huaweicloud-devkit 0.1.17

package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md

@@ -0,0 +1,77 @@
+---
+name: huawei-vpc
+description: "Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration."
+version: 1
+---
+
+# Huawei Cloud VPC
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet lifecycle, security groups, EIP management, NAT gateways, VPN, and network ACLs.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| VPC CIDR cannot change | Once set, VPC CIDR block is immutable |
+| Security group stateful | SG rules are stateful. Return traffic auto-allowed |
+| Network ACL stateless | ACL rules must allow both inbound AND outbound |
+| EIP bills when idle | Unbound EIP still charges. Release when unused |
+| Subnet AZ binding | Subnet tied to single AZ. Cross-AZ needs multiple subnets |
+| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required |
+| **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |
+| **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |
+| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. See `--help` for region-specific DNS IPs |
+
+## Common Workflows
+
+| Task | Command | Steps |
+|------|---------|-------|
+| Create VPC | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr> | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first |
+| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see `hcloud VPC CreateSubnet --help` |
+| Security group | hcloud VPC CreateSecurityGroup --security_group.name=<name> | references/security-group.md |
+| SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |
+| Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |
+| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
+| Unbind EIP | hcloud EIP UnbindPublicIp --publicip_id=<id> | references/eip.md |
+| List EIPs | hcloud EIP ListPublicips | |
+| NAT gateway | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id> | Run `hcloud NAT CreateNatGateway --help` for available spec values |
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|------------------|
+| Cannot reach instance | SG missing rule or no EIP -> Add SG rule / Bind EIP |
+| Subnet CIDR conflict | Overlapping with existing subnets -> Choose non-overlapping CIDR |
+| NAT gateway no internet | Route table missing default route -> Add 0.0.0.0/0 via NAT |
+| EIP quota exceeded | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10) |
+| EIP.7905 | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage |
+| VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |
+| EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
+| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help` |
+| SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction |
+
+## Security Considerations
+
+- MUST use security groups, NOT iptables
+- MUST scope SG rules to specific CIDRs, NOT 0.0.0.0/0
+- SHOULD use network ACLs as defense-in-depth
+- SHOULD place databases in private subnets (no EIP)
+- MUST enable VPC flow logs for audit
+
+## MCP Tools
+
+- huaweicloud_list_operations service=VPC
+- huaweicloud_run_readonly_command for VPC/subnet discovery
+- huaweicloud_run_approved_command for writes
+
+## References
+
+- VPC Docs: https://support.huaweicloud.com/vpc/
+- Subnet guide: references/subnet.md
+- Security group: references/security-group.md

package/plugins/huaweicloud-core/skills/huawei-vpc/references/network.md

@@ -0,0 +1,52 @@
+# VPC Network Management Reference
+
+## Nested Prefix Summary
+
+KooCLI 7.x VPC API requires nested prefixes:
+
+| Resource | Create Param Prefix | Example |
+|----------|---------------------|---------|
+| VPC | `--vpc.` | `--vpc.name=my-vpc --vpc.cidr=192.168.0.0/16` |
+| Subnet | `--subnet.` | `--subnet.name=web --subnet.vpc_id=<id> --subnet.cidr=192.168.1.0/24` |
+| Security Group | `--security_group.` | `--security_group.name=sg-web` |
+| SG Rule | `--security_group_rule.` | `--security_group_rule.direction=ingress` |
+
+## EIP Management
+
+```bash
+# Create EIP (pay-per-use)
+hcloud EIP CreatePublicip --publicip.type=<type> \
+  --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
+
+# Bind to ECS (PORT type, not ECS)
+hcloud EIP AssociatePublicips --publicip_id=<id> \
+  --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT
+
+# Unbind
+hcloud EIP UnbindPublicIp --publicip_id=<id>
+
+# List
+hcloud EIP ListPublicips
+
+# Delete (unbind first)
+hcloud EIP DeletePublicip --publicip_id=<id>
+```
+
+> EIP bills even when not bound. Release unused EIPs.
+
+## Security Group Quick Reference
+
+```bash
+# Create SG (no vpc_id needed)
+hcloud VPC CreateSecurityGroup --security_group.name=<name>
+
+# Add SSH rule
+hcloud VPC CreateSecurityGroupRule \
+  --security_group_rule.security_group_id=<sg-id> \
+  --security_group_rule.direction=<direction> \
+  --security_group_rule.protocol=<protocol> \
+  --security_group_rule.multiport=<port> \
+  --security_group_rule.remote_ip_prefix=<cidr>
+```
+
+> SG is stateful — return traffic auto-allowed. Network ACL is stateless — need both directions.

