@hadooppei/hwcode 0.2.1 → 1.0.0

package/.pi/extensions/hwcode.ts

@@ -1,10 +1,43 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { WORKFLOW_STATE_TYPE, activeWorkflow, updateWorkflowState, workflowLabel, type WorkflowState } from "../lib/workflows/state.ts";
 
 export default function hwcodeExtension(pi: ExtensionAPI) {
   pi.registerCommand("hwcode", {
-    description: "Show whether the HWCode project profile is active",
+    description: "Show, complete, or cancel the active HWCode workflow",
     handler: async (_args, ctx) => {
-      ctx.ui.notify("HWCode project profile is active.", "info");
+      const state = activeWorkflow(ctx.sessionManager.getEntries());
+      if (!state) {
+        ctx.ui.notify("HWCode profile is active; no workflow is running in this session.", "info");
+        return;
+      }
+      const choice = await ctx.ui.select(
+        `${workflowLabel(state.mode)} · ${state.phase} · ${state.root}`,
+        ["查看状态", "标记完成", "取消 workflow", "返回"],
+      );
+      if (!choice || choice === "返回") return;
+      if (choice === "查看状态") {
+		const cloud = state.mode === "cloud" && state.details
+			? ` Successful steps: ${state.details.successfulSteps.length}; failed strategies: ${state.details.failedApproaches.length}; active created resources: ${(state.details.resources ?? []).filter((resource) => resource.ownership === "workflow-created" && resource.status === "active").length}.`
+			: "";
+		const sdd = state.mode === "sdd" && state.sdd ? ` SDD phase: ${state.sdd.phase}; approvals: ${state.sdd.approvals.length}.` : "";
+        ctx.ui.notify(`${workflowLabel(state.mode)} is active. Root: ${state.root}; phase: ${state.phase}.${cloud}${sdd}`, "info");
+        return;
+      }
+      const status = choice === "标记完成" ? "completed" : "cancelled";
+      if (status === "completed" && state.mode === "sdd" && state.sdd?.phase !== "verification") {
+        ctx.ui.notify(`SDD 当前处于 ${state.sdd?.phase ?? "unknown"}，只有完成 verification 阶段后才能标记完成；如需提前退出请选择取消 workflow。`, "warning");
+        return;
+      }
+      const activeCreatedResources = state.mode === "cloud" ? (state.details?.resources ?? []).filter((resource) => resource.ownership === "workflow-created" && resource.status === "active") : [];
+      const warning = activeCreatedResources.length > 0
+        ? `仍有 ${activeCreatedResources.length} 个 workflow 创建的资源处于 active：\n${activeCreatedResources.slice(0, 10).map((resource) => `• ${resource.type} ${resource.id} (${resource.region})`).join("\n")}\n\n结束不会自动删除它们。请确认这些资源需要保留，或先完成逐项确认的清理。`
+		: state.mode === "cloud" && state.details?.runnerPreference === "automatic"
+			? "该 Cloud workflow 请求过临时 Runner，但资源清单中没有可确认的活动记录。结束前请确认 Runner 创建是否成功以及是否已经清理。"
+        : "结束后本 session 将解除 workflow 目录与执行限制。";
+      if (!await ctx.ui.confirm(status === "completed" ? "确认 workflow 已完成？" : "确认取消 workflow？", warning)) return;
+      const updated = updateWorkflowState(state, { status, phase: status, reason: status === "completed" ? "user confirmed completion" : "user cancelled workflow" });
+      pi.appendEntry<WorkflowState>(WORKFLOW_STATE_TYPE, updated);
+      ctx.ui.notify(`${workflowLabel(state.mode)} ${status}.`, "info");
     },
   });
 }

package/.pi/extensions/model-providers.ts

@@ -212,7 +212,6 @@ function registerStaticProvider(
     baseUrl,
     api: "openai-completions",
     apiKey,
-    compat: compatibility(),
     models: (config.models ?? []).map((model) => {
       const contextWindow = resolveContextWindow(
         model.contextWindow ?? config.modelDefaults?.contextWindow,
@@ -372,7 +371,7 @@ function createLoginProvider(
         update: () => { models = refreshed; },
       });
     },
-    stream: (model, context, options) => stream(model, context, options),
+    stream: (model, context, options) => stream(model, context, options as Parameters<typeof stream>[2]),
     streamSimple: (model, context, options) => streamSimple(model, context, options),
   };
 }

