@cloudbase/cloudbase-mcp 2.36.1 → 2.36.2

package/dist/index.cjs

@@ -200596,7 +200596,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.envManager = void 0;
+exports.envManager = exports.runInEnvSlot = void 0;
 exports.probeApiKeyCamCapability = probeApiKeyCamCapability;
 exports.fetchEnvOwnerUin = fetchEnvOwnerUin;
 exports.probeCamCapabilityForLogin = probeCamCapabilityForLogin;
@@ -200618,7 +200618,10 @@ const logger_js_1 = __webpack_require__(40781);
 const tool_result_js_1 = __webpack_require__(69645);
 const site_map_js_1 = __webpack_require__(34533);
 const project_config_js_1 = __webpack_require__(39175);
+const cloud_mode_js_1 = __webpack_require__(88694);
+const env_binding_js_1 = __webpack_require__(61498);
 const local_endpoint_js_1 = __webpack_require__(16156);
+const describe_envs_query_js_1 = __webpack_require__(31284);
 function toEnvCandidates(envList) {
     if (!Array.isArray(envList)) {
         return [];
@@ -200804,11 +200807,7 @@ async function listAvailableEnvCandidates(options) {
     try {
         const result = await cloudbase.commonService("tcb", "2018-06-08").call({
             Action: "DescribeEnvs",
-            Param: {
-                EnvTypes: ["weda", "baas"],
-                IsVisible: false,
-                Channels: ["dcloud", "iotenable", "tem", "scene_module"],
-            },
+            Param: (0, describe_envs_query_js_1.buildDescribeEnvsFilter)(),
         });
         const envList = result?.EnvList || result?.Data?.EnvList || [];
         return toEnvCandidates(envList);
@@ -201026,6 +201025,7 @@ class EnvironmentManager {
     // 手动设置环境ID（用于外部调用）
     async setEnvId(envId) {
         this._setCachedEnvId(envId);
+        (0, env_binding_js_1.noteEnvBinding)({ envId, source: "envManager.cachedEnvId" });
         (0, logger_js_1.debug)('手动设置环境ID并更新缓存:', { envId });
     }
     // Get cached envId without triggering fetch (for optimization)
@@ -201036,44 +201036,136 @@ class EnvironmentManager {
 // 全局实例
 const envManager = new EnvironmentManager();
 exports.envManager = envManager;
-// 导出环境ID获取函数
+function requestHasCloudCredentials(cloudBaseOptions) {
+    return Boolean((cloudBaseOptions?.secretId && cloudBaseOptions?.secretKey) ||
+        cloudBaseOptions?.requestFn);
+}
+function throwCloudModeEnvRequired(envCandidates) {
+    const singleEnvId = envCandidates.length === 1 ? envCandidates[0].envId : undefined;
+    (0, tool_result_js_1.throwToolPayloadError)({
+        ok: false,
+        code: "ENV_REQUIRED",
+        message: "当前请求没有带 envId。Cloud mode 不读取本机登录态、项目配置或进程环境变量。",
+        env_candidates: envCandidates,
+        next_step: (0, tool_result_js_1.buildAuthNextStep)("set_env", {
+            requiredParams: singleEnvId ? undefined : ["envId"],
+            suggestedArgs: singleEnvId
+                ? { action: "set_env", envId: singleEnvId }
+                : { action: "set_env" },
+        }),
+    });
+}
+/**
+ * Cloud mode only sees this request. No envManager, no CLOUDBASE_ENV_ID, no project file, no auth.json.
+ * A single environment is written back onto this request's options and is not cached on the process.
+ */
+async function resolveCloudModeEnvId(cloudBaseOptions, requireEnvId) {
+    if (cloudBaseOptions?.envId) {
+        (0, env_binding_js_1.noteEnvBinding)({ envId: cloudBaseOptions.envId, source: "cloudBaseOptions" });
+        return cloudBaseOptions.envId;
+    }
+    if (!requireEnvId) {
+        return undefined;
+    }
+    if (!requestHasCloudCredentials(cloudBaseOptions)) {
+        throwCloudModeEnvRequired([]);
+    }
+    const envCandidates = await listAvailableEnvCandidates({ cloudBaseOptions });
+    if (envCandidates.length === 1) {
+        const singleEnvId = envCandidates[0].envId;
+        if (cloudBaseOptions) {
+            cloudBaseOptions.envId = singleEnvId;
+        }
+        (0, env_binding_js_1.noteEnvBinding)({ envId: singleEnvId, source: "auto_bound" });
+        return singleEnvId;
+    }
+    throwCloudModeEnvRequired(envCandidates);
+}
+async function getCloudBaseManagerCloudMode(options) {
+    const requireEnvId = options.requireEnvId !== false;
+    const cloudBaseOptions = options.cloudBaseOptions;
+    if (!requestHasCloudCredentials(cloudBaseOptions)) {
+        throwAuthRequiredError();
+    }
+    const resolvedEnvId = await resolveCloudModeEnvId(cloudBaseOptions, requireEnvId);
+    return createCloudBaseManagerWithOptions({
+        ...(cloudBaseOptions ?? {}),
+        envId: resolvedEnvId,
+    });
+}
+/**
+ * Fresh slot for tests. Production stdio/hosted pass their own slot into `runWithEnvSlot`.
+ * Re-exported from `env-binding.ts` so there is only one definition.
+ */
+var env_binding_js_2 = __webpack_require__(61498);
+Object.defineProperty(exports, "runInEnvSlot", ({ enumerable: true, get: function () { return env_binding_js_2.runInEnvSlot; } }));
 async function getEnvId(cloudBaseOptions) {
+    if ((0, cloud_mode_js_1.isCloudMode)()) {
+        const envId = await resolveCloudModeEnvId(cloudBaseOptions, true);
+        if (!envId) {
+            throwCloudModeEnvRequired([]);
+        }
+        return envId;
+    }
+    return resolveEnvIdForCall(cloudBaseOptions);
+}
+async function resolveEnvIdForCall(cloudBaseOptions) {
     if (cloudBaseOptions?.envId) {
         (0, logger_js_1.debug)('使用传入的 envId:', { envId: cloudBaseOptions.envId });
+        (0, env_binding_js_1.noteEnvBinding)({ envId: cloudBaseOptions.envId, source: "cloudBaseOptions" });
         return cloudBaseOptions.envId;
     }
     if ((0, local_endpoint_js_1.resolveLocalEndpoint)()) {
         return 'local';
     }
-    const cachedEnvId = envManager.getCachedEnvId() || process.env.CLOUDBASE_ENV_ID;
+    const cachedEnvId = envManager.getCachedEnvId();
     if (cachedEnvId) {
         (0, logger_js_1.debug)('使用缓存中的 envId:', { envId: cachedEnvId });
+        (0, env_binding_js_1.noteEnvBinding)({ envId: cachedEnvId, source: "envManager.cachedEnvId" });
         return cachedEnvId;
     }
-    // 项目级配置固定的环境优先于账号级登录态，保证「打开仓库即连对环境」，
-    // 且同一仓库的每个 Git worktree / 每个新进程都不需要重复 set_env。
+    if (process.env.CLOUDBASE_ENV_ID) {
+        (0, logger_js_1.debug)('使用进程环境变量的 envId:', { envId: process.env.CLOUDBASE_ENV_ID });
+        (0, env_binding_js_1.noteEnvBinding)({
+            envId: process.env.CLOUDBASE_ENV_ID,
+            source: "process.env.CLOUDBASE_ENV_ID",
+        });
+        return process.env.CLOUDBASE_ENV_ID;
+    }
+    // Project config stays ahead of the account login env, and still writes the cache.
     const projectEnvId = (0, project_config_js_1.readProjectEnvId)();
     if (projectEnvId) {
         (0, logger_js_1.debug)('使用项目配置(.cloudbase/project.json)的 envId:', { envId: projectEnvId });
         await envManager.setEnvId(projectEnvId);
+        (0, env_binding_js_1.noteEnvBinding)({ envId: projectEnvId, source: "project" });
         return projectEnvId;
     }
     const loginState = await (0, auth_js_1.peekLoginState)();
     if (typeof loginState?.envId === 'string' && loginState.envId.length > 0) {
         (0, logger_js_1.debug)('使用登录态中的 envId:', { envId: loginState.envId });
+        // Do not cache. A project file that appears later in this process must still win.