package/plugins/huaweicloud-core/skills/huawei-vpc/references/security-group.md

@@ -0,0 +1,59 @@
+# Security Group Rules
+
+## Security Group is NOT bound to VPC
+
+VPC v3 API `CreateSecurityGroup` does NOT accept a `vpc_id` parameter. Security groups are region-level resources, not VPC-bound. They work across any VPC in the same region.
+
+```bash
+# CORRECT — no vpc_id needed
+hcloud VPC CreateSecurityGroup --security_group.name=<name>
+
+# WRONG
+hcloud VPC CreateSecurityGroup --security_group.vpc_id=<vpc-id>
+```
+
+## KooCLI 7.x Nested Parameter Format
+
+Security group params use `--security_group.` prefix. Rules use `--security_group_rule.` prefix.
+
+## Create Security Group Rule
+
+Complete example with nested prefix:
+```bash
+hcloud VPC CreateSecurityGroupRule \
+  --security_group_rule.security_group_id=<sg-id> \
+  --security_group_rule.direction=<direction> \
+  --security_group_rule.protocol=<protocol> \
+  --security_group_rule.multiport=<port> \
+  --security_group_rule.remote_ip_prefix=<cidr>
+```
+
+> Always run `hcloud VPC CreateSecurityGroupRule --help` to verify param names.
+
+## Stateful vs Stateless
+
+| Feature | Security Group | Network ACL |
+|---------|---------------|-------------|
+| Stateful? | Yes — return traffic auto-allowed | No — must allow both directions |
+| Applied to | ECS instance NIC | Subnet |
+| Rules | Allow only | Allow and Deny |
+| Default | Deny all inbound, allow all outbound | Allow all |
+
+## Common Rules Reference
+
+| Direction | Protocol | Port | Source | Purpose |
+|-----------|----------|------|--------|---------|
+| Ingress | TCP | 22 | <office-ip>/32 | SSH |
+| Ingress | TCP | 80 | 0.0.0.0/0 | HTTP |
+| Ingress | TCP | 443 | 0.0.0.0/0 | HTTPS |
+| Ingress | TCP | 3306 | <sg-app-id> | MySQL from app |
+| Ingress | TCP | 6379 | <sg-app-id> | Redis from app |
+| Egress | ALL | ALL | 0.0.0.0/0 | Outbound default |
+
+## Common Errors
+
+| Error | Root Cause -> Fix |
+|-------|-------------------|
+| Cannot SSH | Default SG denies all inbound. Add port 22 rule |
+| Rule not effective | SG assigned to wrong instance. Verify NIC attachment |
+| `[USE_ERROR]不正确的参数:vpc_id` | Security groups don't need vpc_id. Remove it |

