined) ??
+            args.limit,
+        Offset: (typeof request.Offset === "number" ? request.Offset : undefined) ??
+            args.offset,
+        Username: (typeof request.Username === "string" ? request.Username : undefined) ??
+            args.username,
+        Host: (typeof request.Host === "string" ? request.Host : undefined) ??
+            args.host,
+        Database: (typeof request.Database === "string" ? request.Database : undefined) ??
+            args.database,
+        OrderBy: (typeof request.OrderBy === "string" ? request.OrderBy : undefined) ??
+            args.orderBy,
+        OrderByType: (typeof request.OrderByType === "string"
+            ? request.OrderByType
+            : undefined) ?? args.orderByType,
+        SqlText: (typeof request.SqlText === "string" ? request.SqlText : undefined) ??
+            args.sqlText,
+    });
+    (0, cloudbase_manager_js_1.logCloudBaseResult)(context.server.logger, result);
+    return buildSqlToolResult({
+        success: true,
+        data: {
+            action: "describeInstanceSlowQueries",
+            instanceId: ready.instanceId,
+            totalCount: result.TotalCount ?? 0,
+            slowQueries: result.SlowQueries ?? [],
+            requestId: result.RequestId,
+            raw: result,
+        },
+        message: (0, index_js_1.t)("databaseSQL.instanceLogs.slowQueriesSuccess"),
+    });
+}
+async function handleDescribeInstanceErrorLogs(args, context) {
+    const ready = await requireReadyMysqlInstance(args, context);
+    if (!ready.ok) {
+        return ready.payload;
+    }
+    const request = args.request || {};
+    const cloudbase = await context.getManager();
+    const result = await cloudbase.mysql.describeInstanceErrorLogs({
+        InstanceId: ready.instanceId,
+        Limit: (typeof request.Limit === "number" ? request.Limit : undefined) ??
+            args.limit,
+        Offset: (typeof request.Offset === "number" ? request.Offset : undefined) ??
+            args.offset,
+        StartTime: (typeof request.StartTime === "string" ? request.StartTime : undefined) ??
+            args.startTime,
+        EndTime: (typeof request.EndTime === "string" ? request.EndTime : undefined) ??
+            args.endTime,
+        OrderBy: (typeof request.OrderBy === "string" ? request.OrderBy : undefined) ??
+            (args.orderBy === "Timestamp" ? args.orderBy : undefined),
+        OrderByType: (typeof request.OrderByType === "string"
+            ? request.OrderByType
+            : undefined) ?? args.orderByType,
+        LogLevels: (Array.isArray(request.LogLevels)
+            ? request.LogLevels
+            : undefined) ?? args.logLevels,
+        KeyWords: (Array.isArray(request.KeyWords)
+            ? request.KeyWords
+            : undefined) ?? args.keyWords,
+    });
+    (0, cloudbase_manager_js_1.logCloudBaseResult)(context.server.logger, result);
+    return buildSqlToolResult({
+        success: true,
+        data: {
+            action: "describeInstanceErrorLogs",
+            instanceId: ready.instanceId,
+            totalCount: result.TotalCount ?? 0,
+            errorLogs: result.ErrorLogs ?? [],
+            requestId: result.RequestId,
+            raw: result,
+        },
+        message: (0, index_js_1.t)("databaseSQL.instanceLogs.errorLogsSuccess"),
+    });
+}
 async function handleProvisionMySQL(args, context) {
     if (args.confirm !== true) {
         return buildSqlToolResult({
@@ -217483,6 +217866,54 @@ function registerSQLDatabaseTools(server) {
             })
                 .optional()
                 .describe("databaseSQL.schema.query.dbInstance"),
+            startTime: zod_1.z
+                .string()
+                .optional()
+                .describe("databaseSQL.schema.query.startTime"),
+            endTime: zod_1.z
+                .string()
+                .optional()
+                .describe("databaseSQL.schema.query.endTime"),
+            limit: zod_1.z
+                .number()
+                .optional()
+                .describe("databaseSQL.schema.query.limit"),
+            offset: zod_1.z
+                .number()
+                .optional()
+                .describe("databaseSQL.schema.query.offset"),
+            username: zod_1.z
+                .string()
+                .optional()
+                .describe("databaseSQL.schema.query.username"),
+            host: zod_1.z
+                .string()
+                .optional()
+                .describe("databaseSQL.schema.query.host"),
+            database: zod_1.z
+                .string()
+                .optional()
+                .describe("databaseSQL.schema.query.database"),
+            orderBy: zod_1.z
+                .enum([...SLOW_QUERY_ORDER_BY, "Timestamp"])
+                .optional()
+                .describe("databaseSQL.schema.query.orderBy"),
+            orderByType: zod_1.z
+                .enum(ORDER_BY_TYPE)
+                .optional()
+                .describe("databaseSQL.schema.query.orderByType"),
+            sqlText: zod_1.z
+                .string()
+                .optional()
+                .describe("databaseSQL.schema.query.sqlText"),
+            logLevels: zod_1.z
+                .array(zod_1.z.enum(ERROR_LOG_LEVELS))
+                .optional()
+                .describe("databaseSQL.schema.query.logLevels"),
+            keyWords: zod_1.z
+                .array(zod_1.z.string())
+                .optional()
+                .describe("databaseSQL.schema.query.keyWords"),
         },
         annotations: {
             readOnlyHint: true,
@@ -217506,6 +217937,10 @@ function registerSQLDatabaseTools(server) {
                 return handleGetInstanceInfo(context);
             case "getConnectionInfo":
                 return handleGetConnectionInfo(context);
+            case "describeInstanceSlowQueries":
+                return handleDescribeInstanceSlowQueries(args, context);
+            case "describeInstanceErrorLogs":
+                return handleDescribeInstanceErrorLogs(args, context);
             default:
                 throw new Error((0, index_js_1.t)("databaseSQL.unsupportedQueryAction", { action: args.action }));
         }
@@ -217603,6 +218038,7 @@ const zod_1 = __webpack_require__(21504);
 const cloudbase_manager_js_1 = __webpack_require__(33109);
 const index_js_1 = __webpack_require__(24908);
 const json_content_js_1 = __webpack_require__(18027);
+const project_config_js_1 = __webpack_require__(39175);
 const sql_risk_js_1 = __webpack_require__(29885);
 const hosting_build_utils_js_1 = __webpack_require__(27572);
 // 声明式部署可编排的资源类型，与 DeployOrchestrator 的部署顺序一致：
@@ -217867,7 +218303,7 @@ function registerDeployTools(server) {
         },
     }, async ({ cwd, mode }) => {
         try {
-            const projectRoot = cwd ?? process.cwd();
+            const projectRoot = (0, project_config_js_1.requireProjectRoot)(cwd);
             const config = await resolveDeployConfig({ cwd: projectRoot, mode });
             assertConfigValid(config);
             const hostingItems = Array.isArray(config.hosting)
@@ -217939,7 +218375,7 @@ function registerDeployTools(server) {
         },
     }, async ({ cwd, mode, envId: envIdInput, only, skip, yes, }) => {
         try {
-            const projectRoot = cwd ?? process.cwd();
+            const projectRoot = (0, project_config_js_1.requireProjectRoot)(cwd);
             const config = await resolveDeployConfig({ cwd: projectRoot, mode });
             assertConfigValid(config);
             const envId = await resolveDeployEnvId({
@@ -218023,7 +218459,7 @@ function registerDeployTools(server) {
             if (confirm !== true) {
                 throw new DeployError(exports.DEPLOY_ERROR_CODES.CONFIRM_REQUIRED, (0, index_js_1.t)("deploy.confirmRequired"));
             }
-            const projectRoot = cwd ?? process.cwd();
+            const projectRoot = (0, project_config_js_1.requireProjectRoot)(cwd);
             const config = await resolveDeployConfig({ cwd: projectRoot, mode });
             assertConfigValid(config);
             const envId = await resolveDeployEnvId({
@@ -221001,6 +221437,7 @@ function registerEnvTools(server) {
                             typeof cloudBaseOptions?.envId === "string" &&
                             cloudBaseOptions.envId.length > 0;
                         const envIdFromEnv = !cloudBaseOptions?.requestFn &&
+                            !process.env.CLOUDBASE_LOCAL_ENDPOINT &&
                             (process.env.CLOUDBASE_ENV_ID ||
                                 (isEnvScopedCredential ? cloudBaseOptions.envId : undefined));
                         const shouldPinToEnvVar = Boolean(envIdFromEnv &&
@@ -221960,6 +222397,512 @@ function registerEnvTools(server) {
 }
 
 
+/***/ },
+
+/***/ 6332
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.FEEDBACK_PREFILL_URL_LIMIT = exports.FEEDBACK_ISSUE_NEW_URL = exports.FEEDBACK_TOOL_NAME = void 0;
+exports.resolveMcpVersion = resolveMcpVersion;
+exports.buildFeedbackIssueUrl = buildFeedbackIssueUrl;
+exports.buildFeedbackIssueLink = buildFeedbackIssueLink;
+exports.buildFeedbackPayload = buildFeedbackPayload;
+exports.registerFeedbackTools = registerFeedbackTools;
+const zod_1 = __webpack_require__(21504);
+const feedback_session_js_1 = __webpack_require__(23379);
+const json_content_js_1 = __webpack_require__(18027);
+const site_map_js_1 = __webpack_require__(34533);
+/**
+ * Not a CloudBase resource, so this does not use the query* / manage* pair.
+ * The feedback plugin is in the default set and always registers this tool.