package/.pi/extensions/workflows/cloud/activation.ts

@@ -0,0 +1,235 @@
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+
+import type { ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
+
+import { modelConfigurationIssue } from "../../../lib/models/readiness.ts";
+import { CLOUD_RUNTIME_DEFAULTS } from "../../../lib/runtime/defaults.ts";
+import { remoteRunnerPaths, userRuntimePaths } from "../../../lib/runtime/paths.ts";
+import { canonicalizeWorkspaceRoot } from "../../../lib/workflow-guard.ts";
+import { getWorkingDirectory } from "../../../lib/working-directory.ts";
+import { checkProviderCli, formatValidationFailure, validateCloudCredentials } from "../../../lib/workflows/cloud/adapters.ts";
+import { cloudDeploymentTemplateSource, listCloudDeploymentTemplates, materializeCloudDeploymentTemplate, type CloudDeploymentTemplate } from "../../../lib/workflows/cloud/bundles.ts";
+import { CLOUD_PROVIDERS, getCloudProvider, inaccessibleCloudCliMessage, missingCloudCliMessage, type CloudCredentials, type CloudVendorId } from "../../../lib/workflows/cloud/providers.ts";
+import { connectRemoteTarget } from "../../../lib/workflows/cloud/remote/connect.ts";
+import { remoteTargetLabel, remoteTargetSummary, type RemoteTargetProfile } from "../../../lib/workflows/cloud/remote/profiles.ts";
+import { cloudPromptTemplateSource, expandCloudPromptTemplate, listCloudPromptTemplates, type CloudPromptTemplate } from "../../../lib/workflows/cloud/templates.ts";
+import {
+  cloudCredentialProfileLabel, defaultCloudVaultPath, listCloudCredentialProfiles,
+  listRemoteTargetProfiles, saveCloudCredentialProfile, saveRemoteTargetProfile,
+  writeCloudVault, type CloudCredentialProfile,
+} from "../../../lib/workflows/cloud/vault.ts";
+import { createCloudRunWorkspace } from "../../../lib/workflows/cloud/workspace.ts";
+import { activeWorkflow, createCloudWorkflowState, type CloudWorkflowDetails, type WorkflowState } from "../../../lib/workflows/state.ts";
+import type { CloudExtensionRuntime } from "./runtime.ts";
+import {
+  activationPrompt, cloudDetails, collectCredentials, formatTemplateTime, notify,
+  remoteTrustInteraction, restoreCloudWorkflow, restoreLegacyCloudWorkflow, unlockVault,
+} from "./shared.ts";
+
+type RunnerSelection =
+  | { kind: "cancel" }
+  | { kind: "automatic" }
+  | { kind: "deferred" }
+  | { kind: "profile"; profile: RemoteTargetProfile };
+
+async function chooseRunner(ctx: ExtensionCommandContext, payload: ReturnType<typeof import("../../../lib/workflows/cloud/vault.ts").createEmptyVault>, vendor: CloudVendorId, root: string, region: string): Promise<RunnerSelection> {
+  const existing = listRemoteTargetProfiles(payload).filter((profile) => profile.vendor === vendor);
+  const labels = existing.map(remoteTargetLabel);
+  const automatic = "自动创建临时 Terraform Runner（推荐）";
+  const connect = "连接已有 SSH 主机";
+  const choice = await ctx.ui.select("Terraform Runner 来源", [automatic, ...labels, connect, "暂不使用 Terraform Runner", "取消"]);
+  if (!choice || choice === "取消") return { kind: "cancel" };
+  if (choice === automatic) return { kind: "automatic" };
+  if (choice === "暂不使用 Terraform Runner") return { kind: "deferred" };
+  const index = labels.indexOf(choice);
+  if (index >= 0) return { kind: "profile", profile: existing[index]! };
+  const home = homedir();
+  const defaultKey = CLOUD_RUNTIME_DEFAULTS.runner.keyCandidates.map((file) => resolve(home, ".ssh", file)).find(existsSync)
+    ?? resolve(home, ".ssh", CLOUD_RUNTIME_DEFAULTS.runner.keyCandidates[0]!);
+  const host = (await ctx.ui.input("Runner 公网地址或 DNS", "例如 203.0.113.10"))?.trim();
+  const user = (await ctx.ui.input("SSH 用户", CLOUD_RUNTIME_DEFAULTS.runner.defaultUser))?.trim();
+  if (!host || !user) { notify(ctx, "SSH 地址或用户为空，未保存 Runner。", "warning"); return { kind: "cancel" }; }
+  const identity = await ctx.ui.select("Runner 云身份", ["已配置实例角色/Agency（可执行 Terraform）", "仅 SSH（只连接，不允许云部署）"]);
+  if (!identity) return { kind: "cancel" };
+  try {
+    return { kind: "profile", profile: await connectRemoteTarget({
+      id: `runner-${vendor}-${Date.now()}`,
+      name: `${vendor}-ssh-${host.replace(/[^a-z0-9]+/giu, "-").slice(0, 32)}`,
+      vendor, region: region || "default", host,
+      port: CLOUD_RUNTIME_DEFAULTS.runner.defaultPort, user, keyPath: defaultKey,
+      knownHostsPath: userRuntimePaths(home).cloudKnownHosts,
+      remoteRoot: remoteRunnerPaths(user).root,
+      identityType: identity.startsWith("已配置") ? "agency" : "ssh-only",
+    }, root, remoteTrustInteraction(ctx)) };
+  } catch (error) {
+    notify(ctx, `Runner 配置无效：${error instanceof Error ? error.message : String(error)}`, "error");
+    return { kind: "cancel" };
+  }
+}
+
+async function ensureConversationModel(ctx: ExtensionCommandContext): Promise<boolean> {
+  let environment: Record<string, string | undefined> = {};
+  if (ctx.model) {
+    try { environment = (await ctx.modelRegistry.getProviderAuth(ctx.model.provider))?.env ?? {}; }
+    catch { /* The readiness check below reports the actionable configuration error. */ }
+  }