package/plugins/huaweicloud-core/skills/huawei-vpc/references/subnet.md

@@ -0,0 +1,50 @@
+# VPC Subnet Guide
+
+## Prerequisite: VPC CIDR is Immutable
+
+VPC CIDR block cannot be changed after creation. Plan carefully.
+
+## KooCLI 7.x Nested Parameter Format
+
+VPC API uses nested prefix: `--vpc.name`, `--subnet.vpc_id`, `--subnet.name`. NOT `--name` or `--vpc_id`.
+
+```bash
+# CORRECT
+hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=192.168.0.0/16
+
+hcloud VPC CreateSubnet \
+  --subnet.name=<name> \
+  --subnet.vpc_id=<vpc-id> \
+  --subnet.cidr=192.168.1.0/24 \
+  --subnet.gateway_ip=192.168.1.1 \
+  --subnet.availability_zone=<az>
+
+# WRONG — will fail with [USE_ERROR]
+hcloud VPC CreateVpc --name=xxx
+hcloud VPC CreateSubnet --vpc_id=xxx
+```
+
+## Key Constraints
+
+| Constraint | Detail |
+|-----------|--------|
+| Subnet bound to single AZ | Cross-AZ needs multiple subnets. AZ code format: `cn-south-1a` |
+| CIDR must not overlap | Cannot overlap with other subnets in same VPC |
+| Gateway IP auto-assigned | Default is first IP in CIDR range (e.g., 192.168.1.1 for /24) |
+| 5 IPs reserved per subnet | First 4 + broadcast reserved by platform |
+
+## Common Errors
+
+| Error | Root Cause -> Fix |
+|-------|-------------------|
+| `[USE_ERROR]不正确的参数:name` | Missing nested prefix. Use `--vpc.name=` or `--subnet.name=` |
+| CIDR overlap | Subnet CIDR must be within VPC CIDR and not overlap others |
+| AZ not found | Use `hcloud ECS NovaListAvailabilityZones --cli-region=<r>` to list valid AZ codes |
+
+## CIDR Planning Reference
+
+| Environment | VPC CIDR | Subnet CIDR |
+|------------|----------|-------------|
+| Dev | 192.168.0.0/16 | 192.168.1.0/24 |
+| Staging | 10.0.0.0/16 | 10.0.1.0/24 |
+| Production | 172.16.0.0/16 | 172.16.1.0/24 (public) + 172.16.2.0/24 (private) |

package/plugins/huaweicloud-core/skills/huawei-waf-aad/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: huawei-waf-aad
+description: "Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts)."
+version: 1
+---
+
+# Huawei Cloud WAF / AAD
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud WAF <Operation> --help` before constructing commands to discover exact parameter names and requirements. For AAD operations, use `hcloud AAD --help`.
+
+## Overview
+
+Domain expertise for WAF and Anti-DDoS. Covers WAF policy/rules, AAD protection, IP whitelist/blacklist, and rate limiting.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| WAF needs CNAME redirect | DNS must point to WAF endpoint, not server IP |
+| Premium instance required | Cloud WAF needs a dedicated/premium WAF instance |
+| AAD Standard vs Enterprise | Standard protects single IP. Enterprise protects entire IP ranges |
+| Rule order matters | WAF rules evaluated top-to-bottom within a policy |
+
+## Common Workflows
+
+### WAF
+
+| Task | Operation |
+|------|-----------|
+| List WAF instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| List policies | `ListPolicies --cli-region=<r> --project_id=<p>` |
+| Create custom rule | `BatchCreateCustomRule --cli-region=<r> --project_id=<p>` |
+| Create IP blacklist | `BatchCreateWhiteblackipRule --cli-region=<r> --project_id=<p>` |
+| Create CC rule | `BatchCreateCcRule --cli-region=<r> --project_id=<p>` |
+| Create geo rule | `BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>` |
+
+### AAD
+
+```bash
+hcloud AAD ListInstances --cli-region=<r> --project_id=<p>
+hcloud AAD CreateInstance --cli-region=<r> --project_id=<p>
+```
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| Website unreachable after WAF | Check CNAME record points to WAF endpoint |
+| WAF blocking legitimate traffic | Check rules order, adjust false positive settings |
+| AAD not responding | Standard AAD only protects single EIP. Check EIP binding |
+
+## Security
+
+- MUST use WAF for all public-facing web applications
+- SHOULD enable AAD for DDoS protection
+- MUST test WAF rules in report-only mode before blocking
+
+## Cross-Skill References
+
+- **EIP**: See `huawei-vpc` for elastic IP binding
+- **DNS/CNAME**: Configure via your DNS provider