+        (0, env_binding_js_1.noteEnvBinding)({ envId: loginState.envId, source: "login_state" });
         return loginState.envId;
     }
-    // 否则使用默认逻辑
-    return envManager.getEnvId();
+    const envId = await envManager.getEnvId();
+    (0, env_binding_js_1.noteEnvBinding)({ envId, source: "auto_bound" });
+    return envId;
 }
-// 导出函数保持兼容性
 function resetCloudBaseManagerCache() {
     envManager.reset();
+    (0, env_binding_js_1.clearEnvBinding)();
 }
 // 导出获取缓存环境ID的函数，供遥测模块使用
 function getCachedEnvId() {
     return envManager.getCachedEnvId();
 }
+/**
+ * 实例 ID 是环境关联的 PaaS 资源标识，正常情况下与 envId 同生命周期。
+ * 但失效通知跨系统没有出口（invalidate 在生产路径上没有任何调用点），
+ * 所以用一个长 TTL 兜底：宁可每半小时多查一次环境信息，
+ * 也不要拿着一份没人能证明还正确的实例 ID 一直用下去。
+ */
+const DATABASE_INSTANCE_ID_CACHE_TTL_MS = 30 * 60 * 1000;
 const databaseInstanceIdCache = new Map();
 function buildDatabaseInstanceIdCacheKey(options) {
     const envId = options?.envId ?? options?.cloudBaseOptions?.envId ?? process.env.CLOUDBASE_ENV_ID ?? 'unknown';
@@ -201104,11 +201196,16 @@ async function getDatabaseInstanceId(options) {
     });
     const cachedEntry = databaseInstanceIdCache.get(cacheKey);
     if (cachedEntry?.instanceId) {
-        return {
-            instanceId: cachedEntry.instanceId,
-            source: 'cache',
-            cacheKey,
-        };
+        if (cachedEntry.expiresAt && cachedEntry.expiresAt <= Date.now()) {
+            databaseInstanceIdCache.delete(cacheKey);
+        }
+        else {
+            return {
+                instanceId: cachedEntry.instanceId,
+                source: 'cache',
+                cacheKey,
+            };
+        }
     }
     if (cachedEntry?.inflightPromise) {
         const instanceId = await cachedEntry.inflightPromise;
@@ -201133,6 +201230,7 @@ async function getDatabaseInstanceId(options) {
         const instanceId = await inflightPromise;
         databaseInstanceIdCache.set(cacheKey, {
             instanceId,
+            expiresAt: Date.now() + DATABASE_INSTANCE_ID_CACHE_TTL_MS,
         });
         return {
             instanceId,
@@ -201149,6 +201247,9 @@ async function getDatabaseInstanceId(options) {
  * 每次都实时获取最新的 token/secretId/secretKey
  */
 async function getCloudBaseManager(options = {}) {
+    if ((0, cloud_mode_js_1.isCloudMode)()) {
+        return getCloudBaseManagerCloudMode(options);
+    }
     const { requireEnvId = true, authStrategy = 'fail_fast', } = options;
     let cloudBaseOptions = options.cloudBaseOptions;
     const localEndpoint = (0, local_endpoint_js_1.resolveLocalEndpoint)();
@@ -201164,12 +201265,14 @@ async function getCloudBaseManager(options = {}) {
     // 如果传入了完整凭据或 requestFn，优先使用显式 CloudBase 配置
     if (cloudBaseOptions && (hasDirectCredentials || hasRequestFn)) {
         let resolvedEnvId = cloudBaseOptions.envId;
+        let explicitSource = cloudBaseOptions.envId ? "cloudBaseOptions" : "default";
         if (requireEnvId && !resolvedEnvId) {
             const envCandidates = await listAvailableEnvCandidates({ cloudBaseOptions });
             if (envCandidates.length === 1) {
                 const singleEnvId = envCandidates[0].envId;
                 cloudBaseOptions.envId = singleEnvId;
                 resolvedEnvId = singleEnvId;
+                explicitSource = "auto_bound";
                 (0, logger_js_1.debug)('自动绑定唯一环境(显式配置):', { envId: singleEnvId });
             }
             else if (authStrategy === 'fail_fast') {
@@ -201189,6 +201292,9 @@ async function getCloudBaseManager(options = {}) {
             }
         }
         (0, logger_js_1.debug)('使用传入的 CloudBase 配置');
+        if (resolvedEnvId && explicitSource !== "default") {
+            (0, env_binding_js_1.noteEnvBinding)({ envId: resolvedEnvId, source: explicitSource });
+        }
         return createCloudBaseManagerWithOptions({
             ...cloudBaseOptions,
             envId: resolvedEnvId,
@@ -201210,27 +201316,33 @@ async function getCloudBaseManager(options = {}) {
         }
         const { envId: loginEnvId, secretId, secretKey, token } = loginState;
         let finalEnvId = cloudBaseOptions?.envId;
+        let envSource = finalEnvId ? "cloudBaseOptions" : undefined;
         if (requireEnvId) {
             if (!finalEnvId) {
-                // Optimize: Check if envManager has cached envId first (fast path)
-                // If cached, use it directly; otherwise check loginEnvId before calling getEnvId()
-                // This avoids unnecessary async calls when we have a valid envId available
-                const cachedEnvId = envManager.getCachedEnvId() || process.env.CLOUDBASE_ENV_ID;
-                const projectEnvId = cachedEnvId ? undefined : (0, project_config_js_1.readProjectEnvId)();
+                const cachedEnvId = envManager.getCachedEnvId();
+                const envFromProcess = process.env.CLOUDBASE_ENV_ID;
+                const projectEnvId = (cachedEnvId || envFromProcess) ? undefined : (0, project_config_js_1.readProjectEnvId)();
                 if (cachedEnvId) {
                     (0, logger_js_1.debug)('使用 envManager 缓存的环境ID:', { cachedEnvId });
                     finalEnvId = cachedEnvId;
+                    envSource = "envManager.cachedEnvId";
+                }
+                else if (envFromProcess) {
+                    (0, logger_js_1.debug)('使用进程环境变量的环境ID:', { envId: envFromProcess });
+                    finalEnvId = envFromProcess;
+                    envSource = "process.env.CLOUDBASE_ENV_ID";
                 }
                 else if (projectEnvId) {
-                    // 项目级绑定优先于全局登录态 envId：后者可能来自另一个仓库
+                    // Project binding stays ahead of the account login env.
                     (0, logger_js_1.debug)('使用项目配置(project.json/cloudbaserc.json)的环境ID:', { projectEnvId });
                     await envManager.setEnvId(projectEnvId);
                     finalEnvId = projectEnvId;
+                    envSource = "project";
                 }
                 else if (loginEnvId) {
-                    // If no cache but loginState has envId, use it directly
                     (0, logger_js_1.debug)('使用 loginState 中的环境ID:', { loginEnvId });
                     finalEnvId = loginEnvId;
+                    envSource = "login_state";
                 }
                 else {
                     if (authStrategy === 'fail_fast') {
@@ -201239,6 +201351,7 @@ async function getCloudBaseManager(options = {}) {
                             const singleEnvId = envCandidates[0].envId;
                             await envManager.setEnvId(singleEnvId);
                             finalEnvId = singleEnvId;
+                            envSource = "auto_bound";
                             (0, logger_js_1.debug)('自动绑定唯一环境:', { envId: singleEnvId });
                         }
                         else {
@@ -201246,14 +201359,19 @@ async function getCloudBaseManager(options = {}) {
                         }
                     }
                     else {
-                        // ensure 模式下也保持非交互：单环境自动绑定，多环境返回 ENV_REQUIRED
                         finalEnvId = await envManager.getEnvId();
+                        envSource = "auto_bound";
                     }
                 }
             }
         }
-        // envId priority: explicit option > envManager cache > loginState.envId
         const resolvedEnvId = finalEnvId || loginEnvId;
+        if (!envSource && resolvedEnvId && resolvedEnvId === loginEnvId) {
+            envSource = "login_state";
+        }
+        if (resolvedEnvId && envSource) {
+            (0, env_binding_js_1.noteEnvBinding)({ envId: resolvedEnvId, source: envSource });
+        }
         // region 直接使用 fallbackRegion（resolveSiteAndRegion 统一解析）
         // 不再通过 DescribeEnvs 查询 region，以兼容 STS 临时密钥场景
         const region = fallbackRegion;
@@ -201984,6 +202102,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.handleHostedMcpRequest = handleHostedMcpRequest;
 const streamableHttp_js_1 = __webpack_require__(52827);
 const server_js_1 = __webpack_require__(46324);
+const env_binding_js_1 = __webpack_require__(61498);
 const feedback_session_js_1 = __webpack_require__(23379);
 const client_info_cache_js_1 = __webpack_require__(65454);
 function readInitializeClientInfo(body) {
@@ -202061,36 +202180,42 @@ async function handleHostedMcpRequest(input) {
     const closeBoth = () => {
         void Promise.allSettled([transport?.close(), server?.close()]);
     };
+    const injectedEnvId = input.serverOptions.cloudBaseOptions?.envId;
+    const requestSlot = {
+        binding: injectedEnvId
+            ? { envId: injectedEnvId, source: "cloudBaseOptions" }
+            : null,
+    };
     try {
-        server = await (0, server_js_1.createCloudBaseMcpServer)({
-            name: input.serverOptions.name,
-            version: input.serverOptions.version,
-            enableTelemetry: input.serverOptions.enableTelemetry,
-            cloudBaseOptions: input.serverOptions.cloudBaseOptions,
-            cloudMode: input.serverOptions.cloudMode ?? true,
-            ide: input.serverOptions.ide,
-            client: input.serverOptions.client,
-            clientInfo,
-            // 会话级遥测的身份来源：把**当前** transport 的 sessionId 交给 server（公开 getter）。
-            // 这里是无状态传输（本文件 `:165` `sessionIdGenerator: undefined`）⇒ 今天它恒为 undefined、
-            // 上报按"一个实例一个会话"计；将来若有状态化，sessionId 会自动出现在这里。
-            getSessionId: () => transport?.sessionId,
-            lang: input.serverOptions.lang,
-            pluginsEnabled: input.serverOptions.pluginsEnabled,
-            pluginsDisabled: input.serverOptions.pluginsDisabled,
-        });
-        input.logger?.({
-            type: "cloudbase-mcp-server-create",
-            timeCost: Date.now() - startedAt,
-        });
-        transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
-            enableJsonResponse: true,
+        await (0, env_binding_js_1.runWithEnvSlot)(requestSlot, async () => {
+            server = await (0, server_js_1.createCloudBaseMcpServer)({
+                name: input.serverOptions.name,
+                version: input.serverOptions.version,
+                enableTelemetry: input.serverOptions.enableTelemetry,
+                cloudBaseOptions: input.serverOptions.cloudBaseOptions,
+                cloudMode: input.serverOptions.cloudMode ?? true,
+                ide: input.serverOptions.ide,
+                client: input.serverOptions.client,
+                clientInfo,
+                // Session id comes from this transport. Stateless mode leaves it undefined.
