@hadooppei/hwcode 0.2.4 → 1.0.1

package/.pi/lib/workflows/cloud/terraform/runner.ts

@@ -0,0 +1,64 @@
+import { createHash } from "node:crypto";
+
+import type { RemoteTargetProfile } from "../remote/profiles.ts";
+import { runSsh, type SshRunResult } from "../remote/ssh-transport.ts";
+import { CLOUD_RUNTIME_DEFAULTS } from "../../../runtime/defaults.ts";
+
+export type TerraformRunnerAction = "fmt" | "init" | "validate" | "test" | "plan" | "show-plan" | "show-state" | "apply";
+
+export interface TerraformRunnerRequest {
+  action: TerraformRunnerAction;
+  workspace: string;
+  terraformPath?: string;
+  planPath?: string;
+  mode?: "normal" | "destroy" | "refresh-only";
+}
+
+const ACTIONS: Record<TerraformRunnerAction, readonly string[]> = {
+  fmt: ["fmt", "-check", "-no-color"],
+  init: ["init", "-input=false", "-no-color"],
+  validate: ["validate", "-no-color"],
+  test: ["test", "-no-color"],
+  plan: ["plan", "-input=false", "-no-color"],
+  "show-plan": ["show", "-json", "-no-color"],
+  "show-state": ["show", "-json", "-no-color"],
+  apply: ["apply", "-input=false", "-no-color"],
+};
+
+function assertWorkspace(workspace: string): void {
+  if (!workspace.startsWith("/") || workspace === "/" || workspace.includes("..")) {
+    throw new Error("invalid Terraform workspace path");
+  }
+}
+
+export function buildTerraformRunnerArgs(request: TerraformRunnerRequest): string[] {
+  assertWorkspace(request.workspace);
+  const executable = request.terraformPath?.trim() || CLOUD_RUNTIME_DEFAULTS.terraform.executable;
+  if (!executable || executable.includes(" ") || executable.includes(";")) throw new Error("invalid Terraform executable");
+  const args = [...ACTIONS[request.action]];
+  if (request.action === "plan") {
+    if (request.mode === "destroy") args.push("-destroy");
+    if (request.mode === "refresh-only") args.push("-refresh-only");
+    args.push(`-out=${CLOUD_RUNTIME_DEFAULTS.terraform.planFile}`);
+  }
+  if (request.action === "show-plan" || request.action === "apply") {
+    if (!request.planPath || request.planPath.includes("..") || !request.planPath.endsWith(".tfplan")) {
+      throw new Error("a managed Terraform plan path is required");
+    }
+    args.push(request.planPath);
+  }
+  return [executable, ...args];
+}
+
+export async function executeTerraformRunner(
+  profile: RemoteTargetProfile,
+  request: TerraformRunnerRequest,
+  options: { signal?: AbortSignal; timeoutMs?: number; onOutput?: (chunk: string, stream: "stdout" | "stderr") => void } = {},
+): Promise<SshRunResult> {
+  const [command, ...args] = buildTerraformRunnerArgs({ ...request, terraformPath: request.terraformPath ?? profile.terraformPath });
+  return runSsh(profile, command, args, { ...options, remoteCwd: request.workspace });
+}
+
+export function digestTerraformPlan(planJson: string): string {
+  return createHash("sha256").update(planJson, "utf8").digest("hex");
+}

package/.pi/lib/{cloud-vault.ts → workflows/cloud/vault.ts}

@@ -14,9 +14,11 @@ import {
 	writeFileSync,
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname } from "node:path";
 
