@hadooppei/hwcode 1.0.7 → 1.0.9

package/.pi/extensions/command-filter.ts

@@ -5,6 +5,7 @@ import {
 	filterCommandSuggestions,
 	parseHiddenCommands,
 } from "../lib/command-filter.ts";
+import { notify } from "../lib/extension-ui.ts";
 import { loadLayeredJson } from "../lib/runtime/config.ts";
 
 function loadHiddenCommands(cwd: string, notify: (message: string) => void): Set<string> {
@@ -21,9 +22,7 @@ function loadHiddenCommands(cwd: string, notify: (message: string) => void): Set
 export default function commandFilterExtension(pi: ExtensionAPI) {
 	pi.on("session_start", async (_event, ctx) => {
 		if (ctx.mode !== "tui") return;
-		const hiddenCommands = loadHiddenCommands(ctx.cwd, (message) => {
-			if (ctx.hasUI) ctx.ui.notify(message, "warning");
-		});
+		const hiddenCommands = loadHiddenCommands(ctx.cwd, (message) => notify(ctx, message, "warning"));
 
 		ctx.ui.addAutocompleteProvider((current) => ({
 			triggerCharacters: current.triggerCharacters,

package/.pi/extensions/cwd.ts

@@ -5,6 +5,7 @@ import type {
 } from "@earendil-works/pi-coding-agent";
 import { createLocalBashOperations } from "@earendil-works/pi-coding-agent";
 
+import { notify } from "../lib/extension-ui.ts";
 import {
 	canonicalizeDirectory,
 	clearWorkingDirectoryState,
@@ -28,10 +29,6 @@ interface ChangeResult {
 	error?: string;
 }
 
-function notify(ctx: ExtensionContext, message: string, level: "info" | "warning" | "error" = "info"): void {
-	if (ctx.hasUI) ctx.ui.notify(message, level);
-}
-
 function commandArgument(args: string): string {
 	const trimmed = args.trim();
 	if (!trimmed) return "";

