@hadooppei/hwcode 1.0.7 → 1.0.9

package/.pi/extensions/workflows/cloud/shared.ts

@@ -1,230 +0,0 @@
-import { readFileSync } from "node:fs";
-import { isAbsolute, resolve } from "node:path";
-
-import type { ExtensionAPI, ExtensionCommandContext, ExtensionContext, Theme } from "@earendil-works/pi-coding-agent";
-import { CURSOR_MARKER, Input, type Component, type TUI } from "@earendil-works/pi-tui";
-
-import { isCloudRunWorkspace } from "../../../lib/workflows/cloud/workspace.ts";
-import { type RemoteTrustInteraction } from "../../../lib/workflows/cloud/remote/connect.ts";
-import { getCloudProvider, CLOUD_PROVIDERS, redactCredentialValues, type CloudCredentials, type CloudOperation, type CloudVendorId } from "../../../lib/workflows/cloud/providers.ts";
-import {
-  cloudVaultExists, createEmptyVault, defaultCloudVaultPath, readCloudVault,
-} from "../../../lib/workflows/cloud/vault.ts";
-import { WORKFLOW_STATE_TYPE, activeWorkflow, type CloudWorkflowDetails, type WorkflowState } from "../../../lib/workflows/state.ts";
-
-export const CLOUD_AUDIT_TYPE = "hwcode-cloud-audit";
-export const ORCHESTRATION_COMMANDS = new Set(["terraform", "tofu", "pulumi", "kubectl", "helm"]);
-export const SENSITIVE_ARGUMENT = /^--?(?:access[-_]?key|secret(?:[-_]?(?:access|key))?|client[-_]?secret|password|credential|token)(?:=|$)/iu;
-const LEGACY_CLOUD_STATE_TYPE = "hwcode-cloud-state";
-
-interface LegacyCloudWorkflowState {
-  version: 1;
-  active: true;
-  root: string;
-  vendor: CloudVendorId;
-  deployCurrentProject: boolean;
-  request: string;
-  allowNonDeleteChanges: boolean;
-  failedApproaches: CloudWorkflowDetails["failedApproaches"];
-  terminalFailure: boolean;
-  activatedAt: string;
-}
-
-class MaskedInput implements Component {
-  private readonly input = new Input();
-  private _focused = true;
-  private readonly tui: TUI;
-  private readonly theme: Theme;
-  private readonly title: string;
-
-  constructor(
-    tui: TUI,
-    theme: Theme,
-    title: string,
-    done: (value: string | undefined) => void,
-  ) {
-    this.tui = tui;
-    this.theme = theme;
-    this.title = title;
-    this.input.onSubmit = (value) => done(value);
-    this.input.onEscape = () => done(undefined);
-    this.input.focused = true;
-  }
-
-  get focused(): boolean { return this._focused; }
-  set focused(value: boolean) { this._focused = value; this.input.focused = value; }
-  handleInput(data: string): void { this.input.handleInput(data); this.tui.requestRender(); }
-  invalidate(): void { this.input.invalidate(); }
-  render(width: number): string[] {
-    const masked = "•".repeat(Math.min(Array.from(this.input.getValue()).length, Math.max(1, width - 1)));
-    return [this.theme.fg("accent", this.title), `${masked}${CURSOR_MARKER}`, this.theme.fg("dim", "Enter 确认 · Esc 取消 · 输入内容不会显示")];
-  }
-}
-
-export function notify(ctx: ExtensionContext, message: string, level: "info" | "warning" | "error" = "info"): void {
-  if (ctx.hasUI) ctx.ui.notify(message, level);
-}
-
-export function cloudDetails(state: WorkflowState): CloudWorkflowDetails | undefined {
-  return state.mode === "cloud" ? state.details : undefined;
-}
-
-export function cloudArtifactDirectory(state: WorkflowState): string {
-  const path = cloudDetails(state)?.artifactDirectory;