-import { isCloudVendorId, type CloudCredentials, type CloudVendorId } from "./cloud-providers.ts";
+import { isCloudVendorId, type CloudCredentials, type CloudVendorId } from "./providers.ts";
+import { validateRemoteTargetProfile, type RemoteTargetProfile } from "./remote/profiles.ts";
+import { userRuntimePaths } from "../../runtime/paths.ts";
 
 const AAD = Buffer.from("hwcode-cloud-credentials-v1", "utf8");
 const KEY_LENGTH = 32;
@@ -30,8 +32,9 @@ export interface CloudCredentialProfile {
 }
 
 export interface VaultPayload {
-	version: 2;
-	providers: Partial<Record<CloudVendorId, CloudCredentialProfile[]>>;
+  version: 2;
+  providers: Partial<Record<CloudVendorId, CloudCredentialProfile[]>>;
+  runners?: RemoteTargetProfile[];
 }
 
 interface EncryptedVault {
@@ -45,7 +48,7 @@ interface EncryptedVault {
 }
 
 export function defaultCloudVaultPath(home = homedir()): string {
-	return join(home, ".hwcode", "cloud", "credentials.enc");
+	return userRuntimePaths(home).cloudVault;
 }
 
 export function cloudVaultExists(path = defaultCloudVaultPath()): boolean {
@@ -69,7 +72,7 @@ export function normalizeCloudVaultPayload(value: unknown): VaultPayload {
 	if (!payload.providers || typeof payload.providers !== "object" || Array.isArray(payload.providers)) {
 		throw new Error("invalid vault payload");
 	}
-	const providers: VaultPayload["providers"] = {};
+  const providers: VaultPayload["providers"] = {};
 	for (const [vendor, stored] of Object.entries(payload.providers)) {
 		if (!isCloudVendorId(vendor)) throw new Error("unsupported cloud provider in vault");
 		if (payload.version === 1) {
@@ -96,7 +99,10 @@ export function normalizeCloudVaultPayload(value: unknown): VaultPayload {
 		});
 	}
 	if (payload.version !== 1 && payload.version !== 2) throw new Error("unsupported vault payload");
-	return { version: 2, providers };
+  const runners = payload.runners === undefined
+    ? undefined
+    : Array.isArray(payload.runners) ? payload.runners.map(validateRemoteTargetProfile) : (() => { throw new Error("invalid remote runner profiles"); })();
+  return { version: 2, providers, ...(runners ? { runners } : {}) };
 }
 
 export function readCloudVault(password: string, path = defaultCloudVaultPath()): VaultPayload {
@@ -151,23 +157,6 @@ export function writeCloudVault(payload: VaultPayload, password: string, path =
 	chmodSync(path, 0o600);
 }
 
-export function setCloudCredentials(
-	payload: VaultPayload,
-	vendor: CloudVendorId,
-	credentials: CloudCredentials,
-): VaultPayload {
-	const first = payload.providers[vendor]?.[0];
-	return saveCloudCredentialProfile(payload, vendor, credentials, first?.id);
-}
-
-export function getCloudCredentials(
-	payload: VaultPayload,
-	vendor: CloudVendorId,
-): CloudCredentials | undefined {
-	const credentials = payload.providers[vendor]?.[0]?.credentials;
-	return credentials ? { ...credentials } : undefined;
-}
-
 export function listCloudCredentialProfiles(
 	payload: VaultPayload,
 	vendor: CloudVendorId,
@@ -207,3 +196,16 @@ export function cloudCredentialProfileLabel(
 	const region = profile.credentials.region?.trim() || "未配置";
 	return `使用已有凭据${number} · Region: ${region}`;
 }
+
+export function listRemoteTargetProfiles(payload: VaultPayload): RemoteTargetProfile[] {
+  return (payload.runners ?? []).map((profile) => ({ ...profile }));
+}
+
+export function saveRemoteTargetProfile(payload: VaultPayload, profile: RemoteTargetProfile): VaultPayload {
+  const validated = validateRemoteTargetProfile(profile);
+  const profiles = listRemoteTargetProfiles(payload);
+  const existingIndex = profiles.findIndex((entry) => entry.id === validated.id);
+  if (existingIndex >= 0) profiles[existingIndex] = validated;
+  else profiles.push(validated);
+  return { version: 2, providers: { ...payload.providers }, runners: profiles };
+}