package/.pi/extensions/knowledge.ts

@@ -0,0 +1,224 @@
+import { randomUUID } from "node:crypto";
+import { dirname } from "node:path";
+import { Worker } from "node:worker_threads";
+
+import { Type } from "@earendil-works/pi-ai";
+import { defineTool, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
+
+import {
+  buildKnowledgeExtractionPrompt, KNOWLEDGE_EXTRACTION_SYSTEM_PROMPT,
+} from "../lib/knowledge/extractor.ts";
+import { matchKnowledge } from "../lib/knowledge/matcher.ts";
+import { loadKnowledgeById, loadKnowledgeSnapshot, projectKnowledgeKey } from "../lib/knowledge/store.ts";
+import type { KnowledgeWorkerInput, KnowledgeWorkerOutput } from "../lib/knowledge/worker-protocol.ts";
+import { KNOWLEDGE_RUNTIME_DEFAULTS } from "../lib/runtime/defaults.ts";
+import { getWorkingDirectory } from "../lib/working-directory.ts";
+
+interface ActiveReview {
+  requestId: string;
+  leaderToken: string;
+  controller: AbortController;
+}
+
+interface ProcessKnowledgeRuntime {
+  worker?: Worker;
+  context?: ExtensionContext;
+  sessionsRoot?: string;
+  modelAvailable?: boolean;
+  activeReview?: ActiveReview;
+  capabilityTimer?: NodeJS.Timeout;
+}
+
+const RUNTIME_SYMBOL = Symbol.for("hwcode.knowledge.runtime.v3");
+const processGlobals = globalThis as unknown as Record<PropertyKey, unknown>;
+const runtime = (processGlobals[RUNTIME_SYMBOL] ??= {}) as ProcessKnowledgeRuntime;
+
+function post(message: KnowledgeWorkerInput): void {
+  runtime.worker?.postMessage(message);
+}
+
+function modelAvailable(ctx: ExtensionContext | undefined): boolean {
+  return Boolean(ctx?.model && ctx.modelRegistry.hasConfiguredAuth(ctx.model));
+}
+
+function updateCapability(): void {
+  if (!runtime.worker && runtime.context) ensureWorker();
+  if (!runtime.worker || !runtime.sessionsRoot) return;
+  const available = modelAvailable(runtime.context);
+  if (runtime.modelAvailable === available) return;
+  runtime.modelAvailable = available;
+  post({ type: "configure", modelAvailable: available, sessionsRoot: runtime.sessionsRoot });
+}
+
+function cancelActiveReview(): void {
+  runtime.activeReview?.controller.abort();
+}
+
+async function runReview(message: Extract<KnowledgeWorkerOutput, { type: "review_request" }>): Promise<void> {
+  const ctx = runtime.context;
+  if (!ctx?.model || !ctx.modelRegistry.hasConfiguredAuth(ctx.model)) {
+    post({ type: "review_result", leaderToken: message.leaderToken, requestId: message.requestId, error: "no-configured-model" });
+    updateCapability();
+    return;
+  }
+  if (!ctx.isIdle() || ctx.hasPendingMessages()) {
+    post({ type: "review_result", leaderToken: message.leaderToken, requestId: message.requestId, error: "model-executor-is-busy" });
+    return;
+  }
+  const controller = new AbortController();
+  runtime.activeReview = { requestId: message.requestId, leaderToken: message.leaderToken, controller };
+  const timeout = setTimeout(() => controller.abort(), KNOWLEDGE_RUNTIME_DEFAULTS.review.modelTimeoutMs);
+  timeout.unref();
+  try {
+    const response = await ctx.modelRegistry.complete(
+      ctx.model,
+      {
+        systemPrompt: KNOWLEDGE_EXTRACTION_SYSTEM_PROMPT,
+        messages: [{
+          role: "user",
+          content: [{ type: "text", text: buildKnowledgeExtractionPrompt(message.task.projectRoot, message.task.delta) }],
+          timestamp: Date.now(),
+        }],
+      },
+      { signal: controller.signal, reasoningEffort: "low", cacheRetention: "none", sessionId: randomUUID() },
+    );
+    if (controller.signal.aborted) throw new Error("knowledge-review-aborted-or-timed-out");
+    const raw = response.content.filter((item): item is { type: "text"; text: string } => item.type === "text")
+      .map((item) => item.text).join("\n");
+    post({ type: "review_result", leaderToken: message.leaderToken, requestId: message.requestId, raw });
+  } catch (error) {
+    post({
+      type: "review_result", leaderToken: message.leaderToken, requestId: message.requestId,
+      error: error instanceof Error ? error.message : String(error),
+    });
+  } finally {
+    clearTimeout(timeout);
+    if (runtime.activeReview?.requestId === message.requestId) runtime.activeReview = undefined;
+  }
+}
+
+function handleWorkerMessage(message: KnowledgeWorkerOutput): void {
+  if (message.type === "review_request") { void runReview(message); return; }
+  if (message.type === "review_cancel" && runtime.activeReview?.requestId === message.requestId) {
+    runtime.activeReview.controller.abort();
+  }
+}
+
+function ensureWorker(): Worker {
+  if (runtime.worker) return runtime.worker;
+  const worker = new Worker(new URL("../lib/knowledge/review-worker.ts", import.meta.url));
+  worker.unref();
+  runtime.worker = worker;
+  worker.on("message", (message: KnowledgeWorkerOutput) => handleWorkerMessage(message));
+  worker.on("error", () => {
+    cancelActiveReview();
+    if (runtime.worker === worker) {
+      runtime.worker = undefined;
+      runtime.modelAvailable = undefined;
+    }
+  });
+  worker.on("exit", () => {
+    if (runtime.worker === worker) {
+      runtime.worker = undefined;
+      runtime.modelAvailable = undefined;
+    }
+  });
+  runtime.capabilityTimer ??= setInterval(updateCapability, KNOWLEDGE_RUNTIME_DEFAULTS.review.capabilityPollMs);
+  runtime.capabilityTimer.unref();
+  return worker;
+}
+
+function configureForContext(ctx: ExtensionContext): void {
+  runtime.context = ctx;
+  runtime.sessionsRoot = dirname(ctx.sessionManager.getSessionDir());
+  ensureWorker();
+  const available = modelAvailable(ctx);
+  runtime.modelAvailable = available;
+  post({ type: "configure", modelAvailable: available, sessionsRoot: runtime.sessionsRoot });
+}
+
+function currentProject(ctx: ExtensionContext): { root: string; key: string } {
+  const root = getWorkingDirectory(ctx.sessionManager);
+  return { root, key: projectKnowledgeKey(root) };
+}
+
+export default function registerKnowledgeExtension(pi: ExtensionAPI): void {
+  pi.registerTool(defineTool({
+    name: "hwcode_knowledge_lookup",
+    label: "HWCode Knowledge Lookup",
+    description: "Search the shared HWCode knowledge catalog and load a detailed topic by ID.",
+    promptSnippet: "Use the compact knowledge index, then load a detailed topic only when it is relevant.",
+    parameters: Type.Object({
+      id: Type.Optional(Type.String({ description: "Canonical topic ID from the loaded HWCode knowledge index" })),
+      query: Type.Optional(Type.String({ description: "Keywords to search in the complete local knowledge catalog" })),
+    }),
+    executionMode: "sequential",
+    async execute(_id, params) {
+      const ctx = runtime.context;
+      if (!ctx) return { content: [{ type: "text", text: "Knowledge context is not available." }], isError: true, details: {} };
+      const { key } = currentProject(ctx);
+      if (params.id) {
+        const found = loadKnowledgeById(params.id, key);
+        if (!found) return { content: [{ type: "text", text: `No applicable knowledge found with ID: ${params.id}` }], isError: true, details: {} };
+        return { content: [{ type: "text", text: found.content }], details: {} };
+      }
+      if (params.query) {
+        const snapshot = loadKnowledgeSnapshot(key);
+        const matches = matchKnowledge(params.query, snapshot.catalog)
+          .filter((item) => item.scope === "global" || item.scope === `project:${key}`);
+        if (matches.length === 0) return { content: [{ type: "text", text: `No relevant knowledge found for: ${params.query}` }], details: {} };
+        return {
+          content: [{ type: "text", text: matches.map((item) => `- [${item.id}] ${item.title}: ${item.summary}`).join("\n") }],
+          details: {},
+        };
+      }
+      return { content: [{ type: "text", text: "Provide either id or query." }], isError: true, details: {} };
+    },
+  }));
+
+  pi.on("session_start", (_event, ctx) => configureForContext(ctx));
+
+  pi.on("model_select", (_event, ctx) => {
+    runtime.context = ctx;
+    updateCapability();
+  });
+
+  pi.on("before_agent_start", (event, ctx) => {
+    runtime.context = ctx;
+    updateCapability();
+    const { key } = currentProject(ctx);
+    const snapshot = loadKnowledgeSnapshot(key);
+    const sections = [
+      snapshot.rulesPrompt ? `<hwcode_rules>\n${snapshot.rulesPrompt}\n</hwcode_rules>` : "",
+      snapshot.memoryPrompt ? `<hwcode_knowledge_index>\n${snapshot.memoryPrompt}\n</hwcode_knowledge_index>` : "",
+    ].filter(Boolean);
+    if (sections.length === 0) return undefined;
+    return { systemPrompt: `${event.systemPrompt}\n\n${sections.join("\n\n")}` };
+  });
+
+  pi.on("input", (_event, ctx) => {
+    runtime.context = ctx;
+    cancelActiveReview();
+    updateCapability();
+    return undefined;
+  });
+
+  pi.on("agent_start", (_event, ctx) => {
+    runtime.context = ctx;
+    cancelActiveReview();
+  });
+
+  pi.on("agent_settled", (_event, ctx) => {
+    runtime.context = ctx;
+    updateCapability();
+    post({ type: "scan_now" });
+  });
+
+  pi.on("session_shutdown", (event) => {
+    cancelActiveReview();
+    if (event.reason === "quit") {
+      runtime.context = undefined;
+      updateCapability();
+    }
+  });
+}