+  const issue = modelConfigurationIssue(ctx.model, environment);
+  if (!issue) return true;
+  notify(ctx, `${issue}。HWCode 不会替你选择或覆盖默认模型；请先使用 Pi 原生 /model 切换模型，或补全该 provider 的 endpoint 配置。`, "error");
+  return false;
+}
+
+export async function choosePromptTemplate(ctx: ExtensionCommandContext): Promise<CloudPromptTemplate | undefined> {
+  const templates = listCloudPromptTemplates();
+  if (templates.length === 0) { notify(ctx, "还没有本地 Cloud Prompt Template。成功执行任务后使用 /hwcode-cloud-save-template 保存。", "warning"); return undefined; }
+  const labels = templates.map((template) => `${template.name} · ${formatTemplateTime(template.updatedAt)}`);
+  const selected = await ctx.ui.select("选择已验证的 Cloud Prompt Template", labels);
+  const index = selected ? labels.indexOf(selected) : -1;
+  return index >= 0 ? templates[index] : undefined;
+}
+
+export async function chooseDeploymentTemplate(ctx: ExtensionCommandContext): Promise<CloudDeploymentTemplate | undefined> {
+  const templates = listCloudDeploymentTemplates();
+  if (templates.length === 0) { notify(ctx, "还没有 Terraform Deployment Template。成功 apply 后使用 /hwcode-cloud-save-template 保存。", "warning"); return undefined; }
+  const labels = templates.map((template) => `${template.manifest.name} · ${template.manifest.vendor} · ${formatTemplateTime(template.manifest.updatedAt)}`);
+  const selected = await ctx.ui.select("选择 Terraform Deployment Template", labels);
+  const index = selected ? labels.indexOf(selected) : -1;
+  return index >= 0 ? templates[index] : undefined;
+}
+
+export async function activateCloudWorkflow(runtime: CloudExtensionRuntime, args: string, ctx: ExtensionCommandContext, initialTemplate?: CloudPromptTemplate, initialBundle?: CloudDeploymentTemplate): Promise<void> {
+  if (ctx.mode !== "tui") { notify(ctx, "HWCode Cloud 要求在交互式 TUI 中启动，以安全遮罩凭据输入。", "error"); return; }
+  if (!ctx.isIdle()) { notify(ctx, "请等待当前响应完成后再启动 HWCode Cloud。", "warning"); return; }
+  if (!(await ensureConversationModel(ctx))) return;
+
+  const root = canonicalizeWorkspaceRoot(getWorkingDirectory(ctx.sessionManager));
+  const currentWorkflow = activeWorkflow(ctx.sessionManager.getEntries());
+  if (currentWorkflow && currentWorkflow.mode !== "cloud") {
+    notify(ctx, `当前会话已有 ${currentWorkflow.mode} workflow。请新建 session 后再启动 HWCode Cloud。`, "warning");
+    return;
+  }
+  const storedState = restoreCloudWorkflow(ctx) ?? restoreLegacyCloudWorkflow(ctx);
+  let resumedState: WorkflowState | undefined;
+  if (storedState && storedState.root === root && !cloudDetails(storedState)?.terminalFailure) {
+    const storedDetails = cloudDetails(storedState)!;
+    const choice = await ctx.ui.select("发现当前会话中未完成的 HWCode Cloud workflow", [
+      `恢复 ${getCloudProvider(storedDetails.vendor).label}：${storedDetails.request.slice(0, 60)}`,
+      "开始新的 Cloud workflow", "取消",
+    ]);
+    if (!choice || choice === "取消") return;
+    if (choice.startsWith("恢复 ")) resumedState = storedState;
+  }
+
+  let template = initialTemplate;
+  if (!resumedState && !template && !initialBundle && !args.trim() && (listCloudPromptTemplates().length > 0 || listCloudDeploymentTemplates().length > 0)) {
+    const source = await ctx.ui.select("Cloud 任务来源", ["新建任务", "使用已有 Prompt Template", "使用 Terraform Deployment Template", "取消"]
+      .filter((item) => item !== "使用已有 Prompt Template" || listCloudPromptTemplates().length > 0)
+      .filter((item) => item !== "使用 Terraform Deployment Template" || listCloudDeploymentTemplates().length > 0));
+    if (!source || source === "取消") return;
+    if (source === "使用已有 Prompt Template") { template = await choosePromptTemplate(ctx); if (!template) return; }
+    if (source === "使用 Terraform Deployment Template") { initialBundle = await chooseDeploymentTemplate(ctx); if (!initialBundle) return; }
+  }
+
+  let vendor: CloudVendorId;
+  let deployCurrentProject: boolean;
+  let request: string;
+  let templateGuidance: string | undefined;
+  if (resumedState) {
+    const details = cloudDetails(resumedState)!;
+    ({ vendor, deployCurrentProject, request } = details);
+  } else if (initialBundle) {
+    vendor = initialBundle.manifest.vendor;
+    deployCurrentProject = true;
+    request = `复用 Terraform Deployment Template「${initialBundle.manifest.name}」并完成其验证、计划与部署`;
+    templateGuidance = existsSync(initialBundle.summaryPath) ? readFileSync(initialBundle.summaryPath, "utf8") : `sourceDigest=${initialBundle.manifest.sourceDigest}`;
+  } else if (template) {
+    vendor = template.vendor;
+    deployCurrentProject = template.deployCurrentProject;
+    request = template.objective || template.name;
+    templateGuidance = expandCloudPromptTemplate(template, args);
+  } else {
+    const label = await ctx.ui.select("选择需要对接的云计算厂商", CLOUD_PROVIDERS.map((provider) => provider.label));
+    if (!label) return;
+    vendor = CLOUD_PROVIDERS.find((provider) => provider.label === label)!.id;
+    const deployment = await ctx.ui.select("是否部署当前项目？", ["是，部署当前项目", "否，执行其他云任务"]);
+    if (!deployment) return;
+    deployCurrentProject = deployment.startsWith("是");