+ */
+exports.FEEDBACK_TOOL_NAME = "prepareFeedback";
+const CASE_TEMPLATE_FILE = "1-case-showcase.yml";
+const RETROSPECTIVE_TEMPLATE_FILE = "2-dev-retrospective.yml";
+/** Fixed new-issue pages. Intl uses GitHub. Domestic uses the CNB CloudBase-AI-ToolKit repo. */
+exports.FEEDBACK_ISSUE_NEW_URL = {
+    intl: "https://github.com/TencentCloudBase/CloudBase-AI-ToolKit/issues/new",
+    domestic: "https://cnb.cool/tencent/cloud/cloudbase/CloudBase-AI-ToolKit/-/issues/new",
+};
+const RESOURCE_BY_TOOL = {
+    queryHosting: { zh: "静态托管", en: "Static hosting" },
+    manageHosting: { zh: "静态托管", en: "Static hosting" },
+    readNoSqlDatabaseStructure: { zh: "云数据库（文档型）", en: "Document database" },
+    writeNoSqlDatabaseStructure: { zh: "云数据库（文档型）", en: "Document database" },
+    readNoSqlDatabaseContent: { zh: "云数据库（文档型）", en: "Document database" },
+    writeNoSqlDatabaseContent: { zh: "云数据库（文档型）", en: "Document database" },
+    queryMysqlDatabase: { zh: "云数据库（MySQL）", en: "MySQL" },
+    manageMysqlDatabase: { zh: "云数据库（MySQL）", en: "MySQL" },
+    queryPgDatabase: { zh: "云数据库（PostgreSQL）", en: "PostgreSQL" },
+    managePgDatabase: { zh: "云数据库（PostgreSQL）", en: "PostgreSQL" },
+    queryFunctions: { zh: "云函数", en: "Cloud functions" },
+    manageFunctions: { zh: "云函数", en: "Cloud functions" },
+    queryStorage: { zh: "云存储", en: "Cloud storage" },
+    manageStorage: { zh: "云存储", en: "Cloud storage" },
+    queryPgStorage: { zh: "云存储", en: "Cloud storage" },
+    queryAppAuth: { zh: "身份认证", en: "Auth" },
+    manageAppAuth: { zh: "身份认证", en: "Auth" },
+    queryCloudRun: { zh: "CloudRun", en: "CloudRun" },
+    manageCloudRun: { zh: "CloudRun", en: "CloudRun" },
+};
+/** Stay under common browser and proxy URL limits. Longer drafts are pasted by the user. */
+exports.FEEDBACK_PREFILL_URL_LIMIT = 6000;
+function resolveMcpVersion(declared, packageVersion) {
+    const fromBuild = typeof declared === "string" ? declared.trim() : "";
+    if (fromBuild) {
+        return fromBuild;
+    }
+    const fromPackage = typeof packageVersion === "string" ? packageVersion.trim() : "";
+    return fromPackage;
+}
+function readDeclaredMcpVersion() {
+    return  true ? "2.34.8" : 0;
+}
+function blank(value, lang) {
+    return value.trim().length > 0 ? value.trim() : (lang === "en" ? "blank" : "留空");
+}
+function feedbackSite(server) {
+    return (0, site_map_js_1.resolveSiteAndRegion)({
+        site: server.cloudBaseOptions?.site,
+        region: server.cloudBaseOptions?.region,
+    }).site;
+}
+function feedbackLang(site) {
+    return site === "intl" ? "en" : "zh";
+}
+function uniqueJoin(parts) {
+    const seen = new Set();
+    const ordered = [];
+    for (const part of parts) {
+        const trimmed = part.trim();
+        if (!trimmed || seen.has(trimmed)) {
+            continue;
+        }
+        seen.add(trimmed);
+        ordered.push(trimmed);
+    }
+    return ordered.join(" / ");
+}
+function readAgentLabel(server) {
+    const ide = server.ide || process.env.INTEGRATION_IDE || "";
+    const client = server.client || process.env.CLOUDBASE_MCP_CLIENT || "";
+    return uniqueJoin([ide, client]);
+}
+function toLocalIso(iso) {
+    const date = new Date(iso);
+    if (Number.isNaN(date.getTime())) {
+        return "";
+    }
+    const pad = (value) => String(value).padStart(2, "0");
+    const offsetMinutes = -date.getTimezoneOffset();
+    const sign = offsetMinutes >= 0 ? "+" : "-";
+    const absolute = Math.abs(offsetMinutes);
+    return (`${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}` +
+        `T${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}` +
+        `${sign}${pad(Math.floor(absolute / 60))}:${pad(absolute % 60)}`);
+}
+function resourceTypesFrom(outcomes, lang) {
+    const seen = new Set();
+    const types = [];
+    for (const outcome of outcomes) {
+        if (outcome.failed) {
+            continue;
+        }
+        const resourceType = RESOURCE_BY_TOOL[outcome.toolName]?.[lang];
+        if (!resourceType || seen.has(resourceType)) {
+            continue;
+        }
+        seen.add(resourceType);
+        types.push(resourceType);
+    }
+    return types;
+}
+function formatDeployDuration(outcomes, lang) {
+    const build = outcomes.filter((item) => !item.failed && item.toolName === "deployBuild");
+    const apply = outcomes.filter((item) => !item.failed && item.toolName === "deployApply");
+    if (build.length === 0 && apply.length === 0) {
+        return "";
+    }
+    const sum = (items) => items.reduce((total, item) => total + item.durationMs, 0);
+    const parts = [];
+    if (build.length > 0) {
+        parts.push(`deployBuild ${sum(build)}ms`);
+    }
+    if (apply.length > 0) {
+        parts.push(`deployApply ${sum(apply)}ms`);
+    }
+    const joined = parts.join(lang === "en" ? "; " : "；");
+    return lang === "en"
+        ? `${joined}. Cloud build time and end-to-end time cannot be separated from these tool names.`
+        : `${joined}。无法区分云端构建与端到端，只记录上述工具耗时，未补另一项`;
+}
+function latestDeployTime(outcomes) {
+    const deployOutcomes = outcomes.filter((item) => !item.failed && (item.toolName === "deployBuild" || item.toolName === "deployApply"));
+    if (deployOutcomes.length === 0) {
+        return "";
+    }
+    const latest = deployOutcomes.reduce((current, item) => (item.at > current.at ? item : current));
+    return toLocalIso(latest.at);
+}
+function failureLines(server, outcomes, lang) {
+    const counts = new Map();
+    for (const outcome of outcomes) {
+        if (!outcome.failed) {
+            continue;
+        }
+        counts.set(outcome.toolName, (counts.get(outcome.toolName) ?? 0) + 1);
+    }
+    const lines = [];
+    for (const [toolName, count] of counts) {
+        lines.push(lang === "en"
+            ? `- Verified: tool call failed ${toolName} ×${count}`
+            : `- 可验证事实：工具调用失败 ${toolName} ×${count}`);
+    }
+    const repeatPeak = (0, feedback_session_js_1.readRepeatPeak)(server);
+    if (repeatPeak > 0) {
+        lines.push(lang === "en"
+            ? `- Verified: peak consecutive identical structured errors ${repeatPeak}`
+            : `- 可验证事实：连续相同结构化错误峰值 ${repeatPeak}`);
+    }
+    return lines;
+}
+function collectSecretValues(server) {
+    const options = server.cloudBaseOptions;
+    return [options?.envId, options?.secretId, options?.secretKey, options?.token].filter((value) => typeof value === "string" && value.trim().length >= 6);
+}
+function redact(text, secrets) {
+    let redacted = text;
+    for (const secret of secrets) {
+        redacted = redacted.split(secret).join("");
+    }
+    return redacted;
+}
+function buildCaseDraft(server, outcomes, lang) {
+    const resources = resourceTypesFrom(outcomes, lang);
+    const empty = blank("", lang);
+    const resourceText = resources.length > 0 ? resources.join(lang === "en" ? ", " : "、") : empty;
+    const version = blank(resolveMcpVersion(readDeclaredMcpVersion(), process.env.npm_package_version), lang);
+    if (lang === "en") {
+        return [
+            "This issue will be public. Do not add an environment ID, secrets, or user data.",
+            `Work name: ${empty}`,
+            `One-line summary: ${empty}`,
+            `Public URL: ${empty}`,
+            `Cover / screenshot: ${empty}`,
+            `Agent / CLI: ${blank(readAgentLabel(server), lang)}`,
+            `Model: ${empty}`,
+            `MCP version: ${version}`,
+            `Deploy duration: ${blank(formatDeployDuration(outcomes, lang), lang)}`,
+            `Cloud resources: ${resourceText}`,
+            `Deploy time: ${blank(latestDeployTime(outcomes), lang)}`,
+            `Author: ${empty}`,
+            `Pitfalls: ${empty}`,
+            `Other notes: ${empty}`,
+        ].join("\n");
+    }
+    return [
+        "这条 Issue 会公开。不要补充环境 ID、密钥或用户数据。",
+        `作品名称：${empty}`,
+        `一句话简介：${empty}`,
+        `公网访问地址：${empty}`,
+        `封面 / 截图地址：${empty}`,
+        `Agent / CLI：${blank(readAgentLabel(server), lang)}`,
+        `所用模型：${empty}`,
+        `MCP 版本：${version}`,
+        `部署耗时：${blank(formatDeployDuration(outcomes, lang), lang)}`,
+        `用到的云资源：${resourceText}`,
+        `部署时间：${blank(latestDeployTime(outcomes), lang)}`,
+        `作者署名 / 主页：${empty}`,
+        `开发过程中踩到的坑：${empty}`,
+        `其他补充：${empty}`,
+    ].join("\n");
+}
+function buildRetrospectiveDraft(server, outcomes, lang) {
+    const resources = resourceTypesFrom(outcomes, lang);
+    const failures = failureLines(server, outcomes, lang);
+    const empty = blank("", lang);
+    if (lang === "en") {
+        const failureBlock = failures.length > 0
+            ? failures.join("\n")
+            : "No tool failures recorded in this session.";
+        const resourceBlock = resources.length > 0
+            ? resources.join(", ")
+            : empty;
+        return [
+            "This issue will be public. Do not add an environment ID, secrets, collection names, or function names.",
+            "Conversation turns are not collected. Do not invent a turn count.",
+            "",
+            "Tool failures:",
+            failureBlock,
+            "",
+            "Cloud resources:",
+            resourceBlock,
+        ].join("\n");
+    }
+    const failureBlock = failures.length > 0
+        ? failures.join("\n")
+        : "本次会话没有记录到工具失败。";
+    const resourceBlock = resources.length > 0
+        ? resources.join("、")
+        : empty;
+    return [
+        "这条 Issue 会公开。不要补充环境 ID、密钥、集合名或函数名。",
+        "不采集对话轮次。不要把失败次数写成轮次，也不要补一个数字。",
+        "",
+        "工具失败：",
+        failureBlock,
+        "",
+        "云资源：",
+        resourceBlock,
+    ].join("\n");
+}
+function buildFeedbackIssueUrl(site, channel, draft) {
+    return buildFeedbackIssueLink(site, channel, draft).url;
+}
+function buildFeedbackIssueLink(site, channel, draft) {
+    const title = site === "intl"
+        ? (channel === "case" ? "[case] " : "[retrospective] ")
+        : (channel === "case" ? "[案例] " : "[复盘] ");
+    const base = exports.FEEDBACK_ISSUE_NEW_URL[site];
+    const draftQuery = site === "intl"
+        ? `body=${encodeURIComponent(draft)}`
+        : `session=${encodeURIComponent(draft)}`;
+    const head = site === "intl"
+        ? `${base}?title=${encodeURIComponent(title)}`
+        : `${base}?template=${encodeURIComponent(channel === "case" ? CASE_TEMPLATE_FILE : RETROSPECTIVE_TEMPLATE_FILE)}&title=${encodeURIComponent(title)}`;
+    const prefilled = `${head}&${draftQuery}`;
+    if (prefilled.length <= exports.FEEDBACK_PREFILL_URL_LIMIT) {
+        return { url: prefilled, prefilled: true };
+    }
+    return { url: head, prefilled: false };
+}
+function buildFeedbackPayload(input) {
+    const site = feedbackSite(input.server);
+    const lang = feedbackLang(site);
+    const outcomes = (0, feedback_session_js_1.readToolOutcomes)(input.server);
+    const secrets = collectSecretValues(input.server);
+    const draft = redact(input.channel === "case"
+        ? buildCaseDraft(input.server, outcomes, lang)
+        : buildRetrospectiveDraft(input.server, outcomes, lang), secrets);
+    if (!input.confirmed) {
+        return {
+            success: true,
+            channel: input.channel,
+            confirmed: false,
+            submittable: false,
+            draft,
+            nextStep: lang === "en"
+                ? "Show this draft to the user unchanged. Do not give a submission link before they explicitly confirm. Do not rewrite it into a different write-up."