package/.pi/lib/workflows/cloud/workspace.ts

@@ -0,0 +1,37 @@
+import { mkdirSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { isAbsolute, join, relative, resolve } from "node:path";
+
+import { PROJECT_CLOUD_RUNS_RELATIVE, projectRuntimePaths } from "../../runtime/paths.ts";
+
+export interface CloudRunWorkspace {
+  runId: string;
+  path: string;
+  discoveryPath: string;
+  terraformPath: string;
+  chartsPath: string;
+  reportsPath: string;
+}
+
+export function createCloudRunWorkspace(root: string, runId = randomUUID()): CloudRunWorkspace {
+  const path = join(projectRuntimePaths(root).cloudRuns, runId);
+  const workspace: CloudRunWorkspace = {
+    runId, path,
+    discoveryPath: join(path, "discovery"),
+    terraformPath: join(path, "terraform"),
+    chartsPath: join(path, "charts"),
+    reportsPath: join(path, "reports"),
+  };
+  for (const directory of [workspace.discoveryPath, workspace.terraformPath, workspace.chartsPath, workspace.reportsPath]) {
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+  }
+  return workspace;
+}
+
+export function isCloudRunWorkspace(root: string, path: string): boolean {
+  const resolvedRoot = resolve(root);
+  const resolvedPath = resolve(path);
+  const remainder = relative(resolvedRoot, resolvedPath);
+  return !isAbsolute(remainder) && !remainder.startsWith("..")
+    && remainder.split(/[\\/]/u).slice(0, 3).join("/") === PROJECT_CLOUD_RUNS_RELATIVE;
+}

package/.pi/lib/workflows/sdd.ts

@@ -0,0 +1,11 @@
+import type { SddPhase, SddWorkflowProgress } from "./state.ts";
+
+export const SDD_PHASES: readonly SddPhase[] = ["discovery", "requirements", "design", "test-plan", "tasks", "tests", "implementation", "verification"];
+
+export function advanceSddProgress(progress: SddWorkflowProgress, nextPhase: SddPhase, evidence: string, approvedAt = new Date()): SddWorkflowProgress {
+  const currentIndex = SDD_PHASES.indexOf(progress.phase);
+  if (SDD_PHASES[currentIndex + 1] !== nextPhase) throw new Error(`Invalid SDD transition ${progress.phase} → ${nextPhase}. Complete phases in order.`);
+  const normalizedEvidence = evidence.replace(/[\r\n]+/gu, " ").trim().slice(0, 1_000);
+  if (!normalizedEvidence) throw new Error("SDD phase approval evidence is required");
+  return { phase: nextPhase, approvals: [...progress.approvals, { phase: nextPhase, evidence: normalizedEvidence, approvedAt: approvedAt.toISOString() }] };
+}

package/.pi/lib/workflows/state.ts

@@ -5,10 +5,18 @@ export const WORKFLOW_EXTERNAL_AUDIT_TYPE = "hwcode-workflow-external-approval";
 
 export type WorkflowMode = "vibe" | "sdd" | "cloud";
 export type WorkflowStatus = "active" | "completed" | "cancelled" | "failed";
+export type SddPhase = "discovery" | "requirements" | "design" | "test-plan" | "tasks" | "tests" | "implementation" | "verification";
+
+export interface SddWorkflowProgress {
+  phase: SddPhase;
+  approvals: Array<{ phase: SddPhase; evidence: string; approvedAt: string }>;
+}
 
 export interface FailedApproach {
   approach: string;
   reason: string;
+  stage?: string;
+  attempts?: number;
   failedAt: string;
 }
 
@@ -21,11 +29,54 @@ export interface CloudExecutionStep {
   completedAt: string;
 }
 
+export interface CloudResourceRecord {
+  id: string;
+  type: string;
+  region: string;
+  ownership: "existing" | "workflow-created";
+  status: "active" | "deleted";
+  updatedAt: string;
+}
+
 export interface CloudTemplateSource {
   id: string;
   name: string;
   createdAt: string;
   updatedAt: string;
+  kind?: "prompt" | "terraform";
+}
+
+export interface CloudRunnerSummary {
+  id: string;
+  name: string;
+  vendor: CloudWorkflowDetails["vendor"];
+  region: string;
+  host: string;
+  port: number;
+  user: string;
+  remoteRoot: string;
+  identityType: "instance-role" | "agency" | "ssh-only";
+  hostKeyFingerprint: string;
+}
+
+export interface TerraformRunState {
+  runId: string;
+  runnerId: string;
+  phase: "synced" | "validated" | "planned" | "applied" | "failed";
+  sourceDigest: string;
+  sourcePath?: string;
+  remoteWorkspace: string;
+  planDigest?: string;
+  planSummary?: {
+    create: number;
+    update: number;
+    delete: number;
+    replace: number;
+    read: number;
+    sensitiveChangesHidden: number;
+  };
+  startedAt: string;
+  updatedAt: string;
 }
 