+                getSessionId: () => transport?.sessionId,
+                lang: input.serverOptions.lang,
+                pluginsEnabled: input.serverOptions.pluginsEnabled,
+                pluginsDisabled: input.serverOptions.pluginsDisabled,
+            });
+            input.logger?.({
+                type: "cloudbase-mcp-server-create",
+                timeCost: Date.now() - startedAt,
+            });
+            transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
+                sessionIdGenerator: undefined,
+                enableJsonResponse: true,
+            });
+            input.res.on("close", closeBoth);
+            input.req.on("aborted", closeBoth);
+            await server.connect(transport);
+            await transport.handleRequest(input.req, input.res, input.body);
         });
-        input.res.on("close", closeBoth);
-        input.req.on("aborted", closeBoth);
-        await server.connect(transport);
-        await transport.handleRequest(input.req, input.res, input.body);
     }
     catch (error) {
         await Promise.allSettled([transport?.close(), server?.close()]);
@@ -208260,7 +208385,7 @@ function localizeZodSchemaShape(shape, lang, seen = new WeakMap()) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.validateTimerCron = exports.DEFAULT_NODEJS_RUNTIME = exports.SUPPORTED_NODEJS_RUNTIMES = exports.formatRuntimeList = exports.RECOMMENDED_RUNTIMES = exports.DEFAULT_RUNTIME = exports.ALL_SUPPORTED_RUNTIMES = exports.SUPPORTED_RUNTIMES = exports.HOSTED_CLIENT_INFO_CACHE_TTL_MS = exports.HOSTED_CLIENT_INFO_CACHE_CAPACITY = exports.handleHostedMcpRequest = exports.warmupHostedResources = exports.RAW_IDE_FILE_MAPPINGS = exports.simplifyEnvList = exports.envManager = exports.createCloudBaseManagerWithOptions = exports.resetCloudBaseManagerCache = exports.getEnvId = exports.getCloudBaseManager = exports.shouldRegisterTool = exports.getCloudModeStatus = exports.enableCloudMode = exports.isCloudMode = exports.logout = exports.getLoginState = exports.warn = exports.error = exports.info = exports.reportToolCall = exports.reportToolkitLifecycle = exports.telemetryReporter = exports.StdioServerTransport = exports.getDefaultServer = exports.createCloudBaseMcpServer = void 0;
+exports.validateTimerCron = exports.DEFAULT_NODEJS_RUNTIME = exports.SUPPORTED_NODEJS_RUNTIMES = exports.formatRuntimeList = exports.RECOMMENDED_RUNTIMES = exports.DEFAULT_RUNTIME = exports.ALL_SUPPORTED_RUNTIMES = exports.SUPPORTED_RUNTIMES = exports.HOSTED_CLIENT_INFO_CACHE_TTL_MS = exports.HOSTED_CLIENT_INFO_CACHE_CAPACITY = exports.handleHostedMcpRequest = exports.warmupHostedResources = exports.RAW_IDE_FILE_MAPPINGS = exports.simplifyEnvList = exports.envManager = exports.createCloudBaseManagerWithOptions = exports.resetCloudBaseManagerCache = exports.getEnvId = exports.getCloudBaseManager = exports.runWithEnvSlot = exports.ENV_SOURCES = exports.shouldRegisterTool = exports.getCloudModeStatus = exports.enableCloudMode = exports.isCloudMode = exports.logout = exports.getLoginState = exports.warn = exports.error = exports.info = exports.reportToolCall = exports.reportToolkitLifecycle = exports.telemetryReporter = exports.StdioServerTransport = exports.getDefaultServer = exports.createCloudBaseMcpServer = void 0;
 // CloudBase MCP Server Library
 var server_js_1 = __webpack_require__(46324);
 Object.defineProperty(exports, "createCloudBaseMcpServer", ({ enumerable: true, get: function () { return server_js_1.createCloudBaseMcpServer; } }));
@@ -208280,6 +208405,13 @@ Object.defineProperty(exports, "isCloudMode", ({ enumerable: true, get: function
 Object.defineProperty(exports, "enableCloudMode", ({ enumerable: true, get: function () { return cloud_mode_js_1.enableCloudMode; } }));
 Object.defineProperty(exports, "getCloudModeStatus", ({ enumerable: true, get: function () { return cloud_mode_js_1.getCloudModeStatus; } }));
 Object.defineProperty(exports, "shouldRegisterTool", ({ enumerable: true, get: function () { return cloud_mode_js_1.shouldRegisterTool; } }));
+/**
+ * 环境绑定槽。外部宿主（自己起 transport 的那种）要上报真实的 envId，
+ * 就得在自己的一次 run 里跑 server 的消息处理，否则上报恒为 `default`。
+ */
+var env_binding_js_1 = __webpack_require__(61498);
+Object.defineProperty(exports, "ENV_SOURCES", ({ enumerable: true, get: function () { return env_binding_js_1.ENV_SOURCES; } }));
+Object.defineProperty(exports, "runWithEnvSlot", ({ enumerable: true, get: function () { return env_binding_js_1.runWithEnvSlot; } }));
 var cloudbase_manager_js_1 = __webpack_require__(33109);
 Object.defineProperty(exports, "getCloudBaseManager", ({ enumerable: true, get: function () { return cloudbase_manager_js_1.getCloudBaseManager; } }));
 Object.defineProperty(exports, "getEnvId", ({ enumerable: true, get: function () { return cloudbase_manager_js_1.getEnvId; } }));
@@ -209416,7 +209548,7 @@ exports.buildEnvCreditsHtml = buildEnvCreditsHtml;
 exports.registerEnvCreditsResource = registerEnvCreditsResource;
 const mcp_js_1 = __webpack_require__(55375);
 const index_js_1 = __webpack_require__(24908);
-const cloudbase_manager_js_1 = __webpack_require__(33109);
+const env_binding_js_1 = __webpack_require__(61498);
 const site_map_js_1 = __webpack_require__(34533);
 const logger_js_1 = __webpack_require__(40781);
 const telemetry_js_1 = __webpack_require__(5198);
@@ -209486,17 +209618,12 @@ function buildEnvCreditsConsoleUrl(key, envId, site) {
     return (0, site_map_js_1.getConsoleDevUrl)(envId ?? undefined, exports.ENV_CREDITS_ENV_LINK_HASH[key], site);
 }
 /**
- * 从 server 实例派生静态兜底值。
- *
- * 环境 ID 的取值优先级（与 get-started 同口径，新增来源时同步两处）：
- *   ① 本次工具结果携带（面板侧覆盖，见 EnvCreditsPayload）
- *   → ② `server.cloudBaseOptions.envId` / `process.env.CLOUDBASE_ENV_ID`
- *   → ③ 进程缓存 `getCachedEnvId()`
- *   → ④ 降级：不显示 ID
- * hosted 是无状态的，进程缓存不可靠，因此 ③ 只是本地兜底；面板永远以工具结果为准。
+ * Static fallback until a tool result arrives.
+ * Explicit `cloudBaseOptions.envId` wins. Otherwise the current slot.
+ * Does not read `CLOUDBASE_ENV_ID` or the process cache.