+                : "把这份 draft 原样给用户看。用户明确确认之前，不要给出提交链接，也不要改写成另一份说明。",
+        };
+    }
+    const link = buildFeedbackIssueLink(site, input.channel, draft);
+    const pasteHint = link.prefilled
+        ? ""
+        : (lang === "en"
+            ? " The link does not include the draft because the URL would be too long. Paste the draft into the session field."
+            : " 链接没有带上正文，因为地址过长。请把 draft 粘贴到「本次会话记录」。");
+    return {
+        success: true,
+        channel: input.channel,
+        confirmed: true,
+        submittable: true,
+        draft,
+        url: link.url,
+        nextStep: (lang === "en"
+            ? "The user confirmed. The link body is this draft. Do not submit a rewritten version, and do not submit it for them."
+            : "用户已确认。链接里的正文就是这份 draft。不要另写一版再提交，也不要代为提交。") + pasteHint,
+    };
+}
+function registerFeedbackTools(server) {
+    server.registerTool(exports.FEEDBACK_TOOL_NAME, {
+        title: "feedback.title",
+        description: "feedback.description",
+        inputSchema: {
+            channel: zod_1.z
+                .enum(["case", "retrospective"])
+                .describe("feedback.schema.channel"),
+            confirmed: zod_1.z
+                .boolean()
+                .optional()
+                .describe("feedback.schema.confirmed"),
+        },
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            openWorldHint: false,
+            category: "feedback",
+        },
+    }, async ({ channel, confirmed }) => {
+        return (0, json_content_js_1.jsonContent)(buildFeedbackPayload({
+            server,
+            channel,
+            confirmed: confirmed === true,
+        }));
+    });
+}
+
+
+/***/ },
+
+/***/ 65735
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+/**
+ * 云函数 ZIP 两段式部署·阶段 A：生成 COS 预签名上传地址。
+ *
+ * 通道来源（R1 探针实测裁决，见 output/2026-09-23-functions-zip-two-phase-design.md §4）：
+ * - DescribeBuildServiceCosInfo / build-service 上传 / GetTempCosInfo 三条通道全部判死
+ *   （CosTimestamp 稳定 InternalError；SCF 拉代码强制给桶名拼 -appid 后缀，共享 build 桶
+ *   永远拉不到；tempcos 桶全 region 404）。
+ * - 活通道：用环境自有存储桶（DescribeEnvs → Storages[0].Bucket/Region）+ 用户凭据
+ *   本地铸 COS q-sign 预签名 PUT URL。CloudBase 临时凭据可直接用于 COS（manager-node
+ *   storage 同款 SecretId+SecretKey+token 范式），但必须把 x-cos-security-token 纳入
+ *   签名 Headers 且请求时携带同名头。
+ *
+ * 设计约束：
+ * - 纯函数、零第三方依赖（node:crypto 即可）：签名算法从 cos-nodejs-sdk-v5 getAuth
+ *   逐行复刻，测试里与 SDK 真实现做黄金值对照，防止复刻漂移。
+ * - 预签名是本地 HMAC 计算：CAM 零新增权限、不暴露 appId（URL 用全桶名，阶段 B 回传
+ *   TCB 的 CosBucketName 用短名）、国际站天然可用。
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.stripAppIdSuffix = stripAppIdSuffix;
+exports.camSafeUrlEncode = camSafeUrlEncode;
+exports.buildCosPutAuthorization = buildCosPutAuthorization;
+exports.buildFunctionZipUpload = buildFunctionZipUpload;
+const crypto_1 = __webpack_require__(55511);
+/** 环境存储桶全名形如 `mybucket-1258016615`；TCB CosBucketName 只收短名（不带 -appid 后缀）。 */
+function stripAppIdSuffix(bucket) {
+    return bucket.replace(/-\d+$/, "");
+}
+/** 复刻 cos-nodejs-sdk-v5 util.camSafeUrlEncode：encodeURIComponent 强制编码 !'()* 五个字符。 */
+function camSafeUrlEncode(str) {
+    return encodeURIComponent(str)
+        .replace(/!/g, "%21")
+        .replace(/'/g, "%27")
+        .replace(/\(/g, "%28")
+        .replace(/\)/g, "%29")
+        .replace(/\*/g, "%2A");
+}
+/** 复刻 SDK getObjectKeys：原始 key 按小写比较排序（排序在编码之前）。 */
+function sortedKeys(obj) {
+    return Object.keys(obj).sort((a, b) => {
+        a = a.toLowerCase();
+        b = b.toLowerCase();
+        return a === b ? 0 : a > b ? 1 : -1;
+    });
+}
+/** 复刻 SDK obj2str(obj, true)：key 编码后小写、value 编码，按 key 升序以 & 连接。 */
+function encodeKv(obj) {
+    return sortedKeys(obj)
+        .map((key) => {
+        const k = camSafeUrlEncode(key).toLowerCase();
+        const v = camSafeUrlEncode(obj[key] ?? "");
+        return `${k}=${v}`;
+    })
+        .join("&");
+}
+/**
+ * 生成 COS q-sign 预签名授权串（PUT 方法）。
+ * 算法逐行复刻 cos-nodejs-sdk-v5 getAuth：
+ *   signKey      = HMAC-SHA1(SecretKey, KeyTime)
+ *   formatString = method \n pathname \n query-str \n header-str \n
+ *   stringToSign = sha1 \n KeyTime \n sha1(formatString) \n
+ *   signature    = HMAC-SHA1(signKey, stringToSign)
+ * Host 头始终签入（对齐 SDK ForceSignHost 默认 true），query 为空故 q-url-param-list 为空。
+ */
+function buildCosPutAuthorization(options) {
+    const { secretId, secretKey, bucket, region, objectKey, securityToken, expiresInSeconds = 300, } = options;
+    if (!secretId)
+        throw new Error("missing param SecretId");
+    if (!secretKey)
+        throw new Error("missing param SecretKey");
+    if (!bucket)
+        throw new Error("missing param Bucket");
+    if (!region)
+        throw new Error("missing param Region");
+    if (!objectKey)
+        throw new Error("missing param objectKey");
+    const headers = {
+        host: `${bucket}.cos.${region}.myqcloud.com`,
+    };
+    if (securityToken) {
+        headers["x-cos-security-token"] = securityToken;
+    }
+    const keyTime = options.keyTime ??