 export interface CloudWorkflowDetails {
@@ -35,9 +86,15 @@ export interface CloudWorkflowDetails {
   allowNonDeleteChanges: boolean;
   failedApproaches: FailedApproach[];
   successfulSteps: CloudExecutionStep[];
+  resources?: CloudResourceRecord[];
   terminalFailure: boolean;
+  artifactDirectory?: string;
   templateGuidance?: string;
   sourceTemplate?: CloudTemplateSource;
+  terraformSourcePath?: string;
+  runner?: CloudRunnerSummary;
+  runnerPreference?: "automatic" | "deferred" | "existing";
+  terraformRun?: TerraformRunState;
 }
 
 export interface WorkflowState {
@@ -49,6 +106,7 @@ export interface WorkflowState {
   activatedAt: string;
   updatedAt: string;
   details?: CloudWorkflowDetails;
+  sdd?: SddWorkflowProgress;
   reason?: string;
 }
 
@@ -67,7 +125,39 @@ function isCloudTemplateSource(value: unknown): value is CloudTemplateSource {
   return typeof data.id === "string"
     && typeof data.name === "string"
     && typeof data.createdAt === "string"
-    && typeof data.updatedAt === "string";
+    && typeof data.updatedAt === "string"
+    && (data.kind === undefined || data.kind === "prompt" || data.kind === "terraform");
+}
+
+function isCloudRunnerSummary(value: unknown): value is CloudRunnerSummary {
+  if (!value || typeof value !== "object") return false;
+  const data = value as Record<string, unknown>;
+  return typeof data.id === "string"
+    && typeof data.name === "string"
+    && typeof data.vendor === "string"
+    && typeof data.region === "string"
+    && typeof data.host === "string"
+    && Number.isInteger(data.port)
+    && typeof data.user === "string"
+    && typeof data.remoteRoot === "string"
+    && typeof data.hostKeyFingerprint === "string"
+    && ["instance-role", "agency", "ssh-only"].includes(data.identityType as string);
+}
+
+function isTerraformRunState(value: unknown): value is TerraformRunState {
+  if (!value || typeof value !== "object") return false;
+  const data = value as Record<string, unknown>;
+  const summary = data.planSummary;
+  return typeof data.runId === "string"
+    && typeof data.runnerId === "string"
+    && ["synced", "validated", "planned", "applied", "failed"].includes(data.phase as string)
+    && typeof data.sourceDigest === "string"
+    && typeof data.remoteWorkspace === "string"
+    && typeof data.startedAt === "string"
+    && typeof data.updatedAt === "string"
+    && (data.planDigest === undefined || typeof data.planDigest === "string")
+    && (summary === undefined || (summary !== null && typeof summary === "object"
+      && Object.values(summary as Record<string, unknown>).every((entry) => Number.isInteger(entry))));
 }
 
