huaweicloud-devkit 0.1.17

package/plugins/huaweicloud-core/src/safety-policy.mjs

@@ -0,0 +1,289 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const policyPath = join(__dirname, '..', 'safety', 'policy.json');
+
+export function loadPolicy() {
+  return JSON.parse(readFileSync(policyPath, 'utf8'));
+}
+
+const DEFAULT_POLICY = loadPolicy();
+
+function regexFrom(pattern) {
+  return new RegExp(pattern, 'i');
+}
+
+function isSecretKeyName(key, policy = DEFAULT_POLICY) {
+  const normalized = String(key).toLowerCase().replace(/[^a-z0-9]/g, '');
+  if (
+    /access.*key|secret.*key|security.*token|xauth.*token|authorization|password|passwd|adminpass|credential|private.*key/.test(normalized)
+  ) {
+    return true;
+  }
+  return policy.secretKeyNamePatterns.some((pattern) => regexFrom(`^(${pattern})$`).test(key));
+}
+
+function redactString(text) {
+  return String(text)
+    .replace(/((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|authorization|password|passwd|adminPass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi, '$1<redacted>')
+    .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>');
+}
+
+export function redactSecrets(value, policy = DEFAULT_POLICY) {
+  if (Array.isArray(value)) {
+    return value.map((item) => redactSecrets(item, policy));
+  }
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, val]) => [
+        key,
+        isSecretKeyName(key, policy) ? '<redacted>' : redactSecrets(val, policy),
+      ]),
+    );
+  }
+  if (typeof value === 'string') {
+    return redactString(value);
+  }
+  return value;
+}
+
+function stripExecutable(args) {
+  if (!args.length) return [];
+  const first = String(args[0]).toLowerCase();
+  if (first === 'hcloud' || first.endsWith('/hcloud') || first.endsWith('\\hcloud') || first === 'hcloud.exe') {
+    return args.slice(1);
+  }
+  return args;
+}
+
+function commandOperation(args) {
+  const stripped = stripExecutable(args).map(String).filter(Boolean);
+  if (stripped[0]?.toLowerCase() === 'configure') {
+    return { service: 'configure', operation: stripped[1] || '', args: stripped };
+  }
+  const nonFlags = stripped.filter((arg) => !arg.startsWith('-'));
+  return {
+    service: nonFlags[0] || '',
+    operation: nonFlags[1] || nonFlags[0] || '',
+    args: stripped,
+  };
+}
+
+function matchesAny(value, patterns) {
+  return patterns.some((pattern) => regexFrom(pattern).test(value));
+}
+
+function hasWritePrefix(operation, policy) {
+  const normalized = String(operation);
+  return policy.writeOperationPrefixes.some((prefix) =>
+    new RegExp(`(^|[A-Za-z0-9])${prefix}`, 'i').test(normalized),
+  );
+}
+
+function hasReadPrefix(operation, policy) {
+  return policy.readOperationPrefixes.some((prefix) =>
+    new RegExp(`^${prefix}`, 'i').test(operation),
+  );
+}
+
+function isLocalMetadataCommand(args) {
+  return args.some((arg) => /^(--help|-h|help|version|--version)$/i.test(String(arg)));
+}
+
+export function classifyHcloudArgs(args, options = {}) {
+  const policy = options.policy || DEFAULT_POLICY;
+  const { service, operation, args: normalizedArgs } = commandOperation(args);
+  const joined = normalizedArgs.join(' ');
+
+  if (!normalizedArgs.length) {
+    return {
+      decision: 'deny',
+      risk: 'invalid',
+      reason: 'Empty hcloud command arguments are not executable.',
+    };
+  }
+
+  if (isLocalMetadataCommand(normalizedArgs)) {
+    return {
+      decision: 'allow',
+      risk: 'local_metadata',
+      reason: 'KooCLI local help and version commands are read-only and do not call Huawei Cloud resource APIs.',
+      service,
+      operation,
+      args: normalizedArgs,
+    };
+  }
