dsh-cloudq 0.1.0

package/skills/cloudq/scripts/cleanup.py

@@ -0,0 +1,419 @@
+#!/usr/bin/env python3
+"""
+腾讯云智能顾问 - 配置清理脚本
+
+清理本机上 tencent-cloudq 产生的所有配置和缓存文件，
+可选删除云端通过本工具创建的 CAM 角色。
+
+用法:
+    python3 cleanup.py               # 交互式清理（逐项确认）
+    python3 cleanup.py --all         # 一键清理所有本地配置（不含云端角色）
+    python3 cleanup.py --all --cloud # 一键清理所有本地配置 + 云端角色
+
+清理范围:
+    1. 配置目录  ~/.tencent-cloudq/（含 config.json）
+    2. 凭证（OAuth / Connector）  ~/.tencent-cloudq/credential.json
+    3. 临时缓存  {系统临时目录}/.tcloud_advisor_uin_cache
+    4. 环境变量  TENCENTCLOUD_* 系列环境变量
+    5. 云端角色  CAM 角色 advisor（可选，需 AK/SK）
+
+返回码:
+    0 - 清理完成
+    1 - 用户取消
+
+跨平台支持: Windows / Linux / macOS
+"""
+
+import json
+import os
+import platform
+import shutil
+import sys
+import tempfile
+from pathlib import Path
+
+# 导入 tcloud_api 模块（用于可选的云端角色删除）
+SCRIPT_DIR = Path(__file__).resolve().parent
+sys.path.insert(0, str(SCRIPT_DIR))
+
+# ============== 配置 ==============
+CONFIG_DIR = Path.home() / ".tencent-cloudq"
+CONFIG_FILE = CONFIG_DIR / "config.json"
+CREDENTIAL_FILE = CONFIG_DIR / "credential.json"
+CACHE_FILE = Path(tempfile.gettempdir()) / ".tcloud_advisor_uin_cache"
+ROLE_NAME = "advisor"
+
+# 智能顾问使用的所有环境变量
+ENV_VARS = [
+    "TENCENTCLOUD_SECRET_ID",
+    "TENCENTCLOUD_SECRET_KEY",
+    "TENCENTCLOUD_TOKEN",
+    "TENCENTCLOUD_ROLE_ARN",
+    "TENCENTCLOUD_ROLE_NAME",
+    "TENCENTCLOUD_ROLE_SESSION",
+    "TENCENTCLOUD_STS_DURATION",
+]
+
+
+# ============== 终端颜色 ==============
+def _supports_color() -> bool:
+    if os.environ.get("NO_COLOR"):
+        return False
+    if platform.system() == "Windows":
+        return os.environ.get("TERM") == "xterm" or hasattr(sys.stderr, "reconfigure")
+    return hasattr(sys.stdout, "isatty") and sys.stdout.isatty()
+
+
+_COLOR = _supports_color()
+
+
+def _c(code: str, text: str) -> str:
+    return f"\033[{code}m{text}\033[0m" if _COLOR else text
+
+
+def green(t: str) -> str:
+    return _c("32", t)
+
+
+def red(t: str) -> str:
+    return _c("31", t)
+
+
+def yellow(t: str) -> str:
+    return _c("33", t)
+
+
+def bold(t: str) -> str:
+    return _c("1", t)
+
+
+def dim(t: str) -> str:
+    return _c("2", t)
+
+
+# ============== 工具函数 ==============
+def confirm(prompt: str) -> bool:
+    """交互式确认，默认为 No"""
+    try:
+        answer = input(f"{prompt} [y/N]: ").strip().lower()
+        return answer in ("y", "yes")
+    except (EOFError, KeyboardInterrupt):
+        print()
+        return False
+
+
+def read_config() -> dict:
+    """读取现有配置文件"""
+    if CONFIG_FILE.exists():
+        try:
+            return json.loads(CONFIG_FILE.read_text(encoding="utf-8"))
+        except (json.JSONDecodeError, OSError):
+            return {}
+    return {}
+
+
+def remove_file(path: Path, label: str) -> bool:
+    """删除单个文件"""
+    if not path.exists():
+        print(f"  {dim('[-]')} {label}: {dim('不存在，跳过')}")
+        return False
+    try:
+        path.unlink()
+        print(f"  {green('[OK]')} {label}: 已删除")
+        return True
+    except OSError as e:
+        print(f"  {red('[FAIL]')} {label}: 删除失败 - {e}")
+        return False
+
+
+def remove_dir(path: Path, label: str) -> bool:
+    """删除目录及其所有内容"""
+    if not path.exists():
+        print(f"  {dim('[-]')} {label}: {dim('不存在，跳过')}")
+        return False
+    try:
+        shutil.rmtree(str(path))
+        print(f"  {green('[OK]')} {label}: 已删除")
+        return True