+        (() => {
+            const now = options.now ?? Math.floor(Date.now() / 1000);
+            return `${now - 1};${now + expiresInSeconds}`;
+        })();
+    // 与请求 URL 一致的编码路径（对象 key 仅允许安全字符时与原始 key 相同）。
+    const pathname = `/${objectKey.split("/").map(encodeURIComponent).join("/")}`;
+    const signKey = (0, crypto_1.createHmac)("sha1", secretKey).update(keyTime).digest("hex");
+    const formatString = ["put", pathname, "", encodeKv(headers), ""].join("\n");
+    const stringToSign = [
+        "sha1",
+        keyTime,
+        (0, crypto_1.createHash)("sha1").update(Buffer.from(formatString, "utf8")).digest("hex"),
+        "",
+    ].join("\n");
+    const signature = (0, crypto_1.createHmac)("sha1", signKey).update(stringToSign).digest("hex");
+    const headerList = sortedKeys(headers)
+        .map((key) => camSafeUrlEncode(key).toLowerCase())
+        .join(";");
+    return [
+        "q-sign-algorithm=sha1",
+        `q-ak=${secretId}`,
+        `q-sign-time=${keyTime}`,
+        `q-key-time=${keyTime}`,
+        `q-header-list=${headerList}`,
+        "q-url-param-list=",
+        `q-signature=${signature}`,
+    ].join("&");
+}
+/**
+ * 生成两段式部署阶段 A 的完整返回体：预签名 PUT URL + 阶段 B 所需的 COS 三元组。
+ * 对象 key 形如 `fnzip-upload/{ts}-{rand}/{functionName|code}.zip`。functionName 会被
+ * 收窄到 COS 签名安全字符（字母数字与 -_），保证签名 pathname 与请求 URL 一致。
+ */
+function buildFunctionZipUpload(params) {
+    const { storage, credential, functionName } = params;
+    const expiresIn = params.expiresIn ?? 300;
+    const ts = params.now ?? Math.floor(Date.now() / 1000);
+    const rand = params.randomSuffix ?? (0, crypto_1.randomBytes)(8).toString("hex");
+    // functionName 只用于让对象 key 可读，必须收窄：否则 "../" 之类能把对象写到
+    // fnzip-upload/ 前缀之外
+    const safeFunctionName = functionName && /^[A-Za-z0-9_-]{1,64}$/.test(functionName)
+        ? functionName
+        : "code";
+    const objectKey = `fnzip-upload/${ts}-${rand}/${safeFunctionName}.zip`;
+    const keyTime = params.keyTime ?? `${ts - 1};${ts + expiresIn}`;
+    const authorization = buildCosPutAuthorization({
+        secretId: credential.secretId,
+        secretKey: credential.secretKey,
+        bucket: storage.bucket,
+        region: storage.region,
+        objectKey,
+        securityToken: credential.token || undefined,
+        keyTime,
+    });
+    return {
+        uploadUrl: `https://${storage.bucket}.cos.${storage.region}.myqcloud.com/${objectKey}?${authorization}`,
+        uploadHeaders: credential.token
+            ? [{ Key: "x-cos-security-token", Value: credential.token }]
+            : [],
+        cosBucketName: stripAppIdSuffix(storage.bucket),
+        cosBucketRegion: storage.region,
+        cosObjectName: objectKey,
+        expiresInSeconds: expiresIn,
+    };
+}
+
+
 /***/ },
 
 /***/ 84931
@@ -223319,6 +224262,127 @@ async function waitUntilFunctionActive(getStatus, options = {}) {
 }
 
 
+/***/ },
+
+/***/ 77499
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.FUNCTION_UPLOAD_TARGET_NOT_FOUND_ERROR_CODE = exports.FUNCTION_UPLOAD_TARGET_LIMITS = void 0;
+exports.registerFunctionUploadTarget = registerFunctionUploadTarget;
+exports.findFunctionUploadTarget = findFunctionUploadTarget;
+exports.getFunctionUploadTargetCount = getFunctionUploadTargetCount;
+exports.resetFunctionUploadTargets = resetFunctionUploadTargets;
+const function_cos_upload_js_1 = __webpack_require__(65735);
+/**
+ * 云函数 ZIP 两段式部署的「上传目标」进程内登记。
+ *
+ * 阶段 A（queryFunctions action=getFunctionUploadUrl）铸造预签名上传地址时，
+ * 在本进程登记这次铸造出来的 (envId, bucket, region, objectKey)；阶段 B
+ * （manageFunctions createFunction / updateFunctionCode 带 code 三元组）只接受
+ * 登记过的组合。
+ *
+ * 为什么需要它：code.cosObjectName 是模型可以自由填写的字符串，如果不校验，
+ * 它可以指向环境桶里的任意对象，也可以指向另一个桶（包括调用方自己的桶）——
+ * SCF 会用环境角色去拉取那个对象。登记把可用面收窄成「本进程刚为当前环境铸造
+ * 出来的那个 key」。
+ *
+ * 取舍（刻意不做的事）：
+ * - 不做「用一次即作废」：同一个 key 在保留期内可以重复提交。上传失败重试、
+ *   updateFunctionCode 撞上 ResourceInUse 后的重试、以及同一份代码包重复部署
+ *   都要能重放，收窄的只是「谁能成为目标」，不是「能用几次」。
+ * - 不区分「没登记」与「登记在别的环境」：登记按 envId 隔离，跨环境查询直接
+ *   未命中，调用方只需要知道「这个目标不在登记里，请重新取地址」。
+ *
+ * 登记只保存在当前 MCP 进程内存中，MCP Server 重启即丢失 —— 此时重新调用
+ * getFunctionUploadUrl 取地址、重新上传即可。这与 function-deploy-task-store
+ * 的语义一致（异步部署任务同样只活在进程内）。
+ */
+exports.FUNCTION_UPLOAD_TARGET_LIMITS = {
+    /**
+     * 登记的保留时间。远长于上传地址本身的有效期（默认 300 秒）：地址过期只影响
+     * 「还能不能 PUT」，而登记要覆盖「取地址 → 上传 → 提交部署」整条链在客户端
+     * 可能的等待（大包上传、人工确认、agent 多轮编排）。
+     */
+    ttlMs: 60 * 60 * 1000,
+    /** 最大登记数，超出时淘汰最旧的 */
+    maxTargets: 500,
+};
+exports.FUNCTION_UPLOAD_TARGET_NOT_FOUND_ERROR_CODE = "FUNCTION_UPLOAD_TARGET_NOT_FOUND";
+const uploadTargets = new Map();
+/**
+ * envId 与 objectKey 都不可能含 NUL，用它拼主键不会产生歧义；
+ * 反过来，跨环境的查询无法构造出同一主键（前缀 envId 由服务端解析，调用方改不了）。
+ */
+function targetKey(envId, objectKey) {
+    return `${envId}\u0000${objectKey}`;
+}
+function cleanupUploadTargets(now) {
+    for (const [key, target] of uploadTargets) {
+        if (now - target.createdAtMs > exports.FUNCTION_UPLOAD_TARGET_LIMITS.ttlMs) {
+            uploadTargets.delete(key);
+        }
+    }
+}
+/**
+ * 达到上限时淘汰最旧的登记。
+ *
+ * 与部署任务表不同，这里每一条登记都可以淘汰 —— 淘汰最坏的结果是调用方重新
+ * 取一次上传地址，不会影响任何正在进行中的云端操作，因此不需要 warn。
+ */
+function enforceMaxTargets() {
+    const { maxTargets } = exports.FUNCTION_UPLOAD_TARGET_LIMITS;
+    if (uploadTargets.size < maxTargets) {
+        return;
+    }
+    const oldestFirst = [...uploadTargets.entries()].sort((left, right) => left[1].createdAtMs - right[1].createdAtMs);
+    for (const [key] of oldestFirst) {
+        if (uploadTargets.size < maxTargets) {
+            return;
+        }
+        uploadTargets.delete(key);
+    }
+}
+/** 阶段 A 登记本次铸造的上传目标。 */
+function registerFunctionUploadTarget(input) {
+    const now = input.now ?? Date.now();
+    cleanupUploadTargets(now);
+    enforceMaxTargets();
+    uploadTargets.set(targetKey(input.envId, input.objectKey), {
+        envId: input.envId,
+        bucket: input.bucket,
+        region: input.region,
+        objectKey: input.objectKey,
+        createdAtMs: now,
+    });
+}
+/**
+ * 阶段 B 校验：命中登记且桶、地域都对得上才返回目标，否则返回 undefined。
+ *
+ * 地域与桶都要比对 —— 只比对象 key 的话，仍然可以把同一个 key 指到别的桶或
+ * 别的地域（例如把代码指到调用方自己的桶）上。
+ */
+function findFunctionUploadTarget(input) {
+    const now = input.now ?? Date.now();
+    cleanupUploadTargets(now);
+    const target = uploadTargets.get(targetKey(input.envId, input.objectKey));
+    if (!target) {
+        return undefined;
+    }
+    const bucketMatches = (0, function_cos_upload_js_1.stripAppIdSuffix)(input.bucketName) === (0, function_cos_upload_js_1.stripAppIdSuffix)(target.bucket);
+    return bucketMatches && input.region === target.region ? target : undefined;
+}
+function getFunctionUploadTargetCount() {
+    return uploadTargets.size;
+}
+/** 测试用：清空登记表 */
+function resetFunctionUploadTargets() {
+    uploadTargets.clear();
+}
+
+
 /***/ },
 
 /***/ 51546
@@ -223350,10 +224414,36 @@ const logger_js_1 = __webpack_require__(40781);
 const tool_result_js_1 = __webpack_require__(69645);
 const function_deploy_js_1 = __webpack_require__(39151);
 const function_deploy_schema_js_1 = __webpack_require__(76427);
+const function_cos_upload_js_1 = __webpack_require__(65735);
+const function_upload_target_store_js_1 = __webpack_require__(77499);
 const function_updating_js_1 = __webpack_require__(70326);
 const index_js_1 = __webpack_require__(24908);
 const fs_1 = __webpack_require__(29021);
 const path_1 = __importDefault(__webpack_require__(33873));
+/**
+ * 阶段 B 校验：code 三元组必须是本进程阶段 A 登记过的上传目标。
+ *
+ * 未命中时统一按「目标不在登记里」返回，不区分「没登记」与「登记在别的环境」——
+ * 与部署任务表同款取舍，调用方只需要知道下一步该重新取上传地址。
+ */
+function assertFunctionUploadTarget(input) {
+    if ((0, function_upload_target_store_js_1.findFunctionUploadTarget)(input)) {
+        return;
+    }
+    (0, tool_result_js_1.throwToolPayloadError)({
+        success: false,
+        errorCode: function_upload_target_store_js_1.FUNCTION_UPLOAD_TARGET_NOT_FOUND_ERROR_CODE,
+        data: {
+            action: input.action,
+            cosBucketName: input.bucketName,
+            cosBucketRegion: input.region,
+            cosObjectName: input.objectKey,
+        },
+        message: (0, index_js_1.t)("functions.uploadTargetNotFound", {
+            objectName: input.objectKey,
+        }),
+    });
+}
 exports.SUPPORTED_RUNTIMES = {
     nodejs: [
         "Nodejs20.19",
@@ -223431,6 +224521,7 @@ exports.QUERY_FUNCTION_ACTIONS = [
     "getFunctionDeployStatus",
     "listVersionByFunction",
     "getFunctionAlias",
+    "getFunctionUploadUrl",
 ];
 exports.MANAGE_FUNCTION_ACTIONS = [
     "createFunction",
@@ -223610,6 +224701,25 @@ const MANAGE_LAYER_SCHEMA = zod_1.z.object({
     layerName: zod_1.z.string().describe("functions.schema.manageLayer.name"),
     layerVersion: zod_1.z.number().describe("functions.schema.manageLayer.version"),
 });
+/**
+ * ZIP 两段式部署阶段 B 的 code 入参（camelCase，映射为 SDK 的 PascalCase code 三元组）。
+ * 三件套均来自 queryFunctions getFunctionUploadUrl 的返回体，原样透传即可。
+ * strict：拼错字段名直接报错，而不是被静默丢弃后按本地目录语义执行。
+ */
+const FUNCTION_CODE_SCHEMA = zod_1.z
+    .object({
+    cosBucketName: zod_1.z
+        .string()
+        .describe("functions.schema.code.cosBucketName"),
+    cosObjectName: zod_1.z
+        .string()
+        .describe("functions.schema.code.cosObjectName"),
+    cosBucketRegion: zod_1.z
+        .string()
+        .optional()
+        .describe("functions.schema.code.cosBucketRegion"),
+})
+    .strict();
 const FUNCTION_VERSION_WEIGHT_SCHEMA = zod_1.z.object({
     Version: zod_1.z.string().describe("functions.schema.routing.version"),
     Weight: zod_1.z.number().describe("functions.schema.routing.weight"),
@@ -223809,6 +224919,49 @@ function registerFunctionTools(server) {
             throw new Error((0, index_js_1.t)("functions.confirmRequired", { action }));
         }
     };
+    /**
+     * 解析当前环境的自有存储桶（DescribeEnvs → Storages[0]）。
+     * 两段式部署的上传桶必须用环境自己的桶：共享 build 桶会被 SCF 拉
+     * 代码时的 -appid 拼接判死（R1 探针实测）。无存储的环境直接报错引导。
+     *
+     * DescribeEnvs 是账号级动作，环境级凭据（如 API Key 换取的 STS，
+     * remote MCP 临时 API Key 即此类）调用会被网关拒绝（invalid token），
+     * 此时回退到环境级的 DescribeEnvInfo —— 其 EnvBaseInfo.Storages 与