package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: huaweicloud-api-and-sdk
+description: Huawei Cloud API and SDK guidance for application development. Use when writing code that calls Huawei Cloud services, choosing SDKs, building API requests, handling project_id, endpoint, auth, pagination, retries, error codes, or request IDs.
+---
+
+# Huawei Cloud API And SDK
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Use this skill when the deliverable is application code, API integration, or precise request construction.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| `project_id` in path for most services | Many Huawei Cloud APIs require `project_id` in the URL path. Get it from IAM or KooCLI profile |
+| Pagination is not automatic | APIs return paginated results. Always check for `next_marker` or `page_info` to avoid partial data |
+| AK/SK signing algorithm | Huawei Cloud uses HMAC-SHA256 signing with specific header ordering. Use SDK, don't implement manually |
+| Endpoint varies by service and region | Always verify at https://developer.huaweicloud.com/endpoint |
+| Error response in `body` not HTTP status | Many errors return HTTP 200 with error details in the JSON body. Check `error_code` or `error_msg` fields |
+
+## API Workflow
+
+1. Identify service, region, endpoint, API version, and whether `project_id` is required in the path.
+2. Verify the exact request body and response schema from official API documentation.
+3. Handle pagination explicitly. Do not assume a single page.
+4. Preserve `request_id` from errors and responses for troubleshooting.
+5. Classify operation risk before running a live call.
+6. For write APIs, produce a dry plan and ask the user before execution.
+
+## SDK Workflow
+
+1. Pick the SDK that matches the user's application language and existing dependency style.
+2. Use the official SDK client for the target service.
+3. Keep credentials out of source code. Use environment, profile, workload identity, or runtime secret injection.
+4. Add timeout, retry, and pagination handling.
+5. Return typed or structured results instead of unbounded raw logs.
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|-------------------|
+| Invalid project_id | Wrong or missing project_id in URL path. Use `hcloud IAM KeystoneListProjects` or KooCLI profile |
+| 401/AuthFailure | Expired AK/SK or wrong signing algorithm. Regenerate AK/SK or check SDK version |
+| 403/Forbidden | IAM permission missing. Check user/role has required action permissions |
+| Empty results | Pagination missing — add `limit` and check `marker` |
+| Endpoint not reachable | Wrong region/service endpoint. Verify at developer.huaweicloud.com/endpoint |
+
+## Terraform Priority
+
+Terraform Provider is low priority in V1. Mention it when the user needs reviewed, repeatable infrastructure changes. Do not default to Terraform for quick discovery or app-level SDK integration.
+
+## Cross-Skill References
+
+- **CLI setup**: See `huaweicloud-cli-and-auth` for KooCLI credential setup
+- **Safety**: See `huaweicloud-safety` for write operation approval flow

package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Huawei Cloud API And SDK"
+  short_description: "Build correct Huawei Cloud API requests and SDK integrations."
+  default_prompt: "Use $huaweicloud-api-and-sdk to plan this Huawei Cloud API or SDK integration."