+    except OSError as e:
+        print(f"  {red('[FAIL]')} {label}: 删除失败 - {e}")
+        return False
+
+
+# ============== 清理动作 ==============
+def clean_config_dir(interactive: bool) -> bool:
+    """清理配置目录 ~/.tencent-cloudq/"""
+    print(f"\n{bold('1. 配置目录')}")
+
+    if not CONFIG_DIR.exists():
+        print(f"  {dim('[-]')} {CONFIG_DIR}: {dim('不存在，跳过')}")
+        return False
+
+    # 列出目录内容
+    files = list(CONFIG_DIR.iterdir())
+    print(f"  路径: {CONFIG_DIR}")
+    if files:
+        for f in files:
+            size = f.stat().st_size if f.is_file() else 0
+            print(f"    - {f.name} ({size} bytes)")
+    else:
+        print(f"    {dim('(空目录)')}")
+
+    if interactive and not confirm(f"\n  确认删除 {CONFIG_DIR} ?"):
+        print(f"  {yellow('[SKIP]')} 用户跳过")
+        return False
+
+    return remove_dir(CONFIG_DIR, str(CONFIG_DIR))
+
+
+def clean_oauth_credential(interactive: bool) -> bool:
+    """清理凭证文件（OAuth / Connector）"""
+    print(f"\n{bold('2. 凭证文件')}")
+
+    if not CREDENTIAL_FILE.exists():
+        print(f"  {dim('[-]')} {CREDENTIAL_FILE}: {dim('不存在，跳过')}")
+        return False
+
+    print(f"  路径: {CREDENTIAL_FILE}")
+    try:
+        cred_data = json.loads(CREDENTIAL_FILE.read_text(encoding="utf-8"))
+        secret_id = cred_data.get("secretId", "")
+        masked = secret_id[:4] + "****" + secret_id[-4:] if len(secret_id) > 8 else "****"
+        print(f"    - 凭证类型: {cred_data.get('type', '未知')}")
+        print(f"    - SecretId: {masked}")
+    except (json.JSONDecodeError, OSError):
+        pass
+
+    if interactive and not confirm(f"\n  确认删除凭证文件?"):
+        print(f"  {yellow('[SKIP]')} 用户跳过")
+        return False
+
+    return remove_file(CREDENTIAL_FILE, "凭证文件")
+
+
+def clean_cache_file(interactive: bool) -> bool:
+    """清理临时缓存文件"""
+    print(f"\n{bold('3. 临时缓存')}")
+
+    if not CACHE_FILE.exists():
+        print(f"  {dim('[-]')} {CACHE_FILE}: {dim('不存在，跳过')}")
+        return False
+
+    print(f"  路径: {CACHE_FILE}")
+    try:
+        size = CACHE_FILE.stat().st_size
+        print(f"    - .tcloud_advisor_uin_cache ({size} bytes)")
+    except OSError:
+        pass
+
+    if interactive and not confirm(f"\n  确认删除 {CACHE_FILE} ?"):
+        print(f"  {yellow('[SKIP]')} 用户跳过")
+        return False
+
+    return remove_file(CACHE_FILE, str(CACHE_FILE))
+
+
+def clean_env_vars(interactive: bool) -> bool:
+    """清理智能顾问相关环境变量"""
+    print(f"\n{bold('5. 环境变量')}")
+
+    # 检测哪些环境变量当前已设置
+    found = {}
+    for var in ENV_VARS:
+        val = os.environ.get(var, "")
+        if val:
+            found[var] = val
+
+    if not found:
+        print(f"  {dim('[-]')} 未检测到已设置的 TENCENTCLOUD_* 环境变量，跳过")
+        return False
+
+    # 显示已设置的变量（敏感值掩码）
+    print(f"  检测到 {len(found)} 个已设置的环境变量:")
+    for var, val in found.items():
+        if "SECRET" in var or "TOKEN" in var or "KEY" in var:
+            display = val[:4] + "****" + val[-4:] if len(val) > 8 else "****"
+        else:
+            display = val
+        print(f"    - {var} = {display}")
+
+    if interactive and not confirm(f"\n  确认清理以上 {len(found)} 个环境变量?"):
+        print(f"  {yellow('[SKIP]')} 用户跳过")
+        return False
+
+    # 生成清理命令
+    is_windows = platform.system() == "Windows"
+    print()
+
+    if is_windows:
+        # Windows: 生成 PowerShell 脚本
+        script_file = Path(tempfile.gettempdir()) / "cleanup_tencent_env.ps1"
