@hadooppei/hwcode 0.1.0 → 0.2.1

package/.pi/skills/hwcode-cloud/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: hwcode-cloud
+description: Run a credential-isolated, approval-gated cloud planning and deployment workflow. Use only after the /hwcode-cloud command has selected and validated a provider account.
+---
+
+# HWCode Cloud
+
+Use this skill only after `/hwcode-cloud` has activated the workflow. The activation message is authoritative for the locked project root, selected provider, whether the current project should be deployed, and the user's objective.
+
+## Non-negotiable security rules
+
+- Never ask for, display, infer, copy, log, summarize, or place credentials in chat, shell text, source files, environment files, tool arguments, plans, or session artifacts.
+- Never read `~/.hwcode/cloud/credentials.enc`. The extension owns encryption, decryption, and credential injection.
+- Use `hwcode_cloud_exec` for every provider CLI, Terraform/OpenTofu, Pulumi, kubectl, or Helm operation. Direct Bash use for those commands is forbidden.
+- Keep project reads, writes, builds, manifests, and generated artifacts inside the locked project root. External paths require the workflow guard's one-call approval.
+- Prefer short-lived, least-privilege identities and narrowly scoped roles. Never widen permissions merely to bypass an authorization error without explaining the exact missing permission and obtaining approval.
+- Do not expose sensitive values returned by a provider. If output unexpectedly contains a secret, do not repeat it; tell the user to rotate it.
+
+## Phase 1: Establish facts
+
+The command already collected the provider, deployment choice, objective, and validated account connection. Do not repeat those questions unless the activation context is contradictory.
+
+Inspect the project only as needed to determine:
+
+- application type, build and runtime requirements;
+- existing IaC, container, Kubernetes, CI/CD, and environment configuration;
+- expected domains, networking, data stores, secrets, observability, scaling, and recovery needs;
+- provider region/account/subscription/project identity using read-only `hwcode_cloud_exec` calls;
+- which resources already exist and should be reused.
+
+Ask concise follow-up questions when the objective lacks a material decision such as region, environment name, public exposure, data durability, budget, compliance, availability, or acceptable downtime. Do not guess choices with financial or security impact.
+
+## Phase 2: Present an execution plan
+
+Before modifying account resources, present a plan containing:
+
+1. target architecture and provider services;
+2. resources to reuse, create, modify, and potentially delete;
+3. local project changes and generated IaC artifacts;
+4. security boundaries, identity permissions, secret handling, and network exposure;
+5. rollout, verification, observability, rollback, and estimated cost drivers;
+6. ordered commands and their expected resource impact.
+
+Prefer declarative, reviewable, idempotent infrastructure as code. Use a plan/dry-run command before apply when the selected tooling supports it. Pin important versions and avoid provider defaults that materially affect cost or exposure.
+
+## Phase 3: Execute with approval gates
+
+For every `hwcode_cloud_exec` call:
+
+- set `operation` to `read`, `change`, or `delete` honestly;
+- provide a concise `intent` understandable without reading the raw command;
+- use a stable `approach` name for the current technical strategy;
+- pass an executable and argument vector, never shell syntax;
+- inspect the result before proceeding.
+
+The extension confirms every account-resource create or modification unless the user selects session-wide approval for non-delete changes. A deletion is always confirmed separately, even after that opt-out.
+
+Local source changes still follow normal HWCode safeguards. Validate configuration locally before any apply. After changes, perform provider-side health checks and application-level smoke tests. Compare the final state with the stated objective.
+
+## Failure budget
+
+An approach is a materially different technical strategy, not a renamed retry. Examples include switching from a managed deployment service to Kubernetes, changing the authentication path, or replacing a failing IaC provider with the provider CLI. Parameter tweaks, transient retries, and rerunning the same command remain one approach.
+
+When a command fails:
+
+1. identify the concrete cause from safe output;
+2. decide whether to repair the current approach or adopt a genuinely different one;
+3. keep the same `approach` value for repairs and retries;
+4. explain any new risks before switching strategy.
+
+After three genuinely different approaches fail, stop all execution. Tell the user that the objective cannot be completed in this run and provide:
+
+- the concrete cause of each failed approach;
+- completed local and cloud-side changes;
+- resources that may still exist and their state;
+- verification already performed;
+- rollback or cleanup still required, noting that cleanup deletions need confirmation;
+- the smallest next action that could unblock a future attempt.
+
+Do not attempt a fourth approach.
+
+## Completion
+
+On success, summarize:
+
+- deployed architecture and endpoints;
+- created, changed, reused, and deleted resources;
+- local files changed;
+- verification results;
+- ongoing cost, security, monitoring, backup, and credential-rotation considerations;
+- rollback and teardown procedure (do not execute teardown unless separately requested and approved).