+     * DescribeEnvs 的 Storages 同构（实测两者均含 Bucket/Region/Status）。
+     */
+    const resolveEnvFunctionCosStorage = async () => {
+        const cloudbase = await getManager();
+        const envId = cloudBaseOptions?.envId ?? (await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions));
+        const tcbService = cloudbase.commonService("tcb", "2018-06-08");
+        const fetchStorages = async () => {
+            try {
+                const envsResult = (await tcbService.call({
+                    Action: "DescribeEnvs",
+                    Param: { EnvId: envId },
+                }));
+                const storages = envsResult?.EnvList?.[0]?.Storages ?? envsResult?.EnvInfo?.Storages ?? [];
+                if (storages.length > 0) {
+                    return storages;
+                }
+            }
+            catch (e) {
+                (0, logger_js_1.debug)("resolveEnvFunctionCosStorage: DescribeEnvs failed, falling back to DescribeEnvInfo", { envId, error: e instanceof Error ? e.message : String(e) });
+            }
+            const infoResult = (await tcbService.call({
+                Action: "DescribeEnvInfo",
+                Param: { EnvId: envId },
+            }));
+            return infoResult?.EnvInfo?.EnvBaseInfo?.Storages ?? [];
+        };
+        const storages = await fetchStorages();
+        const bucket = storages[0]?.Bucket ?? "";
+        const region = storages[0]?.Region ?? "";
+        if (!bucket || !region) {
+            throw new Error((0, index_js_1.t)("functions.storageMissing"));
+        }
+        // envId 一并返回：阶段 A 的上传目标登记与阶段 B 的校验都按环境隔离
+        return { bucket, region, envId };
+    };
     const ensureActionAllowedInCloudMode = (input) => {
         if (!(0, cloud_mode_js_1.isCloudMode)()) {
             return;
@@ -223823,6 +224976,11 @@ function registerFunctionTools(server) {
             if (hasImageDeploy) {
                 return;
             }
+            // 两段式部署阶段 B：代码包已上传到环境 COS 桶，全程不依赖本地目录，
+            // 与镜像部署同属可在 cloud mode 下真实执行的路径。
+            if (Boolean(input.code)) {
+                return;
+            }
             throw new Error((0, index_js_1.t)("functions.cloudMode.localOnly", { action: input.action }));
         }
         if (input.action === "createLayerVersion" && input.contentPath) {
@@ -224041,7 +225199,13 @@ function registerFunctionTools(server) {
                 }
                 const cloudbase = await getManager();
                 const result = await cloudbase.functions.getFunctionDetail(input.functionName, input.codeSecret);
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                // 与 getFunctionDetail / listFunctionTriggers 一致：本 action 只想取 Layers，
+                // 但 getFunctionDetail 的返回里带着环境变量明文，日志与 raw 都必须脱敏 ——
+                // 否则一个只读的「看层」动作会把明文环境变量带进模型上下文与持久化日志。
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, maskFunctionDetailEnvValues(result));
+                const detail = input.revealEnvValues === true
+                    ? result
+                    : maskFunctionDetailEnvValues(result);
                 const layers = normalizeFunctionLayers(result.Layers);
                 return buildEnvelope({
                     action: input.action,
@@ -224049,7 +225213,7 @@ function registerFunctionTools(server) {
                     layers,
                     count: layers.length,
                     requestId: result.RequestId,
-                    raw: result,
+                    raw: detail,
                 }, (0, index_js_1.t)("functions.gotFunctionLayers", { fnName: input.functionName }), [
                     {
                         tool: "manageFunctions",
@@ -224187,7 +225351,9 @@ function registerFunctionTools(server) {
                 }
                 const cloudbase = await getManager();
                 const result = await cloudbase.functions.getFunctionDownloadUrl(input.functionName, input.codeSecret);
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                // downloadUrl 是带凭据签名的临时链接：与 apps getUploadUrl 同款处理，只落 RequestId，
+                // 避免整条 URL 随宿主日志持久化
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, { RequestId: result.RequestId });
                 return buildEnvelope({
                     action: input.action,
                     functionName: input.functionName,
@@ -224269,6 +225435,52 @@ function registerFunctionTools(server) {
                     },
                 ]);
             }
+            case "getFunctionUploadUrl": {
+                // ZIP 两段式部署阶段 A：环境自有存储桶 + 用户凭据本地铸 COS 预签名 PUT URL。
+                // functionName 可选，仅用于生成可读的对象 key。
+                const cloudbase = await getManager();
+                const authConfig = cloudbase.currentEnvironment().getAuthConfig();
+                if (!authConfig?.secretId || !authConfig?.secretKey) {
+                    throw new Error((0, index_js_1.t)("functions.credentialMissing"));
+                }
+                const storage = await resolveEnvFunctionCosStorage();
+                const upload = (0, function_cos_upload_js_1.buildFunctionZipUpload)({
+                    storage,
+                    credential: {
+                        secretId: authConfig.secretId,
+                        secretKey: authConfig.secretKey,
+                        // 永久密钥时 token 为空串，转 undefined 才不签入 token 头
+                        token: authConfig.token || undefined,
+                    },
+                    functionName: input.functionName,
+                });
+                // 阶段 A 在进程内登记本次铸造的上传目标：阶段 B 只接受登记过的
+                // (envId, bucket, region, objectKey)，cosObjectName 因此不再是任意字符串。
+                (0, function_upload_target_store_js_1.registerFunctionUploadTarget)({
+                    envId: storage.envId,
+                    bucket: storage.bucket,
+                    region: storage.region,
+                    objectKey: upload.cosObjectName,
+                });
+                // uploadUrl 内含凭据绑定的签名（临时凭据还绑定 token），禁止落日志
+                (0, logger_js_1.debug)(`[getFunctionUploadUrl] envId=${authConfig.envId ?? "n/a"}, cosObjectName=${upload.cosObjectName}, expiresIn=${upload.expiresInSeconds}s`);
+                return buildEnvelope({
+                    action: input.action,
+                    ...(input.functionName ? { functionName: input.functionName } : {}),
+                    uploadUrl: upload.uploadUrl,
+                    uploadHeaders: upload.uploadHeaders,
+                    cosBucketName: upload.cosBucketName,
+                    cosBucketRegion: upload.cosBucketRegion,
+                    cosObjectName: upload.cosObjectName,
+                    expiresInSeconds: upload.expiresInSeconds,
+                }, (0, index_js_1.t)("functions.gotUploadUrl", { seconds: upload.expiresInSeconds }), [
+                    {
+                        tool: "manageFunctions",
+                        action: "createFunction",
+                        reason: (0, index_js_1.t)("functions.reason.cosCreate"),
+                    },
+                ]);
+            }
             default:
                 throw new Error((0, index_js_1.t)("functions.unsupportedAction", { action: input.action }));
         }
@@ -224525,6 +225737,70 @@ function registerFunctionTools(server) {
                         },
                     ]);
                 }
+                // code 入参（ZIP 两段式部署阶段 B）：代码包已由 getFunctionUploadUrl 上传到
+                // 环境 COS 桶，直接 deployMode=cos 提交，跳过本地目录 / 依赖安装逻辑。
+                if (input.code) {
+                    const storage = await resolveEnvFunctionCosStorage();
+                    const cosBucketName = (0, function_cos_upload_js_1.stripAppIdSuffix)(input.code.cosBucketName || storage.bucket);
+                    const cosBucketRegion = input.code.cosBucketRegion ?? storage.region;
+                    assertFunctionUploadTarget({
+                        envId: storage.envId,
+                        bucketName: input.code.cosBucketName || storage.bucket,
+                        region: cosBucketRegion,
+                        objectKey: input.code.cosObjectName,
+                        action: input.action,
+                    });
+                    const codeFunc = { ...func };
+                    // 用户 zip 自带依赖语义（装没装由上传方决定），默认不触发云端依赖安装
+                    delete codeFunc.installDependency;
+                    if (input.func?.installDependency !== undefined) {
+                        codeFunc.installDependency = input.func.installDependency;
+                    }
+                    if (codeFunc.type !== "HTTP") {
+                        codeFunc.runtime = resolveEventFunctionRuntime(codeFunc.runtime);
+                    }
+                    let cosCreateResult;
+                    try {
+                        cosCreateResult = await cloudbase.functions.createFunction({
+                            func: codeFunc,
+                            code: {
+                                CosBucketName: cosBucketName,
+                                CosBucketRegion: cosBucketRegion,
+                                CosObjectName: input.code.cosObjectName,
+                            },
+                            deployMode: "cos",
+                            force: Boolean(input.force),
+                        });
+                    }
+                    catch (error) {
+                        throw wrapFunctionOperationError("createFunction", functionName, undefined, error);
+                    }
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, cosCreateResult);
+                    return buildEnvelope({
+                        action: input.action,
+                        functionName,
+                        deployMode: "cos",
+                        cosBucketName,
+                        cosBucketRegion,
+                        cosObjectName: input.code.cosObjectName,
+                        raw: cosCreateResult,
+                    }, (0, index_js_1.t)("functions.cosCreatedMessage", { fnName: functionName }), [
+                        {
+                            tool: "queryFunctions",
