chore: sync from CloudBase-MCP

Author: github-actions[bot]

.plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://open-plugins.com/schemas/1.0.0/plugin.schema.json",
   "name": "cloudbase",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Tencent CloudBase — AI models, authentication, NoSQL/PostgreSQL databases, cloud functions, cloud storage, CloudRun backend services, and WeChat Mini Program integration. Powered by cloudbase-mcp.",
   "author": {
     "name": "Tencent CloudBase",

.qoder-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudbase",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Tencent CloudBase — AI models, authentication, NoSQL/PostgreSQL databases, cloud functions, cloud storage, CloudRun backend services, and WeChat Mini Program integration. Powered by cloudbase-mcp.",
   "author": {
     "name": "Tencent CloudBase",

docs/qoder-submit.md

@@ -35,7 +35,7 @@ Tone: product listing, not marketing. Write as a backend platform shipping an of
 |-------|-------|
 | Display name | CloudBase |
 | Technical `name` | `cloudbase` |
-| Version | From zip / `.qoder-plugin/plugin.json` (currently `0.2.0`) |
+| Version | From zip / `.qoder-plugin/plugin.json` (currently `0.2.1`) |
 | Category | Coding / DevOps / Database (if multi-select) |
 | Author | Tencent CloudBase |
 | Homepage | https://docs.cloudbase.net/ai/cloudbase-ai-toolkit/ |

hooks/plugin-telemetry.mjs

@@ -5,6 +5,11 @@
 // - toolkit_plugin_first_use: once per local user profile
 // Always includes pluginVersion. No prompts, paths, tool args, or skill-injection details.
 //
+// Account attribution: reads ONLY `uin` (主账号 uin) and `envId` from the local CloudBase auth
+// file (~/.config/.cloudbase/auth.json). No network, no credential exchange — one file read.
+// Secret fields (refreshToken / tmpSecretId / tmpSecretKey / …) are never read, logged or sent.
+// Unreadable (no file / not logged in / env-level API Key, which carries no uin) → "unknown".
+//
 // Disable: CLOUDBASE_PLUGIN_TELEMETRY=off (or CLOUDBASE_MCP_TELEMETRY_DISABLED=true)
 import { createHash, randomBytes } from "crypto";
 import {
@@ -34,6 +39,11 @@ var BEACON_UPLOAD_URL = "https://otheve.beacon.qq.com/analytics/v2_upload";
 var BEACON_APP_KEY = "0WEB0AD0GM4PUUU1";
 var DEFAULT_TIMEOUT_MS = 1500;
 
+// 本地登录态。只读 uin / envId 两个字段 —— 该文件同时装着 refreshToken 与临时密钥。
+var AUTH_FILE = join(homedir(), ".config", ".cloudbase", "auth.json");
+// CLI 站点配置；slotted 形态下靠它的 isIntl 决定取哪个槽（与 @cloudbase/toolbox 同规则）。
+var CLI_CONFIG_FILE = join(homedir(), ".config", ".cloudbase", "config.json");
+
 export var PLUGIN_DAU_EVENT = "toolkit_plugin_dau";
 export var PLUGIN_FIRST_USE_EVENT = "toolkit_plugin_first_use";
 
@@ -215,6 +225,84 @@ function postJson(url, data, timeoutMs = DEFAULT_TIMEOUT_MS) {
   });
 }
 