  */
 function resolveEnvCreditsFallback(server) {
-    const envId = server.cloudBaseOptions?.envId || process.env.CLOUDBASE_ENV_ID || (0, cloudbase_manager_js_1.getCachedEnvId)() || null;
+    const envId = (0, env_binding_js_1.readDisplayedEnvId)(server.cloudBaseOptions?.envId);
     const { site, region } = (0, site_map_js_1.resolveSiteAndRegion)({
         site: server.cloudBaseOptions?.site,
         region: server.cloudBaseOptions?.region,
@@ -210657,7 +210784,7 @@ exports.registerGetStartedResource = registerGetStartedResource;
  *      注入；`t()` 在 read 回调里求值，晚于 `setInstanceLang`，英文实例自动出英文。
  *      注入分两路：HTML 文本走 `escapeHtml`，脚本里的字符串走 `jsLiteral`（JSON 转义 +
  *      转义 `<`，避免 `</script>` 截断）。
- *   3. **只读无密钥**：状态值只来自 `server.cloudBaseOptions` / 环境变量 / 缓存 / 站点解析，
+ *   3. **只读无密钥**：环境 ID 来自这次调用槽；槽是空的才用 `server.cloudBaseOptions.envId`。不读环境变量和缓存。站点仍走站点解析。
  *      读资源时不发网络请求；面板自己只会发两类调用——只读的
  *      `auth(action:"status")`（「重新检查」）和只改本地绑定的
  *      `auth(action:"set_env")`（点「可选环境」里的一行）。两者都不动云端资源，也不碰密钥。
@@ -210678,7 +210805,7 @@ exports.registerGetStartedResource = registerGetStartedResource;
  */
 const mcp_js_1 = __webpack_require__(55375);
 const index_js_1 = __webpack_require__(24908);
-const cloudbase_manager_js_1 = __webpack_require__(33109);
+const env_binding_js_1 = __webpack_require__(61498);
 const site_map_js_1 = __webpack_require__(34533);
 const logger_js_1 = __webpack_require__(40781);
 const telemetry_js_1 = __webpack_require__(5198);
@@ -210722,12 +210849,9 @@ function escapeHtml(value) {
 function jsLiteral(value) {
     return JSON.stringify(value).replace(/</g, "\\u003c");
 }
-/** 从 server 实例派生静态兜底状态；只读本地状态，不发起任何请求。 */
+/** Static fallback for the panel. Reads the current slot, then this server's explicit envId. No network. */
 function resolveGetStartedStatus(server) {
-    const envId = server.cloudBaseOptions?.envId ||
-        process.env.CLOUDBASE_ENV_ID ||
-        (0, cloudbase_manager_js_1.getCachedEnvId)() ||
-        null;
+    const envId = (0, env_binding_js_1.readDisplayedEnvId)(server.cloudBaseOptions?.envId);
     const { site, region } = (0, site_map_js_1.resolveSiteAndRegion)({
         site: server.cloudBaseOptions?.site,
         region: server.cloudBaseOptions?.region,
@@ -211736,6 +211860,7 @@ const index_js_1 = __webpack_require__(24908);
 const schema_js_1 = __webpack_require__(56273);
 const server_instructions_js_1 = __webpack_require__(81808);
 const cloud_mode_js_1 = __webpack_require__(88694);
+const env_binding_js_1 = __webpack_require__(61498);
 const logger_js_1 = __webpack_require__(40781);
 const site_map_js_1 = __webpack_require__(34533);
 const tool_result_js_1 = __webpack_require__(69645);
@@ -211924,6 +212049,8 @@ async function createCloudBaseMcpServer(options) {
     });
     // 初始化 toolDefs，用于外部提取工具列表（如微信 IDE）
     server.toolDefs = [];
+    const envSlot = { binding: null };
+    server.envSlot = envSlot;
     // 实例语言解析（须在工具注册前完成：registerTool 包装层按 lang 解析词典 key 形式的 description）
     server.lang = instanceLang;
     // 同步到 i18n 模块级 instanceLang：否则 t() 无 langOverride 时会退化成
@@ -212081,6 +212208,23 @@ async function createCloudBaseMcpServer(options) {
         // 产物卡片：挂在三个部署类工具上，只读展示部署状态与访问地址，写意图一律交给会话。
         (0, artifact_card_js_1.registerArtifactCardResource)(server);
     }
+    const originalConnect = server.connect.bind(server);
+    server.connect = async (transport) => {
+        await originalConnect(transport);
+        const deliver = transport.onmessage;
+        if (!deliver) {
+            return;
+        }
+        transport.onmessage = (message, extra) => {
+            if ((0, env_binding_js_1.hasEnvSlot)()) {
+                deliver(message, extra);
+                return;
+            }
+            (0, env_binding_js_1.runWithEnvSlot)(envSlot, () => {
+                deliver(message, extra);
+            });
+        };
+    };
     return server;
 }
 /**
@@ -224121,6 +224265,7 @@ function buildEnvMetricsPayload(input) {
  * - Error handling and telemetry reporting
  */
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.TCB_PURCHASE_URL = void 0;
 exports.checkAndInitTcbService = checkAndInitTcbService;
 exports.checkAndCreateFreeEnv = checkAndCreateFreeEnv;
 exports.getUinForTelemetry = getUinForTelemetry;
@@ -224128,6 +224273,17 @@ const auth_js_1 = __webpack_require__(561);
 const index_js_1 = __webpack_require__(24908);
 const logger_js_1 = __webpack_require__(40781);
 const telemetry_js_1 = __webpack_require__(5198);
+/**
+ * 开通 CloudBase 环境的购买页。
+ *
+ * ⚠️ 别再写回 `/lowcode?buyType=tcb&channel=mcp`：那条路径现在 302 到 `/CloudBase`，
+ * **重定向时把 query 全丢了**（实测 `location: https://buy.cloud.tencent.com/CloudBase`），
+ * 用户会落到购买页首页、来源标记也一起丢。
+ *
+ * ⚠️ `region` / `sqlType` 是写死的：国内站默认 ap-shanghai + PG 版。国际站
+ * （`buy.tencentcloud.com`）的域名与路径同构性未验证，见 `specs/site-domain-governance`。
+ */
+exports.TCB_PURCHASE_URL = "https://buy.cloud.tencent.com/CloudBase?buyType=tcb&region=ap-shanghai&sqlType=pg";
 /**
  * Parse InitTcb error and extract user-friendly information
  */
@@ -224150,7 +224306,7 @@ function parseInitTcbError(err) {
     const errorInfo = {
         code: errorCode,
         message: friendlyMessage,
-        helpUrl: "https://buy.cloud.tencent.com/lowcode?buyType=tcb&channel=mcp",
+        helpUrl: exports.TCB_PURCHASE_URL,
         actionText,
         requestId
     };
@@ -224386,7 +224542,7 @@ async function checkAndCreateFreeEnv(cloudbase, context) {
             newContext.createEnvError = {
                 code: "NoPromotionalActivity",
                 message: (0, index_js_1.t)("envSetup.noPromotionalActivity"),
-                helpUrl: "https://buy.cloud.tencent.com/lowcode?buyType=tcb&channel=mcp"
+                helpUrl: exports.TCB_PURCHASE_URL
             };
             return {
                 success: false,
@@ -224452,7 +224608,7 @@ async function checkAndCreateFreeEnv(cloudbase, context) {
                 newContext.createEnvError = {
                     code: "InvalidEnvId",
                     message: (0, index_js_1.t)("envSetup.invalidEnvId"),
-                    helpUrl: "https://buy.cloud.tencent.com/lowcode?buyType=tcb&channel=mcp"
+                    helpUrl: exports.TCB_PURCHASE_URL
                 };
                 return {
                     success: false,
@@ -224513,7 +224669,7 @@ async function checkAndCreateFreeEnv(cloudbase, context) {
             newContext.createEnvError = {
                 code: createErr.code || createErr.Code || "UnknownError",
                 message: errorMessage,
-                helpUrl: "https://buy.cloud.tencent.com/lowcode?buyType=tcb&channel=mcp"
+                helpUrl: exports.TCB_PURCHASE_URL
             };
             (0, logger_js_1.debug)('[env-setup] CreateFreeEnvByActivity failed:', {
                 code: newContext.createEnvError.code,
@@ -224613,12 +224769,14 @@ const cloudbase_manager_js_1 = __webpack_require__(33109);
 const logger_js_1 = __webpack_require__(40781);
 const site_map_js_1 = __webpack_require__(34533);
 const project_config_js_1 = __webpack_require__(39175);
+const describe_envs_query_js_1 = __webpack_require__(31284);
 const index_js_1 = __webpack_require__(24908);
 const tool_result_js_1 = __webpack_require__(69645);
 const gateway_access_urls_js_1 = __webpack_require__(84173);
 const env_setup_js_1 = __webpack_require__(27528);
 const env_credits_payload_js_1 = __webpack_require__(63880);
 const mcp_ui_js_1 = __webpack_require__(55880);
+const env_setup_js_2 = __webpack_require__(27528);
 /**
  * Resources accepted by CreateEnv. Matches Cloud API / Manager SDK contract.
  * `postgresql` enables CloudBase PostgreSQL (PG mode) when supported by the package.