+        lines = ["# 腾讯云智能顾问 - 环境变量清理脚本 (PowerShell)",
+                 "# 自动生成，执行后可删除此文件", ""]
+        for var in found:
+            lines.append(f'Remove-Item Env:\\{var} -ErrorAction SilentlyContinue')
+            lines.append(f'Write-Host "  [OK] 已清除 {var}"')
+        lines.append("")
+        lines.append('Write-Host ""')
+        lines.append(f'Write-Host "  已清理 {len(found)} 个环境变量（仅影响当前会话）"')
+
+        script_file.write_text("\n".join(lines), encoding="utf-8")
+        print(f"  已生成 PowerShell 清理脚本: {script_file}")
+        print(f"  请在 PowerShell 中执行:")
+        print(f"    . {script_file}")
+
+    else:
+        # Linux / macOS: 生成 source 脚本
+        script_file = Path(tempfile.gettempdir()) / "cleanup_tencent_env.sh"
+        lines = ["#!/bin/sh",
+                 "# 腾讯云智能顾问 - 环境变量清理脚本",
+                 "# 自动生成，执行后可删除此文件", ""]
+        for var in found:
+            lines.append(f'unset {var}')
+            lines.append(f'echo "  [OK] 已清除 {var}"')
+        lines.append("")
+        lines.append('echo ""')
+        lines.append(f'echo "  已清理 {len(found)} 个环境变量（仅影响当前会话）"')
+
+        script_file.write_text("\n".join(lines), encoding="utf-8")
+        try:
+            os.chmod(str(script_file), 0o755)
+        except OSError:
+            pass
+        print(f"  已生成清理脚本: {script_file}")
+        print(f"  请在当前终端执行:")
+        print(f"    source {script_file}")
+
+    print()
+    print(f"  {yellow('注意')}: 环境变量存在于 shell 进程中，Python 脚本无法直接修改父 shell。")
+    print(f"         请执行上方命令完成清理（仅影响当前终端会话）。")
+    print(f"         如果变量写在 ~/.bashrc、~/.zshrc 或系统环境中，请手动移除对应行。")
+
+    return True
+
+
+def clean_cloud_role(interactive: bool) -> bool:
+    """删除云端 CAM 角色（可选）"""
+    print(f"\n{bold('4. 云端 CAM 角色')}")
+
+    secret_id = os.environ.get("TENCENTCLOUD_SECRET_ID", "")
+    secret_key = os.environ.get("TENCENTCLOUD_SECRET_KEY", "")
+
+    if not secret_id or not secret_key:
+        print(f"  {dim('[-]')} 未配置 AK/SK 环境变量，跳过云端角色清理")
+        print(f"      如需删除云端角色，请设置 TENCENTCLOUD_SECRET_ID 和 TENCENTCLOUD_SECRET_KEY 后重试")
+        return False
+
+    # 加载 tcloud_api
+    try:
+        from tcloud_api import call_api
+    except ImportError:
+        print(f"  {red('[FAIL]')} 无法加载 tcloud_api 模块")
+        return False
+
+    # 检查角色是否存在
+    print(f"  正在检查角色 {ROLE_NAME} ...")
+    check_result = call_api(
+        "cam", "cam.tencentcloudapi.com",
+        "GetRole", "2019-01-16",
+        {"RoleName": ROLE_NAME},
+    )
+
+    if not check_result.get("success"):
+        err_code = check_result.get("error", {}).get("code", "")
+        if "NotFound" in err_code or "not exist" in check_result.get("error", {}).get("message", "").lower():
+            print(f"  {dim('[-]')} 角色 {ROLE_NAME} 不存在，无需删除")
+            return False
+        else:
+            print(f"  {red('[FAIL]')} 查询角色失败: {check_result.get('error', {}).get('message', '未知错误')}")
+            return False
+
+    role_data = check_result.get("data", {})
+    role_id = role_data.get("RoleId", "unknown")
+    description = role_data.get("Description", "无描述")
+    print(f"  检测到角色:")
+    print(f"    名称: {ROLE_NAME}")
+    print(f"    ID:   {role_id}")
+    print(f"    描述: {description}")
+
+    if interactive and not confirm(f"\n  确认删除云端角色 {ROLE_NAME} ? (此操作不可恢复)"):
+        print(f"  {yellow('[SKIP]')} 用户跳过")
+        return False
+
+    # 执行删除
+    print(f"  正在删除角色 {ROLE_NAME} ...")