+    const entered = (await ctx.ui.editor("描述需要执行的具体需求", args.trim()))?.trim();
+    if (!entered) { notify(ctx, "必须提供明确的云任务需求，HWCode Cloud 未启动。", "warning"); return; }
+    request = entered;
+  }
+
+  const vendorLabel = getCloudProvider(vendor).label;
+  const cliCheck = await checkProviderCli(vendor, root);
+  if (cliCheck.spawnErrorCode === "ENOENT") { notify(ctx, missingCloudCliMessage(vendor), "error"); return; }
+  if (cliCheck.spawnErrorCode === "EACCES") { notify(ctx, inaccessibleCloudCliMessage(vendor), "error"); return; }
+
+  const vaultPath = defaultCloudVaultPath();
+  if (!(await ctx.ui.confirm("安全保存云账户信息？", [
+    `当前项目根目录将锁定为：\n${root}`,
+    `凭据将使用主密码派生密钥，以 AES-256-GCM 加密保存到：\n${vaultPath}`,
+    "文件权限限制为当前用户读写，不会发送给模型或上传至 HWCode 服务。",
+    "连接校验和后续命令只会把凭据提交给所选云厂商的官方认证端点或 CLI。",
+    "如果忘记主密码，加密凭据无法恢复。",
+  ].join("\n\n")))) return;
+
+  const unlocked = await unlockVault(ctx);
+  if (!unlocked) return;
+  const profiles = listCloudCredentialProfiles(unlocked.payload, vendor);
+  let selectedProfile: CloudCredentialProfile | undefined;
+  let credentials: CloudCredentials | undefined;
+  if (profiles.length > 0) {
+    const labels = profiles.map((profile, index) => cloudCredentialProfileLabel(profile, index, profiles.length));
+    const choice = await ctx.ui.select(`选择 ${vendorLabel} 凭据`, [...labels, "新建凭据", "取消"]);
+    if (!choice || choice === "取消") return;
+    const selectedIndex = labels.indexOf(choice);
+    if (selectedIndex >= 0) { selectedProfile = profiles[selectedIndex]; credentials = { ...selectedProfile.credentials }; }
+  }
+  while (true) {
+    credentials ??= await collectCredentials(vendor, root, ctx);
+    if (!credentials) return;
+    notify(ctx, `正在校验 ${vendorLabel} 连接…`);
+    const validation = await validateCloudCredentials(vendor, { root, credentials, temporaryStore: runtime.temporaryStore });
+    if (validation.code === 0) break;
+    if (validation.spawnErrorCode === "ENOENT") { notify(ctx, missingCloudCliMessage(vendor), "error"); return; }
+    if (validation.spawnErrorCode === "EACCES") { notify(ctx, inaccessibleCloudCliMessage(vendor), "error"); return; }
+    notify(ctx, `连接校验失败：${formatValidationFailure(validation, credentials)}`, "error");
+    if (!(await ctx.ui.confirm("重新输入账户信息？", "连接尚未建立。请检查凭据、账号状态、网络及对应云 CLI。"))) return;
+    credentials = undefined;
+  }
+
+  let vaultPayload = saveCloudCredentialProfile(unlocked.payload, vendor, credentials, selectedProfile?.id);
+  const existingRunnerId = resumedState ? cloudDetails(resumedState)?.runner?.id : undefined;
+  runtime.activeRunner = existingRunnerId ? listRemoteTargetProfiles(vaultPayload).find((profile) => profile.id === existingRunnerId) : undefined;
+  let runnerPreference: CloudWorkflowDetails["runnerPreference"] = runtime.activeRunner ? "existing" : resumedState ? cloudDetails(resumedState)?.runnerPreference : undefined;
+  if (!runtime.activeRunner) {
+    const selection = await chooseRunner(ctx, vaultPayload, vendor, root, credentials.region ?? "");
+    if (selection.kind === "cancel") return;
+    if (selection.kind === "profile") { runtime.activeRunner = selection.profile; runnerPreference = "existing"; }
+    else runnerPreference = selection.kind;
+  }
+  if (runtime.activeRunner && !listRemoteTargetProfiles(vaultPayload).some((profile) => profile.id === runtime.activeRunner!.id)) {
+    vaultPayload = saveRemoteTargetProfile(vaultPayload, runtime.activeRunner);
+  }
+  writeCloudVault(vaultPayload, unlocked.password, vaultPath);
+  runtime.activeVault = { password: unlocked.password, payload: vaultPayload, path: vaultPath };
+  runtime.cleanupCredentialDirectories();
+  runtime.activeCredentials = credentials;
+  const artifactWorkspace = resumedState ? undefined : createCloudRunWorkspace(root);
+  const materializedBundle = initialBundle && artifactWorkspace ? materializeCloudDeploymentTemplate(initialBundle, artifactWorkspace.path) : undefined;
+  runtime.activeState = resumedState ?? createCloudWorkflowState(
+    root, vendor, deployCurrentProject, request,
+    (template || initialBundle) && templateGuidance ? {
+      source: initialBundle ? cloudDeploymentTemplateSource(initialBundle) : cloudPromptTemplateSource(template!),
+      guidance: templateGuidance,
+    } : undefined,
+    artifactWorkspace?.path,
+  );
+  if (initialBundle && !resumedState) runtime.activeState = runtime.replaceDetails(runtime.activeState, { ...cloudDetails(runtime.activeState)!, terraformSourcePath: materializedBundle!.terraformPath }, runtime.activeState.phase);
+  if (runtime.activeRunner) runtime.activeState = runtime.replaceDetails(runtime.activeState, { ...cloudDetails(runtime.activeState)!, runnerPreference, runner: remoteTargetSummary(runtime.activeRunner) }, runtime.activeState.phase);
+  else runtime.activeState = runtime.replaceDetails(runtime.activeState, { ...cloudDetails(runtime.activeState)!, runnerPreference }, runtime.activeState.phase);
+  notify(ctx, `${vendorLabel} 连接成功。凭据已加密保存，项目根目录锁定为 ${root}。`);
+  runtime.pi.sendUserMessage(activationPrompt(runtime.activeState), { expandPromptTemplates: true });
+}