+
+  if (service.toLowerCase() === 'configure') {
+    const subcommand = operation.toLowerCase();
+    if (
+      policy.blockedConfigureSubcommands.map((cmd) => cmd.toLowerCase()).includes(subcommand)
+      && options.allowCredentialRead !== true
+    ) {
+      return {
+        decision: 'deny',
+        risk: 'credential',
+        reason: 'Direct hcloud configure inspection may expose profile credentials. Use the redacted toolkit tools instead.',
+      };
+    }
+  }
+
+  if (policy.blockedSecretOperations.some((op) => op.toLowerCase() === operation.toLowerCase())) {
+    return {
+      decision: 'deny',
+      risk: 'secret',
+      reason: 'Direct secret value reads are blocked so plaintext secrets do not enter the agent context.',
+    };
+  }
+
+  if (/secret[_-]?string|secret[_-]?binary|showsecretversion|getsecretvalue/i.test(joined)) {
+    return {
+      decision: 'deny',
+      risk: 'secret',
+      reason: 'The command appears to retrieve a secret value. Use a runtime secret reference pattern instead.',
+    };
+  }
+
+  const readOnly = hasReadPrefix(operation, policy);
+  const executionOps = /(^|\.)(Invoke|SyncInvoke|AsyncInvoke|Send|Trigger|Execute|Start|Reboot|Restart|Stop|Publish|Deploy)/i;
+  const isExecution = executionOps.test(operation) && !readOnly;
+  const isWrite = !readOnly && hasWritePrefix(operation, policy);
+
+  if (isExecution && !options.allowWrites) {
+    return {
+      decision: 'deny',
+      risk: 'execution',
+      reason: 'Huawei Cloud execution/trigger operation blocked until approved.',
+    };
+  }
+
+  if (isWrite && !options.allowWrites) {
+    return {
+      decision: 'deny',
+      risk: 'write',
+      reason: 'Huawei Cloud write operation blocked until the agent presents a plan and receives explicit user approval.',
+    };
+  }
+
+  const obsutilWrites = ['mb', 'cp', 'mv', 'rm', 'delete', 'mkdir', 'sync', 'restore', 'chattri', 'bucketpolicy', 'lifecycle', 'cors', 'website', 'sign', 'share-add', 'share-update', 'share-rm'];
+  const obsutilReads = ['ls', 'stat', 'cat', 'help', 'version'];
+  const isObs = service.toLowerCase() === 'obs' || service.toLowerCase() === 'hcloud obs';
+  const isObsWrite = isObs && obsutilWrites.includes(operation);
+  const isObsRead = isObs && obsutilReads.includes(operation);
+  if (isObsWrite && !options.allowWrites) {
+    return {
+      decision: 'deny',
+      risk: 'write',
+      reason: 'OBS write operation blocked until the agent presents a plan and receives explicit user approval.',
+    };
+  }
+  if (isObsRead) {
+    return {
+      decision: 'allow',
+      risk: 'read_only',
+      reason: 'OBS read-only operation.',
+      service,
+      operation,
+      args: normalizedArgs,
+    };
+  }
+  if (isObsWrite && options.allowWrites) {
+    return {
+      decision: 'allow',
+      risk: 'write',
+      reason: 'OBS write operation approved by user.',
+      service,
+      operation,
+      args: normalizedArgs,
+    };
+  }
+
+  if (isExecution && options.allowWrites) {
+    return {
+      decision: 'allow',
+      risk: 'execution',
+      reason: 'Huawei Cloud execution/trigger operation approved by user.',
+      service,
+      operation,
+      args: normalizedArgs,
+    };
+  }
+
+  if (isWrite && options.allowWrites) {
+    return {
+      decision: 'allow',
+      risk: 'write',
+      reason: 'Huawei Cloud write operation approved by user.',
+      service,
+      operation,
+      args: normalizedArgs,
+    };
+  }
+
+  return {
+    decision: 'allow',
+    risk: readOnly ? 'read_only' : 'unknown_read',
+    reason: readOnly
+      ? 'Command appears to be a read-only Huawei Cloud operation.'