package/.pi/extensions/workflows/cloud/activation.ts

@@ -4,29 +4,29 @@ import { resolve } from "node:path";
 
 import type { ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
 
+import { notify } from "../../../lib/extension-ui.ts";
 import { modelConfigurationIssue } from "../../../lib/models/readiness.ts";
 import { CLOUD_RUNTIME_DEFAULTS } from "../../../lib/runtime/defaults.ts";
 import { remoteRunnerPaths, userRuntimePaths } from "../../../lib/runtime/paths.ts";
 import { canonicalizeWorkspaceRoot } from "../../../lib/workflow-guard.ts";
 import { getWorkingDirectory } from "../../../lib/working-directory.ts";
 import { checkProviderCli, formatValidationFailure, validateCloudCredentials } from "../../../lib/workflows/cloud/adapters.ts";
-import { cloudDeploymentTemplateSource, listCloudDeploymentTemplates, materializeCloudDeploymentTemplate, type CloudDeploymentTemplate } from "../../../lib/workflows/cloud/bundles.ts";
+import { cloudTerraformTemplateSource, listCloudTerraformTemplates, materializeCloudTerraformTemplate, type CloudTerraformTemplate } from "../../../lib/workflows/cloud/bundles.ts";
 import { CLOUD_PROVIDERS, getCloudProvider, inaccessibleCloudCliMessage, missingCloudCliMessage, type CloudCredentials, type CloudVendorId } from "../../../lib/workflows/cloud/providers.ts";
 import { connectRemoteTarget } from "../../../lib/workflows/cloud/remote/connect.ts";
 import { remoteTargetLabel, remoteTargetSummary, type RemoteTargetProfile } from "../../../lib/workflows/cloud/remote/profiles.ts";
-import { cloudPromptTemplateSource, expandCloudPromptTemplate, listCloudPromptTemplates, type CloudPromptTemplate } from "../../../lib/workflows/cloud/templates.ts";
 import {
   cloudCredentialProfileLabel, defaultCloudVaultPath, listCloudCredentialProfiles,
   listRemoteTargetProfiles, saveCloudCredentialProfile, saveRemoteTargetProfile,
   writeCloudVault, type CloudCredentialProfile,
 } from "../../../lib/workflows/cloud/vault.ts";
-import { createCloudRunWorkspace } from "../../../lib/workflows/cloud/workspace.ts";
-import { activeWorkflow, createCloudWorkflowState, type CloudWorkflowDetails, type WorkflowState } from "../../../lib/workflows/state.ts";
-import type { CloudExtensionRuntime } from "./runtime.ts";
+import { cloudArtifactDirectory, createCloudRunWorkspace } from "../../../lib/workflows/cloud/workspace.ts";
 import {
-  activationPrompt, cloudDetails, collectCredentials, formatTemplateTime, notify,
-  remoteTrustInteraction, restoreCloudWorkflow, restoreLegacyCloudWorkflow, unlockVault,
-} from "./shared.ts";
+  activeWorkflow, cloudDetails, createCloudWorkflowState,
+  type CloudWorkflowDetails, type WorkflowState,
+} from "../../../lib/workflows/state.ts";
+import { collectCredentials, remoteTrustInteraction, unlockVault } from "./interactions.ts";
+import type { CloudExtensionRuntime } from "./runtime.ts";
 