package/.pi/extensions/workflows/cloud/commands.ts

@@ -0,0 +1,96 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+
+import { cloudDeploymentTemplateSource, listCloudDeploymentTemplates, saveCloudDeploymentTemplate, updateCloudDeploymentTemplate } from "../../../lib/workflows/cloud/bundles.ts";
+import { redactCredentialValues } from "../../../lib/workflows/cloud/providers.ts";
+import { saveCloudWorkflowTemplate } from "../../../lib/workflows/cloud/template-save.ts";
+import { listCloudPromptTemplates, saveCloudPromptTemplate, updateCloudPromptTemplate } from "../../../lib/workflows/cloud/templates.ts";
+import { activateCloudWorkflow, chooseDeploymentTemplate, choosePromptTemplate } from "./activation.ts";
+import type { CloudExtensionRuntime } from "./runtime.ts";
+import { cloudDetails, formatTemplateTime, notify } from "./shared.ts";
+
+export function registerCloudCommands(pi: ExtensionAPI, runtime: CloudExtensionRuntime): void {
+  pi.registerCommand("hwcode-cloud", {
+    description: "Start or resume the guarded HWCode cloud workflow",
+    handler: (args, ctx) => activateCloudWorkflow(runtime, args, ctx),
+  });
+
+  pi.registerCommand("hwcode-cloud-template", {
+    description: "Start HWCode Cloud from a locally saved prompt or Terraform deployment template",
+    handler: async (args, ctx) => {
+      const promptTemplates = listCloudPromptTemplates();
+      const deploymentTemplates = listCloudDeploymentTemplates();
+      const source = await ctx.ui.select("选择本地 Cloud Template 类型", [
+        ...(promptTemplates.length > 0 ? ["Prompt Template"] : []),
+        ...(deploymentTemplates.length > 0 ? ["Terraform Deployment Template"] : []),
+        "取消",
+      ]);
+      if (source === "Prompt Template") {
+        const template = await choosePromptTemplate(ctx);
+        if (template) await activateCloudWorkflow(runtime, args, ctx, template);
+      } else if (source === "Terraform Deployment Template") {
+        const bundle = await chooseDeploymentTemplate(ctx);
+        if (bundle) await activateCloudWorkflow(runtime, args, ctx, undefined, bundle);
+      }
+    },
+  });
+
+  pi.registerCommand("hwcode-cloud-save-template", {
+    description: "Save or update the successful Cloud path as a Prompt or Terraform Deployment Template",
+    handler: async (args, ctx) => {
+      const activeState = runtime.restore(ctx);
+      const details = activeState && cloudDetails(activeState);
+      if (!activeState || !details || (details.successfulSteps.length === 0 && details.terraformRun?.phase !== "applied")) {
+        notify(ctx, "当前 Cloud workflow 还没有成功执行步骤，无法生成可复用模板。", "warning");
+        return;
+      }
+      if (details.terraformRun?.phase === "applied" && details.terraformRun.sourcePath) {
+        const existing = details.sourceTemplate?.kind === "terraform"
+          ? listCloudDeploymentTemplates().find((template) => template.manifest.id === details.sourceTemplate?.id)
+          : undefined;
+        let action: "update" | "create" = "create";
+        if (existing) {
+          const choice = await ctx.ui.select(`当前会话关联模板「${existing.manifest.name}」`, ["更新原模板", "创建新模板", "取消"]);
+          if (!choice || choice === "取消") return;
+          action = choice === "更新原模板" ? "update" : "create";
+        }
+        const name = (action === "update" ? existing!.manifest.name : args.trim() || await ctx.ui.input("Terraform Deployment Template 名称", `${details.vendor}-${new Date().toISOString().slice(0, 10)}`))?.trim();
+        if (!name) return;
+        try {
+          const template = action === "update"
+            ? updateCloudDeploymentTemplate(existing!, details.terraformRun.sourcePath, activeState, new Date(), details.artifactDirectory)
+            : saveCloudDeploymentTemplate(name, details.terraformRun.sourcePath, activeState, undefined, new Date(), details.artifactDirectory);
+          runtime.replaceDetails(activeState, { ...details, sourceTemplate: cloudDeploymentTemplateSource(template) });
+          notify(ctx, `${action === "update" ? "已更新" : "已保存"} Terraform Deployment Template「${template.manifest.name}」，包含完整性清单、Terraform、Helm、脱敏 discovery/reports 与验证摘要。`);
+        } catch (error) {
+          notify(ctx, `Terraform Deployment Template 保存失败：${error instanceof Error ? error.message : String(error)}`, "error");
+        }
+        return;
+      }
+
+      const result = await saveCloudWorkflowTemplate({
+        state: activeState,
+        requestedName: args,
+        redact: runtime.activeCredentials ? (value) => redactCredentialValues(value, runtime.activeCredentials!) : undefined,
+        interaction: {
+          async chooseSourceAction(source) {
+            const updateLabel = `更新原模板「${source.name}」`;
+            const choice = await ctx.ui.select(`当前会话关联模板「${details.sourceTemplate?.name ?? source.name}」`, [updateLabel, "创建新模板", "取消"]);
+            if (!choice || choice === "取消") return "cancel";
+            return choice === updateLabel ? "update" : "create";
+          },
+          inputName: (defaultName) => ctx.ui.input("模板名称", defaultName),
+          editNotes: (initialNotes) => ctx.ui.editor("补充必要前置条件、成功经验及必须避免的高消耗错误路径（可留空；不得包含凭据）", initialNotes),
+          sourceMissing(sourceName) { notify(ctx, `本次使用的原模板「${sourceName}」已不存在，将创建新模板。`, "warning"); },
+        },
+        store: {
+          list: () => listCloudPromptTemplates(),
+          create: (name, state, notes) => saveCloudPromptTemplate(name, state, undefined, notes),
+          update: (template, state, notes) => updateCloudPromptTemplate(template, state, notes),
+        },
+      });
+      if (result.status === "cancelled") return;
+      runtime.replaceDetails(activeState, result.details);
+      notify(ctx, `${result.action === "updated" ? "已更新" : "已创建"}模板「${result.template.name}」（${formatTemplateTime(result.template.updatedAt)}）。使用 /hwcode-cloud-template 可立即复用。`);
+    },
+  });
+}