-  return path && isCloudRunWorkspace(state.root, path) ? path : state.root;
-}
-
-export function formatTemplateTime(value: string): string {
-  const date = new Date(value);
-  if (Number.isNaN(date.valueOf())) return value;
-  const pad = (part: number) => String(part).padStart(2, "0");
-  return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} ${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}`;
-}
-
-export function restoreCloudWorkflow(ctx: ExtensionContext): WorkflowState | undefined {
-  const state = activeWorkflow(ctx.sessionManager.getEntries());
-  return state?.mode === "cloud" && state.details ? state : undefined;
-}
-
-function decodeLegacyCloudState(value: unknown): LegacyCloudWorkflowState | undefined {
-  if (!value || typeof value !== "object") return undefined;
-  const data = value as Record<string, unknown>;
-  if (data.version !== 1 || data.active !== true || typeof data.root !== "string"
-    || typeof data.vendor !== "string" || !CLOUD_PROVIDERS.some((provider) => provider.id === data.vendor)
-    || typeof data.deployCurrentProject !== "boolean" || typeof data.request !== "string"
-    || typeof data.allowNonDeleteChanges !== "boolean" || !Array.isArray(data.failedApproaches)
-    || typeof data.terminalFailure !== "boolean" || typeof data.activatedAt !== "string") return undefined;
-  return data as unknown as LegacyCloudWorkflowState;
-}
-
-export function restoreLegacyCloudWorkflow(ctx: ExtensionContext): WorkflowState | undefined {
-  for (const entry of [...ctx.sessionManager.getEntries()].reverse()) {
-    if (entry.type !== "custom" || entry.customType !== LEGACY_CLOUD_STATE_TYPE) continue;
-    const legacy = decodeLegacyCloudState(entry.data);
-    if (!legacy) return undefined;
-    return {
-      version: 2, status: "active", mode: "cloud", root: legacy.root,
-      phase: legacy.terminalFailure ? "failed" : "connected",
-      activatedAt: legacy.activatedAt, updatedAt: legacy.activatedAt,
-      details: {
-        vendor: legacy.vendor, deployCurrentProject: legacy.deployCurrentProject,
-        request: legacy.request, allowNonDeleteChanges: legacy.allowNonDeleteChanges,
-        failedApproaches: legacy.failedApproaches, successfulSteps: [], terminalFailure: legacy.terminalFailure,
-      },
-    };
-  }
-  return undefined;
-}
-
-export function appendWorkflowState(pi: ExtensionAPI, state: WorkflowState): void {
-  pi.appendEntry<WorkflowState>(WORKFLOW_STATE_TYPE, state);
-}
-
-async function secretInput(ctx: ExtensionContext, title: string): Promise<string | undefined> {
-  if (ctx.mode !== "tui") return undefined;
-  return ctx.ui.custom<string | undefined>((tui, theme, _keybindings, done) => new MaskedInput(tui, theme, title, done));
-}
-
-export async function unlockVault(ctx: ExtensionCommandContext): Promise<{ password: string; payload: ReturnType<typeof createEmptyVault> } | undefined> {
-  const vaultPath = defaultCloudVaultPath();
-  if (!cloudVaultExists(vaultPath)) {
-    while (true) {
-      const password = await secretInput(ctx, "创建云凭据主密码（至少 8 个字符）");
-      if (password === undefined) return undefined;
-      if (password.length < 8) { notify(ctx, "主密码至少需要 8 个字符。", "warning"); continue; }
-      const confirmation = await secretInput(ctx, "再次输入主密码");