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: huaweicloud-capability-discovery
+description: Discover Huawei Cloud capabilities for an agent task. Use when the user asks what Huawei Cloud service, Skill, CLI command, API, SDK, or document should be used, or when a request is scenario-shaped and needs capability selection before implementation.
+---
+
+# Huawei Cloud Capability Discovery
+
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Use this skill to turn vague developer intent into a precise Huawei Cloud capability path.
+
+## Workflow
+
+1. Classify the goal: application hosting, compute, container, serverless, storage, database, network, security, observability, AI, data, migration, cost, or troubleshooting.
+2. Search Huawei Cloud Skills first when the task is scenario-based or operational.
+3. Use official docs for exact service limits, API request/response fields, regions, and pricing-sensitive behavior.
+4. Prefer KooCLI for local read-only discovery after auth is configured.
+5. Before using KooCLI, discover exact operation names with `hcloud <Service> --help`; do not guess from intuition. Examples: list ECS instances with `ECS ListServersDetails`, create ECS with `ECS CreateServers`, inspect images through `IMS GlanceShowImage`.
+6. Prefer SDK docs when the deliverable is application code.
+7. Prefer MCP only when an approved Huawei Cloud MCP tool exists for the needed operation.
+8. Treat Terraform as a secondary V1 path for reviewed IaC, not the default.
+9. When no built-in devkit skill matches, browse the community skill marketplace at https://github.com/huaweicloud/huaweicloud-skills. Fetch the index from https://raw.githubusercontent.com/huaweicloud/huaweicloud-skills/master/skills-index/index.json.
+
+## Region Intent
+
+- Extract region intent from the user's words before querying. Examples: Singapore -> `ap-southeast-3` first, Hong Kong -> `ap-southeast-2`, Beijing -> `cn-north-4`, Shanghai -> `cn-east-3`.
+- Target operation region wins over reference-resource uncertainty. If the user says "buy ECS in Singapore, reference SSY", inspect Singapore first.
+- No blind all-region scans. If the reference resource location is unknown and the target region is not enough, ask the user for the region instead of scanning unrelated regions.
+- For unfamiliar names, check Huawei Cloud API Explorer or official endpoint documentation for the region and service endpoint mapping.
+
+## Output Format
+
+When routing a task, return:
+
+- `intent`: one concise sentence
+- `recommended_path`: Skills, CLI, API, SDK, MCP, or Terraform
+- `why`: why this path is shortest and safest
+- `next_action`: exact next command, document lookup, or code file to inspect
+- `risk`: read-only, write, secret, permission, cost, or public exposure
+
+## Avoid
+
+- Do not guess a service when Huawei Cloud Skills or official docs should be checked.
+- Do not load many service references. Pick the next one that matches the intent.
+- Do not propose write operations before the user has seen the plan.
+- Do not query every region just to find a reference resource.

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Huawei Cloud Capability Discovery"
+  short_description: "Find the right Huawei Cloud capability path for a developer task."
+  default_prompt: "Use $huaweicloud-capability-discovery to route this scenario to Huawei Cloud capabilities."