@@ -225407,7 +225565,7 @@ async function prepareAuthEnvironment(params) {
                 reason: "tcb_init_failed",
                 errorCode: "TCB_INIT_FAILED",
                 message: (0, index_js_1.t)("env.prepare.tcbInitFailed"),
-                helpUrl: "https://buy.cloud.tencent.com/lowcode?buyType=tcb&channel=mcp",
+                helpUrl: env_setup_js_2.TCB_PURCHASE_URL,
             });
         return {
             currentEnvId: null,
@@ -225460,7 +225618,7 @@ async function prepareAuthEnvironment(params) {
             reason: "env_creation_failed",
             errorCode: "ENV_CREATION_FAILED",
             message: (0, index_js_1.t)("env.prepare.envCreateFailed"),
-            helpUrl: "https://buy.cloud.tencent.com/lowcode?buyType=tcb&channel=mcp",
+            helpUrl: env_setup_js_2.TCB_PURCHASE_URL,
         });
     const failureMessage = userNotice
         ? `${userNotice}\n${createFailure.message}`
@@ -227140,11 +227298,8 @@ function registerEnvTools(server) {
                             // Filter parameters match the reference conditions provided by user
                             result = await cloudbaseList.commonService("tcb", "2018-06-08").call({
                                 Action: "DescribeEnvs",
-                                Param: {
-                                    EnvTypes: ["weda", "baas"], // Include weda and baas (normal) environments
-                                    IsVisible: false, // Filter out invisible environments
-                                    Channels: ["dcloud", "iotenable", "tem", "scene_module"], // Filter special channels
-                                },
+                                // 过滤口径与 cloudbase-manager 共用一份，别在这里另写白名单
+                                Param: (0, describe_envs_query_js_1.buildDescribeEnvsFilter)(),
                             });
                             (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                             // Transform response format to match original listEnvs() format
@@ -240437,7 +240592,7 @@ exports.readSkipList = readSkipList;
 exports.isSkipped = isSkipped;
 exports.readAutoApprovePolicy = readAutoApprovePolicy;
 exports.guardDestructiveAction = guardDestructiveAction;
-const cloudbase_manager_js_1 = __webpack_require__(33109);
+const env_binding_js_1 = __webpack_require__(61498);
 const index_js_1 = __webpack_require__(24908);
 const elicitation_js_1 = __webpack_require__(65048);
 const destructive_actions_js_1 = __webpack_require__(72827);
@@ -240506,16 +240661,7 @@ function readAutoApprovePolicy() {
     return "allow";
 }
 function resolveEnvId(server) {
-    const fromOptions = server.cloudBaseOptions?.envId;
-    if (typeof fromOptions === "string" && fromOptions.length > 0) {
-        return fromOptions;
-    }
-    try {
-        return (0, cloudbase_manager_js_1.getCachedEnvId)() ?? (0, index_js_1.t)("confirmation.message.unknownEnv");
-    }
-    catch {
-        return (0, index_js_1.t)("confirmation.message.unknownEnv");
-    }
+    return (0, env_binding_js_1.readDisplayedEnvId)(server.cloudBaseOptions?.envId) ?? (0, index_js_1.t)("confirmation.message.unknownEnv");
 }
 function blockedText(status, actionKey, targetInfo, params) {
     const keyByStatus = {
@@ -240883,6 +241029,47 @@ async function guardCredentialWrite(server, params) {
 }
 
 
+/***/ },
+
+/***/ 31284
+(__unused_webpack_module, exports) {
+
+"use strict";
+
+/**
+ * 账号级 DescribeEnvs 的查询口径 —— 唯一真源。
+ *
+ * EnvTypes 是白名单语义（不为空时以该字段为准）：少写一个值不会报错，只会静默
+ * 少一类环境。2026-10 的客户案例就是这样：平台侧代建的环境 EnvType=platform，
+ * 控制台能列、MCP 拉不到，用户看到的是「请先创建环境」，现场没有任何错误可看。
+ *
+ * - baas / weda：标准云开发、微搭，MCP 工具主要面向这两类
+ * - platform：平台侧代建的环境（site-* 一类），控制台列这类
+ *
+ * 未纳入 hosting / run（云托管）、tcbgw、paas：MCP 历史上就没列过，加进来会让
+ * 用户在环境候选里看到一堆用不了的托管环境。授权页那份白名单多一个 hosting，
+ * 是历史原因，两边差异是有意的。
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.DESCRIBE_ENVS_EXCLUDED_CHANNELS = exports.DESCRIBE_ENVS_ENV_TYPES = void 0;
+exports.buildDescribeEnvsFilter = buildDescribeEnvsFilter;
+/** 允许出现在环境候选列表里的 EnvType */
+exports.DESCRIBE_ENVS_ENV_TYPES = ["baas", "weda", "platform"];
+/**
+ * IsVisible=false 表示 Channels 是「排除列表」：
+ * 这 4 个渠道创建的环境不参与环境候选，其余渠道（含控制台的 qc_console）正常返回。
+ */
+exports.DESCRIBE_ENVS_EXCLUDED_CHANNELS = ["dcloud", "iotenable", "tem", "scene_module"];
+/** 生成 DescribeEnvs 的 Param 过滤段；每次返回新数组，避免调用方改到共享常量 */
+function buildDescribeEnvsFilter() {
+    return {
+        EnvTypes: [...exports.DESCRIBE_ENVS_ENV_TYPES],
+        IsVisible: false,
+        Channels: [...exports.DESCRIBE_ENVS_EXCLUDED_CHANNELS],
+    };
+}
+
+
 /***/ },
 
 /***/ 72827
@@ -241233,6 +241420,213 @@ function resolveDestructiveAction(toolName, args) {
 }
 
 
+/***/ },
+
+/***/ 36953
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.readSystemAnchor = readSystemAnchor;
+exports.physicalMacAddresses = physicalMacAddresses;
+exports.collectHostSignal = collectHostSignal;
+exports.computeDeviceId = computeDeviceId;
+const crypto_1 = __importDefault(__webpack_require__(55511));
+const child_process_1 = __webpack_require__(79646);
+const fs_1 = __importDefault(__webpack_require__(29021));
+const os_1 = __importDefault(__webpack_require__(21820));
+/**
+ * 匿名设备指纹。
+ *
+ * 为什么要有这个文件：旧实现是 `sha256(hostname | CPU model | 全部非内部网卡 MAC)`，
+ * 锚点选错了 —— macOS 开着「私有 Wi-Fi 地址」时每个 SSID 一个随机 MAC，`awdl0` / `llw0` /
+ * `bridge0` 的 MAC 随系统状态漂移，容器里 hostname 和 MAC 每次重建都变。结果是同一台 Mac
+ * 一天能上报成几十个「设备」（2026-10-26 实测：Mac 指纹 82% 只在那一天出现过，
+ * Windows 同口径 22%）。
+ *
+ * 现在的取值顺序：
+ * 1. 系统级不可变标识 —— macOS `IOPlatformUUID`、Windows `MachineGuid`、Linux `/etc/machine-id`；
+ * 2. 取不到时退到 `hostname + CPU model + 过滤后的物理网卡 MAC`；
+ * 3. 再取不到只留 `hostname + CPU model`。
+ *
+ * 三条纪律：
+ * - **格式不变**：仍是 SHA256 前 32 位 hex，灯塔 `A2` 字段与后端都不用改。
+ * - **绝不用随机数兜底**。旧实现取不到信息时 `crypto.randomBytes(16)`，等于每次启动都是
+ *   一台新设备 —— 正是要消灭的行为。宁可所有机器共用一个弱指纹，也不要一堆假设备。
+ * - **只在构造时跑一次**。锚点要起子进程（`ioreg` / `reg`），1s 超时就降级，
+ *   绝不放进每次上报的路径。
+ *
+ * 口径变化（换锚点当天就会看到，报表侧要提前打招呼）：
+ * - 历史 `A2` 全部失效，老设备会以新指纹重新出现 —— 报表上「装机量跳一下」不是增长。
+ * - 容器内多实例若共享镜像固化的 `/etc/machine-id`，会被合并成同一台设备（以前是各算一个新设备）。
+ */
+/** 取系统级锚点的子进程超时：超了直接降级，不能拖慢进程启动 */
+const ANCHOR_TIMEOUT_MS = 1000;
+/**
+ * 虚拟 / 隧道网卡名前缀（小写比较）。这些接口的 MAC 会随系统状态漂移或每次重建都变，
+ * 拼进指纹就等于给同一台机器发新身份。
+ */
+const VIRTUAL_NIC_PREFIXES = [
+    'awdl', // Apple Wireless Direct Link
+    'llw', // Apple 低延迟 WLAN
+    'bridge', // macOS / Windows 网桥
+    'utun', // macOS / iOS VPN 隧道
+    'tun',
+    'tap',
+    'veth', // 容器 veth pair
+    'docker',
+    'br-', // docker bridge
+    'vmnet', // VMware
+    'vboxnet', // VirtualBox
+    'vether', // Hyper-V 虚拟交换机（vEthernet）
+    'zt', // ZeroTier
+    'tailscale',
+    'wg', // WireGuard
+    'lo', // loopback（正常情况下 internal 已过滤，兜一层）
+];
+function sha256Short(input) {
+    return crypto_1.default.createHash('sha256').update(input).digest('hex').substring(0, 32);
+}
+/** `machine-id` 合法值：16–64 位 hex，且不能是全 0（有些镜像里就是全 0 的空壳） */
+function isUsableMachineId(value) {
+    if (!/^[0-9a-f]{16,64}$/i.test(value)) {
+        return false;
+    }
+    return !/^0+$/.test(value);