-      if (confirmation === undefined) return undefined;
-      if (confirmation !== password) { notify(ctx, "两次输入的主密码不一致。", "warning"); continue; }
-      return { password, payload: createEmptyVault() };
-    }
-  }
-  while (true) {
-    const password = await secretInput(ctx, "输入云凭据主密码以解锁");
-    if (password === undefined) return undefined;
-    try { return { password, payload: readCloudVault(password, vaultPath) }; }
-    catch (error) {
-      notify(ctx, error instanceof Error ? error.message : String(error), "error");
-      if (!(await ctx.ui.confirm("重新输入主密码？", "凭据未解锁，HWCode Cloud 尚未启动。"))) return undefined;
-    }
-  }
-}
-
-export async function collectCredentials(vendor: CloudVendorId, root: string, ctx: ExtensionCommandContext): Promise<CloudCredentials | undefined> {
-  const credentials: CloudCredentials = {};
-  for (const field of getCloudProvider(vendor).credentialFields) {
-    let value = field.secret ? await secretInput(ctx, field.label) : await ctx.ui.input(field.label, field.placeholder);
-    if (value === undefined) return undefined;
-    value = value.trim();
-    if (!value && !field.optional) { notify(ctx, `${field.label} 不能为空。`, "warning"); return collectCredentials(vendor, root, ctx); }
-    if (!value) continue;
-    if (field.fileContents) {
-      const path = isAbsolute(value) ? value : resolve(root, value);
-      try { const contents = readFileSync(path, "utf8"); JSON.parse(contents); credentials[field.key] = contents; }
-      catch (error) {
-        notify(ctx, `无法读取有效的 JSON 凭据文件 ${path}: ${error instanceof Error ? error.message : String(error)}`, "error");
-        return collectCredentials(vendor, root, ctx);
-      }
-    } else credentials[field.key] = value;
-  }
-  if (vendor === "gcp") {
-    const account = JSON.parse(credentials.serviceAccountJson) as Record<string, unknown>;
-    credentials.projectId ||= typeof account.project_id === "string" ? account.project_id : "";
-    if (!credentials.projectId) { notify(ctx, "Service Account JSON 中没有 project_id，请重新输入。", "error"); return collectCredentials(vendor, root, ctx); }
-  }
-  return credentials;
-}
-
-export function activationPrompt(state: WorkflowState): string {
-  const details = cloudDetails(state)!;
-  const provider = getCloudProvider(details.vendor);
-  const guidance = details.templateGuidance
-    ? `\n\nReusable template guidance (${details.sourceTemplate?.name ?? "saved template"}):\n${details.templateGuidance}`
-    : "";
-  const runner = details.runner?.name ?? (details.runnerPreference === "automatic" ? "automatic temporary Runner requested" : "not selected");
-  return `/skill:hwcode-cloud HWCode Cloud workflow activated.
-  
-  Locked project root: ${state.root}
-  Task artifact workspace: ${cloudArtifactDirectory(state)}
-  Cloud provider: ${getCloudProvider(details.vendor).label}
-  Terraform Runner: ${runner}(Note: Runner is only for Terraform; regular discovery and CLI queries run locally via ${provider.cli})
-  Deploy current project: ${details.deployCurrentProject ? "yes" : "no"}
-  User objective:\n${details.request}${guidance}
-
-  Note: If the cloud CLI is unavailable on this machine, you may use Python scripts, Node.js SDKs, or curl to invoke the cloud provider's REST APIs directly. Otherwise, prefer hwcode_cloud_exec.