package/.pi/skills/hwcode-cloud/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "HWCode Cloud"
+  short_description: "Approval-gated, credential-isolated cloud deployment workflow"
+  default_prompt: "Use $hwcode-cloud after /hwcode-cloud has validated the selected cloud account."

package/.pi/welcome.json

@@ -9,7 +9,9 @@
     "success",
     "warning"
   ],
-  "subtitle": "Local AI Coding Workspace",
+  "subtitle": "Local HuaweiCloud AI Coding Workspace",
   "subtitleColor": "muted",
-  "reservedRows": 8
+  "reservedRows": 8,
+  "logoScale": 0.82,
+  "verticalOffsetRows": 1
 }

package/README.md

@@ -1,7 +1,7 @@
 # HWCode
 
 A customizable terminal coding agent built on Pi, with local-model providers,
-persistent working directories, a tailored TUI, and Vibe/SDD workflows.
+persistent working directories, a tailored TUI, and Vibe/SDD/Cloud workflows.
 
 ## Install
 
@@ -18,10 +18,14 @@ cd your-project
 hwcode
 ```
 
-`npx @hadooppei/hwcode` is also supported without a global installation. HWCode loads a
-project's `.env` file when present and keeps Pi's normal user-level auth and
-session storage. Project-local `.pi` resources continue to load alongside the
-built-in HWCode profile.
+Run `hwcode --help` for the HWCode command reference, including model,
+session, tool, and workflow options.
+
+`npx @hadooppei/hwcode` is also supported without a global installation. HWCode
+loads a project's `.env` file when present and keeps Pi's normal user-level auth
+and session storage. Project-local Pi resources continue to load alongside the
+built-in HWCode profile, except for HWCode's package-scoped model-provider
+definition described below.
 
 ## Repository setup
 
@@ -35,45 +39,31 @@ On first launch, review and accept Pi's project-trust prompt so it can load the
 
 ## Model providers
 
-OpenAI-compatible providers are declared in `.pi/model-providers.json`.
-Static providers list their models directly:
+The published `.pi/model-providers.json` is package-scoped and is not replaced
+by a file in the current project. It registers the configurable `hw` provider
+without shipping a machine-specific endpoint or a pre-populated model catalog.
+Use Pi's native `/login` flow, select `Huawei MaaS`, and enter the endpoint and
+API key. The key can instead come from `HW_API_KEY`. HWCode then discovers every model exposed by the
+OpenAI-compatible endpoint and Pi stores the selected endpoint, credential, and
+dynamic catalog in its user-level stores.
 
-```json
-{
-  "id": "local-example",
-  "name": "Local example",
-  "baseUrl": "http://127.0.0.1:8082",
-  "apiKeyEnv": "PI_LOCAL_MODEL_API_KEY",
-  "models": [
-    {
-      "id": "model-id",
-      "input": ["text", "image"],
-      "contextWindow": 32768,
-      "maxTokens": 8192
-    }
-  ]
-}
-```
-
-Login providers use Pi's native `/login` flow and discover every model exposed
-by an OpenAI-compatible model endpoint:
+The published provider is equivalent to:
 
 ```json
 {
   "id": "hw",
-  "name": "hw",
-  "baseUrl": "http://127.0.0.1:8080/v1",
+  "name": "Huawei MaaS",
   "apiKeyEnv": "HW_API_KEY",
   "login": {
     "enabled": true,
     "promptBaseUrl": true,
     "promptApiKey": true,
-    "apiKeyRequired": false,
+    "apiKeyRequired": true,
     "catalogPath": "models"
   },
   "modelDefaults": {
     "input": ["text"],
-    "contextWindow": 32768,
+    "contextWindow": 1000000,
     "maxTokens": 8192
   }
 }
@@ -81,12 +71,14 @@ by an OpenAI-compatible model endpoint:
 