 type RunnerSelection =
   | { kind: "cancel" }
@@ -34,6 +34,34 @@ type RunnerSelection =
   | { kind: "deferred" }
   | { kind: "profile"; profile: RemoteTargetProfile };
 
+function formatTemplateTime(value: string): string {
+  const date = new Date(value);
+  if (Number.isNaN(date.valueOf())) return value;
+  const pad = (part: number) => String(part).padStart(2, "0");
+  return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} ${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}`;
+}
+
+function activationPrompt(state: WorkflowState): string {
+  const details = cloudDetails(state)!;
+  const provider = getCloudProvider(details.vendor);
+  const guidance = details.templateGuidance
+    ? `\n\nReusable template guidance (${details.sourceTemplate?.name ?? "saved template"}):\n${details.templateGuidance}`
+    : "";
+  const runner = details.runner?.name
+    ?? (details.runnerPreference === "automatic" ? "automatic temporary Runner requested" : "not selected");
+  return `/skill:hwcode-cloud HWCode Cloud workflow activated.
+
+  Locked project root: ${state.root}
+  Task artifact workspace: ${cloudArtifactDirectory(state)}
+  Cloud provider: ${getCloudProvider(details.vendor).label}
+  Terraform Runner: ${runner}(Note: Runner is only for Terraform; regular discovery and CLI queries run locally via ${provider.cli})
+  Deploy current project: ${details.deployCurrentProject ? "yes" : "no"}
+  User objective:\n${details.request}${guidance}
+
+  Note: If the cloud CLI is unavailable on this machine, you may use Python scripts, Node.js SDKs, or curl to invoke the cloud provider's REST APIs directly. Otherwise, prefer hwcode_cloud_exec.
+  `;
+}
+
 async function chooseRunner(ctx: ExtensionCommandContext, payload: ReturnType<typeof import("../../../lib/workflows/cloud/vault.ts").createEmptyVault>, vendor: CloudVendorId, root: string, region: string): Promise<RunnerSelection> {
   const existing = listRemoteTargetProfiles(payload).filter((profile) => profile.vendor === vendor);
   const labels = existing.map(remoteTargetLabel);
@@ -81,25 +109,19 @@ async function ensureConversationModel(ctx: ExtensionCommandContext): Promise<bo
   return false;
 }
 
-export async function choosePromptTemplate(ctx: ExtensionCommandContext): Promise<CloudPromptTemplate | undefined> {
-  const templates = listCloudPromptTemplates();
-  if (templates.length === 0) { notify(ctx, "还没有本地 Cloud Prompt Template。成功执行任务后使用 /hwcode-cloud-save-template 保存。", "warning"); return undefined; }
-  const labels = templates.map((template) => `${template.name} · ${formatTemplateTime(template.updatedAt)}`);
-  const selected = await ctx.ui.select("选择已验证的 Cloud Prompt Template", labels);
-  const index = selected ? labels.indexOf(selected) : -1;
-  return index >= 0 ? templates[index] : undefined;
-}
-
-export async function chooseDeploymentTemplate(ctx: ExtensionCommandContext): Promise<CloudDeploymentTemplate | undefined> {
-  const templates = listCloudDeploymentTemplates();
-  if (templates.length === 0) { notify(ctx, "还没有 Terraform Deployment Template。成功 apply 后使用 /hwcode-cloud-save-template 保存。", "warning"); return undefined; }
+export async function chooseTerraformTemplate(ctx: ExtensionCommandContext): Promise<CloudTerraformTemplate | undefined> {
+  const templates = listCloudTerraformTemplates();
+  if (templates.length === 0) {
+    notify(ctx, "还没有 Terraform Template。首次成功完成 managed apply 后会自动保存。", "warning");
+    return undefined;
+  }
   const labels = templates.map((template) => `${template.manifest.name} · ${template.manifest.vendor} · ${formatTemplateTime(template.manifest.updatedAt)}`);
-  const selected = await ctx.ui.select("选择 Terraform Deployment Template", labels);
+  const selected = await ctx.ui.select("选择 Terraform Template", labels);
   const index = selected ? labels.indexOf(selected) : -1;
   return index >= 0 ? templates[index] : undefined;
 }
 