+                            action: "getFunctionDetail",
+                            reason: (0, index_js_1.t)("functions.reason.confirmConfig"),
+                        },
+                        ...(codeFunc.type === "HTTP"
+                            ? [
+                                {
+                                    tool: "manageGateway",
+                                    action: "createRoute",
+                                    reason: (0, index_js_1.t)("functions.reason.gatewayRouteForHttp"),
+                                },
+                            ]
+                            : []),
+                    ]);
+                }
                 if (func.type !== "HTTP") {
                     const originalRuntime = typeof func.runtime === "string" ? func.runtime : undefined;
                     func.runtime = resolveEventFunctionRuntime(func.runtime);
@@ -224733,6 +226009,65 @@ function registerFunctionTools(server) {
                         },
                     ]);
                 }
+                // code 入参（ZIP 两段式部署阶段 B）：zip 已在环境 COS 桶，直接 deployMode=cos
+                // 更新代码包，跳过 functionRootPath / zipFile 本地语义。
+                if (input.code) {
+                    const storage = await resolveEnvFunctionCosStorage();
+                    const cosBucketName = (0, function_cos_upload_js_1.stripAppIdSuffix)(input.code.cosBucketName || storage.bucket);
+                    const cosBucketRegion = input.code.cosBucketRegion ?? storage.region;
+                    assertFunctionUploadTarget({
+                        envId: storage.envId,
+                        bucketName: input.code.cosBucketName || storage.bucket,
+                        region: cosBucketRegion,
+                        objectKey: input.code.cosObjectName,
+                        action: input.action,
+                    });
+                    let cosUpdateResult;
+                    try {
+                        cosUpdateResult = await cloudbase.functions.updateFunctionCode({
+                            func: {
+                                name: input.functionName,
+                                // 与 create 的 code 分支一致：默认不触发云端依赖安装，显式传参才覆盖
+                                ...(input.func?.installDependency !== undefined
+                                    ? { installDependency: input.func.installDependency }
+                                    : {}),
+                                ...(input.handler ? { handler: input.handler } : {}),
+                            },
+                            code: {
+                                CosBucketName: cosBucketName,
+                                CosBucketRegion: cosBucketRegion,
+                                CosObjectName: input.code.cosObjectName,
+                            },
+                            deployMode: "cos",
+                        });
+                    }
+                    catch (error) {
+                        if ((0, function_updating_js_1.isFunctionUpdatingError)(error)) {
+                            return (0, function_updating_js_1.buildFunctionUpdatingPayload)({
+                                action: "updateFunctionCode",
+                                functionName: input.functionName,
+                                rawMessage: (0, function_updating_js_1.getErrorMessage)(error),
+                            });
+                        }
+                        throw wrapFunctionOperationError("updateFunctionCode", input.functionName, undefined, error);
+                    }
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, cosUpdateResult);
+                    return buildEnvelope({
+                        action: input.action,
+                        functionName: input.functionName,
+                        deployMode: "cos",
+                        cosBucketName,
+                        cosBucketRegion,
+                        cosObjectName: input.code.cosObjectName,
+                        raw: cosUpdateResult,
+                    }, (0, index_js_1.t)("functions.cosUpdatedMessage", { fnName: input.functionName }), [
+                        {
+                            tool: "queryFunctions",
+                            action: "getFunctionDetail",
+                            reason: (0, index_js_1.t)("functions.reason.confirmConfig"),
+                        },
+                    ]);
+                }
                 const processedRootPath = processFunctionRootPath(input.functionRootPath, input.functionName);
                 const updateParams = {
                     func: {
@@ -225283,6 +226618,7 @@ function registerFunctionTools(server) {
                 .optional()
                 .describe("functions.schema.manage.functionName"),
             zipFile: zod_1.z.string().optional().describe("functions.schema.manage.zipFile"),
+            code: FUNCTION_CODE_SCHEMA.optional().describe("functions.schema.manage.code"),
             handler: zod_1.z.string().optional().describe("functions.schema.manage.handler"),
             timeout: zod_1.z.number().optional().describe("functions.schema.manage.timeout"),
             envVariables: zod_1.z
@@ -227920,18 +229256,23 @@ const cloudbase_manager_js_1 = __webpack_require__(33109);
 const json_content_js_1 = __webpack_require__(18027);
 const index_js_1 = __webpack_require__(24908);
 const QUERY_LOG_ACTIONS = ["checkLogService", "searchLogs"];
-function buildEnvelope(data, message) {
+const MANAGE_LOG_ACTIONS = ["createLogService"];
+function buildEnvelope(data, message, extras) {
     return {
         success: true,
         data,
         message,
+        ...extras,
     };
 }
-function buildErrorEnvelope(error) {
+function buildErrorEnvelope(error, extras) {
     return {
         success: false,
-        data: {},
-        message: error instanceof Error ? error.message : String(error),
+        data: extras?.data ?? {},
+        message: extras?.message ??
+            (error instanceof Error ? error.message : String(error)),
+        errorCode: extras?.errorCode,
+        nextActions: extras?.nextActions,
     };
 }
 function registerLogTools(server) {
@@ -228004,6 +229345,89 @@ function registerLogTools(server) {
             return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
         }
     });
+    server.registerTool?.("manageLogs", {
+        title: "logs.manage.title",
+        description: "logs.manage.description",
+        inputSchema: {
+            action: zod_1.z
+                .enum(MANAGE_LOG_ACTIONS)
+                .describe("logs.manage.schema.action"),
+            confirm: zod_1.z
+                .boolean()
+                .optional()
+                .describe("logs.manage.schema.confirm"),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+            category: "logs",
+        },
+    }, async ({ action, confirm, }) => {
+        try {
+            if (action !== "createLogService") {
+                return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(new Error((0, index_js_1.t)("logs.manage.unsupportedAction", { action })), {
+                    errorCode: "UNSUPPORTED_ACTION",
+                }));
+            }
+            if (confirm !== true) {
+                return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(null, {
+                    errorCode: "CONFIRM_REQUIRED",
+                    message: (0, index_js_1.t)("logs.manage.create.confirmRequired"),
+                    data: { action },
+                    nextActions: [
+                        {
+                            tool: "manageLogs",
+                            action: "createLogService",
+                            suggested_args: { action: "createLogService", confirm: true },
+                            reason: (0, index_js_1.t)("logs.manage.create.needsConfirmation"),
+                        },
+                    ],
+                }));
+            }
+            const cloudbase = await getManager();
+            const enabled = await cloudbase.log.checkLogServiceEnabled();
+            if (enabled) {
+                return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                    action,
+                    enabled: true,
+                    alreadyEnabled: true,
+                }, (0, index_js_1.t)("logs.manage.create.alreadyEnabled"), {
+                    nextActions: [
+                        {
+                            tool: "queryLogs",
+                            action: "searchLogs",
+                            suggested_args: {
+                                action: "searchLogs",
+                                queryString: 'log:"ERROR"',
+                            },
+                            reason: (0, index_js_1.t)("logs.manage.create.nextSearch"),
+                        },
+                    ],
+                }));
+            }
+            const result = await cloudbase.log.createLogService();
+            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+            return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                action,
+                requestId: result.RequestId ?? null,
+                raw: result,
+            }, (0, index_js_1.t)("logs.manage.create.submitted"), {
+                nextActions: [
+                    {
+                        tool: "queryLogs",
+                        action: "checkLogService",
+                        suggested_args: { action: "checkLogService" },
+                        reason: (0, index_js_1.t)("logs.manage.create.nextCheck"),
+                    },
+                ],
+            }));
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    });
 }
 
 
@@ -229350,7 +230774,7 @@ function extractRiskyDocFieldOperations(securityRule) {
             continue;
         }
         const referencesNonIdDocField = /doc\.(?!_id\b)[A-Za-z_][A-Za-z0-9_]*/.test(expression);
-        const usesGetByDocId = /get\('database\.[^']+'\s*\+\s*doc\._id\)/.test(expression);
+        const usesGetByDocId = /get\(('database\.[^']+'\s*\+\s*doc\._id|`database\.[^`]*\$\{\s*doc\._id\s*\})\)/.test(expression);