 function isCloudDetails(value: unknown): value is CloudWorkflowDetails {
@@ -79,9 +169,22 @@ function isCloudDetails(value: unknown): value is CloudWorkflowDetails {
     && typeof data.allowNonDeleteChanges === "boolean"
     && Array.isArray(data.failedApproaches)
     && Array.isArray(data.successfulSteps)
+    && (data.resources === undefined || (Array.isArray(data.resources) && data.resources.every((resource) => {
+      if (!resource || typeof resource !== "object") return false;
+      const entry = resource as Record<string, unknown>;
+      return typeof entry.id === "string" && typeof entry.type === "string" && typeof entry.region === "string"
+        && ["existing", "workflow-created"].includes(entry.ownership as string)
+        && ["active", "deleted"].includes(entry.status as string)
+        && typeof entry.updatedAt === "string";
+    })))
     && typeof data.terminalFailure === "boolean"
+    && (data.artifactDirectory === undefined || typeof data.artifactDirectory === "string")
     && (data.templateGuidance === undefined || typeof data.templateGuidance === "string")
-    && (data.sourceTemplate === undefined || isCloudTemplateSource(data.sourceTemplate));
+    && (data.terraformSourcePath === undefined || typeof data.terraformSourcePath === "string")
+    && (data.sourceTemplate === undefined || isCloudTemplateSource(data.sourceTemplate))
+    && (data.runner === undefined || isCloudRunnerSummary(data.runner))
+    && (data.runnerPreference === undefined || ["automatic", "deferred", "existing"].includes(data.runnerPreference as string))
+    && (data.terraformRun === undefined || isTerraformRunState(data.terraformRun));
 }
 
 export function decodeWorkflowState(value: unknown): WorkflowState | undefined {
@@ -95,6 +198,11 @@ export function decodeWorkflowState(value: unknown): WorkflowState | undefined {
       || typeof data.activatedAt !== "string"
       || typeof data.updatedAt !== "string") return undefined;
     if (data.mode === "cloud" && !isCloudDetails(data.details)) return undefined;
+    if (data.mode === "sdd" && data.sdd !== undefined) {
+      const sdd = data.sdd as Record<string, unknown>;
+      if (!( ["discovery", "requirements", "design", "test-plan", "tasks", "tests", "implementation", "verification"] as unknown[]).includes(sdd.phase)
+        || !Array.isArray(sdd.approvals)) return undefined;
+    }
     return data as unknown as WorkflowState;
   }
 
@@ -141,6 +249,7 @@ export function createWorkflowState(
     phase,
     activatedAt: now,
     updatedAt: now,
+    ...(mode === "sdd" ? { sdd: { phase: "discovery", approvals: [] } } : {}),
   };
 }
 
@@ -150,6 +259,7 @@ export function createCloudWorkflowState(
   deployCurrentProject: boolean,
   request: string,
   template?: { source: CloudTemplateSource; guidance: string },
+  artifactDirectory?: string,
 ): WorkflowState {
   const now = new Date().toISOString();
   return {
@@ -167,7 +277,9 @@ export function createCloudWorkflowState(
       allowNonDeleteChanges: false,
       failedApproaches: [],
       successfulSteps: [],
+      resources: [],
       terminalFailure: false,
+      ...(artifactDirectory ? { artifactDirectory } : {}),
       ...(template ? {
         templateGuidance: template.guidance,
         sourceTemplate: template.source,

package/.pi/lib/working-directory.ts

@@ -29,11 +29,6 @@ export interface DirectoryChange {
 	remainder: string;
 }
 
-export interface ChainedDirectoryChange {
-	argument: string;
-	standalone: boolean;
-}
-
 const workingDirectories = new Map<string, WorkingDirectoryState>();
 
 function isWorkingDirectoryState(value: unknown): value is WorkingDirectoryState {
@@ -190,59 +185,6 @@ export function parseLeadingDirectoryChange(command: string): DirectoryChange |
 	return { argument, remainder: command.slice(index).trimStart() };
 }
 