+function readJsonQuietly(file) {
+  try {
+    return JSON.parse(readFileSync(file, "utf-8"));
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * 从登录态里挑出「当前有效的那份凭证」。
+ *
+ * 这个文件的形状**会变**，三种都要认（实测都出现过）：
+ *   A. `{ credential: { uin, envId, tmpSecretId, … } }`          ← flat，当前 CLI 写的就是它
+ *   B. `{ credential: { domestic: {…}, intl: {…} } }`            ← slotted，双站点登录 / 旧版
+ *   C. `{ uin, envId, … }`                                       ← 没有 credential 包裹（防御）
+ *
+ * slotted 时取哪个槽与 `@cloudbase/toolbox` 的 `migrateSlottedCredentialToFlat` 同规则：
+ * 读 CLI `config.json` 的 `isIntl`；读不到 / 不是布尔值 ⇒ 退化为「取有凭证的那个，优先 domestic」。
+ * 取错槽会拿到**另一个站点的 uin**，所以这一步不能省。
+ */
+function pickCredentialSlot(raw, cliConfigFile) {
+  if (!raw || typeof raw !== "object") return undefined;
+  const inner = raw.credential;
+  const c = inner && typeof inner === "object" ? inner : raw;
+  if (!c || typeof c !== "object") return undefined;
+
+  const domestic =
+    c.domestic && typeof c.domestic === "object" ? c.domestic : undefined;
+  const intl = c.intl && typeof c.intl === "object" ? c.intl : undefined;
+  if (!domestic && !intl) return c; // flat
+
+  const cli = readJsonQuietly(cliConfigFile);
+  const isIntl =
+    cli && typeof cli.isIntl === "boolean" ? cli.isIntl : undefined;
+  if (isIntl === true) return intl ?? domestic;
+  if (isIntl === false) return domestic ?? intl;
+  return domestic ?? intl;
+}
+
+/** uin 可能是数字（实测 123811017）也可能是字符串；空 / "0" 视为没有。 */
+function normalizeUin(value) {
+  if (value === undefined || value === null) return undefined;
+  const s = String(value).trim();
+  return s && s !== "0" ? s : undefined;
+}
+
+/**
+ * 从本地登录态读「主账号 uin」与「凭证上绑的环境 id」。
+ *
+ * ⚠️ **两者都可能读不到，这是常态**：
+ *   - `uin` 只在**账号级**登录态里有；环境级 API Key 的凭证自身不带 uin。
+ *   - `envId` 由 CLI 登录时写入（MCP 侧从不写），实测历史快照里只有很小一部分带它。
+ * 读不到一律返回 undefined，由调用方上报 `unknown` —— 不抛错、不阻塞会话。
+ *
+ * 🔴 只读 `uin` / `envId`：同文件里的 refreshToken 与临时密钥绝不读取、绝不落日志、绝不上报。
+ */
+export function resolveLocalAuthFacts(options = {}) {
+  const facts = { loginUin: undefined, envId: undefined };
+  const slot = pickCredentialSlot(
+    readJsonQuietly(options.authFile ?? AUTH_FILE),
+    options.cliConfigFile ?? CLI_CONFIG_FILE,
+  );
+  if (!slot) return facts;
+
+  const uin = normalizeUin(slot.uin);
+  if (uin) facts.loginUin = uin;
+  if (typeof slot.envId === "string" && slot.envId.trim()) {
+    facts.envId = slot.envId.trim();
+  }
+  return facts;
+}
+
+/** 上报字段：读不到就报 `unknown`（与 MCP 侧 `toolkit_tool_call.envId` 同一约定）。 */
+export function buildAuthAttribution(options = {}) {
+  const { loginUin, envId } = resolveLocalAuthFacts(options);
+  return { login_uin: loginUin ?? "unknown", envId: envId ?? "unknown" };
+}
+
 /**
  * Report lightweight plugin session telemetry (DAU + first use).
  * Stamps are written only after a successful Beacon upload (Vercel-aligned).
@@ -227,6 +315,8 @@ export async function reportPluginSessionTelemetry(options = {}) {
     now = new Date(),
     timeoutMs = DEFAULT_TIMEOUT_MS,
     postFetch = postJson,
+    authFile,
+    cliConfigFile,
   } = options;
 
   if (!isPluginTelemetryEnabled(env)) {
@@ -236,6 +326,8 @@ export async function reportPluginSessionTelemetry(options = {}) {
   const pluginVersion = resolvePluginVersion(pluginRoot);
   const deviceId = buildDeviceId();
   const userAgent = buildUserAgent(pluginVersion);
+  // 一次文件读；读不到就是两个 unknown，不影响下面两条事件
+  const attribution = buildAuthAttribution({ authFile, cliConfigFile });
   const sent = [];
 
   const sendEvent = async (eventCode, eventData, onSuccess) => {
@@ -244,6 +336,7 @@ export async function reportPluginSessionTelemetry(options = {}) {
       eventData: {
         pluginVersion,
         value: "1",
+        ...attribution,
         ...eventData,
       },
       deviceId,

kimi.plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://kimi.com/schemas/kimi.plugin.schema.json",
   "name": "cloudbase",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Tencent CloudBase \u2014 AI models, authentication, NoSQL/PostgreSQL databases, cloud functions, cloud storage, CloudRun backend services, and WeChat Mini Program integration. Powered by cloudbase-mcp.",
   "keywords": [
     "cloudbase",

plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "cloudbase",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Tencent CloudBase — AI models, authentication, NoSQL/PostgreSQL databases, cloud functions, cloud storage, CloudRun backend services, and WeChat Mini Program integration. Powered by cloudbase-mcp.",
   "author": {
     "name": "Tencent CloudBase",