-  `;
-}
-
-let approvalQueue = Promise.resolve();
-export async function approveOperation(operation: CloudOperation, params: { command: string; args: string[]; intent: string }, state: WorkflowState, ctx: ExtensionContext): Promise<"allow" | "allow-session" | "deny"> {
-  if (operation === "read") return "allow";
-  if (!ctx.hasUI) return "deny";
-  const next = approvalQueue.then(async () => {
-    const details = cloudDetails(state)!;
-    const command = `${params.command} ${params.args.join(" ")}`;
-    if (operation === "delete") return await ctx.ui.confirm("确认删除云资源？", `目标：${params.intent}\n命令：${command}\n\n删除操作始终逐次确认。`) ? "allow" : "deny";
-    if (details.allowNonDeleteChanges) return "allow";
-    const choice = await ctx.ui.select("允许修改云账号内资源？", ["仅允许本次", "允许本会话后续非删除变更，不再询问", "拒绝"]);
-    if (choice === "仅允许本次") return "allow";
-    if (choice === "允许本会话后续非删除变更，不再询问") return "allow-session";
-    return "deny";
-  });
-
-  approvalQueue = next.then(() => {}, () => {});
-  return await next;
-}
-
-export function remoteTrustInteraction(ctx: ExtensionContext): RemoteTrustInteraction {
-  return {
-    confirm: async (host, port, keys, role) => ctx.hasUI && ctx.ui.confirm(
-      role === "jump" ? "信任 SSH 跳板机主机密钥？" : "信任 Terraform Runner 主机密钥？",
-      `主机：${host}:${port}\n${keys.map((key) => `${key.algorithm} ${key.fingerprint}`).join("\n")}\n\n请仅在指纹与云控制台或可信运维记录一致时确认。`,
-    ),
-  };
-}
-
-export function safeStepText(value: string, credentials: CloudCredentials): string {
-  return redactCredentialValues(value.replace(/[\r\n]+/gu, " ").slice(0, 2_000), credentials);
-}
-
-export const terraformError = (message: string) => ({ content: [{ type: "text" as const, text: message }], isError: true, details: {} });
-export const terraformOk = (message: string, details: Record<string, unknown> = {}) => ({ content: [{ type: "text" as const, text: message }], details });

package/.pi/lib/workflows/cloud/template-save.ts

@@ -1,108 +0,0 @@
-import type { CloudPromptTemplate } from "./templates.ts";
-import { cloudPromptTemplateSource } from "./templates.ts";
-import type { CloudWorkflowDetails, WorkflowState } from "../state.ts";
-import { CLOUD_RUNTIME_DEFAULTS } from "../../runtime/defaults.ts";
-
-export type CloudTemplateSourceAction = "update" | "create" | "cancel";
-export type CloudTemplateSaveStage = "source-action" | "name" | "notes";
-
-export interface CloudTemplateSaveInteraction {
-  chooseSourceAction(source: CloudPromptTemplate): Promise<CloudTemplateSourceAction | undefined>;
-  inputName(defaultName: string): Promise<string | undefined>;
-  editNotes(initialNotes: string): Promise<string | undefined>;
-  sourceMissing(sourceName: string): void | Promise<void>;
-}
-
-export interface CloudTemplateStore {
-  list(): CloudPromptTemplate[];
-  create(name: string, state: WorkflowState, notes: string): CloudPromptTemplate;
-  update(template: CloudPromptTemplate, state: WorkflowState, notes: string): CloudPromptTemplate;
-}
-
-export type CloudTemplateSaveResult =
-  | { status: "cancelled"; stage: CloudTemplateSaveStage }
-  | {
-    status: "saved";
-    action: "created" | "updated";
-    template: CloudPromptTemplate;
-    details: CloudWorkflowDetails;
-  };
-
-export interface SaveCloudWorkflowTemplateOptions {
-  state: WorkflowState;
-  requestedName?: string;
-  interaction: CloudTemplateSaveInteraction;
-  store: CloudTemplateStore;
-  redact?: (value: string) => string;
-}
-
-/**
- * Coordinates the save/update decision without depending on Pi UI or filesystem APIs.
- * Storage is invoked only after every interactive step succeeds, so cancellation and
- * storage failures cannot partially change the workflow state.