-export async function activateCloudWorkflow(runtime: CloudExtensionRuntime, args: string, ctx: ExtensionCommandContext, initialTemplate?: CloudPromptTemplate, initialBundle?: CloudDeploymentTemplate): Promise<void> {
+export async function activateCloudWorkflow(runtime: CloudExtensionRuntime, args: string, ctx: ExtensionCommandContext, initialBundle?: CloudTerraformTemplate): Promise<void> {
   if (ctx.mode !== "tui") { notify(ctx, "HWCode Cloud 要求在交互式 TUI 中启动，以安全遮罩凭据输入。", "error"); return; }
   if (!ctx.isIdle()) { notify(ctx, "请等待当前响应完成后再启动 HWCode Cloud。", "warning"); return; }
   if (!(await ensureConversationModel(ctx))) return;
@@ -110,7 +132,7 @@ export async function activateCloudWorkflow(runtime: CloudExtensionRuntime, args
     notify(ctx, `当前会话已有 ${currentWorkflow.mode} workflow。请新建 session 后再启动 HWCode Cloud。`, "warning");
     return;
   }
-  const storedState = restoreCloudWorkflow(ctx) ?? restoreLegacyCloudWorkflow(ctx);
+  const storedState = runtime.restore(ctx);
   let resumedState: WorkflowState | undefined;
   if (storedState && storedState.root === root && !cloudDetails(storedState)?.terminalFailure) {
     const storedDetails = cloudDetails(storedState)!;
@@ -122,14 +144,11 @@ export async function activateCloudWorkflow(runtime: CloudExtensionRuntime, args
     if (choice.startsWith("恢复 ")) resumedState = storedState;
   }
 
-  let template = initialTemplate;
-  if (!resumedState && !template && !initialBundle && !args.trim() && (listCloudPromptTemplates().length > 0 || listCloudDeploymentTemplates().length > 0)) {
-    const source = await ctx.ui.select("Cloud 任务来源", ["新建任务", "使用已有 Prompt Template", "使用 Terraform Deployment Template", "取消"]
-      .filter((item) => item !== "使用已有 Prompt Template" || listCloudPromptTemplates().length > 0)
-      .filter((item) => item !== "使用 Terraform Deployment Template" || listCloudDeploymentTemplates().length > 0));
+  let bundle = initialBundle;
+  if (!resumedState && !bundle && !args.trim() && listCloudTerraformTemplates().length > 0) {
+    const source = await ctx.ui.select("Cloud 任务来源", ["新建任务", "使用 Terraform Template", "取消"]);
     if (!source || source === "取消") return;
-    if (source === "使用已有 Prompt Template") { template = await choosePromptTemplate(ctx); if (!template) return; }
-    if (source === "使用 Terraform Deployment Template") { initialBundle = await chooseDeploymentTemplate(ctx); if (!initialBundle) return; }
+    if (source === "使用 Terraform Template") { bundle = await chooseTerraformTemplate(ctx); if (!bundle) return; }
   }
 