-/** Find a standalone `cd` segment in a top-level `&&` or `;` command chain. */
-export function findChainedDirectoryChange(command: string): ChainedDirectoryChange | undefined {
-	const segments: string[] = [];
-	let segmentStart = 0;
-	let quote: "'" | '"' | undefined;
-	let escaped = false;
-	let nesting = 0;
-
-	for (let index = 0; index < command.length; index += 1) {
-		const character = command[index];
-		if (escaped) {
-			escaped = false;
-			continue;
-		}
-		if (character === "\\" && quote !== "'") {
-			escaped = true;
-			continue;
-		}
-		if (quote) {
-			if (character === quote) quote = undefined;
-			continue;
-		}
-		if (character === "'" || character === '"') {
-			quote = character;
-			continue;
-		}
-		if (character === "(" || character === "{") {
-			nesting += 1;
-			continue;
-		}
-		if (character === ")" || character === "}") {
-			nesting = Math.max(0, nesting - 1);
-			continue;
-		}
-		if (nesting > 0) continue;
-
-		const separatorLength = command.slice(index, index + 2) === "&&" ? 2 : character === ";" ? 1 : 0;
-		if (!separatorLength) continue;
-		segments.push(command.slice(segmentStart, index));
-		index += separatorLength - 1;
-		segmentStart = index + 1;
-	}
-	segments.push(command.slice(segmentStart));
-
-	for (const segment of segments) {
-		const parsed = parseLeadingDirectoryChange(segment);
-		if (parsed && !parsed.remainder) {
-			return { argument: parsed.argument, standalone: segments.length === 1 };
-		}
-	}
-	return undefined;
-}
-
 export function getActiveWorkflowRoot(entries: readonly SessionEntry[]): string | undefined {
 	return activeWorkflow(entries)?.root;
 }

package/.pi/skills/hwcode-cloud/SKILL.md

@@ -11,7 +11,7 @@ Use this skill only after `/hwcode-cloud` has activated the workflow. The activa
 
 - Never ask for, display, infer, copy, log, summarize, or place credentials in chat, shell text, source files, environment files, tool arguments, plans, or session artifacts.
 - Never read `~/.hwcode/cloud/credentials.enc`. The extension owns encryption, decryption, and credential injection.
-- Use `hwcode_cloud_exec` for every provider CLI, Terraform/OpenTofu, Pulumi, kubectl, or Helm operation. Direct Bash use for those commands is forbidden.
+- Use `hwcode_cloud_exec` for provider CLI operations. Use `hwcode_runner_prepare` and `hwcode_terraform_*` for Terraform execution. Direct Bash use for those commands is forbidden.
 - Keep project reads, writes, builds, manifests, and generated artifacts inside the locked project root. External paths require the workflow guard's one-call approval.
 - Prefer short-lived, least-privilege identities and narrowly scoped roles. Never widen permissions merely to bypass an authorization error without explaining the exact missing permission and obtaining approval.
 - Do not expose sensitive values returned by a provider. If output unexpectedly contains a secret, do not repeat it; tell the user to rotate it.
@@ -20,6 +20,19 @@ Use this skill only after `/hwcode-cloud` has activated the workflow. The activa
 
 The command already collected the provider, deployment choice, objective, and validated account connection. Do not repeat those questions unless the activation context is contradictory.
 
+## Artifact workspace
+
+The activation context includes a task artifact workspace inside the locked project root. Keep all generated Cloud-task artifacts there; never write them to the project root or invent top-level task directories.
+
+The run workspace is retained after the session so `/hwcode-cloud-save-template` can safely extract its validated artifacts. Do not move or duplicate these files into another temporary directory.
+
+- `discovery/`: provider CLI skeletons, read-only snapshots, and API input exploration;
+- `terraform/`: Terraform source, module lock files, and generated provider configuration (never state files or tfvars with secrets);
+- `charts/`: Helm chart sources and package archives;
+- `reports/`: sanitized plans, verification results, and final summaries.
+
+Provider CLIs run with this workspace as their current directory. When an argument must reference an existing project source file, use its absolute path under the locked project root.
+
 Inspect the project only as needed to determine:
 
 - application type, build and runtime requirements;
@@ -43,6 +56,19 @@ Before modifying account resources, present a plan containing:
 
 Prefer declarative, reviewable, idempotent infrastructure as code. Use a plan/dry-run command before apply when the selected tooling supports it. Pin important versions and avoid provider defaults that materially affect cost or exposure.
 