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -0,0 +1,125 @@
+---
+name: huaweicloud-cli-and-auth
+description: Safe Huawei Cloud KooCLI usage and authentication guidance. Use when working with hcloud, KooCLI, profiles, AK/SK, regions, projects, endpoints, CLI output, credential errors, or local Huawei Cloud account context.
+---
+
+# Huawei Cloud CLI And Auth
+
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Use KooCLI `hcloud` for local inspection and reviewed operations. Never ask the user to paste AK/SK, SK, tokens, passwords, or credential files into chat.
+
+## Install KooCLI
+
+Official guide: `https://support.huaweicloud.com/qs-hcli/hcli_02_003.html`.
+
+### Windows
+1. Download and unzip: `https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-windows-amd64.zip`
+2. Extract to `%USERPROFILE%\hcloud`, add to user `PATH`
+3. Verify: `hcloud version`
+
+### Linux (amd64 / arm64)
+One-liner (recommended):
+```bash
+curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
+```
+Or manual download:
+```bash
+# amd64
+curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-amd64.tar.gz"
+tar -zxvf huaweicloud-cli-linux-amd64.tar.gz
+# arm64
+curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-arm64.tar.gz"
+tar -zxvf huaweicloud-cli-linux-arm64.tar.gz
+```
+Move to PATH: `mv $(pwd)/hcloud ~/.local/bin/`
+Verify: `hcloud version`
+
+### macOS (amd64 / arm64)
+One-liner (recommended):
+```bash
+curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
+```
+Or manual download:
+```bash
+# amd64
+curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-amd64.tar.gz"
+tar -zxvf huaweicloud-cli-mac-amd64.tar.gz
+# arm64 (Apple Silicon)
+curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-arm64.tar.gz"
+tar -zxvf huaweicloud-cli-mac-arm64.tar.gz
+```
+Move to PATH: `mv $(pwd)/hcloud /usr/local/bin/`
+Verify: `hcloud version`
+
+Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `hcloud`, restart after updating `PATH`, or set `HCLOUD_BIN`.
+
+## Configure Credentials Outside Chat
+
+- Create AK/SK in the Huawei Cloud console under `My Credentials -> Access Keys`.
+- **Interactive** (preferred): `hcloud configure init` — prompts safely for AK/SK/region.
+- **Non-interactive** (Agent/CI environments): `hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>` — user must execute outside agent chat.
+- Required concepts: Access Key ID, Secret Access Key, Region such as `ap-southeast-3`, and Project ID.
+- Never paste AK/SK, passwords, tokens, or profile files into the agent conversation.
+- KooCLI stores credentials in `~/.hcloud/config.json`, NOT environment variables. `HCLOUD_ACCESS_KEY` / `HCLOUD_SECRET_KEY` / `HCLOUD_REGION` env vars are NOT read by KooCLI 7.x. Always use `hcloud configure set`.
+
+## Safe Flow
+
+1. Check whether `hcloud` is installed.
+2. **KooCLI first-run privacy agreement**: On a fresh KooCLI install, `hcloud` blocks with `同意并继续使用(y)/不同意并退出(N)` and fails with `[USE_ERROR]您输入的是无效字符` in non-interactive mode. Detection: check command output for these strings. Ask the user: "KooCLI needs to accept its privacy agreement. May I accept it on your behalf?" If the user agrees, run `huaweicloud_run_readonly_command` with `args=["version"]` and `stdin="y\n"`. This accepts the agreement once, after which hcloud works normally.
+3. Ask the user to configure credentials outside the agent conversation when setup is needed.
+4. Inspect profile and region only through redacted tooling.
+4. Discover exact operation names with `hcloud <Service> --help` before guessing. Example: ECS instance listing is commonly `ECS ListServersDetails`; ECS creation is commonly `ECS CreateServers`; image lookup may be under `IMS GlanceShowImage`.
+5. Use `--cli-output=json` for machine-readable responses when supported.
+6. For resource operations, include `--cli-region`, `--cli-profile`, and service-specific project information when required.
+7. Classify every command before running it:
+   - Read-only: `List*`, `Show*`, `Get*`, `Describe*`.
+   - Write: `Create*`, `Delete*`, `Update*`, `Resize*`, `Start*`, `Stop*`, `Authorize*`, and similar.
+   - Secret: any operation returning secret string, binary secret, token, or password.
+8. For write operations, show the exact command and ask for explicit approval.
+
+## KooCLI Syntax Notes
+
+- Prefer `--param=value`; KooCLI 7.x may reject some space-separated parameter forms.
+- Array-style parameters use 1-based indexes, for example `--server.nics.1.subnet_id=<subnet-id>`, not `.0`.
+- For ECS creation, first inspect help: `hcloud ECS CreateServers --help`.
+- Minimal create shape to refine after help lookup:
+
+```bash
+hcloud ECS CreateServers --cli-region=<region> --server.name=<name> --server.flavorRef=<flavor-id> --server.imageRef=<image-id> --server.nics.1.subnet_id=<subnet-id> --server.root_volume.volumetype=<type>
+```
+
+If a command needs an `adminPass` or other password field, do not leave plaintext secrets in shell history. Prefer local-only input or runtime injection.
+
+## Output Formatting
+
+```bash
+# JSON format (recommended for Agent)
+hcloud <Service> <Op> --cli-output=json
+
+# Table format (manual viewing)
+hcloud <Service> <Op> --cli-output=table
+
+# JMESPath filtering (extract specific fields)
+hcloud <Service> <ListOp> --cli-output=json --cli-query "items[?status=='ACTIVE'].{ID:id,Name:name}"
+
+# Debug mode (when commands fail)
+hcloud <Service> <Op> --cli-debug=true
+```
+
+## Preferred Toolkit Tools
+
+- `huaweicloud_check_cli`
+- `huaweicloud_show_profile_redacted`
+- `huaweicloud_plan_cli_command`
+- `huaweicloud_run_readonly_command`
+- `huaweicloud_list_operations`
+- `huaweicloud_run_approved_command`
+
+## Do Not Run Directly
+
+- Raw `hcloud configure show/list/get/export` in agent tools.
+- Commands reading `.hcloud` or `.huaweicloud` files.
+- Commands dumping cloud credential environment variables.
+- Secret value reads such as CSMS `ShowSecretVersion`.