- */
-export async function saveCloudWorkflowTemplate(
-  options: SaveCloudWorkflowTemplateOptions,
-): Promise<CloudTemplateSaveResult> {
-  const { state, interaction, store } = options;
-  if (state.mode !== "cloud" || !state.details) throw new Error("Cloud workflow state is required");
-  if (state.details.successfulSteps.length === 0) {
-    throw new Error("No successful Cloud execution steps are available to summarize");
-  }
-
-  const details = state.details;
-  let target: CloudPromptTemplate | undefined;
-  if (details.sourceTemplate) {
-    target = store.list().find((template) => template.id === details.sourceTemplate?.id);
-    if (target) {
-      const sourceAction = await interaction.chooseSourceAction(target);
-      if (!sourceAction || sourceAction === "cancel") {
-        return { status: "cancelled", stage: "source-action" };
-      }
-      if (sourceAction === "create") target = undefined;
-    } else {
-      await interaction.sourceMissing(details.sourceTemplate.name);
-    }
-  }
-
-  let name = target?.name;
-  if (!name) {
-    const suppliedName = options.requestedName?.trim();
-    if (suppliedName) {
-      name = suppliedName;
-    } else {
-      const defaultName = details.sourceTemplate
-        ? `${details.sourceTemplate.name} 副本`
-        : details.request.slice(0, CLOUD_RUNTIME_DEFAULTS.templates.slugMaxLength);
-      name = (await interaction.inputName(defaultName))?.trim();
-    }
-    if (!name) return { status: "cancelled", stage: "name" };
-  }
-
-  const notes = await interaction.editNotes(target?.notes ?? "");
-  if (notes === undefined) return { status: "cancelled", stage: "notes" };
-
-  const redact = options.redact ?? ((value: string) => value);
-  const safeName = redact(name);
-  const safeNotes = redact(notes.trim());
-  const safeState: WorkflowState = {
-    ...state,
-    details: {
-      ...details,
-      request: redact(details.request),
-      templateGuidance: details.templateGuidance === undefined
-        ? undefined
-        : redact(details.templateGuidance),
-    },
-  };
-  const template = target
-    ? store.update(target, safeState, safeNotes)
-    : store.create(safeName, safeState, safeNotes);
-
-  return {
-    status: "saved",
-    action: target ? "updated" : "created",
-    template,
-    details: { ...details, sourceTemplate: cloudPromptTemplateSource(template) },
-  };
-}

package/.pi/lib/workflows/cloud/templates.ts

@@ -1,314 +0,0 @@
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { basename, dirname, join } from "node:path";
-
-import { getCloudProvider, isCloudVendorId, type CloudVendorId } from "./providers.ts";
-import type { CloudTemplateSource, WorkflowState } from "../state.ts";
-import { legacyUserCloudTemplatePaths, userRuntimePaths } from "../../runtime/paths.ts";
-import { CLOUD_RUNTIME_DEFAULTS } from "../../runtime/defaults.ts";
-
-export interface CloudPromptTemplate {
-  id: string;
-  name: string;
-  description: string;
-  createdAt: string;
-  updatedAt: string;
-  vendor: CloudVendorId;
-  deployCurrentProject: boolean;
-  objective: string;
-  notes: string;
-  body: string;
-  path: string;
-}
-
-export function cloudPromptTemplateSource(template: CloudPromptTemplate): CloudTemplateSource {
-  return {
-    id: template.id,
-    name: template.name,
-    createdAt: template.createdAt,
-    updatedAt: template.updatedAt,
-    kind: "prompt",
-  };
-}
-
-export function defaultCloudPromptDirectory(home = homedir()): string {
-  return userRuntimePaths(home).cloudPromptTemplates;
-}
-
-function slugify(value: string): string {
-  const slug = value
-    .normalize("NFKD")
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/gu, "-")
-    .replace(/^-+|-+$/gu, "")
-    .slice(0, CLOUD_RUNTIME_DEFAULTS.templates.slugMaxLength);
-  return slug || `task-${new Date().toISOString().slice(0, 10)}`;
-}
-