+    delete_result = call_api(
+        "cam", "cam.tencentcloudapi.com",
+        "DeleteRole", "2019-01-16",
+        {"RoleName": ROLE_NAME},
+    )
+
+    if delete_result.get("success"):
+        print(f"  {green('[OK]')} 云端角色 {ROLE_NAME} 已删除")
+        return True
+    else:
+        err_msg = delete_result.get("error", {}).get("message", "未知错误")
+        print(f"  {red('[FAIL]')} 删除角色失败: {err_msg}")
+        return False
+
+
+# ============== 主流程 ==============
+def main():
+    args = set(sys.argv[1:])
+
+    # 帮助信息
+    if args & {"-h", "--help"}:
+        print(__doc__)
+        sys.exit(0)
+
+    auto_mode = "--all" in args
+    include_cloud = "--cloud" in args
+
+    # 标题
+    print(f"\n{'=' * 58}")
+    print(f"  腾讯云智能顾问 - 配置清理")
+    print(f"{'=' * 58}")
+
+    # 显示当前配置摘要
+    config = read_config()
+    if config:
+        print(f"\n当前配置:")
+        print(f"  账号 UIN:  {config.get('accountUin', '未知')}")
+        print(f"  角色名称:  {config.get('roleName', '未知')}")
+        print(f"  角色 ARN:  {config.get('roleArn', '未知')}")
+        print(f"  配置时间:  {config.get('configuredAt', '未知')}")
+
+    interactive = not auto_mode
+
+    if interactive:
+        print(f"\n{dim('提示: 使用 --all 跳过确认，--cloud 同时删除云端角色')}")
+
+    # 执行清理（注意：云端角色删除必须在环境变量清理之前，因为需要 AK/SK）
+    results = []
+    results.append(("配置目录", clean_config_dir(interactive)))
+    results.append(("凭证文件", clean_oauth_credential(interactive)))
+    results.append(("临时缓存", clean_cache_file(interactive)))
+
+    if include_cloud:
+        results.append(("云端角色", clean_cloud_role(interactive)))
+    else:
+        print(f"\n{bold('4. 云端 CAM 角色')}")
+        print(f"  {dim('[-]')} 未指定 --cloud 参数，跳过云端角色清理")
+        print(f"      如需同时删除云端角色，请添加 --cloud 参数")
+
+    # 环境变量清理放在最后（云端角色删除可能需要用到 AK/SK）
+    results.append(("环境变量", clean_env_vars(interactive)))
+
+    # 汇总
+    cleaned = sum(1 for _, ok in results if ok)
+    total = len(results)
+
+    print(f"\n{'=' * 58}")
+    print(f"  清理完成: {cleaned}/{total} 项已清理")
+    print(f"{'=' * 58}\n")
+
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/skills/cloudq/scripts/create_role.py

@@ -0,0 +1,281 @@
+#!/usr/bin/env python3
+"""
+腾讯云智能顾问 — CAM 角色创建脚本 (Python 版)
+
+功能：创建 advisor 角色并关联 QcloudTAGFullAccess、QcloudAdvisorFullAccess 策略
+注意：本脚本包含 IAM 写入操作（CreateRole、AttachRolePolicy），
+      仅应在用户明确同意后执行，不可自动运行
+
+用法:
+    python3 create_role.py                  # 自动获取账号 UIN
+    python3 create_role.py --uin 100001234  # 手动指定账号 UIN
+
+返回码:
+    0 - 角色创建成功，配置已保存
+    1 - 参数错误
+    2 - AK/SK 未配置或无效
+    3 - 角色创建失败
+
+输出: JSON 格式结果（供 AI 解析）
+
+跨平台支持: Windows / Linux / macOS
+"""
+
+import json
+import os
+import platform
+import stat
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+
+# 导入 tcloud_api 模块
+SCRIPT_DIR = Path(__file__).resolve().parent
+sys.path.insert(0, str(SCRIPT_DIR))
+
+from tcloud_api import call_api  # noqa: E402
+
+# ============== 配置 ==============
+CONFIG_DIR = Path.home() / ".tencent-cloudq"
+CONFIG_FILE = CONFIG_DIR / "config.json"
+ROLE_NAME = "advisor"
+POLICY_NAMES = [
+    "QcloudTAGFullAccess",
+    "QcloudAdvisorFullAccess",
+]
+
+
+def output_json(obj: dict) -> str:
+    return json.dumps(obj, indent=2, ensure_ascii=False)
+
+
+def output_success(role_arn: str, account_uin: str, role_id: str = "unknown") -> dict:
+    return {
+        "success": True,
+        "action": "CreateAdvisorRole",
+        "data": {
+            "roleName": ROLE_NAME,
+            "roleArn": role_arn,
+            "roleId": role_id,
+            "accountUin": account_uin,
+            "policiesAttached": POLICY_NAMES,
+            "consoleLogin": True,
+            "configFile": str(CONFIG_FILE),
+        },
+    }
+
+
+def output_error(code: str, message: str) -> dict:
+    return {
+        "success": False,
+        "action": "CreateAdvisorRole",
+        "error": {"code": code, "message": message},
+    }
+
+
+MAX_ROLE_NAME_ATTEMPTS = 20
+
+
+def find_available_role_name() -> tuple:
+    """查找可用的角色名称，支持递增命名。
+
+    检查顺序: advisor → advisor1 → advisor2 → ...