package/.pi/extensions/workflows/cloud/events.ts

@@ -0,0 +1,58 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+
+import { CLOUD_RUNTIME_DEFAULTS } from "../../../lib/runtime/defaults.ts";
+import { canonicalizeWorkspaceRoot } from "../../../lib/workflow-guard.ts";
+import { getWorkingDirectory } from "../../../lib/working-directory.ts";
+import { containsCloudCommand, getCloudProvider } from "../../../lib/workflows/cloud/providers.ts";
+import { updateWorkflowState } from "../../../lib/workflows/state.ts";
+import type { CloudExtensionRuntime } from "./runtime.ts";
+import {
+  appendWorkflowState, cloudArtifactDirectory, cloudDetails, notify,
+  restoreLegacyCloudWorkflow,
+} from "./shared.ts";
+
+export function registerCloudEvents(pi: ExtensionAPI, runtime: CloudExtensionRuntime): void {
+  pi.on("session_start", async (_event, ctx) => {
+    runtime.restore(ctx);
+    if (!runtime.activeState) {
+      runtime.activeState = restoreLegacyCloudWorkflow(ctx);
+      if (runtime.activeState) appendWorkflowState(pi, runtime.activeState);
+    }
+    runtime.clearSecrets();
+    if (!runtime.activeState) return;
+    const root = canonicalizeWorkspaceRoot(getWorkingDirectory(ctx.sessionManager));
+    if (root !== runtime.activeState.root) {
+      appendWorkflowState(pi, updateWorkflowState(runtime.activeState, { status: "cancelled", phase: "root-changed", reason: "working directory changed" }));
+      runtime.activeState = undefined;
+      notify(ctx, "Stored HWCode Cloud workflow disabled because the current directory changed.", "warning");
+      return;
+    }
+    const details = cloudDetails(runtime.activeState)!;
+    if (!details.terminalFailure) notify(ctx, `HWCode Cloud session restored for ${getCloudProvider(details.vendor).label}. Credentials are locked; run /hwcode-cloud to unlock before continuing.`, "warning");
+  });
+
+  pi.on("before_agent_start", async (event, ctx) => {
+    const activeState = runtime.restore(ctx);
+    const details = activeState && cloudDetails(activeState);
+    if (!activeState || !details) return undefined;
+    const failureRule = details.terminalFailure
+      ? "Three distinct approaches already failed. Only summarize causes, progress, and changes; do not continue execution."
+      : `Distinct failed approaches: ${details.failedApproaches.length}/${CLOUD_RUNTIME_DEFAULTS.workflow.maxFailedApproaches}. After the third distinct approach fails, stop and summarize.`;
+    return {
+      systemPrompt: `${event.systemPrompt}\n\nHWCODE CLOUD ACTIVE\nProvider: ${details.vendor}\nObjective: ${details.request}\nArtifact workspace: ${cloudArtifactDirectory(activeState)}\nCredentials must never be requested in chat, printed, placed in tool arguments, or read from the vault. Write all generated Cloud artifacts only under the artifact workspace: discovery/ for CLI skeletons and snapshots, terraform/ for IaC, charts/ for Helm sources/packages, reports/ for plans and summaries. Project source remains under ${activeState.root}; when a provider CLI needs a project source file, pass its absolute project-root path. Use hwcode_cloud_exec for provider CLI operations. ${details.runner ? "Use hwcode_runner_prepare and hwcode_terraform_* for Terraform source synchronization, validation, planning, approval, and apply on the selected Runner." : details.runnerPreference === "automatic" ? "The user requested an automatic temporary Runner. Provision it through approved provider CLI changes with workload identity and cloud-init, then register the discovered endpoint with hwcode_runner_connect." : "No Terraform Runner is selected. Do not provision one unless the user explicitly changes this choice."} Resource creates and changes require approval unless the user opted out; deletion always requires approval. After success, offer /hwcode-cloud-save-template to preserve the validated path locally. ${failureRule}`,
+    };
+  });
+
+  pi.on("tool_call", async (event, ctx) => {
+    const activeState = runtime.restore(ctx);
+    if (!activeState || event.toolName !== "bash") return undefined;
+    const input = event.input as Record<string, unknown>;
+    if (typeof input.command !== "string" || !containsCloudCommand(input.command)) return undefined;
+    return { block: true, reason: "Direct cloud and infrastructure CLI use is blocked during HWCode Cloud. Use hwcode_cloud_exec so credentials remain isolated and approvals are enforced." };
+  });
+
+  pi.on("session_shutdown", async () => {
+    runtime.activeState = undefined;
+    runtime.clearSecrets();
+  });
+}

