huaweicloud-devkit 0.1.17 → 0.1.21-dev.0

package/README.md

@@ -27,10 +27,10 @@ npx --yes huaweicloud-devkit uninstall # 卸载
 ### Codex
 
 ```bash
-npx --yes huaweicloud-devkit install --target codex     # 暂用于测试
+npx --yes huaweicloud-devkit install --target codex
 ```
 
-> **注意：** 如果未检测到 Codex CLI，安装程序会自动跳过 Codex。
+> 需要先安装 Codex CLI。`--target all` 会在 Codex CLI 缺失时跳过 Codex。
 
 ### Claude Code
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "0.1.17",
+  "version": "0.1.21-dev.0",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
   "files": [

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud-mate"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud-mate"

package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md

@@ -9,16 +9,20 @@ hcloud ECS ListFlavors --cli-region=<region> --cli-output=json
 hcloud ECS NovaListAvailabilityZones --cli-region=<region>
 
 ## 3. Find image
+
+```bash
+# Broad search — specific names may return empty in some regions
 hcloud IMS ListImages --cli-region=<region> --__imagetype=gold --__isregistered=true --limit=20
+```
 
-Common image IDs (cn-south-1, verify with region):
-| Image | ID |
-|-------|----|
-| Ubuntu 22.04 | Query live via ListImages |
-| CentOS 8.2 64bit | Query live via ListImages |
-| EulerOS 2.9 64bit | Query live via ListImages |
+If searching by name (e.g. --name="Ubuntu") returns empty: use broad search without name filter, pick from results. Some regions only offer Huawei Cloud EulerOS (HCE).
 
-Always run ListImages to get the latest image IDs — they change over time.
+Common images (verify live per region):
+| Image | Region | ID |
+|-------|--------|----|
+| HCE 2.0 Standard | cn-north-4 | 7d940784-ac0a-425f-b3fa-8478f1a1df70 |
+| Ubuntu 22.04 | Query live | Query live |
+| CentOS 8.2 | Query live | Query live |
 
 ## 4. Verify or create VPC/subnet
 hcloud VPC ListVpcs --cli-region=<region>
@@ -26,7 +30,7 @@ hcloud VPC ListSubnets --vpc_id=<vpc-id> --cli-region=<region>
 If no VPC/subnet exists: load `huawei-vpc` skill → create VPC → create subnet (with DNS) → create security group → return here.
 
 ## 5. Create keypair (recommended over adminPass)
-hcloud ECS NovaCreateKeypair --keypair.name=<name>
+hcloud ECS NovaCreateKeypair --keypair_name=<name>
 Save the returned private key to a local file. The public key is auto-injected.
 
 Password alternative:

package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md

@@ -38,7 +38,8 @@ Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet
 | SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |
 | Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |
 | Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
-| Unbind EIP | hcloud EIP UnbindPublicIp --publicip_id=<id> | references/eip.md |
+| Unbind EIP | hcloud EIP DisassociatePublicip --publicip_id=<id> | references/eip.md |
+| Delete EIP | hcloud EIP DeletePublicip --publicip_id=<id> | references/eip.md |
 | List EIPs | hcloud EIP ListPublicips | |
 | NAT gateway | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id> | Run `hcloud NAT CreateNatGateway --help` for available spec values |
 

package/plugins/huaweicloud-core/skills/huawei-vpc/references/network.md

@@ -1,5 +1,29 @@
 # VPC Network Management Reference
 
+## DNS Addresses by Region
+
+Subnets without DNS configuration will fail cloud-init. Use these DNS addresses:
+
+| Region | Primary DNS | Secondary DNS |
+|--------|------------|---------------|
+| cn-north-1 | 100.125.1.250 | 100.125.129.250 |
+| cn-north-4 | 100.125.1.250 | 100.125.129.250 |
+| cn-east-3 | 100.125.1.250 | 100.125.129.250 |
+| cn-south-1 | 100.125.1.250 | 100.125.129.250 |
+| ap-southeast-3 | 100.125.1.250 | 100.125.129.250 |
+
+**Subnet create with DNS**:
+```bash
+hcloud VPC CreateSubnet \
+  --subnet.name=<name> \
+  --subnet.vpc_id=<id> \
+  --subnet.cidr=10.50.1.0/24 \
+  --subnet.gateway_ip=10.50.1.1 \
+  --subnet.availability_zone=<az> \
+  --subnet.dnsList.1=100.125.1.250 \
+  --subnet.dnsList.2=100.125.129.250
+```
+
 ## Nested Prefix Summary
 