         if (referencesNonIdDocField && !usesGetByDocId) {
             operations.push(operation);
         }
@@ -229360,8 +230784,8 @@ function extractRiskyDocFieldOperations(securityRule) {
 function buildRecommendedOwnerWriteRule(resourceId) {
     return JSON.stringify({
         create: "auth.uid != null",
-        update: "auth.uid != null && (get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid)",
-        delete: "auth.uid != null && (get('database.user_roles.' + auth.uid).role == 'admin' || doc.authorId == auth.uid)",
+        update: "auth.uid != null && (get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid)",
+        delete: "auth.uid != null && (get(`database.user_roles.${auth.uid}`).role == 'admin' || doc.authorId == auth.uid)",
     });
 }
 function buildRoleLookupNote() {
@@ -229423,7 +230847,9 @@ function buildInvalidGetPathHint(securityRule, resourceId) {
     if (!securityRule) {
         return undefined;
     }
-    const hasFieldEmbeddedInsideGetPath = /get\('database\.[^']+'\s*\+\s*[^)]*\+\s*'\.[A-Za-z_][A-Za-z0-9_]*'\)/.test(securityRule);
+    // get() 的 path 里嵌了字段名：拼接形态，或反引号模板里在 ${} 之后又接字段
+    const hasFieldEmbeddedInsideGetPath = /get\('database\.[^']+'\s*\+\s*[^)]*\+\s*'\.[A-Za-z_][A-Za-z0-9_]*'\)/.test(securityRule) ||
+        /get\(`database\.[^`]*\.\$\{[^}]+\}\.[A-Za-z_][A-Za-z0-9_]*`\)/.test(securityRule);
     if (!hasFieldEmbeddedInsideGetPath) {
         return undefined;
     }
@@ -229443,7 +230869,9 @@ function buildTemplateLiteralRuleHint(securityRule, resourceId) {
     if (!securityRule) {
         return undefined;
     }
-    const usesTemplateLiteralPlaceholderInRule = /\$\{(?:auth\.uid|doc\._id|doc\.[A-Za-z_][A-Za-z0-9_]*)\}/.test(securityRule);
+    // 反引号模板字符串是官方形态，必须先剥掉再判——否则会把正确的写法误报成错误
+    const withoutTemplateLiterals = securityRule.replace(/`[^`]*`/g, '');
+    const usesTemplateLiteralPlaceholderInRule = /['"][^'"]*\$\{(?:auth\.uid|doc\._id|doc\.[A-Za-z_][A-Za-z0-9_]*)\}/.test(withoutTemplateLiterals);
     if (!usesTemplateLiteralPlaceholderInRule) {
         return undefined;
     }
@@ -230979,6 +232407,7 @@ const url_1 = __webpack_require__(79551);
 const zod_1 = __webpack_require__(21504);
 const index_js_1 = __webpack_require__(24908);
 const remote_url_safety_js_1 = __webpack_require__(23694);
+const project_config_js_1 = __webpack_require__(39175);
 // CloudBase 模板配置
 const TEMPLATES = {
     react: {
@@ -231464,6 +232893,23 @@ function registerSetupTools(server) {
                 };
             }
             const resolvedIDE = ideResolution.resolvedIDE;
+            let workspaceFolder;
+            try {
+                workspaceFolder = (0, project_config_js_1.resolveProjectRoot)();
+            }
+            catch (error) {
+                if (error instanceof project_config_js_1.ProjectRootError) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: (0, index_js_1.t)("setup.projectRoot.hostConfigDir", { dir: error.dir }),
+                            },
+                        ],
+                    };
+                }
+                throw error;
+            }
             // 验证IDE类型
             const ideValidation = validateIDE(resolvedIDE);
             if (!ideValidation.valid) {
@@ -231501,7 +232947,6 @@ function registerSetupTools(server) {
             // 创建过滤后的目录结构（当选择特定IDE时）
             const workingDir = await createFilteredDirectory(extractDir, filteredFiles, resolvedIDE);
             // 检查是否需要复制到项目目录
-            const workspaceFolder = process.env.WORKSPACE_FOLDER_PATHS || process.cwd();
             let finalFiles = [];
             let createdCount = 0;
             let overwrittenCount = 0;
@@ -232706,6 +234151,143 @@ function resolveRequestId(error) {
 }
 
 
+/***/ },
+
+/***/ 23379
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+/**
+ * In-process log of tool outcomes for an explicitly requested feedback draft.
+ *
+ * Hosted gateways may construct a new server object per request. The log is
+ * therefore keyed by a hash of the credential when one is present, and only
+ * falls back to the server object when no credential is available. The cache
+ * is bounded. Arguments are never stored, and the raw credential is not stored.
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.FEEDBACK_CREDENTIAL_LIMIT = exports.FEEDBACK_SESSION_LIMIT = void 0;
+exports.recordToolOutcome = recordToolOutcome;
+exports.readToolOutcomes = readToolOutcomes;
+exports.noteRepeatCount = noteRepeatCount;
+exports.readRepeatPeak = readRepeatPeak;
+exports.clearToolOutcomes = clearToolOutcomes;
+exports.__resetFeedbackSessionsForTests = __resetFeedbackSessionsForTests;
+const node_crypto_1 = __webpack_require__(75305);
+const MAX_OUTCOMES = 200;
+const MAX_CREDENTIALS = 64;
+const MAX_TOOL_NAME_LENGTH = 80;
+const byCredential = new Map();
+const byServer = new WeakMap();
+function credentialKey(server) {
+    const options = server.cloudBaseOptions;
+    const secretId = typeof options?.secretId === "string" ? options.secretId.trim() : "";
+    if (!secretId) {
+        return undefined;
+    }
+    const token = typeof options?.token === "string" ? options.token.trim() : "";
+    const site = typeof options?.site === "string" ? options.site.trim() : "";
+    return (0, node_crypto_1.createHash)("sha256").update(`${site}\n${secretId}\n${token}`).digest("hex");
+}
+function emptyBucket() {
+    return { outcomes: [], repeatPeak: 0, touchedAt: Date.now() };
+}
+function evictOldestCredential() {
+    let oldestKey;
+    let oldestTouched = Number.POSITIVE_INFINITY;
+    for (const [key, bucket] of byCredential) {
+        if (bucket.touchedAt < oldestTouched) {
+            oldestTouched = bucket.touchedAt;
+            oldestKey = key;
+        }
+    }
+    if (oldestKey) {
+        byCredential.delete(oldestKey);
+    }
+}
+function bucketFor(server) {
+    if (!server || typeof server !== "object") {
+        return undefined;
+    }
+    const key = credentialKey(server);
+    if (key) {
+        let bucket = byCredential.get(key);
+        if (!bucket) {
+            if (byCredential.size >= MAX_CREDENTIALS) {
+                evictOldestCredential();
+            }
+            bucket = emptyBucket();
+            byCredential.set(key, bucket);
+        }
+        bucket.touchedAt = Date.now();
+        return bucket;
+    }
+    let bucket = byServer.get(server);
+    if (!bucket) {
+        bucket = emptyBucket();
+        byServer.set(server, bucket);
+    }
+    return bucket;
+}
+function recordToolOutcome(server, input) {
+    const bucket = bucketFor(server);
+    if (!bucket) {
+        return;
+    }
+    const toolName = typeof input.toolName === "string" ? input.toolName.trim() : "";
+    if (!toolName) {
+        return;
+    }
+    const durationMs = Number.isFinite(input.durationMs) && input.durationMs >= 0
+        ? Math.round(input.durationMs)
+        : 0;
+    const at = typeof input.at === "string" && input.at.length > 0
+        ? input.at
+        : new Date().toISOString();
+    bucket.outcomes.push({
+        toolName: toolName.slice(0, MAX_TOOL_NAME_LENGTH),
+        durationMs,
+        failed: input.failed === true,
+        at,
+    });
+    if (bucket.outcomes.length > MAX_OUTCOMES) {
+        bucket.outcomes.splice(0, bucket.outcomes.length - MAX_OUTCOMES);
+    }
+}
+function readToolOutcomes(server) {
+    return bucketFor(server)?.outcomes ?? [];
+}
+function noteRepeatCount(server, count) {
+    const bucket = bucketFor(server);
+    if (!bucket || !Number.isFinite(count) || count <= 0) {
+        return;
+    }
+    const rounded = Math.round(count);
+    if (rounded > bucket.repeatPeak) {
+        bucket.repeatPeak = rounded;
+    }
+}
+function readRepeatPeak(server) {
+    return bucketFor(server)?.repeatPeak ?? 0;
+}
+function clearToolOutcomes(server) {
+    const key = server && typeof server === "object" ? credentialKey(server) : undefined;
+    if (key) {
+        byCredential.delete(key);
+        return;
+    }
+    if (server && typeof server === "object") {
+        byServer.delete(server);
+    }
+}
+function __resetFeedbackSessionsForTests() {
+    byCredential.clear();
+}
+exports.FEEDBACK_SESSION_LIMIT = MAX_OUTCOMES;
+exports.FEEDBACK_CREDENTIAL_LIMIT = MAX_CREDENTIALS;
+
+
 /***/ },
 
 /***/ 84173
@@ -233171,14 +234753,101 @@ async function sendDeployNotification(server, notificationData) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.ProjectRootError = void 0;
+exports.resolveProjectRoot = resolveProjectRoot;
+exports.requireProjectRoot = requireProjectRoot;
 exports.readCloudbaseRcBinding = readCloudbaseRcBinding;
 exports.readProjectConfig = readProjectConfig;
 exports.readProjectEnvId = readProjectEnvId;
 exports.writeProjectConfig = writeProjectConfig;
 const node_fs_1 = __webpack_require__(89971);
+const node_os_1 = __webpack_require__(81258);
 const node_path_1 = __webpack_require__(26743);
 const toolbox_1 = __webpack_require__(23233);
+const index_js_1 = __webpack_require__(24908);
 const CLOUDBASE_RC_FILENAME = "cloudbaserc.json";
+const PROJECT_ROOT_ENV_KEYS = [
+    "WORKSPACE_FOLDER_PATHS",
+    "PROJECT_ROOT",
+    "GITHUB_WORKSPACE",
+    "CI_PROJECT_DIR",
+    "BUILD_SOURCESDIRECTORY",
+];
+/** Thrown when the resolved directory is a host config root, not a project. */
+class ProjectRootError extends Error {
+    dir;
+    constructor(dir) {
+        super("setup.projectRoot.hostConfigDir");
+        this.name = "ProjectRootError";
+        this.dir = dir;
+    }
+}
+exports.ProjectRootError = ProjectRootError;
+function firstPathSegment(value) {
+    return value
+        .split(node_path_1.delimiter)
+        .map((segment) => segment.trim())
+        .find((segment) => segment.length > 0);
+}
+function isUnderHostConfig(candidate) {
+    const hostRoot = (0, node_path_1.resolve)((0, node_os_1.homedir)(), ".dsh");
+    const resolved = (0, node_path_1.resolve)(candidate);
+    const rel = (0, node_path_1.relative)(hostRoot, resolved);
+    return rel === "" || (!rel.startsWith("..") && !(0, node_path_1.isAbsolute)(rel));
+}
+/**
+ * Project directory for reads and writes.