+}
+function readFileQuietly(filePath) {
+    try {
+        return fs_1.default.readFileSync(filePath, 'utf8').trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** 起一次子进程读锚点。超时 / 不存在 / 权限不足一律返回 undefined，由调用方降级。 */
+function execQuietly(file, args) {
+    try {
+        return (0, child_process_1.execFileSync)(file, args, {
+            timeout: ANCHOR_TIMEOUT_MS,
+            encoding: 'utf8',
+            // 子进程的 stderr 全部吞掉：`ioreg` 在受限环境会打噪音，`reg` 在 32 位 Node
+            // 下可能报找不到键，这些都不该出现在 MCP 的 stdout（stdio transport 上是协议流）
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * 读系统级不可变标识。**只读一次**，失败即降级。
+ * `platform` 参数只为测试注入，正常运行不传。
+ */
+function readSystemAnchor(platform = process.platform) {
+    if (platform === 'darwin') {
+        const out = execQuietly('ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice']);
+        const matched = out && /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out);
+        if (matched?.[1]) {
+            return { value: matched[1].trim(), source: 'platform-uuid' };
+        }
+        return undefined;
+    }
+    if (platform === 'win32') {
+        const out = execQuietly('reg', [
+            'query',
+            'HKLM\\SOFTWARE\\Microsoft\\Cryptography',
+            '/v',
+            'MachineGuid',
+        ]);
+        // 形如：`    MachineGuid    REG_SZ    3f2a....`（分隔符是多个空格或 tab）
+        const matched = out && /MachineGuid\s+REG_SZ\s+([0-9a-fA-F-]{8,})/.exec(out);
+        if (matched?.[1]) {
+            return { value: matched[1].trim().toLowerCase(), source: 'machine-guid' };
+        }
+        return undefined;
+    }
+    // linux / openharmony / 其他类 Unix：先 /etc/machine-id，再 dbus 那份
+    for (const candidate of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
+        const raw = readFileQuietly(candidate);
+        if (raw && isUsableMachineId(raw)) {
+            return { value: raw.toLowerCase(), source: 'machine-id' };
+        }
+    }
+    return undefined;
+}
+function isVirtualNic(name) {
+    const lower = name.toLowerCase();
+    return VIRTUAL_NIC_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+/**
+ * 非内部、非虚拟、MAC 不是全 0 / 广播地址的网卡 MAC，去重后排序。
+ * 排序是为了让指纹与网卡枚举顺序无关（枚举顺序在重启后可能变）。
+ */
+function physicalMacAddresses(interfaces = os_1.default.networkInterfaces()) {
+    const macs = new Set();
+    for (const [name, list] of Object.entries(interfaces)) {
+        if (!list || isVirtualNic(name)) {
+            continue;
+        }
+        for (const nic of list) {
+            const mac = nic?.mac?.toLowerCase();
+            if (!nic || nic.internal || !mac) {
+                continue;
+            }
+            if (mac === '00:00:00:00:00:00' || mac === 'ff:ff:ff:ff:ff:ff') {
+                continue;
+            }
+            macs.add(mac);
+        }
+    }
+    return [...macs].sort();
+}
+/** 取不到系统锚点时的兜底信号：**不含虚拟网卡**，主机名与 CPU 型号足够稳。 */
+function collectHostSignal() {
+    let hostname = 'unknown-host';
+    try {
+        hostname = os_1.default.hostname() || hostname;
+    }
+    catch {
+        // 主机名读不到不影响降级：CPU + MAC 仍可用
+    }
+    let cpu = '';
+    try {
+        cpu = os_1.default
+            .cpus()
+            .map((item) => item.model)
+            .join(',');
+    }
+    catch {
+        // 同上
+    }
+    let macs = [];
+    try {
+        macs = physicalMacAddresses();
+    }
+    catch {
+        // 同上
+    }
+    const parts = [hostname, cpu, ...macs].filter((part) => Boolean(part));
+    return {
+        value: parts.join('|'),
+        source: macs.length > 0 ? 'host-fallback' : 'host-only',
+    };
+}
+/**
+ * 计算匿名设备指纹（SHA256 前 32 位 hex），并返回这次用的锚点来源 ——
+ * 来源只进 debug 日志，用于上线后确认「到底有多少机器走到了兜底」。
+ */
+function computeDeviceId(platform = process.platform) {
+    const anchor = readSystemAnchor(platform) ?? collectHostSignal();
+    return { deviceId: sha256Short(anchor.value), source: anchor.source };
+}
+
+
 /***/ },
 
 /***/ 65048
@@ -241373,6 +241767,113 @@ async function requestChoiceElicitation(server, params) {
 }
 
 
+/***/ },
+
+/***/ 61498
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.ENV_SOURCES = void 0;
+exports.noteEnvBinding = noteEnvBinding;
+exports.clearEnvBinding = clearEnvBinding;
+exports.hasEnvSlot = hasEnvSlot;
+exports.readReportedEnv = readReportedEnv;
+exports.readDisplayedEnvId = readDisplayedEnvId;
+exports.runWithEnvSlot = runWithEnvSlot;
+exports.runInEnvSlot = runInEnvSlot;
+exports.peekLocalEnvBinding = peekLocalEnvBinding;
+const node_async_hooks_1 = __webpack_require__(18667);
+const project_config_js_1 = __webpack_require__(39175);
+/**
+ * Where this resolution got its env id.
+ * The first four values are already in shipped queries. Do not rename them.
+ * `default` stays `default` (an empty result, not a rename to `unresolved`).
+ */
+exports.ENV_SOURCES = [
+    "cloudBaseOptions",
+    "process.env.CLOUDBASE_ENV_ID",
+    "envManager.cachedEnvId",
+    "project",
+    "login_state",
+    "auto_bound",
+    "default",
+];
+const envCall = new node_async_hooks_1.AsyncLocalStorage();
+function isReportableEnvId(envId) {
+    return !!envId && envId !== "local" && envId !== "unknown";
+}
+/** Write into the current slot. Outside a slot this is a no-op and does not touch process globals. */
+function noteEnvBinding(binding) {
+    const slot = envCall.getStore();
+    if (!slot || binding.source === "default" || !isReportableEnvId(binding.envId)) {
+        return;
+    }
+    slot.binding = { envId: binding.envId, source: binding.source };
+}
+function clearEnvBinding() {
+    const slot = envCall.getStore();
+    if (slot) {
+        slot.binding = null;
+    }
+}
+function hasEnvSlot() {
+    return envCall.getStore() !== undefined;
+}
+function readReportedEnv() {
+    const binding = envCall.getStore()?.binding;
+    if (!binding || binding.source === "default" || !isReportableEnvId(binding.envId)) {
+        return { envId: "unknown", envIdSource: "default" };
+    }
+    return { envId: binding.envId, envIdSource: binding.source };
+}
+/**
+ * Env id shown on the start page, the usage card, and confirmation text.
+ * An explicit envId on this call wins, matching the resolver ladder.
+ * Otherwise the current slot (login state, project, cache, or env var already noted).
+ * Does not read process.env or the manager cache: on a hosted request those belong to the server machine.
+ */
+function readDisplayedEnvId(explicitEnvId) {
+    if (isReportableEnvId(explicitEnvId)) {
+        return explicitEnvId;
+    }
+    const reported = readReportedEnv();
+    if (reported.envIdSource !== "default") {
+        return reported.envId;
+    }
+    return null;
+}
+function runWithEnvSlot(slot, fn) {
+    return envCall.run(slot, fn);
+}
+/** One fresh slot. Tests and any caller that must not share another request's binding. */
+function runInEnvSlot(fn) {
+    return envCall.run({ binding: null }, fn);
+}
+/**
+ * Read-only snapshot for process start. Does not call setEnvId and does not list envs.
+ * `cachedEnvId` is passed in so this module does not import the manager (that import cycles).