package/.pi/extensions/workflows/cloud/index.ts

@@ -0,0 +1,17 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+
+import { registerCloudCommands } from "./commands.ts";
+import { registerCloudEvents } from "./events.ts";
+import { registerCloudProviderTools } from "./provider-tools.ts";
+import { registerCloudRunnerTools } from "./runner-tools.ts";
+import { CloudExtensionRuntime } from "./runtime.ts";
+import { registerCloudTerraformTools } from "./terraform-tools.ts";
+
+export function registerCloudWorkflow(pi: ExtensionAPI): void {
+  const runtime = new CloudExtensionRuntime(pi);
+  registerCloudCommands(pi, runtime);
+  registerCloudProviderTools(pi, runtime);
+  registerCloudRunnerTools(pi, runtime);
+  registerCloudTerraformTools(pi, runtime);
+  registerCloudEvents(pi, runtime);
+}

package/.pi/extensions/workflows/cloud/provider-tools.ts

@@ -0,0 +1,127 @@
+import { basename } from "node:path";
+
+import { Type } from "@earendil-works/pi-ai";
+import { defineTool, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
+
+import { CLOUD_RUNTIME_DEFAULTS } from "../../../lib/runtime/defaults.ts";
+import { evaluateCommandArgumentsAccess } from "../../../lib/workspace/access-policy.ts";
+import { prepareCloudExecution } from "../../../lib/workflows/cloud/adapters.ts";
+import { cloudExecutionBlockReason, recordStrategyFailure } from "../../../lib/workflows/cloud/execution.ts";
+import { runProcess, truncateOutput, type ProcessResult } from "../../../lib/workflows/cloud/process.ts";
+import { CLOUD_EXECUTABLES, classifyCloudOperation, getCloudProvider, redactCredentialValues, type CloudOperation } from "../../../lib/workflows/cloud/providers.ts";
+import { WORKFLOW_EXTERNAL_AUDIT_TYPE } from "../../../lib/workflows/state.ts";
+import type { CloudExtensionRuntime } from "./runtime.ts";
+import {
+  CLOUD_AUDIT_TYPE, ORCHESTRATION_COMMANDS, SENSITIVE_ARGUMENT, approveOperation,
+  cloudArtifactDirectory, cloudDetails, safeStepText, terraformError, terraformOk,
+} from "./shared.ts";
+
+export function registerCloudProviderTools(pi: ExtensionAPI, runtime: CloudExtensionRuntime): void {
+  pi.registerTool(defineTool({
+    name: "hwcode_cloud_record_resource",
+    label: "HWCode Cloud Resource Inventory",
+    description: "Record non-secret cloud resource identifiers after discovery, creation, or confirmed deletion so cleanup and completion remain auditable.",
+    promptSnippet: "Keep the Cloud resource inventory current after resource changes.",
+    parameters: Type.Object({
+      id: Type.String(), type: Type.String(), region: Type.String(),
+      ownership: Type.Union([Type.Literal("existing"), Type.Literal("workflow-created")]),
+      status: Type.Union([Type.Literal("active"), Type.Literal("deleted")]),
+    }),
+    executionMode: "sequential",
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+      const activeState = runtime.restore(ctx);
+      const blocked = cloudExecutionBlockReason(activeState, { allowAfterTerminalFailure: true });
+      if (!activeState || blocked) return terraformError(blocked ?? "HWCode Cloud is not active.");
+      const details = cloudDetails(activeState)!;
+      const clean = (value: string, limit: number) => value.replace(/[\r\n\0]/gu, " ").trim().slice(0, limit);
+      const id = clean(params.id, 256);
+      const type = clean(params.type, 128);
+      const region = clean(params.region, 128);
+      if (!id || !type || !region) return terraformError("Resource id, type, and region are required.");
+      const resources = [...(details.resources ?? [])];
+      const index = resources.findIndex((resource) => resource.id === id && resource.type === type && resource.region === region);
+      const record = { id, type, region, ownership: params.ownership, status: params.status, updatedAt: new Date().toISOString() } as const;
+      if (index >= 0) resources[index] = record;
+      else resources.push(record);
+      runtime.replaceDetails(activeState, { ...details, resources: resources.slice(-500) });
+      return terraformOk(`Resource inventory updated: ${type} ${id} (${params.status}).`, { resource: record });
+    },
+  }));
+
+  pi.registerTool(defineTool({
+    name: "hwcode_cloud_exec",
+    label: "HWCode Cloud",
+    description: "Run one cloud or infrastructure CLI command with isolated credentials and unified workspace/resource approvals.",
+    promptSnippet: "Execute credential-isolated cloud CLI commands with mandatory resource-change approvals.",
+    parameters: Type.Object({
+      command: Type.String({ description: "Executable name only" }),
+      args: Type.Array(Type.String(), { description: "Argument vector; never include credentials or shell syntax" }),
+      operation: Type.Union([Type.Literal("read"), Type.Literal("change"), Type.Literal("delete")]),
+      intent: Type.String({ description: "Concise description of what this command inspects or changes" }),
+      approach: Type.String({ description: "Stable name for this technical approach" }),
+    }),
+    executionMode: "sequential",
+    async execute(_toolCallId, params, signal, _onUpdate, ctx) {
+      let activeState = runtime.restore(ctx);
+      let details = activeState && cloudDetails(activeState);
+      const blocked = cloudExecutionBlockReason(activeState, { allowAfterTerminalFailure: true });
+      if (!activeState || !details || blocked) return { content: [{ type: "text" as const, text: blocked ?? "HWCode Cloud is not active." }], isError: true, details: { terminalFailure: details?.terminalFailure } };