+      : 'Command does not match a known write or secret operation; treat output as untrusted and redact it.',
+    service,
+    operation,
+    args: normalizedArgs,
+  };
+}
+
+function splitSimpleCommand(command) {
+  return String(command)
+    .match(/"[^"]*"|'[^']*'|\S+/g)
+    ?.map((part) => part.replace(/^['"]|['"]$/g, '')) || [];
+}
+
+export function classifyTextCommand(command, options = {}) {
+  const policy = options.policy || DEFAULT_POLICY;
+  const text = String(command || '');
+
+  if (matchesAny(text, policy.credentialFilePatterns)) {
+    return {
+      decision: 'deny',
+      risk: 'credential',
+      reason: 'Reading Huawei Cloud credential or profile files is blocked. Use redacted profile inspection tools instead.',
+    };
+  }
+
+  if (/(^|\s)(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:)/i.test(text) && /HUAWEICLOUD|HWC_|HCLOUD|OS_/i.test(text)) {
+    return {
+      decision: 'deny',
+      risk: 'credential',
+      reason: 'Dumping cloud credential environment variables is blocked.',
+    };
+  }
+
+  if (/(^|\s)hcloud(\.exe)?\s+/i.test(text)) {
+    return classifyHcloudArgs(splitSimpleCommand(text), options);
+  }
+
+  if (/ShowSecretVersion|GetSecretValue|secret_string|secret_binary/i.test(text)) {
+    return {
+      decision: 'deny',
+      risk: 'secret',
+      reason: 'Direct secret value retrieval patterns are blocked.',
+    };
+  }
+
+  return {
+    decision: 'allow',
+    risk: 'not_huaweicloud',
+    reason: 'No Huawei Cloud safety rule matched.',
+  };
+}
+
+export function assertAllowed(result) {
+  if (result.decision === 'deny') {
+    const error = new Error(result.reason);
+    error.policy = result;
+    throw error;
+  }
+  return result;
+}

package/plugins/huaweicloud-core/src/search-market.mjs

@@ -0,0 +1,169 @@
+const INDEX_URL = 'https://gitcode.com/api/v5/repos/2501_91318609/skills-for-index/contents/skills-index/index.json?ref=main';
+const CN_EN_MAP_URL = 'https://gitcode.com/api/v5/repos/2501_91318609/skills-for-index/contents/skills-index/cn-en-map.json?ref=main';
+const HTTP_TIMEOUT_MS = 10000;
+
+const GENERIC_KEYWORDS = new Set([
+  '华为云', 'huawei', 'huawei cloud', '云', 'cloud',
+  '技能', 'skill', 'skills', '所有', 'all', '全部',
+  '有什么', '有哪些', '相关', '列表', 'list',
+  '查找', '搜索', '发现', '浏览', 'find', 'search',
+  'discover', 'browse', 'show', 'explore',
+  'agent', '市场', 'market', '类目', 'category',
+  '安装', 'install',
+]);
+
+let cachedIndex = null;
+let cachedCnEnMap = null;
+
+async function fetchJson(url, label = '') {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS);
+  try {
+    const resp = await fetch(url, {
+      headers: { 'User-Agent': 'huaweicloud-devkit/1.0' },
+      signal: controller.signal,
+    });
+    const data = await resp.json();
+    if (data && data.encoding === 'base64' && data.content) {
+      const decoded = Buffer.from(data.content, 'base64').toString('utf8');
+      return JSON.parse(decoded);
+    }
+    return data;
+  } catch (e) {
+    throw new Error(`Failed to fetch ${label}: ${e.message}`);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function loadIndex() {
+  if (!cachedIndex) cachedIndex = await fetchJson(INDEX_URL, 'index.json');
+  return cachedIndex;
+}
+
+async function loadCnEnMap() {
+  if (!cachedCnEnMap) cachedCnEnMap = await fetchJson(CN_EN_MAP_URL, 'cn-en-map.json');
+  return cachedCnEnMap;
+}
+
+export function clearMarketCache() {
+  cachedIndex = null;
+  cachedCnEnMap = null;
+}
+
+function isGeneric(kw) {
+  const k = kw.toLowerCase().trim();
+  return GENERIC_KEYWORDS.has(k) || /华为云|huawei/i.test(k);
+}