+### Terraform Runner
+
+Do not ask the user to name or manually configure a Runner. If the activation context has no selected Runner and Terraform is required:
+
+1. design a minimal temporary Runner (image, network exposure, instance role/agency, SSH access, estimated cost);
+2. ask for approval to create those billable cloud resources;
+3. create them through `hwcode_cloud_exec`, preferring provider identity on the Runner over copying AK/SK;
+4. install Terraform and `tar` through the instance image or cloud-init, then pass the resulting endpoint to `hwcode_runner_connect`; it selects a local default SSH key, shows standard OpenSSH SHA256 host-key fingerprints for verification, and stores the Runner profile encrypted;
+5. when the target is private, use the tool's ProxyJump fields with the approved bastion instead of copying credentials or opening broad public access;
+6. call `hwcode_runner_prepare` to create the managed Runner directories and verify required capabilities, then use only `hwcode_terraform_*` for Terraform.
+
+If an existing SSH host is selected, reuse it. Only ask for SSH information when it cannot be derived from the provider result or saved Runner profile.
+
 ## Phase 3: Execute with approval gates
 
 For every `hwcode_cloud_exec` call:
@@ -52,6 +78,7 @@ For every `hwcode_cloud_exec` call:
 - use a stable `approach` name for the current technical strategy;
 - pass an executable and argument vector, never shell syntax;
 - inspect the result before proceeding.
+- after discovering, creating, or deleting a resource, call `hwcode_cloud_record_resource` with its non-secret provider identifier, type, region, ownership, and current status. This inventory is required for completion and cleanup reporting.
 
 The extension confirms every account-resource create or modification unless the user selects session-wide approval for non-delete changes. A deletion is always confirmed separately, even after that opt-out.
 
@@ -79,6 +106,8 @@ After three genuinely different approaches fail, stop all execution. Tell the us
 
 Do not attempt a fourth approach.
 
+Read-only inspection and explicitly confirmed cleanup deletions remain allowed after the failure budget is reached; new resource changes do not.
+
 ## Completion
 
 On success, summarize:
@@ -89,3 +118,5 @@ On success, summarize:
 - verification results;
 - ongoing cost, security, monitoring, backup, and credential-rotation considerations;
 - rollback and teardown procedure (do not execute teardown unless separately requested and approved).
+
+When saving a successful Terraform run, the local Deployment Template is a schema-v2 bundle. It contains filtered Terraform/Helm/discovery artifacts, verification guidance, an exclusion report, and a digest of the actual saved content. Runtime state, plans, tfvars, credentials, and discovered runtime identifiers must not be copied. Reuse is blocked if the bundle content no longer matches its manifest digest; schema-v1 bundles are migrated in memory when read.

package/.pi/skills/hwcode-sdd/SKILL.md

@@ -11,6 +11,8 @@ Make the approved specification the source of truth. Move through discovery, spe
 
 Confirm that the activation message states a locked project root and Git status. If this skill was invoked directly without the `/hwcode-sdd` project command, do not begin work; ask the user to run `/hwcode-sdd [initial requirement]`. The command confirms the directory, enforces the path boundary, initializes Git when approved, and verifies that the current directory is the repository root.
 
+The activation starts a persisted `discovery` phase. After completing and presenting each phase artifact, call `hwcode_sdd_advance` for the next phase. The extension asks the user for explicit approval and rejects skipped transitions. Before `tests`, built-in write/edit tools are limited to `.hwcode/specs/`; during `tests`, they may also create test files. Production-file changes begin only in `implementation`.
+
 Use the locked root as the only project workspace. Use in-root paths silently. Explain a genuine external-path need and rely on the one-call approval prompt; never bypass it.
 
 Do not implement production behavior until the user has explicitly approved the requirements and then the design, test plan, and task plan. If later evidence exposes ambiguity, return to the earliest affected artifact and obtain approval again.

package/README.md

@@ -106,6 +106,13 @@ iterative build-and-verify loops. `/hwcode-sdd` additionally requires the curren
 to be the Git repository root, inventories the codebase, resolves requirement
 questions, and persists approved artifacts under
 `.hwcode/specs/<requirement-slug>/` before test-first implementation begins.
+SDD phases are persisted and advance one step at a time through an interactive
+approval gate. Before the tests phase, built-in file writes are restricted to
+the spec directory; production writes begin only in implementation.
+
+Use `/hwcode` to inspect, complete, or cancel the active workflow. Completing
+SDD is allowed only after verification. Cloud completion warns about any
+workflow-created resources that remain active in its resource inventory.
 