   let vendor: CloudVendorId;
@@ -139,16 +158,11 @@ export async function activateCloudWorkflow(runtime: CloudExtensionRuntime, args
   if (resumedState) {
     const details = cloudDetails(resumedState)!;
     ({ vendor, deployCurrentProject, request } = details);
-  } else if (initialBundle) {
-    vendor = initialBundle.manifest.vendor;
+  } else if (bundle) {
+    vendor = bundle.manifest.vendor;
     deployCurrentProject = true;
-    request = `复用 Terraform Deployment Template「${initialBundle.manifest.name}」并完成其验证、计划与部署`;
-    templateGuidance = existsSync(initialBundle.summaryPath) ? readFileSync(initialBundle.summaryPath, "utf8") : `sourceDigest=${initialBundle.manifest.sourceDigest}`;
-  } else if (template) {
-    vendor = template.vendor;
-    deployCurrentProject = template.deployCurrentProject;
-    request = template.objective || template.name;
-    templateGuidance = expandCloudPromptTemplate(template, args);
+    request = `复用 Terraform Template「${bundle.manifest.name}」并完成其验证、计划与部署`;
+    templateGuidance = existsSync(bundle.summaryPath) ? readFileSync(bundle.summaryPath, "utf8") : `sourceDigest=${bundle.manifest.sourceDigest}`;
   } else {
     const label = await ctx.ui.select("选择需要对接的云计算厂商", CLOUD_PROVIDERS.map((provider) => provider.label));
     if (!label) return;
@@ -237,16 +251,16 @@ export async function activateCloudWorkflow(runtime: CloudExtensionRuntime, args
   runtime.cleanupCredentialDirectories();
   runtime.activeCredentials = credentials;
   const artifactWorkspace = resumedState ? undefined : createCloudRunWorkspace(root);
-  const materializedBundle = initialBundle && artifactWorkspace ? materializeCloudDeploymentTemplate(initialBundle, artifactWorkspace.path) : undefined;
+  const materializedBundle = bundle && artifactWorkspace ? materializeCloudTerraformTemplate(bundle, artifactWorkspace.path) : undefined;
   runtime.activeState = resumedState ?? createCloudWorkflowState(
     root, vendor, deployCurrentProject, request,
-    (template || initialBundle) && templateGuidance ? {
-      source: initialBundle ? cloudDeploymentTemplateSource(initialBundle) : cloudPromptTemplateSource(template!),
+    bundle && templateGuidance ? {
+      source: cloudTerraformTemplateSource(bundle),
       guidance: templateGuidance,
     } : undefined,
     artifactWorkspace?.path,
   );
-  if (initialBundle && !resumedState) runtime.activeState = runtime.replaceDetails(runtime.activeState, { ...cloudDetails(runtime.activeState)!, terraformSourcePath: materializedBundle!.terraformPath }, runtime.activeState.phase);
+  if (bundle && !resumedState) runtime.activeState = runtime.replaceDetails(runtime.activeState, { ...cloudDetails(runtime.activeState)!, terraformSourcePath: materializedBundle!.terraformPath }, runtime.activeState.phase);
   if (runtime.activeRunner) runtime.activeState = runtime.replaceDetails(runtime.activeState, { ...cloudDetails(runtime.activeState)!, runnerPreference, runner: remoteTargetSummary(runtime.activeRunner) }, runtime.activeState.phase);
   else runtime.activeState = runtime.replaceDetails(runtime.activeState, { ...cloudDetails(runtime.activeState)!, runnerPreference }, runtime.activeState.phase);
   notify(ctx, `${vendorLabel} 连接成功。凭据已加密保存，项目根目录锁定为 ${root}。`);

package/.pi/extensions/workflows/cloud/commands.ts

@@ -1,96 +1,11 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
-import { cloudDeploymentTemplateSource, listCloudDeploymentTemplates, saveCloudDeploymentTemplate, updateCloudDeploymentTemplate } from "../../../lib/workflows/cloud/bundles.ts";
-import { redactCredentialValues } from "../../../lib/workflows/cloud/providers.ts";
-import { saveCloudWorkflowTemplate } from "../../../lib/workflows/cloud/template-save.ts";
-import { listCloudPromptTemplates, saveCloudPromptTemplate, updateCloudPromptTemplate } from "../../../lib/workflows/cloud/templates.ts";
-import { activateCloudWorkflow, chooseDeploymentTemplate, choosePromptTemplate } from "./activation.ts";
+import { activateCloudWorkflow } from "./activation.ts";
 import type { CloudExtensionRuntime } from "./runtime.ts";
-import { cloudDetails, formatTemplateTime, notify } from "./shared.ts";
 
