@hadooppei/hwcode 1.0.0 → 1.0.2

package/.pi/APPEND_SYSTEM.md

@@ -3,3 +3,5 @@
 Treat this repository as the active project boundary. Follow `AGENTS.md`, keep edits scoped to the user's request, and verify material changes before reporting completion.
 
 Do not expose secrets or perform destructive, irreversible, or externally visible actions without explicit user authorization.
+
+When using the hwcode-cloud workflow, invoke cloud provider CLI operations (e.g., hcloud, aws) via hwcode_cloud_exec instead of bash. Use hwcode_terraform_* tools for Terraform tasks. Standard project tasks (such as ssh build or test scripts) should continue using normal tools.

package/.pi/extensions/workflows/cloud/activation.ts

@@ -57,7 +57,7 @@ async function chooseRunner(ctx: ExtensionCommandContext, payload: ReturnType<ty
     return { kind: "profile", profile: await connectRemoteTarget({
       id: `runner-${vendor}-${Date.now()}`,
       name: `${vendor}-ssh-${host.replace(/[^a-z0-9]+/giu, "-").slice(0, 32)}`,
-      vendor, region: region || "default", host,
+      vendor, region: region || "", host,
       port: CLOUD_RUNTIME_DEFAULTS.runner.defaultPort, user, keyPath: defaultKey,
       knownHostsPath: userRuntimePaths(home).cloudKnownHosts,
       remoteRoot: remoteRunnerPaths(user).root,

package/.pi/extensions/workflows/cloud/runner-tools.ts

@@ -49,7 +49,7 @@ export function registerCloudRunnerTools(pi: ExtensionAPI, runtime: CloudExtensi
       try {
         profile = await connectRemoteTarget({
           id: `runner-${details.vendor}-${Date.now()}`, name: `${details.vendor}-temporary-runner`, vendor: details.vendor,
-          region: runtime.activeCredentials?.region || "default", host: params.host, port, user, keyPath,
+          region: runtime.activeCredentials?.region || "", host: params.host, port, user, keyPath,
           knownHostsPath: userRuntimePaths(home).cloudKnownHosts,
           remoteRoot: remoteRunnerPaths(user).root,
           identityType: params.identityType || "instance-role",

package/.pi/extensions/workflows/vibe-sdd.ts

@@ -144,6 +144,7 @@ function workflowSystemPrompt(state: WorkflowState): string {
 
 export function registerVibeSddWorkflows(pi: ExtensionAPI) {
 	let activeState: WorkflowState | undefined;
+	let allowExternalPathsForSession = false;
 
 	async function activate(mode: WorkflowMode, args: string, ctx: ExtensionCommandContext): Promise<void> {
 		if (!ctx.isIdle()) {
@@ -260,7 +261,7 @@ export function registerVibeSddWorkflows(pi: ExtensionAPI) {
 		}
 		const external = evaluateToolPathAccess({ toolName: event.toolName, input }, activeState.root);
 
-		if (external.length === 0) return undefined;
+		if (external.length === 0 || allowExternalPathsForSession) return undefined;
 		const details = external.map((entry) => `• ${entry.raw} → ${entry.resolved}`).join("\n");
 		if (!ctx.hasUI) {
 			return {
@@ -269,20 +270,21 @@ export function registerVibeSddWorkflows(pi: ExtensionAPI) {
 			};
 		}
 
-		const allowed = await ctx.ui.confirm(
-			"Allow external path for this call?",
+		const choice = await ctx.ui.select(
+			"Allow external path for this call? `${modeLabel(activeState.mode)} is locked to ${activeState.root}.`",
 			[
-				`${modeLabel(activeState.mode)} is locked to ${activeState.root}.`,
-				"This tool call references paths outside that root:",
-				"",
-				details,
-				"",
-				"Approval applies only to this tool call.",
-			].join("\n"),
+				"Allow once (仅允许本次)",
+				"Always allow for this session (本会话不再询问)",
+				"Deny (拒绝)"
+			]
 		);
-		if (!allowed) {
+		if (!choice || choice.startsWith("Deny")) {
 			return { block: true, reason: `User denied external path access:\n${details}` };
 		}
+		if (choice.startsWith("Always allow")) {
+			allowExternalPathsForSession = true;
+			notify(ctx, "[已开启本会话外部路径访问权限，后续不再提示]", "info");
+		}
 
 		pi.appendEntry(WORKFLOW_EXTERNAL_AUDIT_TYPE, {
 			mode: activeState.mode,
@@ -296,5 +298,6 @@ export function registerVibeSddWorkflows(pi: ExtensionAPI) {
 
 	pi.on("session_shutdown", () => {
 		activeState = undefined;
+		allowExternalPathsForSession = false; 
 	});
 }

package/.pi/lib/workflows/cloud/adapters.ts

@@ -42,18 +42,6 @@ function validationFailure(result: ProcessResult, credentials: CloudCredentials)
   return truncateOutput(redactCredentialValues(raw, credentials));
 }
 