 KooCLI 7.x VPC API requires nested prefixes:
@@ -23,7 +47,7 @@ hcloud EIP AssociatePublicips --publicip_id=<id> \
   --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT
 
 # Unbind
-hcloud EIP UnbindPublicIp --publicip_id=<id>
+hcloud EIP DisassociatePublicip --publicip_id=<id>
 
 # List
 hcloud EIP ListPublicips

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -57,12 +57,14 @@ Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `
 
 ## Configure Credentials Outside Chat
 
+**NEVER let AK/SK enter shell history. This is the #1 credential leak vector.**
+
 - Create AK/SK in the Huawei Cloud console under `My Credentials -> Access Keys`.
-- **Interactive** (preferred): `hcloud configure init` — prompts safely for AK/SK/region.
-- **Non-interactive** (Agent/CI environments): `hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>` — user must execute outside agent chat.
-- Required concepts: Access Key ID, Secret Access Key, Region such as `ap-southeast-3`, and Project ID.
+- **Interactive** (preferred, SAFE): `hcloud configure init` — prompts for AK/SK via terminal input. Values do NOT enter shell history.
+- **Non-interactive** (DANGEROUS — AK/SK in shell history): `hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>`. Only use in ephemeral CI/CD shells. User must execute outside agent chat.
+- If MCP is available, use `huaweicloud_show_profile_redacted` to check status without ever seeing credentials.
 - Never paste AK/SK, passwords, tokens, or profile files into the agent conversation.
-- KooCLI stores credentials in `~/.hcloud/config.json`, NOT environment variables. `HCLOUD_ACCESS_KEY` / `HCLOUD_SECRET_KEY` / `HCLOUD_REGION` env vars are NOT read by KooCLI 7.x. Always use `hcloud configure set`.
+- KooCLI stores credentials in `~/.hcloud/config.json`, NOT environment variables. `HCLOUD_ACCESS_KEY` / `HCLOUD_SECRET_KEY` / `HCLOUD_REGION` env vars are NOT read by KooCLI 7.x.
 
 ## Safe Flow
 

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -323,19 +323,24 @@ async function cmdInstall() {
   if (target === 'codex' || target === 'all') {
     console.log('\n[Codex]');
     if (!hasCodexCLI()) {
-      console.log(`  \x1b[33mCodex CLI not found. Skipping Codex install.\x1b[0m`);
-      console.log('  To install for Codex, first install Codex CLI, then run:');
-      console.log('    npx huaweicloud-devkit install --target codex');
+      if (target === 'codex') {
+        console.log(`  \x1b[31mCodex CLI not found. Install Codex first: https://github.com/openai/codex-cli\x1b[0m`);
+        console.log(`  Then re-run: npx huaweicloud-devkit install --target codex`);
+        process.exit(1);
+      }
+      console.log(`  \x1b[33mCodex CLI not found. Skipping Codex.\x1b[0m`);
+      console.log('  Install Codex CLI to enable: npx huaweicloud-devkit install --target codex');
     } else {
       installCodex();
     }
   }
 
   console.log(`\n\x1b[32mInstallation complete!\x1b[0m`);
-  console.log(`\n\x1b[1m\x1b[33m========================================`);
-  console.log(`  IMPORTANT: Restart your OpenCode session now!`);
-  console.log(`  MCP tools only become available AFTER restart.`);
-  console.log(`========================================\x1b[0m`);
+  console.log(`\n\x1b[1m\x1b[33m╔══════════════════════════════════════════════════════╗`);
+  console.log(`\x1b[1m\x1b[33m║  MCP 工具在重启 OpenCode 会话后才生效                ║`);
+  console.log(`\x1b[1m\x1b[33m║  关闭当前会话 → 重新打开，直接描述华为云任务即可      ║`);
+  console.log(`\x1b[1m\x1b[33m║  重启前请勿执行 hcloud 命令，避免 AK/SK 泄露         ║`);
+  console.log(`\x1b[1m\x1b[33m╚══════════════════════════════════════════════════════╝\x1b[0m`);
 
   const hcloudOk = checkHcloud();
   if (!hcloudOk) {
@@ -346,8 +351,11 @@ async function cmdInstall() {
   }
 