-function frontmatterValue(text: string, key: string): string | undefined {
-  const line = text.match(new RegExp(`^${key}:\\s*(.+)$`, "mu"))?.[1]?.trim();
-  if (!line) return undefined;
-  try {
-    const value = JSON.parse(line) as unknown;
-    return typeof value === "string" ? value : String(value);
-  } catch {
-    return line.replace(/^['"]|['"]$/gu, "");
-  }
-}
-
-function normalizeTimestamp(value: string | undefined, fallback: string): string {
-  if (!value) return fallback;
-  const date = new Date(value);
-  return Number.isNaN(date.valueOf()) ? fallback : date.toISOString();
-}
-
-function legacyTemplateName(id: string): string {
-  const words = id.replace(/^hwcloud-/u, "").split("-").filter(Boolean);
-  if (words.length === 0) return "Legacy Cloud Template";
-  return words.map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
-}
-
-function cleanTemplateName(value: string): string {
-  return value.replace(/[\r\n]+/gu, " ").replace(/\s+/gu, " ").trim().slice(0, CLOUD_RUNTIME_DEFAULTS.templates.nameMaxLength);
-}
-
-export function parseCloudPromptTemplate(path: string): CloudPromptTemplate | undefined {
-  const text = readFileSync(path, "utf8");
-  const match = text.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/u);
-  if (!match) return undefined;
-  const metadata = match[1];
-  const vendorValue = frontmatterValue(metadata, "hwcode-cloud-vendor");
-  if (!vendorValue || !isCloudVendorId(vendorValue)) return undefined;
-  const id = basename(path, ".md");
-  const stats = statSync(path);
-  const modifiedAt = stats.mtime.toISOString();
-  const bornAt = stats.birthtimeMs > 0 ? stats.birthtime.toISOString() : modifiedAt;
-  const name = cleanTemplateName(frontmatterValue(metadata, "hwcode-cloud-name") ?? "") || legacyTemplateName(id);
-  return {
-    id,
-    name,
-    description: frontmatterValue(metadata, "description") ?? name,
-    createdAt: normalizeTimestamp(frontmatterValue(metadata, "hwcode-cloud-created-at"), bornAt),
-    updatedAt: normalizeTimestamp(frontmatterValue(metadata, "hwcode-cloud-updated-at"), modifiedAt),
-    vendor: vendorValue,
-    deployCurrentProject: frontmatterValue(metadata, "hwcode-cloud-deploy") === "true",
-    objective: frontmatterValue(metadata, "hwcode-cloud-objective") ?? "",
-    notes: frontmatterValue(metadata, "hwcode-cloud-notes") ?? "",
-    body: match[2].trim(),
-    path,
-  };
-}
-
-export function listCloudPromptTemplates(
-  directory?: string,
-  home = homedir(),
-): CloudPromptTemplate[] {
-  const directories = directory
-    ? [directory]
-    : [...new Set([defaultCloudPromptDirectory(home), legacyUserCloudTemplatePaths(home).prompts])];
-  return directories
-    .filter(existsSync)
-    .flatMap((path) => readdirSync(path, { withFileTypes: true })
-      .filter((entry) => entry.isFile() && entry.name.endsWith(".md"))
-      .map((entry) => parseCloudPromptTemplate(join(path, entry.name))))
-    .filter((template): template is CloudPromptTemplate => Boolean(template))
-    .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt) || left.name.localeCompare(right.name));
-}
-
-export function expandCloudPromptTemplate(template: CloudPromptTemplate, argumentsText: string): string {
-  const value = argumentsText.trim();
-  return template.body.replace(/\$\{@:-([^}]*)\}/gu, (_match, fallback: string) => value || fallback);
-}
-
-function inlineCode(value: string): string {
-  return value.replace(/[\r\n]+/gu, " ").replaceAll("`", "\\`");
-}
-
-function singleLine(value: string): string {
-  return value.replace(/[\r\n]+/gu, " ").replace(/\s+/gu, " ").trim();
-}
-
-interface GeneralizedVar { placeholder: string; original: string; hint: string }
-
-const GENERALIZE_KEY_PATTERNS: Array<[RegExp, string, string]> = [
-  [/(?:^|--)(?:cli-)?region$/iu, "region", "使用当前凭据 region"],
-  [/vpc[-_]?id$/iu, "vpc-id", "ListVpcs 查询"],