 `id` is the stable credential and cache key; `name` is the configurable label
 shown alongside other providers in `/login`. A login authenticates the whole
-provider and publishes its complete model catalog to `/model`. Entries in a
-login provider's `models` array are optional metadata overrides for discovered
-IDs, which is where vision support should be declared with
-`"input": ["text", "image"]`. Unknown models default to text-only. Keep real
-API keys in `.env` or enter them through `/login`; Pi stores entered credentials
-in its own auth store rather than the project configuration.
+provider and publishes its complete model catalog to `/model`. Unknown models
+default to text-only. Keep real API keys in `.env` or enter them through
+`/login`; Pi stores entered credentials in its own auth store rather than the
+package configuration.
+
+Repository maintainers can refer to `.pi/model-providers.json.template` for the
+previous local static-provider examples, including multimodal metadata. The
+template is not loaded at runtime and is explicitly excluded from npm packages.
 
 ## Welcome screen
 
@@ -103,6 +95,7 @@ Start one of the project workflows from the Pi input:
 ```text
 /hwcode-vibe Build a small web application with me
 /hwcode-sdd Add role-based access control
+/hwcode-cloud Deploy this service with a managed database
 ```
 
 Both commands first confirm the current directory and lock project work to that
@@ -113,6 +106,67 @@ to be the Git repository root, inventories the codebase, resolves requirement
 questions, and persists approved artifacts under
 `.hwcode/specs/<requirement-slug>/` before test-first implementation begins.
 
+### Cloud workflow
+
+`/hwcode-cloud` interactively collects the cloud provider, whether the current
+project should be deployed, and the concrete objective. It supports AWS, Azure,
+Google Cloud, Huawei Cloud, Alibaba Cloud, and Tencent Cloud. Provider-specific
+credentials are entered through masked prompts and validated before planning.
+
+Credentials are encrypted with AES-256-GCM using a key derived from a user
+master password and stored at `~/.hwcode/cloud/credentials.enc` with user-only
+permissions. They are never added to model context or uploaded to an HWCode
+service. Authentication necessarily sends them to the selected provider's
+official endpoint or CLI. Google credential JSON is materialized only in a
+user-only temporary file for the duration of a command. Azure CLI authentication
+uses an isolated temporary configuration directory that is removed after each
+command.
+
+Multiple credential profiles can be saved for the same provider. On the next
+Cloud workflow, HWCode offers each existing profile as
+`使用已有凭据 [n] · Region: <region>` plus `新建凭据`; only the region and an
+ordinal are displayed. Legacy vaults containing one credential per provider are
+migrated in memory and written in the multi-profile format after the next
+successful validation.
+
+Cloud and infrastructure commands run through a credential-isolated tool.
+Read-only calls run directly. Account-resource creates and changes require user
+confirmation unless the user approves remaining non-delete changes for the
+session. Resource deletion is always confirmed. After three genuinely distinct
+technical approaches fail, the workflow stops and reports causes, progress,
+remaining resources, and local changes instead of attempting a fourth approach.
+
+After at least one cloud command succeeds, run
+`/hwcode-cloud-save-template [name]` to save the objective, validated execution
+sequence, and optional lessons learned as a local Prompt Template. Templates are
+stored under `~/.hwcode/cloud/prompts/` with user-only permissions. Credential
+values are excluded and redacted before steps are persisted.
+
+Use `/hwcode-cloud-template [additional instructions]` to select and start a
+saved template immediately. `/hwcode-cloud` also offers saved templates when it
+starts without an inline request. The files use a Pi-compatible
+Markdown/frontmatter format, but HWCode intentionally keeps them out of Pi
+resource discovery so each saved template does not become another slash
+command. Templates are extension-private resources and always run through the
+fixed `/hwcode-cloud-template` entry point, preserving credential isolation and
+Cloud approval guards.
+
+## Internal architecture
+
+Extensions under `.pi/extensions/` are Pi-facing adapters: they register events,
+commands, tools, and UI. Reusable behavior lives under `.pi/lib/`:
+
+- `runtime/` owns layered/replacing configuration and session-state primitives.
+- `workflows/` owns the shared Vibe/SDD/Cloud lifecycle schema.
+- `workspace/` owns tool and command path-boundary decisions.
+- `cloud/` owns provider adapters, isolated processes, and prompt templates.
+- `context/` and `models/` own compaction and provider-configuration policy.
+
+`settings.json` is layered as defaults → profile → project for settings such as
+context and hidden commands. `welcome.json` uses a single replacing resource.
+`model-providers.json` is deliberately package-scoped so a project cannot
+silently replace login providers or reintroduce machine-local defaults.
+
 ## Working directory
 