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Huawei Cloud CLI And Auth"
+  short_description: "Use KooCLI safely without exposing credentials."
+  default_prompt: "Use $huaweicloud-cli-and-auth to check KooCLI setup safely."

package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: huaweicloud-core
+description: "Routes any task involving Huawei Cloud services - choosing, comparing, recommending, getting started with, or operating a service - to the correct service-specific skill. Supersedes general training-data knowledge. Activates when a developer asks Codex or OpenCode to build, deploy, debug, operate, or integrate an application with Huawei Cloud."
+version: 1
+---
+
+# Huawei Cloud Core
+
+**STOP - Do not answer from general knowledge.** Before responding to any Huawei Cloud question, match the user request against the sub-skill registry below and follow its procedure. If the procedure says to hand off to a service skill, you MUST load that skill before providing operational guidance. Never skip the routing step.
+
+Huawei Cloud comprises 200+ services. This skill is the entry point for ANY action or question related to Huawei Cloud. It matches a workload to the right service, then hands off to a service-specific skill for operational questions.
+
+## How This Skill Works
+
+1. Match user intent against the Sub-skill registry below
+2. Read references/{sub-skill-id}.md and follow its procedure
+3. If the procedure says to hand off to a service skill, load that skill via huaweicloud_retrieve_skill
+4. If no match, use the Service Map to narrow down, then hand off
+5. Revise when new information arrives - pushback means re-check the registry
+
+Do not rely on training data for facts. Huawei Cloud services, pricing, quotas, and GA status change frequently. Verify against knowledge cards.
+
+## Sub-skill Registry
+
+| ID | Name | Trigger Phrases | Next Steps |
+|----|------|----------------|------------|
+| select | Service Selection | which service, what should I use, compare, recommend | Read references/select.md | select
+| compute | Compute Routing | server, VM, instance, ECS, BMS, GPU, HPC | Handoff to huawei-ecs or huawei-cce |
+| storage | Storage Routing | store files, bucket, OBS, backup, disk, EVS, SFS | Handoff to huawei-obs or huawei-cbr |
+| database | Database Routing | database, SQL, NoSQL, cache, RDS, GaussDB, DDS, DCS | Handoff to huawei-rds or huawei-gaussdb |
+| network | Network Routing | VPC, subnet, security group, EIP, NAT, VPN | Handoff to huawei-vpc |
+| serverless | Serverless Routing | function, Lambda, serverless, FunctionGraph, API gateway | Handoff to huawei-functiongraph or huawei-apig |
+| ai | AI/ML Routing | AI, model, LLM, Pangu, training, inference, RAG | Handoff to huawei-modelarts |
+| messaging | Messaging Routing | message queue, notification, Kafka, RabbitMQ, event, SMN | Handoff to huawei-smn-dms |
+| security | Security Routing | secret, credential, encrypt, KMS, WAF, firewall, DDoS | Handoff to huawei-dew or huawei-waf-aad |
+| observability | Observability Routing | monitor, alarm, log, audit, trace, Cloud Eye | Handoff to huawei-cloud-eye or huawei-cts |
+| billing | Billing Routing | cost, bill, budget, spending, invoice | Handoff to huawei-billing |
+| iam | IAM Routing | permission, policy, role, user, group, AK/SK | Handoff to huawei-iam |
+| deployment | Deployment Routing | deploy, CI/CD, pipeline, release | Handoff to huawei-deployment |