 ### Cloud workflow
 
@@ -136,15 +143,31 @@ confirmation unless the user approves remaining non-delete changes for the
 session. Resource deletion is always confirmed. After three genuinely distinct
 technical approaches fail, the workflow stops and reports causes, progress,
 remaining resources, and local changes instead of attempting a fourth approach.
+Read-only inspection and confirmed cleanup deletion remain available after the
+failure budget is reached.
+
+Terraform execution uses a pinned SSH Runner connection. New and existing hosts
+share the same OpenSSH SHA256 host-key confirmation path; private targets can be
+scanned through a verified ProxyJump. Runner execution requires Terraform,
+`tar`, `sha256sum`, a declared cloud workload identity, and an explicit non-local
+Terraform backend. The exact policy-checked file manifest is uploaded and its
+per-file digest is verified remotely before execution.
 
 After at least one cloud command succeeds, run
 `/hwcode-cloud-save-template [name]` to save the objective, validated execution
 sequence, failed approaches, prerequisites, and optional lessons learned as a
-local Prompt Template. Each template records its user-facing name plus creation
+local Prompt Template. A successful managed Terraform apply instead produces a
+schema-v2 Deployment Template bundle containing filtered Terraform, Helm,
+discovery and report artifacts plus verification notes, exclusion reasons, and
+content/metadata integrity digests. Each template records its user-facing name plus creation
 and update timestamps. Its prompt is layered into stable intent, prerequisites,
 the preferred known-good path, expensive failed paths that must not be retried,
-and the guarded execution contract. Templates are stored under
-`~/.hwcode/cloud/prompts/` with user-only permissions. Credential values are
+and the guarded execution contract. Prompt Templates are stored under
+`~/.hwcode/cloud/templates/prompts/`; Deployment Template bundles are stored
+under `~/.hwcode/cloud/templates/deployments/`, both with user-only permissions.
+Existing resources under the legacy `~/.hwcode/cloud/prompts/` and
+`~/.hwcode/cloud/templates/` locations remain discoverable and are updated in
+place when reused. Credential values are
 excluded and redacted before steps are persisted.
 
 Use `/hwcode-cloud-template [additional instructions]` to select and start a
@@ -161,14 +184,24 @@ Cloud approval guards.
 ## Internal architecture
 
 Extensions under `.pi/extensions/` are Pi-facing adapters: they register events,
-commands, tools, and UI. Reusable behavior lives under `.pi/lib/`:
-
-- `runtime/` owns layered/replacing configuration and session-state primitives.
-- `workflows/` owns the shared Vibe/SDD/Cloud lifecycle schema.
+commands, tools, and UI. `extensions/workflows.ts` is the single Workflow entry;
+Vibe/SDD live in `extensions/workflows/vibe-sdd.ts`, while the Cloud adapter is
+split under `extensions/workflows/cloud/` into activation, commands, events,
+Provider tools, Runner tools, Terraform tools, shared UI, and session runtime.
+Reusable behavior lives under `.pi/lib/`:
+
+- `runtime/` owns layered/replacing configuration, canonical runtime paths, and session-state primitives.
+- `workflows/` owns the shared lifecycle schema; `workflows/cloud/` contains the complete Cloud workflow domain, including its `remote/` and `terraform/` execution components.
 - `workspace/` owns tool and command path-boundary decisions.
-- `cloud/` owns provider adapters, isolated processes, and prompt templates.
 - `context/` and `models/` own compaction and provider-configuration policy.
 
+Runtime data is separated by ownership: project SDD specifications live under
+`.hwcode/specs/`, retained Cloud run artifacts live under
+`.hwcode/cloud/runs/<run-id>/`, and user-private credentials, SSH trust, and
+templates live under `~/.hwcode/cloud/`. Cloud run artifacts are deliberately
+retained for inspection and later template extraction; HWCode does not apply a
+time-based cleanup policy.
+
 `settings.json` is layered as defaults → profile → project for settings such as
 context and hidden commands. `welcome.json` uses a single replacing resource.
 `model-providers.json` is deliberately package-scoped so a project cannot