chore: sync upstream main

Author: github-actions[bot]

docs/runtime-api.md

@@ -45,10 +45,39 @@ keep `GET` SSE streams open.
 The MCP server exposes a small discovery-oriented tool set:
 
 - `list_apps`
+- `list_connections`
 - `search_actions`
 - `get_action_guide`
 - `execute_action`
 
+Use `list_connections` to discover configured accounts before selecting one. Both
+`get_action_guide` and `execute_action` accept an optional `connectionName`:
+
+`get_action_guide` request:
+
+```json
+{
+  "actionId": "example.get_record",
+  "connectionName": "secondary"
+}
+```
+
+`execute_action` request:
+
+```json
+{
+  "actionId": "example.get_record",
+  "connectionName": "secondary",
+  "input": {
+    "recordId": "record-123"
+  }
+}
+```
+
+Omitting `connectionName` uses the `default` connection. A requested named connection must exist;
+the runtime does not silently fall back to another account. Connection results expose only safe
+account identity fields and never include stored credentials.
+
 Preview MCP tool metadata:
 
 ```bash

examples/aliyun-sls-query-logs.ts

@@ -0,0 +1,81 @@
+import type { ExecutionContext, ResolvedCredential } from "../src/core/types.ts";
+
+import { executors } from "../src/providers/aliyun_sls/executors.ts";
+import { parseAliyunSlsCredential, resolveAliyunSlsLogstoreTarget } from "../src/providers/aliyun_sls/resources.ts";
+
+const requiredEnvironment = [
+  "ALIYUN_SLS_ACCESS_KEY_ID",
+  "ALIYUN_SLS_ACCESS_KEY_SECRET",
+  "ALIYUN_SLS_ENDPOINT",
+] as const;
+
+async function main(): Promise<void> {
+  const missing = requiredEnvironment.filter((name) => !process.env[name]?.trim());
+  if (missing.length > 0) {
+    console.log(`Skip Alibaba Cloud SLS example: missing ${missing.join(", ")}.`);
+    return;
+  }
+
+  const values: Record<string, string> = {
+    accessKeyId: process.env.ALIYUN_SLS_ACCESS_KEY_ID!,
+    accessKeySecret: process.env.ALIYUN_SLS_ACCESS_KEY_SECRET!,
+    endpoint: process.env.ALIYUN_SLS_ENDPOINT!,
+  };
+  if (process.env.ALIYUN_SLS_SECURITY_TOKEN?.trim()) {
+    values.securityToken = process.env.ALIYUN_SLS_SECURITY_TOKEN;
+  }
+  if (process.env.ALIYUN_SLS_RESOURCE_SCOPE?.trim()) {
+    values.resourceScope = process.env.ALIYUN_SLS_RESOURCE_SCOPE;
+  }
+
+  const credential = parseAliyunSlsCredential(values);
+  let target;
+  try {
+    target = resolveAliyunSlsLogstoreTarget(
+      credential,
+      undefined,
+      process.env.ALIYUN_SLS_PROJECT,
+      process.env.ALIYUN_SLS_LOGSTORE,
+    );
+  } catch {
+    console.log(
+      "Skip Alibaba Cloud SLS example: set ALIYUN_SLS_PROJECT and ALIYUN_SLS_LOGSTORE, or configure resourceScope with exactly one candidate Project and Logstore.",
+    );
+    return;
+  }
+
+  const resolvedCredential: ResolvedCredential = {
+    authType: "custom_credential",
+    values,
+    profile: {
+      accountId: credential.accessKeyId,
+      displayName: `${credential.accessKeyId}@${credential.endpoint}`,
+      grantedScopes: [],
+    },
+    metadata: {},
+  };
+  const context: ExecutionContext = {
+    async getCredential(service) {
+      return service === "aliyun_sls" ? resolvedCredential : undefined;
+    },
+  };
+
+  const to = Math.floor(Date.now() / 1000);
+  const result = await executors["aliyun_sls.query_logs"]!(
+    {
+      endpoint: target.endpoint,
+      project: target.project,
+      logstore: target.logstore,
+      from: to - 900,
+      to,
+      query: process.env.ALIYUN_SLS_QUERY ?? "*",
+      line: 100,
+      reverse: true,
+    },
+    context,
+  );
+  console.log(JSON.stringify(result, null, 2));
+  if (!result.ok) process.exitCode = 1;
+}
+
+await main();

src/core/guarded-fetch.test.ts

@@ -210,6 +210,7 @@ describe("createGuardedFetch redirects", () => {
         "x-api-key": "provider-secret",
         "x-auth-token": "tok",
         "x-seq-apikey": "seq-secret",
+        "x-acs-security-token": "aliyun-sts-secret",
         "x-trace": "keep",
         // Look-alike but non-credential headers must survive cross-origin.
         "idempotency-key": "abc",
@@ -221,12 +222,14 @@ describe("createGuardedFetch redirects", () => {
     expect(sameOriginHeaders.get("authorization")).toBe("Bearer secret");
     expect(sameOriginHeaders.get("x-api-key")).toBe("provider-secret");
     expect(sameOriginHeaders.get("x-seq-apikey")).toBe("seq-secret");
+    expect(sameOriginHeaders.get("x-acs-security-token")).toBe("aliyun-sts-secret");
     const crossOriginHeaders = new Headers(calls[2]?.init?.headers);
     expect(crossOriginHeaders.has("authorization")).toBe(false);
     expect(crossOriginHeaders.has("cookie")).toBe(false);
     expect(crossOriginHeaders.has("x-api-key")).toBe(false);
     expect(crossOriginHeaders.has("x-auth-token")).toBe(false);
     expect(crossOriginHeaders.has("x-seq-apikey")).toBe(false);
+    expect(crossOriginHeaders.has("x-acs-security-token")).toBe(false);
     expect(crossOriginHeaders.get("x-trace")).toBe("keep");
     expect(crossOriginHeaders.get("idempotency-key")).toBe("abc");
     expect(crossOriginHeaders.get("x-correlation-id")).toBe("cid");

src/core/guarded-fetch.ts

@@ -94,6 +94,7 @@ const crossOriginCredentialHeaders = new Set([
   "x-csrf-token",
   "x-xsrf-token",
   "x-goog-api-key",
+  "x-acs-security-token",
   "x-amz-security-token",
 ]);
 /** Body-describing headers dropped when a redirect rewrites the method to GET, mirroring the fetch spec. */