+
+function expandKeywords(rawKeyword, cnEnMap) {
+  if (!rawKeyword) return [[], []];
+  const parts = rawKeyword.replace(/[,;]/g, ' ').split(/\s+/).filter(Boolean);
+  const expanded = [...parts];
+  for (const p of parts) {
+    const lower = p.toLowerCase();
+    if (cnEnMap[p]) expanded.push(cnEnMap[p]);
+    for (const [cn, en] of Object.entries(cnEnMap)) {
+      if (en === lower) expanded.push(cn);
+    }
+  }
+  const unique = [...new Set(expanded)].sort();
+  const specific = unique.filter((kw) => !isGeneric(kw));
+  const generic = unique.filter((kw) => isGeneric(kw));
+  return [specific, generic];
+}
+
+function scoreSkill(skill, specificKws, genericKws) {
+  if (!specificKws.length && !genericKws.length) return [1, []];
+  let total = 0;
+  const matched = [];
+  const nameLower = (skill.name || '').toLowerCase();
+  const descLower = (skill.description || '').toLowerCase();
+  const serviceLower = (skill.service || '').toLowerCase();
+  const triggers = (skill.triggers || []).map((t) => (t || '').toLowerCase());
+
+  for (const kw of specificKws) {
+    const k = kw.toLowerCase();
+    let s = 0;
+    if (nameLower.includes(k)) s += 10;
+    else if (triggers.some((t) => t.includes(k))) s += 8;
+    else if (descLower.includes(k)) s += 5;
+    else if (serviceLower.includes(k)) s += 3;
+    if (s > 0) { total += s; matched.push(kw); }
+  }
+  for (const kw of genericKws) {
+    const k = kw.toLowerCase();
+    let s = 0;
+    if (nameLower.includes(k)) s += 10;
+    else if (triggers.some((t) => t.includes(k))) s += 4;
+    else if (descLower.includes(k)) s += 2;
+    else if (serviceLower.includes(k)) s += 1;
+    if (s > 0) { total += s; matched.push(kw); }
+  }
+  if (!specificKws.length && total === 0) {
+    total = 1;
+    if (descLower.length > 20) total += 1;
+    if (triggers.length) total += 1;
+  }
+  return [total, matched];
+}
+
+function truncate(desc, limit = 150) {
+  if (!desc) return '';
+  return desc.length > limit ? desc.slice(0, limit) + '...' : desc;
+}
+
+export async function searchMarketplace(query = '', category = '') {
+  const idx = await loadIndex();
+  const cnEnMap = await loadCnEnMap();
+  const [specificKws, genericKws] = expandKeywords(query, cnEnMap);
+  const hasSpecific = specificKws.length > 0;
+
+  const results = [];
+  for (const skill of idx.skills || []) {
+    if (category && skill.category !== category) continue;
+    const [score, matched] = scoreSkill(skill, specificKws, genericKws);
+    if (hasSpecific && score === 0) continue;
+    results.push({
+      score,
+      name: skill.name || '',
+      category: skill.category || '',
+      service: skill.service || '',
+      description: truncate(skill.description),
+      triggers: (skill.triggers || []).slice(0, 5),
+      matched,
+    });
+  }
+  results.sort((a, b) => b.score - a.score);
+
+  if (!results.length) {
+    return {
+      ok: true,
+      query,
+      category,
+      count: 0,
+      results: [],
+      fallback: [
+        'Try broader or alternative keywords',
+        'Remove category filter',
+        'Switch CN<->EN (e.g., obs <-> object storage)',
+        'List all: search with empty keyword and a category',
+      ],
+    };
+  }
+
+  const allKws = [...new Set([...specificKws, ...genericKws])];
+  return {
+    ok: true,
+    query,
+    category,
+    count: results.length,
+    expandedKeywords: allKws.length > 1 ? allKws : undefined,
+    results,
+  };
+}
+
+export async function getMarketplaceCategories() {
+  const idx = await loadIndex();
+  return { ok: true, categories: idx.categories || [] };
+}