+    - 如果角色不存在 → 返回该名称（可创建）
+    - 如果角色存在且 ConsoleLogin=1 → 返回该名称（已可用）
+    - 如果角色存在但 ConsoleLogin=0 → 尝试下一个名称
+
+    Returns:
+        tuple: (role_name, existing_ok)
+            role_name: 可用的角色名称，或 None（超过最大尝试次数）
+            existing_ok: True 表示角色已存在且支持控制台登录（无需创建）
+    """
+    candidates = [ROLE_NAME] + [f"{ROLE_NAME}{i}" for i in range(1, MAX_ROLE_NAME_ATTEMPTS)]
+    for name in candidates:
+        result = call_api(
+            "cam", "cam.tencentcloudapi.com",
+            "GetRole", "2019-01-16",
+            {"RoleName": name},
+        )
+        if not result.get("success"):
+            return name, False
+        if result.get("data", {}).get("ConsoleLogin", 0) == 1:
+            return name, True
+    return None, False
+
+
+def save_config(account_uin: str, role_arn: str, role_id: str = "",
+                auto_created: bool = True):
+    """保存配置到文件"""
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+
+    if platform.system() != "Windows":
+        try:
+            os.chmod(str(CONFIG_DIR), stat.S_IRWXU)  # 700
+        except OSError:
+            pass
+
+    config = {
+        "accountUin": account_uin,
+        "roleName": ROLE_NAME,
+        "roleArn": role_arn,
+        "roleId": role_id,
+        "configuredAt": datetime.now(timezone.utc).isoformat(),
+        "autoCreated": auto_created,
+        "version": "1.0",
+    }
+
+    CONFIG_FILE.write_text(
+        json.dumps(config, indent=2, ensure_ascii=False),
+        encoding="utf-8",
+    )
+
+    if platform.system() != "Windows":
+        try:
+            os.chmod(str(CONFIG_FILE), stat.S_IRUSR | stat.S_IWUSR)  # 600
+        except OSError:
+            pass
+
+
+def main():
+    # ============== 参数解析 ==============
+    account_uin = ""
+    args = sys.argv[1:]
+    i = 0
+    while i < len(args):
+        if args[i] == "--uin" and i + 1 < len(args):
+            account_uin = args[i + 1]
+            i += 2
+        else:
+            print(output_json(output_error("InvalidParameter", f"未知参数: {args[i]}")))
+            sys.exit(1)
+
+    # ============== 1. 检查 AK/SK ==============
+    secret_id = os.environ.get("TENCENTCLOUD_SECRET_ID", "")
+    secret_key = os.environ.get("TENCENTCLOUD_SECRET_KEY", "")
+
+    if not secret_id or not secret_key:
+        print(output_json(output_error(
+            "MissingCredentials",
+            "未配置 TENCENTCLOUD_SECRET_ID 或 TENCENTCLOUD_SECRET_KEY"
+        )))
+        sys.exit(2)
+
+    # ============== 2. 获取账号 UIN ==============
+    if not account_uin:
+        uin_result = call_api(
+            "sts", "sts.tencentcloudapi.com",
+            "GetCallerIdentity", "2018-08-13", {},
+        )
+        account_uin = str(uin_result.get("data", {}).get("AccountId", ""))
+
+        if not account_uin or account_uin in ("", "None", "null"):
+            error_msg = uin_result.get("error", {}).get("message", "无法获取账号 UIN")
+            print(output_json(output_error("GetCallerIdentityFailed", error_msg)))
+            sys.exit(2)
+
+    # ============== 3. 查找可用角色名称 ==============
+    target_role, existing_ok = find_available_role_name()
+
+    if target_role is None:
+        print(output_json(output_error(
+            "NoAvailableRoleName",
+            "无法找到可用的角色名称（已尝试 advisor ~ advisor19），"
+            "请到 CAM 控制台手动管理: https://console.cloud.tencent.com/cam/role"
+        )))
+        sys.exit(3)
+
+    if existing_ok:
+        # 角色已存在且支持控制台登录 → 补充缺失策略 + 保存配置
+        role_check = call_api(
+            "cam", "cam.tencentcloudapi.com",