 Use `/cd <path>` to change the working directory without starting a new
@@ -133,6 +187,44 @@ command. Restart Pi or manually enter `/reload` after changing the list.
 This setting controls visibility, not capability. A hidden command can still be
 entered manually when it is needed.
 
+## Context and compaction
+
+HWCode defaults locally configured and dynamically discovered models to a
+1,000,000-token context window and caps configured or provider-reported values
+at that limit. If an OpenAI-compatible model catalog reports a smaller
+`context_window`, `context_length`, `max_context_length`, `max_model_len`, or
+`n_ctx`, the smaller server value wins. The package-scoped provider's
+`modelDefaults.contextWindow` can also select a smaller limit for dynamically
+discovered models.
+
+The default context policy is configured under `hwcode.context` in
+`.pi/settings.json`:
+
+```json
+{
+  "compaction": {
+    "enabled": true,
+    "reserveTokens": 80000,
+    "keepRecentTokens": 220000
+  },
+  "hwcode": {
+    "context": {
+      "defaultContextWindow": 1000000,
+      "maxContextWindow": 1000000,
+      "compactionTriggerTokens": 920000,
+      "compactionTargetTokens": 300000,
+      "compactionOverheadTokens": 80000
+    }
+  }
+}
+```
+
+For a 1M model, HWCode starts compaction around 920K and retains up to 220K of
+recent messages, reserving 80K for the system prompt, tools, and summary so the
+result remains within the 300K target. The policy scales proportionally for
+smaller models. A single indivisible message larger than the target cannot be
+silently truncated; HWCode keeps it and displays a warning instead.
+
 ## Project resources
 