+ *
+ * Explicit path, then host-injected workspace env vars, then process.cwd().
+ * A result under ~/.dsh is refused so tools do not treat the host profile as a project.
+ */
+function resolveProjectRoot(explicit) {
+    const trimmed = explicit?.trim();
+    let chosen;
+    if (trimmed) {
+        chosen = (0, node_path_1.resolve)(trimmed);
+    }
+    else {
+        let fromEnv;
+        for (const key of PROJECT_ROOT_ENV_KEYS) {
+            const raw = process.env[key];
+            if (!raw?.trim())
+                continue;
+            const first = firstPathSegment(raw);
+            if (first) {
+                fromEnv = (0, node_path_1.resolve)(first);
+                break;
+            }
+        }
+        chosen = fromEnv ?? (0, node_path_1.resolve)(process.cwd());
+    }
+    if (isUnderHostConfig(chosen)) {
+        throw new ProjectRootError(chosen);
+    }
+    return chosen;
+}
+/** Same as resolveProjectRoot, with the refusal already translated for tool output. */
+function requireProjectRoot(explicit) {
+    try {
+        return resolveProjectRoot(explicit);
+    }
+    catch (error) {
+        if (error instanceof ProjectRootError) {
+            throw new Error((0, index_js_1.t)("setup.projectRoot.hostConfigDir", { dir: error.dir }));
+        }
+        throw error;
+    }
+}
+function projectRootForConfig(cwd) {
+    try {
+        return resolveProjectRoot(cwd);
+    }
+    catch (error) {
+        if (error instanceof ProjectRootError)
+            return undefined;
+        throw error;
+    }
+}
 /**
  * 解析 cloudbaserc.json 字段值用于绑定（fail-safe：解析不出一律返回 undefined 回落下一级）：
  * - 字面量 → trim 后直接返回
@@ -233236,7 +234905,9 @@ function resolveBindingValue(raw, projectRoot) {
  */
 function readCloudbaseRcBinding(cwd) {
     try {
-        const projectRoot = cwd ?? process.env.WORKSPACE_FOLDER_PATHS ?? process.cwd();
+        const projectRoot = projectRootForConfig(cwd);
+        if (!projectRoot)
+            return undefined;
         const configPath = (0, node_path_1.join)(projectRoot, CLOUDBASE_RC_FILENAME);
         if (!(0, node_fs_1.existsSync)(configPath)) {
             return undefined;
@@ -233270,7 +234941,9 @@ function readCloudbaseRcBinding(cwd) {
  */
 function readProjectConfig(cwd) {
     try {
-        const projectRoot = cwd ?? process.env.WORKSPACE_FOLDER_PATHS ?? process.cwd();
+        const projectRoot = projectRootForConfig(cwd);
+        if (!projectRoot)
+            return undefined;
         const configPath = (0, node_path_1.join)(projectRoot, ".cloudbase", "project.json");
         if (!(0, node_fs_1.existsSync)(configPath)) {
             return undefined;
@@ -233318,7 +234991,9 @@ function readProjectEnvId(cwd) {
  */
 function writeProjectConfig(patch, cwd) {
     try {
-        const projectRoot = cwd ?? process.env.WORKSPACE_FOLDER_PATHS ?? process.cwd();
+        const projectRoot = projectRootForConfig(cwd);
+        if (!projectRoot)
+            return false;
         const configPath = (0, node_path_1.join)(projectRoot, ".cloudbase", "project.json");
         let existing = {};
         if ((0, node_fs_1.existsSync)(configPath)) {
@@ -233544,6 +235219,7 @@ function getRemoteUrlSafetyErrorMessage() {
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.REPEAT_GUARD_THRESHOLD = void 0;
+exports.getRepeatGuardSnapshot = getRepeatGuardSnapshot;
 exports.applyRepeatGuardToPayload = applyRepeatGuardToPayload;
 exports.resetRepeatGuard = resetRepeatGuard;
 exports.__resetRepeatGuardForTests = __resetRepeatGuardForTests;
@@ -233562,6 +235238,13 @@ exports.REPEAT_GUARD_THRESHOLD = 3;
 const REPEAT_GUARD_KEY_MAX_LENGTH = 200;
 let lastKey = null;
 let consecutiveCount = 0;
+/**
+ * Live streak only. Does not expose the dedup key: that key contains the raw
+ * error message, which may include secrets or identifiers.
+ */
+function getRepeatGuardSnapshot() {
+    return { consecutiveCount };
+}
 function buildRepeatGuardKey(payload) {
     const code = typeof payload.code === "string" ? payload.code : "";
     const message = typeof payload.message === "string" ? payload.message : "";
@@ -234034,7 +235717,7 @@ class TelemetryReporter {
         const arch = os_1.default.arch(); // 系统架构
         // Build-time injected version; guard for vitest / non-webpack runtimes.
         const mcpVersion = process.env.npm_package_version ||
-            ( true ? "2.34.6" : 0);
+            ( true ? "2.34.8" : 0);
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -234682,6 +236365,7 @@ const logger_js_1 = __webpack_require__(40781);
 const telemetry_js_1 = __webpack_require__(5198);
 const tool_result_js_1 = __webpack_require__(69645);
 const repeat_error_guard_js_1 = __webpack_require__(13);
+const feedback_session_js_1 = __webpack_require__(23379);
 const error_guidance_js_1 = __webpack_require__(81194);
 /**
  * Mirror annotations.category into _meta.category.
@@ -234757,7 +236441,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${( true ? "2.34.6" : 0) || 0 || 0}
+- MCP 版本：${( true ? "2.34.8" : 0) || 0 || 0}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -234791,6 +236475,8 @@ function createWrappedHandler(name, handler, server) {
     return async (args) => {
         const startTime = Date.now();
         let success = false;
+        let businessFailed = false;
+        let repeatCountSeen = 0;
         let errorMessage;
         let requestId;
         try {
@@ -234802,7 +236488,11 @@ function createWrappedHandler(name, handler, server) {
             }
             // 执行原始处理函数
             const result = await handler(args);
+            // Returned { success: false } is a business failure for the local
+            // session log. The telemetry flag below stays on the existing path.
+            businessFailed = (0, tool_result_js_1.isBusinessFailureToolResult)(result);
             success = true;
+            repeatCountSeen = (0, repeat_error_guard_js_1.getRepeatGuardSnapshot)().consecutiveCount;
             // 任一工具成功说明重复错误循环已被打破，清零连续错误计数
             (0, repeat_error_guard_js_1.resetRepeatGuard)();
             requestId = extractRequestIdFromToolResult(result);
@@ -234835,8 +236525,11 @@ function createWrappedHandler(name, handler, server) {
             if ((0, tool_result_js_1.isToolPayloadError)(error)) {
                 // 连续相同结构化错误达到阈值时注入 repeat_guard 升级提示，
                 // 打断无头客户端的原样重试循环（不改写 message，保持遥测聚合稳定）
-                throw new tool_result_js_1.ToolPayloadError((0, repeat_error_guard_js_1.applyRepeatGuardToPayload)(error.payload));
+                const payload = (0, repeat_error_guard_js_1.applyRepeatGuardToPayload)(error.payload);
+                repeatCountSeen = (0, repeat_error_guard_js_1.getRepeatGuardSnapshot)().consecutiveCount;
+                throw new tool_result_js_1.ToolPayloadError(payload);
             }
+            repeatCountSeen = (0, repeat_error_guard_js_1.getRepeatGuardSnapshot)().consecutiveCount;
             // In tests, avoid any extra work that may block (envId lookup, issue link generation, etc.)
             if (isTestEnvironment) {
                 throw error instanceof Error ? error : new Error(String(error));
@@ -234846,7 +236539,7 @@ function createWrappedHandler(name, handler, server) {
                 requestId,
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const mcpVersion =  true ? "2.34.6" : 0;
+            const mcpVersion =  true ? "2.34.8" : 0;
             const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
             const enhancedErrorMessage = `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息
@@ -234862,6 +236555,20 @@ function createWrappedHandler(name, handler, server) {
             throw enhancedError;
         }
         finally {
+            try {
+                (0, feedback_session_js_1.noteRepeatCount)(server, repeatCountSeen);
+                (0, feedback_session_js_1.recordToolOutcome)(server, {
+                    toolName: name,
+                    durationMs: Date.now() - startTime,
+                    failed: Boolean(errorMessage) || businessFailed,
+                });
+            }
+            catch (recordError) {
+                (0, logger_js_1.debug)("feedback session record failed", {
+                    toolName: name,
+                    error: recordError instanceof Error ? recordError.message : String(recordError),
+                });
+            }
             // 上报工具调用数据（测试环境中跳过，避免阻塞）
             const isTestEnvironment =  false || process.env.VITEST === "true";
             if (!isTestEnvironment) {