+ */
+function peekLocalEnvBinding(input) {
+    if (isReportableEnvId(input.cachedEnvId)) {
+        return { envId: input.cachedEnvId, source: "envManager.cachedEnvId" };
+    }
+    const fromEnv = process.env.CLOUDBASE_ENV_ID;
+    if (isReportableEnvId(fromEnv)) {
+        return { envId: fromEnv, source: "process.env.CLOUDBASE_ENV_ID" };
+    }
+    const projectEnvId = (0, project_config_js_1.readProjectEnvId)();
+    if (isReportableEnvId(projectEnvId)) {
+        return { envId: projectEnvId, source: "project" };
+    }
+    if (isReportableEnvId(input.loginEnvId)) {
+        return { envId: input.loginEnvId, source: "login_state" };
+    }
+    return { envId: null, source: "default" };
+}
+
+
 /***/ },
 
 /***/ 81194
@@ -243051,6 +243552,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.reportToolkitSessionInitialized = exports.reportToolkitLifecycle = exports.reportResourceRead = exports.reportElicitationResult = exports.reportToolCall = exports.MCP_UI_EXTENSION = exports.telemetryReporter = void 0;
+exports.seedStdioEnvBinding = seedStdioEnvBinding;
 exports.extractMcpClientInfo = extractMcpClientInfo;
 exports.readMcpClientInfoFromServer = readMcpClientInfoFromServer;
 exports.normalizeClientName = normalizeClientName;
@@ -243064,6 +243566,8 @@ const os_1 = __importDefault(__webpack_require__(21820));
 const auth_js_1 = __webpack_require__(561);
 const cloudbase_manager_js_1 = __webpack_require__(33109);
 const cloud_mode_js_1 = __webpack_require__(88694);
+const env_binding_js_1 = __webpack_require__(61498);
+const device_id_js_1 = __webpack_require__(36953);
 const logger_js_1 = __webpack_require__(40781);
 const site_map_js_1 = __webpack_require__(34533);
 /**
@@ -243119,7 +243623,7 @@ class TelemetryReporter {
         const arch = os_1.default.arch(); // 系统架构
         // Build-time injected version; guard for vitest / non-webpack runtimes.
         const mcpVersion = process.env.npm_package_version ||
-            ( true ? "2.36.1" : 0);
+            ( true ? "2.36.2" : 0);
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -243132,26 +243636,25 @@ class TelemetryReporter {
     }
     /**
      * 获取设备唯一标识
-     * 基于主机名、CPU信息和MAC地址生成匿名设备指纹
+     *
+     * 锚点与降级顺序见 `utils/device-id.ts`：优先系统级不可变标识（IOPlatformUUID /
+     * MachineGuid / machine-id），取不到才退到 hostname + CPU + 过滤后的物理网卡 MAC。
+     * 容器里 hostname 每次重建都变、macOS 私有 Wi-Fi 地址让 MAC 随 SSID 漂移，
+     * 两者都不能当锚点 —— 旧实现把它们全拼进去，同一台 Mac 一天能上报成几十个设备。
+     *
+     * 子进程（ioreg / reg）只在这里跑一次（构造时），1s 超时即降级。
      */
     getDeviceId() {
         try {
-            // 获取设备信息组合
-            const deviceInfo = [
-                os_1.default.hostname(),
-                os_1.default.cpus().map((cpu) => cpu.model).join(','),
-                Object.values(os_1.default.networkInterfaces())
-                    .reduce((acc, val) => acc.concat(val || []), [])
-                    .filter((nic) => nic && !nic.internal && nic.mac)
-                    .map((nic) => nic.mac)
-                    .join(',')
-            ].join('|');
-            // 生成SHA256哈希作为设备ID
-            return crypto_1.default.createHash('sha256').update(deviceInfo).digest('hex').substring(0, 32);
+            const { deviceId, source } = (0, device_id_js_1.computeDeviceId)();
+            (0, logger_js_1.debug)('device_id_resolved', { source, deviceId: deviceId.substring(0, 8) + '...' });
+            return deviceId;
         }
         catch (err) {
-            // 如果获取设备信息失败，生成随机ID
-            return crypto_1.default.randomBytes(16).toString('hex');
+            // 走到这里说明连 hostname / CPU 都读不到：用固定串兜底，**绝不能**用随机数
+            // （随机数等于每次启动都是一台新设备，正是这次要消灭的行为）。
+            (0, logger_js_1.debug)('获取设备标识失败，回落到固定串', err instanceof Error ? err : new Error(String(err)));
+            return crypto_1.default.createHash('sha256').update('cloudbase-mcp|no-device-signal').digest('hex').substring(0, 32);
         }
     }
     /**
@@ -243267,39 +243770,40 @@ class TelemetryReporter {
 // 创建全局实例
 exports.telemetryReporter = new TelemetryReporter();
 /**
- * 解析环境ID
- * 优先级：传入配置 > envManager缓存 > 环境变量 > unknown
+ * Reports read the current AsyncLocalStorage slot.
+ * They do not re-read envManager or CLOUDBASE_ENV_ID.
+ * An explicit envId on this call is only used when the slot is still empty
+ * (hosted initialized, before a resolver runs, when the request already carried one).
+ *
+ * The source list lives in `env-binding.ts` (`ENV_SOURCES`) — one definition only.
  */
 function resolveEnvId(cloudBaseOptions) {
-    let envId = 'unknown';
-    let envIdSource = 'unknown';
-    try {
-        if (cloudBaseOptions?.envId) {
-            envId = cloudBaseOptions.envId;
-            envIdSource = 'cloudBaseOptions';
-        }
-        else {
-            const cachedEnvId = (0, cloudbase_manager_js_1.getCachedEnvId)();
-            if (cachedEnvId) {
-                envId = cachedEnvId;
-                envIdSource = 'envManager.cachedEnvId';
-            }
-            else if (process.env.CLOUDBASE_ENV_ID) {
-                envId = process.env.CLOUDBASE_ENV_ID;
-                envIdSource = 'process.env.CLOUDBASE_ENV_ID';
-            }
-            else {
-                envId = 'unknown';
-                envIdSource = 'default';
-            }
-        }
+    const reported = (0, env_binding_js_1.readReportedEnv)();
+    if (reported.envIdSource !== "default") {
+        return reported;
     }
-    catch (err) {
-        (0, logger_js_1.debug)('获取环境ID失败，遥测数据将使用 unknown', err instanceof Error ? err : new Error(String(err)));
-        envId = 'unknown';
-        envIdSource = 'error';
+    if (cloudBaseOptions?.envId) {
+        return { envId: cloudBaseOptions.envId, envIdSource: "cloudBaseOptions" };
+    }
+    return { envId: "unknown", envIdSource: "default" };
+}
+/**
+ * Stdio start: reuse the login warm (one peekLoginState per process) and one project-file read.
+ * Does not call setEnvId and does not list environments. Cloud mode does not read local files.
+ */
+async function seedStdioEnvBinding(slot) {
+    if ((0, cloud_mode_js_1.isCloudMode)()) {
+        return;
+    }
+    await warmLocalLoginState();
+    const loginEnvId = typeof localLoginState?.envId === "string" ? localLoginState.envId : null;
+    const binding = (0, env_binding_js_1.peekLocalEnvBinding)({
+        cachedEnvId: (0, cloudbase_manager_js_1.getCachedEnvId)(),
+        loginEnvId,
+    });
+    if (binding.envId && binding.source !== "default") {
+        slot.binding = binding;
     }
-    return { envId, envIdSource };
 }
 /**
  * Normalize SDK Implementation / clientInfo into telemetry-safe fields.