 export function registerCloudCommands(pi: ExtensionAPI, runtime: CloudExtensionRuntime): void {
   pi.registerCommand("hwcode-cloud", {
     description: "Start or resume the guarded HWCode cloud workflow",
     handler: (args, ctx) => activateCloudWorkflow(runtime, args, ctx),
   });
-
-  pi.registerCommand("hwcode-cloud-template", {
-    description: "Start HWCode Cloud from a locally saved prompt or Terraform deployment template",
-    handler: async (args, ctx) => {
-      const promptTemplates = listCloudPromptTemplates();
-      const deploymentTemplates = listCloudDeploymentTemplates();
-      const source = await ctx.ui.select("选择本地 Cloud Template 类型", [
-        ...(promptTemplates.length > 0 ? ["Prompt Template"] : []),
-        ...(deploymentTemplates.length > 0 ? ["Terraform Deployment Template"] : []),
-        "取消",
-      ]);
-      if (source === "Prompt Template") {
-        const template = await choosePromptTemplate(ctx);
-        if (template) await activateCloudWorkflow(runtime, args, ctx, template);
-      } else if (source === "Terraform Deployment Template") {
-        const bundle = await chooseDeploymentTemplate(ctx);
-        if (bundle) await activateCloudWorkflow(runtime, args, ctx, undefined, bundle);
-      }
-    },
-  });
-
-  pi.registerCommand("hwcode-cloud-save-template", {
-    description: "Save or update the successful Cloud path as a Prompt or Terraform Deployment Template",
-    handler: async (args, ctx) => {
-      const activeState = runtime.restore(ctx);
-      const details = activeState && cloudDetails(activeState);
-      if (!activeState || !details || (details.successfulSteps.length === 0 && details.terraformRun?.phase !== "applied")) {
-        notify(ctx, "当前 Cloud workflow 还没有成功执行步骤，无法生成可复用模板。", "warning");
-        return;
-      }
-      if (details.terraformRun?.phase === "applied" && details.terraformRun.sourcePath) {
-        const existing = details.sourceTemplate?.kind === "terraform"
-          ? listCloudDeploymentTemplates().find((template) => template.manifest.id === details.sourceTemplate?.id)
-          : undefined;
-        let action: "update" | "create" = "create";
-        if (existing) {
-          const choice = await ctx.ui.select(`当前会话关联模板「${existing.manifest.name}」`, ["更新原模板", "创建新模板", "取消"]);
-          if (!choice || choice === "取消") return;
-          action = choice === "更新原模板" ? "update" : "create";
-        }
-        const name = (action === "update" ? existing!.manifest.name : args.trim() || await ctx.ui.input("Terraform Deployment Template 名称", `${details.vendor}-${new Date().toISOString().slice(0, 10)}`))?.trim();
-        if (!name) return;
-        try {
-          const template = action === "update"
-            ? updateCloudDeploymentTemplate(existing!, details.terraformRun.sourcePath, activeState, new Date(), details.artifactDirectory)
-            : saveCloudDeploymentTemplate(name, details.terraformRun.sourcePath, activeState, undefined, new Date(), details.artifactDirectory);
-          runtime.replaceDetails(activeState, { ...details, sourceTemplate: cloudDeploymentTemplateSource(template) });
-          notify(ctx, `${action === "update" ? "已更新" : "已保存"} Terraform Deployment Template「${template.manifest.name}」，包含完整性清单、Terraform、Helm、脱敏 discovery/reports 与验证摘要。`);
-        } catch (error) {
-          notify(ctx, `Terraform Deployment Template 保存失败：${error instanceof Error ? error.message : String(error)}`, "error");
-        }
-        return;
-      }
-
-      const result = await saveCloudWorkflowTemplate({
-        state: activeState,
-        requestedName: args,
-        redact: runtime.activeCredentials ? (value) => redactCredentialValues(value, runtime.activeCredentials!) : undefined,
-        interaction: {
-          async chooseSourceAction(source) {
-            const updateLabel = `更新原模板「${source.name}」`;
-            const choice = await ctx.ui.select(`当前会话关联模板「${details.sourceTemplate?.name ?? source.name}」`, [updateLabel, "创建新模板", "取消"]);
-            if (!choice || choice === "取消") return "cancel";
-            return choice === updateLabel ? "update" : "create";
-          },
-          inputName: (defaultName) => ctx.ui.input("模板名称", defaultName),
-          editNotes: (initialNotes) => ctx.ui.editor("补充必要前置条件、成功经验及必须避免的高消耗错误路径（可留空；不得包含凭据）", initialNotes),
-          sourceMissing(sourceName) { notify(ctx, `本次使用的原模板「${sourceName}」已不存在，将创建新模板。`, "warning"); },
-        },
-        store: {
-          list: () => listCloudPromptTemplates(),
-          create: (name, state, notes) => saveCloudPromptTemplate(name, state, undefined, notes),
-          update: (template, state, notes) => updateCloudPromptTemplate(template, state, notes),
-        },
-      });
-      if (result.status === "cancelled") return;
-      runtime.replaceDetails(activeState, result.details);
-      notify(ctx, `${result.action === "updated" ? "已更新" : "已创建"}模板「${result.template.name}」（${formatTemplateTime(result.template.updatedAt)}）。使用 /hwcode-cloud-template 可立即复用。`);
-    },
-  });
 }

package/.pi/extensions/workflows/cloud/events.ts

@@ -1,20 +1,15 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
+import { notify } from "../../../lib/extension-ui.ts";
 import { CLOUD_RUNTIME_DEFAULTS } from "../../../lib/runtime/defaults.ts";
-import { containsCloudCommand, getCloudProvider } from "../../../lib/workflows/cloud/providers.ts";
+import { getCloudProvider } from "../../../lib/workflows/cloud/providers.ts";
+import { cloudArtifactDirectory } from "../../../lib/workflows/cloud/workspace.ts";
+import { cloudDetails } from "../../../lib/workflows/state.ts";
 import type { CloudExtensionRuntime } from "./runtime.ts";
-import {
-  appendWorkflowState, cloudArtifactDirectory, cloudDetails, notify,
-  restoreLegacyCloudWorkflow,
-} from "./shared.ts";
 