+            "GetRole", "2019-01-16",
+            {"RoleName": target_role},
+        )
+        role_id = str(role_check.get("data", {}).get("RoleId", "unknown"))
+        role_arn = f"qcs::cam::uin/{account_uin}:roleName/{target_role}"
+
+        # 为存量角色补充新增策略（已关联的会返回成功或 PolicyAlreadyAttached，均无副作用）
+        attach_warnings = []
+        for policy_name in POLICY_NAMES:
+            attach_result = call_api(
+                "cam", "cam.tencentcloudapi.com",
+                "AttachRolePolicy", "2019-01-16",
+                {"AttachRoleName": target_role, "PolicyName": policy_name},
+            )
+            if not attach_result.get("success"):
+                err_code = attach_result.get("error", {}).get("code", "")
+                # PolicyAlreadyAttached 不视为错误
+                if "AlreadyAttached" not in err_code:
+                    err_msg = attach_result.get("error", {}).get("message", "未知错误")
+                    attach_warnings.append(f"策略 {policy_name} 关联失败: {err_msg}")
+                    print(f"WARNING: {attach_warnings[-1]}", file=sys.stderr)
+
+        save_config(account_uin, role_arn, role_id, auto_created=False)
+        result = output_success(role_arn, account_uin, role_id)
+        result["data"]["roleName"] = target_role
+        if attach_warnings:
+            result["data"]["warnings"] = attach_warnings
+        print(output_json(result))
+        sys.exit(0)
+
+    # ============== 4. 创建角色 ==============
+    trust_policy = json.dumps({
+        "version": "2.0",
+        "statement": [{
+            "action": "name/sts:AssumeRole",
+            "effect": "allow",
+            "principal": {
+                "qcs": [f"qcs::cam::uin/{account_uin}:root"]
+            }
+        }]
+    }, separators=(",", ":"))
+
+    create_result = call_api(
+        "cam", "cam.tencentcloudapi.com",
+        "CreateRole", "2019-01-16",
+        {
+            "RoleName": target_role,
+            "PolicyDocument": trust_policy,
+            "ConsoleLogin": 1,
+            "Description": "腾讯云智能顾问助手角色（由 tencent-cloudq skill 创建）",
+        },
+    )
+
+    if not create_result.get("success"):
+        err = create_result.get("error", {})
+        print(output_json(output_error(
+            err.get("code", "CreateRoleFailed"),
+            f"角色 {target_role} 创建失败: {err.get('message', '未知错误')}"
+        )))
+        sys.exit(3)
+
+    role_id = str(create_result.get("data", {}).get("RoleId", "unknown"))
+
+    # ============== 5. 关联策略 ==============
+    attach_warnings = []
+    for policy_name in POLICY_NAMES:
+        attach_result = call_api(
+            "cam", "cam.tencentcloudapi.com",
+            "AttachRolePolicy", "2019-01-16",
+            {"AttachRoleName": target_role, "PolicyName": policy_name},
+        )
+        if not attach_result.get("success"):
+            err_msg = attach_result.get("error", {}).get("message", "未知错误")
+            attach_warnings.append(f"策略 {policy_name} 关联失败: {err_msg}")
+            print(f"WARNING: {attach_warnings[-1]}", file=sys.stderr)
+
+    # ============== 6. 保存配置 ==============
+    role_arn = f"qcs::cam::uin/{account_uin}:roleName/{target_role}"
+    save_config(account_uin, role_arn, role_id, auto_created=True)
+
+    # ============== 7. 输出结果 ==============
+    result = output_success(role_arn, account_uin, role_id)
+    result["data"]["roleName"] = target_role
+    if attach_warnings:
+        result["data"]["warnings"] = attach_warnings
+    print(output_json(result))
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()