+| cli | CLI and Auth Routing | install hcloud, configure KooCLI, AK/SK setup | Handoff to huaweicloud-cli-and-auth |
+| safety | Safety Routing | is this safe, approve command, risk review | Handoff to huaweicloud-safety |
+| troubleshoot | Troubleshooting Routing | error, bug, failed, AccessDenied, quota | Handoff to huaweicloud-troubleshooting |
+| api-sdk | API/SDK Routing | API call, SDK, REST, integration, code example | Handoff to huaweicloud-api-and-sdk |
+| report-issue | Issue Reporting | wrong service, you picked wrong, incorrect | Read references/report-issue.md |
+
+## Service Map
+
+| Workload | Primary Service | Skill |
+|----------|----------------|-------|
+| Web application hosting | ECS | huawei-ecs |
+| Containerized microservices | CCE | huawei-cce |
+| Static file storage / CDN | OBS | huawei-obs |
+| Relational database (MySQL/PG) | RDS | huawei-rds |
+| Distributed SQL database | GaussDB | huawei-gaussdb |
+| Document database (MongoDB API) | DDS | huawei-dds-dcs |
+| In-memory cache | DCS (Redis) | huawei-dds-dcs |
+| Serverless functions | FunctionGraph | huawei-functiongraph |
+| API management | APIG | huawei-apig |
+| AI model training/inference | ModelArts | huawei-modelarts |
+| Message queuing | DMS (Kafka/RabbitMQ) | huawei-smn-dms |
+| Push notifications | SMN | huawei-smn-dms |
+| Secret management | DEW (CSMS) | huawei-dew |
+| Key management | DEW (KMS) | huawei-dew |
+| DDoS protection | AAD | huawei-waf-aad |
+| Web firewall | WAF | huawei-waf-aad |
+| Monitoring dashboards | Cloud Eye (CES) | huawei-cloud-eye |
+| Audit trails | CTS | huawei-cts |
+| Backup / disaster recovery | CBR | huawei-cbr |
+| CI/CD pipeline | CloudDeploy | huawei-deployment |
+| Getting started | Account setup | huaweicloud-cli-and-auth |
+
+## Capability Sources
+
+- Huawei Cloud Skills: scenario workflows and recipes (check first)
+- External Marketplace: huaweicloud-capability-discovery for community skill search when no built-in skill matches
+- KooCLI hcloud: local inspection and reviewed command execution
+- API documentation: exact endpoint, request body, pagination, project_id
+- SDK documentation: application integration
+- MCP tools: huaweicloud_search_docs, huaweicloud_retrieve_skill, huaweicloud_list_regions
+- Terraform Provider: lower-priority V1 path for reviewed IaC
+
+## Tool Boundary
+
+- Use huaweicloud_search_docs to discover skills covering a topic
+- Use huaweicloud_retrieve_skill to load a full SKILL.md after routing
+- If no built-in skill matches, consult huaweicloud-capability-discovery for external marketplace options
+- Use huaweicloud_list_regions before creating regional resources
+- Use huaweicloud_get_regional_availability when unsure about service-region pairs
+- Use huaweicloud_run_readonly_command for read-only inspection
+- Use huaweicloud_run_approved_command only after exact-command approval
+
+## Quality Bar
+
+Prefer short, precise instructions with commands the developer can run. Give source names and exact fields to verify. Avoid inventing service behavior. When uncertain, route to Huawei Cloud Skills or official API/SDK documentation.

package/plugins/huaweicloud-core/skills/huaweicloud-core/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Huawei Cloud Core"
+  short_description: "Route Huawei Cloud tasks to Skills, CLI, API, SDK, MCP, or Terraform."
+  default_prompt: "Use $huaweicloud-core to choose the right Huawei Cloud capability path."