+      if (!runtime.activeCredentials) return { content: [{ type: "text" as const, text: "Cloud credentials are locked after restoration. Run /hwcode-cloud to unlock and validate them." }], isError: true, details: {} };
+      const credentials = runtime.activeCredentials;
+      if (basename(params.command) !== params.command || !CLOUD_EXECUTABLES.has(params.command)) return { content: [{ type: "text" as const, text: `Unsupported executable: ${params.command}` }], isError: true, details: {} };
+      if (["terraform", "tofu", "pulumi"].includes(params.command)) return { content: [{ type: "text" as const, text: "Terraform/OpenTofu/Pulumi must use the structured hwcode_terraform_* tools so source policy, remote workspace isolation, plan digests, and approvals remain enforceable." }], isError: true, details: {} };
+      const providerCli = getCloudProvider(details.vendor).cli;
+      if (params.command !== providerCli && !ORCHESTRATION_COMMANDS.has(params.command)) return { content: [{ type: "text" as const, text: `${params.command} does not match the active ${details.vendor} provider.` }], isError: true, details: {} };
+      if (params.args.some((argument) => SENSITIVE_ARGUMENT.test(argument))) return { content: [{ type: "text" as const, text: "Credential-like command arguments are forbidden. HWCode injects credentials outside model context." }], isError: true, details: {} };
+
+      const operation = classifyCloudOperation(params.command, params.args, params.operation as CloudOperation);
+      if (details.terminalFailure && operation === "change") return { content: [{ type: "text" as const, text: "Failure budget reached. New resource changes are blocked; only read-only inspection and confirmed cleanup deletion remain available." }], isError: true, details: { terminalFailure: true } };
+      const external = evaluateCommandArgumentsAccess(params.command, params.args, activeState.root);
+      if (external.length > 0) {
+        const summary = external.map((entry) => `• ${entry.raw} → ${entry.resolved}`).join("\n");
+        if (!ctx.hasUI || !(await ctx.ui.confirm("允许本次云工具访问项目目录之外的路径？", `项目根目录：${activeState.root}\n\n${summary}\n\n该授权仅适用于本次命令。`))) {
+          return { content: [{ type: "text" as const, text: `User denied external path access:\n${summary}` }], isError: true, details: { denied: true } };
+        }
+        pi.appendEntry(WORKFLOW_EXTERNAL_AUDIT_TYPE, { mode: "cloud", root: activeState.root, toolName: "hwcode_cloud_exec", external, approvedAt: new Date().toISOString() });
+      }
+
+      const approval = await approveOperation(operation, params, activeState, ctx);
+      if (approval === "deny") return { content: [{ type: "text" as const, text: `User denied ${operation} operation: ${params.intent}` }], isError: true, details: { denied: true, operation } };
+      if (approval === "allow-session") {
+        activeState = runtime.replaceDetails(activeState, { ...details, allowNonDeleteChanges: true });
+        details = cloudDetails(activeState)!;
+      }
+
+      const prepared = await prepareCloudExecution(details.vendor, params.command, params.args, { root: activeState.root, credentials, temporaryStore: runtime.temporaryStore, signal });
+      let result: ProcessResult;
+      try {
+        result = prepared.error
+          ? { stdout: "", stderr: prepared.error, code: 1, killed: false }
+          : await runProcess(params.command, prepared.args, { cwd: cloudArtifactDirectory(activeState), env: prepared.env, signal });
+      } finally { prepared.cleanup?.(); }
+
+      const stdout = truncateOutput(redactCredentialValues(result.stdout, credentials));
+      const stderr = truncateOutput(redactCredentialValues(result.stderr, credentials));
+      pi.appendEntry(CLOUD_AUDIT_TYPE, { vendor: details.vendor, command: params.command, operation, intent: params.intent, approach: params.approach, exitCode: result.code, executedAt: new Date().toISOString() });
+      if (result.code !== 0) {
+        const failed = recordStrategyFailure(details, params.approach, params.command, stderr.trim() || stdout.trim() || `exit code ${result.code}`, CLOUD_RUNTIME_DEFAULTS.workflow.maxFailedApproaches);
+        runtime.replaceDetails(activeState, failed, failed.terminalFailure ? "failed" : "executing");
+        const suffix = failed.terminalFailure
+          ? "\n\nTERMINAL FAILURE: Three materially different approaches failed. Explain causes and summarize progress and changes. Do not try another cloud operation."
+          : `\n\nDistinct failed approaches: ${failed.failedApproaches.length}/${CLOUD_RUNTIME_DEFAULTS.workflow.maxFailedApproaches}.`;
+        return { content: [{ type: "text" as const, text: `Cloud command failed with exit code ${result.code}.\n${stderr || stdout}${suffix}` }], isError: true, details: { operation, exitCode: result.code, terminalFailure: failed.terminalFailure } };
+      }
+
+      const successfulSteps = [...details.successfulSteps, {
+        command: safeStepText(params.command, credentials),
+        args: params.args.map((argument) => safeStepText(argument, credentials)),
+        operation,
+        intent: safeStepText(params.intent, credentials),
+        approach: safeStepText(params.approach, credentials),
+        completedAt: new Date().toISOString(),
+      }].slice(-CLOUD_RUNTIME_DEFAULTS.workflow.maxSuccessfulSteps);
+      runtime.replaceDetails(activeState, { ...details, successfulSteps }, "executing");
+      return { content: [{ type: "text" as const, text: stdout.trim() || stderr.trim() || "Cloud command completed successfully." }], details: { operation, exitCode: 0 } };
+    },
+  }));
+}