-  [/subnet[-_]?id$/iu, "subnet-id", "ListSubnets 查询"],
-  [/image[-_]?id$/iu, "image-id", "ListImages 查询"],
-  [/secur(?:ity)?[-_]?group[-_]?id$/iu, "sg-id", "ListSecurityGroups 查询"],
-  [/key[-_]?(?:pair|name)$/iu, "key-name", "ListKeypairs 查询"],
-];
-
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
-const HEX32_RE = /^[0-9a-f]{32}$/iu;
-
-function generalizeArgs(args: readonly string[]): { args: string[]; vars: GeneralizedVar[] } {
-  const vars: GeneralizedVar[] = [];
-  const seen = new Set<string>();
-  const result = args.map((arg) => {
-    const eq = arg.indexOf("=");
-    if (eq > 0) {
-      const key = arg.slice(0, eq);
-      const val = arg.slice(eq + 1);
-      for (const [pattern, name, hint] of GENERALIZE_KEY_PATTERNS) {
-        if (pattern.test(key) && !seen.has(name)) {
-          seen.add(name);
-          vars.push({ placeholder: `<${name}>`, original: val, hint });
-          return `${key}=<${name}>`;
-        }
-      }
-      if (/id$/iu.test(key) && (UUID_RE.test(val) || HEX32_RE.test(val))) {
-        const name = key.replace(/^--(?:cli-)?/u, "").replace(/[_=]/gu, "-");
-        if (!seen.has(name)) {
-          seen.add(name);
-          vars.push({ placeholder: `<${name}>`, original: val, hint: "执行前通过只读查询获取" });
-          return `${key}=<${name}>`;
-        }
-      }
-    }
-    if ((UUID_RE.test(arg) || HEX32_RE.test(arg)) && !seen.has("resource-id")) {
-      seen.add("resource-id");
-      vars.push({ placeholder: "<resource-id>", original: arg, hint: "执行前通过只读查询获取" });
-      return "<resource-id>";
-    }
-    return arg;
-  });
-  return { args: result, vars };
-}
-
-export function renderCloudPromptTemplate(state: WorkflowState, notes = ""): string {
-  if (state.mode !== "cloud" || !state.details) throw new Error("Cloud workflow state is required");
-  const details = state.details;
-  if (details.successfulSteps.length === 0) {
-    throw new Error("No successful Cloud execution steps are available to summarize");
-  }
-  const provider = getCloudProvider(details.vendor);
-  const allVars: GeneralizedVar[] = [];
-  const steps = details.successfulSteps.map((step, index) => {
-    const gen = generalizeArgs(step.args);
-    for (const v of gen.vars) {
-      if (!allVars.some((e) => e.placeholder === v.placeholder)) allVars.push(v);
-    }
-    return `${index + 1}. [${step.operation}] ${singleLine(step.intent)}\n`
-      + `   - Validated approach: ${singleLine(step.approach)}\n`
-      + `   - Known-good command: \`${inlineCode([step.command, ...gen.args].join(" "))}\``;
-  }).join("\n");
-  const failedPaths = details.failedApproaches.length > 0
-    ? details.failedApproaches.map((failure, index) => (
-      `${index + 1}. **DO NOT RETRY:** ${singleLine(failure.approach)}\n`
-        + `   - Recorded failure: ${singleLine(failure.reason)}`
-    )).join("\n")
-    : "No failed execution paths were recorded for this run.";
-  return [
-    "Execute this HWCode Cloud task from a layered record of a previously successful run.",
-    "",
-    "## Layer 1 — Stable intent and boundaries",
-    "",
-    `Preferred provider: ${provider.label}`,
-    `Deploy current project: ${details.deployCurrentProject ? "yes" : "no"}`,
-    `Objective pattern: ${details.request}`,
-    "",
-    "Preserve the objective, provider boundary, credential isolation, resource approvals, and deletion confirmations. Adapt only environment-specific values.",
-    "",
-    "## Layer 2 — Preconditions and operator knowledge",
-    "",
-    "Start with read-only discovery. Re-check the active account, region, project, resource state, tool versions, and workspace paths before making changes.",
-    ...(notes ? ["", "Validated prerequisites, lessons, and expensive pitfalls:", notes] : []),
-    ...(allVars.length > 0 ? [
-      "",
-      "Environment-specific values (resolve via read-only discovery before executing):",