 - `AGENTS.md`: project-wide working rules

package/bin/hwcode.js

@@ -15,15 +15,85 @@ const piCli = join(
 	"dist",
 	"cli.js",
 );
+const packageJson = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
 const userArgs = process.argv.slice(2);
+
+function helpText() {
+	return `HWCode ${packageJson.version} — 可定制的终端 AI 编程助手
+
+用法:
+  hwcode [选项] [@文件...] [指令...]
+  hwcode <管理命令> [选项]
+
+启动与会话:
+  hwcode                         在当前目录启动交互式 TUI
+  hwcode "分析这个项目"          启动并发送首条指令
+  hwcode -p "列出所有 API"       非交互执行一次任务
+  hwcode -c                      继续当前项目最近一次会话
+  hwcode -r                      选择历史会话恢复
+  hwcode --session <路径或 ID>   打开指定会话
+  hwcode --no-session            使用不落盘的临时会话
+
+模型选项:
+  --provider <名称>              指定模型提供商
+  --model <名称>                 指定模型，支持 provider/model
+  --models <模式列表>            限定模型切换范围
+  --api-key <密钥>               为本次运行提供 API Key
+  --thinking <级别>              off|minimal|low|medium|high|xhigh|max
+
+运行模式与工具:
+  -p, --print                    非交互模式，完成后退出
+  --mode <模式>                  text|json|rpc
+  --tools <工具列表>             只启用指定工具
+  --exclude-tools <工具列表>     禁用指定工具
+  --no-tools                     禁用全部工具
+  --tui-mode <模式>              fullscreen|regular
+  --offline                      禁止启动时的网络操作
+  -a, --approve                  本次运行信任项目本地资源
+  -na, --no-approve              本次运行忽略项目本地资源
+
+HWCode 交互命令:
+  /hwcode-vibe [需求]            启动持续对话式 Vibe Coding workflow
+  /hwcode-sdd [需求]             启动测试优先的 Spec-Driven workflow
+  /hwcode-cloud [需求]           启动凭据隔离、变更审批的云部署 workflow
+  /hwcode-cloud-template [补充]  从本地成功模板启动 Cloud workflow
+  /hwcode-cloud-save-template    将成功执行路径保存为本地 Prompt Template
+  /cd <目录>                     持久切换当前会话工作目录
+  /model                         选择模型
+  /login                         登录或配置模型提供商
+  /new                           新建会话
+  /resume                        恢复历史会话
+
+管理命令:
+  auth <命令>                    查看认证状态或读取凭据
+  config                         管理已安装的资源
+  install <来源>                 安装扩展包
+  remove <来源>                  移除扩展包
+  update [来源]                  更新扩展或运行时
+  list                           列出已安装扩展
+
+其他选项:
+  -h, --help                     显示此帮助
+  -v, --version                  显示 HWCode 版本
+
+示例:
+  hwcode
+  hwcode --model hw/Qwen3.5-9B-Q4_K_M
+  hwcode -p "总结当前代码库"
+  hwcode @README.md "检查文档是否完整"
+
+项目中的 .env 会自动加载；模型 Provider 使用 HWCode 发布配置，其余项目本地 .pi 资源照常生效。`;
+}
+
+if (userArgs[0] === "--help" || userArgs[0] === "-h") {
+	console.log(helpText());
+	process.exit(0);
+}
 if (userArgs[0] === "--version" || userArgs[0] === "-v") {
-	const packageJson = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
 	console.log(packageJson.version);
 	process.exit(0);
 }
 const piManagementCommands = new Set([
-	"--help",
-	"-h",
 	"auth",
 	"config",
 	"install",
@@ -44,6 +114,8 @@ const profileArgs = [
 
 for (const extension of [
 	"command-filter.ts",
+	"cloud.ts",
+	"context-policy.ts",
 	"cwd.ts",
 	"footer-tps.ts",
 	"hwcode.ts",
@@ -54,7 +126,7 @@ for (const extension of [
 	profileArgs.push("--extension", join(profileDirectory, "extensions", extension));
 }
 
-for (const skill of ["hwcode-vibe", "hwcode-sdd"]) {
+for (const skill of ["hwcode-vibe", "hwcode-sdd", "hwcode-cloud"]) {
 	profileArgs.push("--skill", join(profileDirectory, "skills", skill));
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadooppei/hwcode",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "A customizable terminal coding agent with local-model support and HWCode workflows.",
   "type": "module",
   "bin": {
@@ -10,15 +10,14 @@
     "bin/hwcode.js",
     ".env.example",
     ".pi/APPEND_SYSTEM.md",
+    ".pi/settings.json",
     ".pi/extensions",
-    ".pi/lib/command-filter.ts",
-    ".pi/lib/pixel-font.ts",
-    ".pi/lib/welcome-input.ts",
-    ".pi/lib/workflow-guard.ts",
-    ".pi/lib/working-directory.ts",
+    ".pi/lib",
+    "!.pi/lib/*.test.ts",
     ".pi/model-providers.json",
     ".pi/skills/hwcode-sdd",
     ".pi/skills/hwcode-vibe",
+    ".pi/skills/hwcode-cloud",
     ".pi/welcome.json",
     "README.md"
   ],
@@ -27,7 +26,7 @@
     "pi": "node --env-file-if-exists=.env ./bin/hwcode.js",
     "test": "node --test .pi/lib/*.test.ts",
     "test:workflows": "npm test",
-    "prepack": "npm test"
+    "prepack": "npm test && node scripts/audit-package.mjs"
   },
   "engines": {
     "node": ">=22.19.0"
@@ -46,6 +45,8 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.84.2"
+    "@earendil-works/pi-ai": "0.84.2",
+    "@earendil-works/pi-coding-agent": "0.84.2",
+    "@earendil-works/pi-tui": "0.84.2"
   }
 }