 export function registerCloudEvents(pi: ExtensionAPI, runtime: CloudExtensionRuntime): void {
   pi.on("session_start", async (_event, ctx) => {
     runtime.restore(ctx);
-    if (!runtime.activeState) {
-      runtime.activeState = restoreLegacyCloudWorkflow(ctx);
-      if (runtime.activeState) appendWorkflowState(pi, runtime.activeState);
-    }
     runtime.clearSecrets();
     if (!runtime.activeState) return;
     const details = cloudDetails(runtime.activeState)!;
@@ -29,20 +24,22 @@ export function registerCloudEvents(pi: ExtensionAPI, runtime: CloudExtensionRun
       ? "Three distinct approaches already failed. Only summarize causes, progress, and changes; do not continue execution."
       : `Distinct failed approaches: ${details.failedApproaches.length}/${CLOUD_RUNTIME_DEFAULTS.workflow.maxFailedApproaches}. After the third distinct approach fails, stop and summarize.`;
     return {
-      systemPrompt: `${event.systemPrompt}\n\nHWCODE CLOUD ACTIVE\nProvider: ${details.vendor}\nObjective: ${details.request}\nArtifact workspace: ${cloudArtifactDirectory(activeState)}\nCredentials must never be requested in chat, printed, placed in tool arguments, or read from the vault. Write all generated Cloud artifacts only under the artifact workspace: discovery/ for CLI skeletons and snapshots, terraform/ for IaC, charts/ for Helm sources/packages, reports/ for plans and summaries. Project source remains under ${activeState.root}; when a provider CLI needs a project source file, pass its absolute project-root path. Use hwcode_cloud_exec for provider CLI operations. ${details.runner ? "Use hwcode_runner_prepare and hwcode_terraform_* for Terraform source synchronization, validation, planning, approval, and apply on the selected Runner." : details.runnerPreference === "automatic" ? "The user requested an automatic temporary Runner. Provision it through approved provider CLI changes with workload identity and cloud-init, then register the discovered endpoint with hwcode_runner_connect." : "No Terraform Runner is selected. Do not provision one unless the user explicitly changes this choice."} Resource creates and changes require approval unless the user opted out; deletion always requires approval. After success, offer /hwcode-cloud-save-template to preserve the validated path locally. ${failureRule}`
+      systemPrompt: `${event.systemPrompt}\n\nHWCODE CLOUD ACTIVE\nProvider: ${details.vendor}
+      Objective: ${details.request}\nArtifact workspace: ${cloudArtifactDirectory(activeState)}
+      Credentials must never be requested in chat, printed, placed in tool arguments, or read from the vault. \
+      Write all generated Cloud artifacts only under the artifact workspace: discovery/ for CLI skeletons and \
+      snapshots, terraform/ for IaC, charts/ for Helm sources/packages, reports/ for plans and summaries. \
+      Project source remains under ${activeState.root}; when a provider CLI needs a project source file, \
+      pass its absolute project-root path. Use hwcode_cloud_exec for provider CLI operations. \
+      ${details.runner ? "Use hwcode_runner_prepare and hwcode_terraform_* for Terraform source \
+      synchronization, validation, planning, approval, and apply on the selected Runner." : details.runnerPreference === "automatic" ? "The user requested an automatic temporary Runner. \
+      Provision it through approved provider CLI changes with workload identity and cloud-init, \
+      then register the discovered endpoint with hwcode_runner_connect." : "No Terraform Runner is selected. \
+      Do not provision one unless the user explicitly changes this choice."} Resource creates and changes require approval unless the user opted out; deletion always requires approval. ${failureRule}`
       + `\nConcurrency rule: Batch all independent read-only discovery calls concurrently in a single response turn. For resource creation, group independent operations into parallel tool calls while keeping dependent operations strictly sequential.`,
     };
   });
 
-  pi.on("tool_call", async (event, ctx) => {
-    return undefined; // TODO: block direct cloud CLI calls during active workflow
-    // const activeState = runtime.restore(ctx);
-    // if (!activeState || event.toolName !== "bash") return undefined;
-    // const input = event.input as Record<string, unknown>;
-    // if (typeof input.command !== "string" || !containsCloudCommand(input.command)) return undefined;
-    // return { block: true, reason: "Direct cloud and infrastructure CLI use is blocked during HWCode Cloud. Use hwcode_cloud_exec so credentials remain isolated and approvals are enforced." };
-  });
-
   pi.on("session_shutdown", async () => {
     runtime.activeState = undefined;
     runtime.clearSecrets();