@@ -243606,6 +244110,9 @@ const reportToolCall = async (params) => {
         duration: params.duration !== undefined ? String(params.duration) : undefined,
         error: params.error ? params.error.substring(0, 200) : undefined, // 限制错误信息长度
         envId: envId || 'unknown',
+        // 取值来源（cloudBaseOptions / envManager.cachedEnvId / process.env / default）：
+        // 这一列就是「envId 为什么是 unknown」的判据，别再靠猜
+        envIdSource,
         region: siteRegion.region,
         site: siteRegion.site,
         login_uin: loginUin,
@@ -243619,6 +244126,13 @@ const reportToolCall = async (params) => {
     if (params.action !== undefined) {
         eventData.action = params.action;
     }
+    // 环境准备结果：拿不到就不占列（与能力字段同一纪律，不写 unknown 假值）
+    if (params.envSetupStatus !== undefined) {
+        eventData.envSetupStatus = params.envSetupStatus;
+    }
+    if (params.envSetupFailReason !== undefined) {
+        eventData.envSetupFailReason = params.envSetupFailReason;
+    }
     // 添加入参信息（如果提供）
     if (params.inputParams !== undefined) {
         try {
@@ -243740,7 +244254,15 @@ const reportToolkitLifecycle = async (params) => {
     // 安全获取环境ID，优先使用传入的配置
     const { envId, envIdSource } = resolveEnvId(params.cloudBaseOptions);
     const siteRegion = resolveTelemetrySiteRegion(params.cloudBaseOptions);
-    const loginUin = await resolveLoginUin(params.cloudBaseOptions, { allowResolve: false });
+    // `start` 在进程最早期发出：此时既没有宿主注入的 uin，也还没人 warm 过本地登录态。
+    // 卡死 `allowResolve: false` 就只能读到空缓存 → 恒 'unknown'（2026-10-26 实测：这一列
+    // 有真实 uin 的行是 0）。start 允许解析：`warmLocalLoginState()` 进程内只跑一次
+    // （读本地 auth.json；临时密钥过期时可能续期一次，与工具调用本来就要付的开销同源），
+    // 不会挂到每次上报上。
+    // `exit` 仍保持不允许 —— 退出路径不能等，拿不到就是 unknown，`start` 那次已经把值带出去了。
+    const loginUin = await resolveLoginUin(params.cloudBaseOptions, {
+        allowResolve: params.event !== 'exit',
+    });
     (0, logger_js_1.debug)('[telemetry] 生命周期事件 envId 获取结果', {
         event: params.event,
         envId,
@@ -243755,6 +244277,9 @@ const reportToolkitLifecycle = async (params) => {
         exitCode: params.exitCode !== undefined ? String(params.exitCode) : undefined,
         error: params.error ? params.error.substring(0, 200) : undefined, // 限制错误信息长度
         envId: envId || 'unknown',
+        // 取值来源（cloudBaseOptions / envManager.cachedEnvId / process.env / default）：
+        // 这一列就是「envId 为什么是 unknown」的判据，别再靠猜
+        envIdSource,
         region: siteRegion.region,
         site: siteRegion.site,
         login_uin: loginUin,
@@ -243811,12 +244336,15 @@ exports.reportToolkitLifecycle = reportToolkitLifecycle;
  */
 const reportToolkitSessionInitialized = async (params) => {
     const { nodeVersion, osType, osRelease, arch, mcpVersion } = exports.telemetryReporter.getUserAgent();
-    const { envId } = resolveEnvId(params.cloudBaseOptions);
+    const { envId, envIdSource } = resolveEnvId(params.cloudBaseOptions);
     const siteRegion = resolveTelemetrySiteRegion(params.cloudBaseOptions);
-    const loginUin = await resolveLoginUin(params.cloudBaseOptions, { allowResolve: false });
+    // 与 `start` 同理：`initialized` 紧跟在 `start` 之后，也是不允许等的分支就会白报一条 unknown。
+    // 这里放开解析；若 `start` 已经 warm 过，这一句直接命中进程内缓存，零额外成本。
+    const loginUin = await resolveLoginUin(params.cloudBaseOptions);
     const eventData = {
         event: 'initialized',
         envId: envId || 'unknown',
+        envIdSource,
         region: siteRegion.region,
         site: siteRegion.site,
         login_uin: loginUin,
@@ -243990,7 +244518,6 @@ function throwToolPayloadError(payload) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.applyCategoryAnnotationMeta = applyCategoryAnnotationMeta;
 exports.wrapServerWithTelemetry = wrapServerWithTelemetry;
-const cloudbase_manager_js_1 = __webpack_require__(33109);
 const cloud_mode_js_1 = __webpack_require__(88694);
 const logger_js_1 = __webpack_require__(40781);
 const telemetry_js_1 = __webpack_require__(5198);
@@ -244053,8 +244580,56 @@ function contributionHint(server) {
     ].join("\n");
 }
 /**
- * 创建包装后的处理函数，添加数据上报功能
+ * 从 `auth` 的返回里取出「环境准备」的结果，供遥测上报。
+ *
+ * 为什么要从返回体里抠：`env_setup_status` / `env_setup_failure.reason` 只存在于
+ * `auth` 的 payload 里，不是 `reportToolCall` 的入参。而工具 wrapper 是唯一同时
+ * 看得见 args 和 result 的地方。
+ *
+ * 现状（2026-10-27）：这两项只回给模型、没进埋点，于是「无环境的用户卡在购买页、
+ * 实名、还是 CAM 授权」在数据里长得一模一样，加文案也无法验收。
  */
+function readEnvSetupOutcome(result) {
+    const rec = result;
+    if (!rec || typeof rec !== 'object')
+        return undefined;
+    // 优先 structuredContent（MCP 规范位），退到 content[0].text 里的 JSON
+    const candidates = [];
+    if (rec.structuredContent)
+        candidates.push(rec.structuredContent);
+    const content = Array.isArray(rec.content) ? rec.content : [];
+    for (const item of content) {
+        const text = item?.text;
+        if (typeof text === 'string' && text.trim().startsWith('{')) {
+            try {
+                candidates.push(JSON.parse(text));
+            }
+            catch {
+                /* 不是 JSON 就跳过，不要因为解析失败影响正常返回 */
+            }
+        }
+    }
+    for (const payload of candidates) {
+        const p = payload;
+        const status = typeof p?.env_setup_status === 'string' ? p.env_setup_status : undefined;
+        if (!status)
+            continue;
+        const failure = p?.env_setup_failure;
+        const reason = typeof failure?.reason === 'string' ? failure.reason : undefined;
+        // 把两个布尔压进 reason 的后缀：一列就能看清「卡在哪」，
+        // 单看 reason 只知道「建环境失败」，不知道是实名还是 CAM 授权拦住的
+        const gates = [];
+        if (failure?.need_real_name_auth === true)
+            gates.push('realname');
+        if (failure?.need_cam_auth === true)
+            gates.push('cam');
+        return {
+            status,
+            reason: reason ? (gates.length ? `${reason}+${gates.join('+')}` : reason) : undefined,
+        };
+    }
+    return undefined;
+}
 /**
  * 工具自己返回的失败：结构化 `{ success: false }`（`isBusinessFailureToolResult` 已覆盖
  * 顶层 / structuredContent / JSON 文本三种挂法），**或**已经显式带 `isError: true` 的回执。
@@ -244074,7 +244649,7 @@ function isReturnedFailureResult(result) {
  * 所以两条路径对同一个底层错误得到的文本逐字相同（🆔 RequestId + 📦 版本页脚都在这里）。
  */
 function buildFailureClientText(errorMessage, requestId, server) {
-    const mcpVersion =  true ? "2.36.1" : 0;
+    const mcpVersion =  true ? "2.36.2" : 0;
     const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
     return `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n${contributionHint(server)}`;
 }
@@ -244134,12 +244709,18 @@ function withEnhancedFailureText(result, errorMessage, requestId, server) {
     }
     return result;
 }
+/**
+ * 创建包装后的处理函数，添加数据上报功能
+ */
 function createWrappedHandler(name, handler, server) {
     return async (args, extra) => {
         const startTime = Date.now();
         let success = false;
         let errorMessage;
         let requestId;
+        // 提到 try 外：finally 里要读 auth 的环境准备结果（env_setup_status / failure.reason）。
+        // 护栏拦截的早退路径不会赋值，finally 里按 undefined 处理。
+        let result;
         try {
             (0, logger_js_1.debug)(`开始执行工具: ${name}`, { args: sanitizeArgs(args) });
             // In test environment, skip logger to avoid potential blocking
@@ -244171,7 +244752,7 @@ function createWrappedHandler(name, handler, server) {
                 return guardDecision.result;
             }
             // 执行原始处理函数（extra 一并透传，工具可据此拿到在途请求 id）
-            const result = await handler(args, extra);
+            result = await handler(args, extra);
             // 工具**自己返回**的失败（`{ success: false }` 结构化载荷，或已经带 `isError: true` 的
             // 失败回执）与"抛错"是同一件事：遥测要按失败记，文案要吃同一套收尾（增强 + RequestId +
             // 版本页脚）。护栏拦截的返回走不到这里——它在上面就 return 了，且它的载荷既没有
@@ -244252,24 +244833,19 @@ function createWrappedHandler(name, handler, server) {
             const isTestEnvironment =  false || process.env.VITEST === "true";
             if (!isTestEnvironment) {
                 const duration = Date.now() - startTime;
-                // 如果 server.cloudBaseOptions 为空或没有 envId，尝试从缓存获取并更新
-                let cloudBaseOptions = server.cloudBaseOptions;
-                if (!cloudBaseOptions?.envId) {
-                    const cachedEnvId = (0, cloudbase_manager_js_1.getCachedEnvId)();
-                    if (cachedEnvId) {
-                        cloudBaseOptions = { ...cloudBaseOptions, envId: cachedEnvId };
-                    }
-                }
+                const envSetup = name === 'auth' ? readEnvSetupOutcome(result) : undefined;
                 // 异步上报，不阻塞工具返回
                 (0, telemetry_js_1.reportToolCall)({
                     toolName: name,
+                    envSetupStatus: envSetup?.status,
+                    envSetupFailReason: envSetup?.reason,
                     success,
                     requestId,
                     duration,
                     error: errorMessage,
                     inputParams: sanitizeArgs(args), // 添加入参上报
                     action: args?.action, // 工具级 action（如 auth 的 status/set_env）
-                    cloudBaseOptions: cloudBaseOptions, // 传递 CloudBase 配置（可能已更新）
+                    cloudBaseOptions: server.cloudBaseOptions,
                     ide: server.ide || process.env.INTEGRATION_IDE, // 传递集成IDE信息
                     client: server.client || process.env.CLOUDBASE_MCP_CLIENT, // 传递 MCP client 来源标识
                     mcpClientInfo: (0, telemetry_js_1.readMcpClientInfoFromServer)(server),
@@ -264583,6 +265159,14 @@ module.exports = require("net");
 
 /***/ },
 
+/***/ 18667
+(module) {
+
+"use strict";
+module.exports = require("node:async_hooks");
+
+/***/ },
+
 /***/ 75305
 (module) {