   console.log(`\nAfter restart + hcloud setup, run: npx huaweicloud-devkit doctor`);
+
+  // Write install marker for doctor to detect
+  writeFileSync(join(opencodePluginsDir(), '.installed'), new Date().toISOString());
   if (target === 'opencode' || target === 'all') {
-    console.log('Or mention @huaweicloud-core in OpenCode');
+    console.log('Or describe your Huawei Cloud task in OpenCode');
   }
   if (target === 'codex' || target === 'all') {
     console.log('Or mention @huaweicloud-core in Codex');
@@ -477,7 +485,16 @@ async function cmdDoctor() {
     console.log('\x1b[33mFix failures above, then restart your OpenCode / Codex session.\x1b[0m');
   }
   if (fail === 0 && mcpConfigured) {
-    console.log('\n\x1b[32mAll checks passed.\x1b[0m Restart OpenCode and try @huaweicloud-core');
+    console.log('\n\x1b[32mAll checks passed.\x1b[0m Restart OpenCode, then describe your Huawei Cloud task');
+  }
+
+  // Detect "installed but not restarted" scenario
+  const installedMarker = join(opencodePluginsDir(), '.installed');
+  if (mcpConfigured && existsSync(installedMarker)) {
+    console.log(`\n\x1b[1m\x1b[31m╔══════════════════════════════════════════╗`);
+    console.log(`\x1b[1m\x1b[31m║  请重启 OpenCode！MCP 工具尚未激活       ║`);
+    console.log(`\x1b[1m\x1b[31m║  关闭当前会话 → 重新打开即可             ║`);
+    console.log(`\x1b[1m\x1b[31m╚══════════════════════════════════════════╝\x1b[0m`);
   }
 }
 
@@ -533,14 +550,38 @@ async function cmdInstallHcloud() {
     : join(homedir(), '.local', 'bin');
 
   if (os === 'win32') {
-    console.log(`[Windows] Download and unzip to ${installDir}`);
     const url = `${baseUrl}/huaweicloud-cli-windows-amd64.zip`;
-    console.log(`  Download: ${url}`);
-    console.log(`  Unzip to: ${installDir}`);
-    console.log(`  Add to PATH: ${installDir}`);
-    console.log(`  Verify: hcloud version`);
-    console.log('\n\x1b[33mWindows auto-install not supported yet. Run commands above manually.\x1b[0m');
-    console.log(`\nFull guide: https://support.huaweicloud.com/qs-hcli/hcli_02_003_01.html`);
+    const zipPath = join(installDir, 'hcloud.zip');
+
+    console.log(`[Windows] Auto-installing to ${installDir}...`);
+
+    try {
+      mkdirSync(installDir, { recursive: true });
+
+      // Download
+      console.log(`  Downloading ${url}...`);
+      const psCmd = `[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri '${url}' -OutFile '${zipPath}' -UseBasicParsing`;
+      spawnSync('powershell', ['-NoProfile', '-Command', psCmd], { stdio: 'inherit', windowsHide: true });
+
+      // Extract
+      console.log('  Extracting...');
+      spawnSync('powershell', ['-NoProfile', '-Command', `Expand-Archive -Path '${zipPath}' -DestinationPath '${installDir}' -Force`], { stdio: 'inherit', windowsHide: true });
+
+      // Clean up zip
+      rmSync(zipPath, { force: true });
+
+      // Add to PATH
+      console.log('  Adding to user PATH...');
+      spawnSync('setx', ['PATH', `${process.env.PATH};${installDir}`], { stdio: 'inherit', windowsHide: true });
+
+      console.log(`\n\x1b[32mInstall complete.\x1b[0m`);
+      console.log(`  Verify: ${join(installDir, 'hcloud.exe')} version`);
+      console.log('  Or restart terminal and: hcloud version');
+    } catch (e) {
+      console.log(`\n\x1b[33mAuto-install failed: ${e.message}\x1b[0m`);
+      console.log(`  Manual: download ${url}, unzip to ${installDir}, add to PATH`);
+      console.log(`  Guide: https://support.huaweicloud.com/qs-hcli/hcli_02_003_01.html`);
+    }
   } else if (os === 'linux') {
     console.log('[Linux] One-liner install:');
     console.log('  curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y');
@@ -564,7 +605,10 @@ async function cmdInstallHcloud() {
   }
 
   console.log('\nAfter install, set HCLOUD_BIN if hcloud is not on PATH.');
-  console.log('Then run: npx huaweicloud-devkit doctor');
+  console.log('\n\x1b[1m\x1b[33m=== Configure credentials SAFELY ===\x1b[0m');
+  console.log('  Interactive (safe): hcloud configure init');
+  console.log('  NEVER: hcloud configure set --cli-access-key=xxx  (AK/SK in shell history!)');
+  console.log('\nThen run: npx huaweicloud-devkit doctor');
 }
 
 async function main() {