-function huaweiAuthenticationArgs(credentials: CloudCredentials): string[] {
-  return [
-    `--cli-access-key=${credentials.accessKey}`,
-    `--cli-secret-key=${credentials.secretKey}`,
-    `--cli-region=${credentials.region}`,
-    ...(credentials.securityToken ? [`--cli-security-token=${credentials.securityToken}`] : []),
-    ...(credentials.projectId ? [`--cli-project-id=${credentials.projectId}`] : []),
-    ...(credentials.domainId ? [`--cli-domain-id=${credentials.domainId}`] : []),
-    "--cli-output=json",
-  ];
-}
-
 function basicAdapter(
   vendor: CloudVendorId,
   validationCommand: string,
@@ -129,11 +117,11 @@ const adapters: Record<CloudVendorId, CloudProviderAdapter> = {
     provider: getCloudProvider("huawei"),
     validate: ({ root, credentials, signal }) => runProcess(
       "hcloud",
-      ["IAM", "KeystoneListProjects", ...huaweiAuthenticationArgs(credentials)],
+      ["IAM", "KeystoneListProjects", ...mergeHuaweiArgs([], credentials)],
       { cwd: root, env: cloudEnvironment("huawei", credentials), signal, timeoutMs: CLOUD_RUNTIME_DEFAULTS.process.providerValidationTimeoutMs },
     ),
     prepare: async (command, args, { credentials }) => ({
-      args: command === "hcloud" ? [...args, ...huaweiAuthenticationArgs(credentials)] : args,
+      args: command === "hcloud" ? mergeHuaweiArgs(args, credentials) : args,
       env: cloudEnvironment("huawei", credentials),
     }),
   },
@@ -233,3 +221,32 @@ export function checkProviderCli(vendor: CloudVendorId, root: string): Promise<P
   const provider = getCloudProvider(vendor);
   return runProcess(provider.cli, provider.versionArgs, { cwd: root, timeoutMs: 10_000 });
 }
+
+function mergeHuaweiArgs(args: readonly string[], credentials: CloudCredentials): string[] {
+  const result = [...args];
+  const hasArg = (prefix: string) => result.some((arg) => arg.startsWith(prefix));
+  if (!hasArg("--cli-access-key=")) {
+    result.push(`--cli-access-key=${credentials.accessKey}`);
+  }
+  if (!hasArg("--cli-secret-key=")) {
+    result.push(`--cli-secret-key=${credentials.secretKey}`);
+  }
+  if (!hasArg("--cli-region=")) {
+    if (credentials.region?.trim()) {
+      result.push(`--cli-region=${credentials.region.trim()}`);
+    }
+  }
+  if (credentials.securityToken && !hasArg("--cli-security-token=")) {
+    result.push(`--cli-security-token=${credentials.securityToken}`);
+  }
+  if (credentials.projectId && !hasArg("--cli-project-id=")) {
+    result.push(`--cli-project-id=${credentials.projectId}`);
+  }
+  if (credentials.domainId && !hasArg("--cli-domain-id=")) {
+    result.push(`--cli-domain-id=${credentials.domainId}`);
+  }
+  if (!hasArg("--cli-output=")) {
+    result.push("--cli-output=json");
+  }
+  return result;
+}

package/.pi/lib/workflows/cloud/providers.ts

@@ -30,7 +30,7 @@ export const CLOUD_PROVIDERS: readonly CloudProvider[] = [
 			{ key: "accessKeyId", label: "Access Key ID" },
 			{ key: "secretAccessKey", label: "Secret Access Key", secret: true },
 			{ key: "sessionToken", label: "Session Token（临时凭据可选）", secret: true, optional: true },
-			{ key: "region", label: "默认 Region", placeholder: "us-east-1" },
+			{ key: "region", label: "默认 Region", placeholder: "请输入目标 Region（必填）" },
 		],
 	},
 	{
@@ -64,7 +64,7 @@ export const CLOUD_PROVIDERS: readonly CloudProvider[] = [
 			{ key: "accessKey", label: "Access Key (AK)" },
 			{ key: "secretKey", label: "Secret Access Key (SK)", secret: true },
 			{ key: "securityToken", label: "Security Token（临时凭据可选）", secret: true, optional: true },
-			{ key: "region", label: "Region", placeholder: "cn-north-4" },
+			{ key: "region", label: "Region", placeholder: "请输入目标 Region（必填）" },
 			{ key: "projectId", label: "Project ID（可选）", optional: true },
 			{ key: "domainId", label: "Domain ID（全局服务可选）", optional: true },
 		],
@@ -78,7 +78,7 @@ export const CLOUD_PROVIDERS: readonly CloudProvider[] = [
 			{ key: "accessKeyId", label: "AccessKey ID" },
 			{ key: "accessKeySecret", label: "AccessKey Secret", secret: true },
 			{ key: "securityToken", label: "STS Security Token（可选）", secret: true, optional: true },
-			{ key: "region", label: "默认 Region", placeholder: "cn-hangzhou" },
+			{ key: "region", label: "默认 Region", placeholder: "请输入目标 Region（必填）" },
 		],
 	},
 	{
@@ -90,7 +90,7 @@ export const CLOUD_PROVIDERS: readonly CloudProvider[] = [
 			{ key: "secretId", label: "SecretId" },
 			{ key: "secretKey", label: "SecretKey", secret: true },
 			{ key: "token", label: "临时凭据 Token（可选）", secret: true, optional: true },
-			{ key: "region", label: "默认 Region", placeholder: "ap-guangzhou" },
+			{ key: "region", label: "默认 Region", placeholder: "请输入目标 Region（必填）" },
 		],
 	},
 ] as const;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadooppei/hwcode",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "A customizable terminal coding agent with local-model support and HWCode workflows.",
   "type": "module",
   "bin": {