-      ...allVars.map((v) => `  ${v.placeholder.padEnd(20)} 原值: ${v.original}  → ${v.hint}`),
-    ] : []),
-    "",
-    "## Layer 3 — Preferred validated execution path",
-    "",
-    "Use this path first and preserve its order. Replace <placeholder> values with discovered IDs from the current environment before executing. The command structure is the known-good reference; do not replace it with speculative alternatives.",
-    "",
-    steps,
-    "",
-    "## Layer 4 — Expensive failed paths to avoid",
-    "",
-    "Do not retry any path below, including renamed or parameter-only variants. Reconsider one only when the user explicitly directs it after reviewing the recorded failure.",
-    "",
-    failedPaths,
-    "",
-    "## Layer 5 — Execution contract",
-    "",
-    "Present the adapted plan and obtain all normal HWCode Cloud approvals. Never copy credentials, assume old resources still exist, or skip current-state verification.",
-    "If HWCode Cloud is not active, do not run cloud commands directly; ask the user to start this template through /hwcode-cloud-template.",
-    "",
-    "Additional instructions: ${@:-Use the objective and successful sequence above.}",
-  ].join("\n");
-}
-
-function renderTemplateFile(
-  name: string,
-  state: WorkflowState,
-  notes: string,
-  createdAt: string,
-  updatedAt: string,
-): string {
-  if (state.mode !== "cloud" || !state.details) throw new Error("Cloud workflow state is required");
-  const body = renderCloudPromptTemplate(state, notes);
-  return [
-    "---",
-    `description: ${JSON.stringify(name)}`,
-    'argument-hint: "[additional instructions]"',
-    `hwcode-cloud-name: ${JSON.stringify(name)}`,
-    `hwcode-cloud-created-at: ${JSON.stringify(createdAt)}`,
-    `hwcode-cloud-updated-at: ${JSON.stringify(updatedAt)}`,
-    `hwcode-cloud-vendor: ${JSON.stringify(state.details.vendor)}`,
-    `hwcode-cloud-deploy: ${state.details.deployCurrentProject}`,
-    `hwcode-cloud-objective: ${JSON.stringify(state.details.request)}`,
-    `hwcode-cloud-notes: ${JSON.stringify(notes)}`,
-    "---",
-    body,
-    "",
-  ].join("\n");
-}
-
-function writeTemplateFile(path: string, content: string): void {
-  const directory = dirname(path);
-  mkdirSync(directory, { recursive: true, mode: 0o700 });
-  chmodSync(directory, 0o700);
-  const temporaryPath = `${path}.${process.pid}.tmp`;
-  writeFileSync(temporaryPath, content, { encoding: "utf8", mode: 0o600 });
-  chmodSync(temporaryPath, 0o600);
-  renameSync(temporaryPath, path);
-  chmodSync(path, 0o600);
-}
-
-export function saveCloudPromptTemplate(
-  requestedName: string,
-  state: WorkflowState,
-  directory = defaultCloudPromptDirectory(),
-  notes = "",
-  savedAt = new Date(),
-): CloudPromptTemplate {
-  if (state.mode !== "cloud" || !state.details) throw new Error("Cloud workflow state is required");
-  const name = cleanTemplateName(requestedName);
-  if (!name) throw new Error("Cloud Prompt Template name is required");
-  const idBase = `hwcloud-${slugify(name)}`;
-  const timestamp = savedAt.toISOString();
-  const content = renderTemplateFile(name, state, notes, timestamp, timestamp);
-  let id = idBase;
-  let path = join(directory, `${id}.md`);
-  for (let suffix = 2; existsSync(path); suffix++) {
-    id = `${idBase}-${suffix}`;
-    path = join(directory, `${id}.md`);
-  }
-  writeTemplateFile(path, content);
-  return parseCloudPromptTemplate(path)!;
-}
-
-export function updateCloudPromptTemplate(
-  template: CloudPromptTemplate,
-  state: WorkflowState,
-  notes = template.notes,
-  updatedAt = new Date(),
-): CloudPromptTemplate {
-  const timestamp = updatedAt.toISOString();
-  const content = renderTemplateFile(template.name, state, notes, template.createdAt, timestamp);
-  writeTemplateFile(template.path, content);
-  return parseCloudPromptTemplate(template.path)!;
-}