huaweicloud-devkit 0.1.19 → 0.1.20

package/README.md

@@ -143,6 +143,13 @@ Agent 技能是经过整理的指令和参考材料包，帮助 Agent 完成特
 - [安全模型](docs/safety-model.md)
 - [KooCLI 官方文档](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html)
 
+## 发布流程
+
+发布采用两步 workflow，全部在 GitHub Actions 中完成：
+
+1. **Prepare Release**（手动触发，选 `patch` / `minor` / `major`）：自动 bump 版本、跑质量门、推 `release/vX.Y.Z` 分支并创建 PR，CI 全绿后自动合并进 `main`。
+2. **Publish Release**（PR 合并后手动触发）：读取 `main` 版本，创建并推送 `vX.Y.Z` tag，生成 GitHub Release；tag 触发 `CD Production`，经 `production` 环境人工审批后发布到 npm（包名 `huaweicloud-devkit`）。
+
 ## 许可证
 
 本项目基于 Apache-2.0 许可证发布。详见 [LICENSE](LICENSE)。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
   "files": [

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud-mate"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud-mate"

package/plugins/huaweicloud-core/skills/huawei-cloud-find-skills/SKILL.md

@@ -12,7 +12,7 @@ description: |
 
 # Huawei Cloud Agent Skills Search and Discovery
 
-This skill enables users to efficiently search, discover, and install Huawei Cloud skills. 
+This skill enables users to efficiently search, discover, and install Huawei Cloud skills.
 
 ## Scenario Description
 

package/plugins/huaweicloud-core/skills/huawei-dds-dcs/SKILL.md

@@ -12,7 +12,7 @@ Always run `hcloud DDS <Operation> --help` or `hcloud DCS <Operation> --help` be
 
 ## DDS (Document Database Service — MongoDB Compatible)
 
-## Critical Warnings
+## DDS Critical Warnings
 
 | Trap | Why |
 |------|-----|
@@ -35,7 +35,7 @@ Discover exact parameters with `--help` before executing any command.
 
 ## DCS (Distributed Cache Service — Redis/Memcached)
 
-## Critical Warnings
+## DCS Critical Warnings
 
 | Trap | Why |
 |------|-----|

package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md

@@ -58,18 +58,20 @@ hcloud ECS CreateServers ... --server.user_data=$user_data
 ```
 
 > **Security**: Never embed secrets (passwords, AK/SK, tokens) in user_data. It is stored unencrypted and readable from within the instance via IMDS. Fetch secrets at boot from DEW/CSMS instead.
-
+>
 > **Debugging**: If the script didn't run, check `/var/log/cloud-init-output.log` on the instance.
 
 ## 7. EIP (optional)
 hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
 
+```bash
 # Get the ECS network port ID
 hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>
 # → addresses.<vpc-id>[].OS-EXT-IPS:port_id
 
 # Bind EIP via port
 hcloud EIP AssociatePublicips --publicip_id=<eip-id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT
+```
 
 ## 8. Verify
 hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/triggers.md

@@ -138,5 +138,5 @@ hcloud FunctionGraph DeleteFunctionTrigger --function_urn=<urn> --trigger_type_c
 ```
 
 > Deleting a trigger does NOT cascade-delete the associated APIG API. After `DeleteFunctionTrigger`, also run `hcloud APIG ListApisV2 --instance_id=<id>` and delete orphaned APIs to avoid resource residue.
-
+>
 > **APIG event format**: When using DEDICATEDGATEWAY, the event body is Base64 encoded and uses a non-standard structure. See `apig-event-format.md` for handler templates.

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -57,14 +57,12 @@ Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `
 
 ## Configure Credentials Outside Chat
 
-**NEVER let AK/SK enter shell history. This is the #1 credential leak vector.**
-
 - Create AK/SK in the Huawei Cloud console under `My Credentials -> Access Keys`.
-- **Interactive** (preferred, SAFE): `hcloud configure init` — prompts for AK/SK via terminal input. Values do NOT enter shell history.
-- **Non-interactive** (DANGEROUS — AK/SK in shell history): `hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>`. Only use in ephemeral CI/CD shells. User must execute outside agent chat.
-- If MCP is available, use `huaweicloud_show_profile_redacted` to check status without ever seeing credentials.
+- **Interactive** (preferred): `hcloud configure init` — prompts safely for AK/SK/region.
+- **Non-interactive** (Agent/CI environments): `hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>` — user must execute outside agent chat.
+- Required concepts: Access Key ID, Secret Access Key, Region such as `ap-southeast-3`, and Project ID.
 - Never paste AK/SK, passwords, tokens, or profile files into the agent conversation.
-- KooCLI stores credentials in `~/.hcloud/config.json`, NOT environment variables. `HCLOUD_ACCESS_KEY` / `HCLOUD_SECRET_KEY` / `HCLOUD_REGION` env vars are NOT read by KooCLI 7.x.
+- KooCLI stores credentials in `~/.hcloud/config.json`, NOT environment variables. `HCLOUD_ACCESS_KEY` / `HCLOUD_SECRET_KEY` / `HCLOUD_REGION` env vars are NOT read by KooCLI 7.x. Always use `hcloud configure set`.
 
 ## Safe Flow
 
@@ -72,14 +70,14 @@ Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `
 2. **KooCLI first-run privacy agreement**: On a fresh KooCLI install, `hcloud` blocks with `同意并继续使用(y)/不同意并退出(N)` and fails with `[USE_ERROR]您输入的是无效字符` in non-interactive mode. Detection: check command output for these strings. Ask the user: "KooCLI needs to accept its privacy agreement. May I accept it on your behalf?" If the user agrees, run `huaweicloud_run_readonly_command` with `args=["version"]` and `stdin="y\n"`. This accepts the agreement once, after which hcloud works normally.
 3. Ask the user to configure credentials outside the agent conversation when setup is needed.
 4. Inspect profile and region only through redacted tooling.
-4. Discover exact operation names with `hcloud <Service> --help` before guessing. Example: ECS instance listing is commonly `ECS ListServersDetails`; ECS creation is commonly `ECS CreateServers`; image lookup may be under `IMS GlanceShowImage`.
-5. Use `--cli-output=json` for machine-readable responses when supported.
-6. For resource operations, include `--cli-region`, `--cli-profile`, and service-specific project information when required.
-7. Classify every command before running it:
+5. Discover exact operation names with `hcloud <Service> --help` before guessing. Example: ECS instance listing is commonly `ECS ListServersDetails`; ECS creation is commonly `ECS CreateServers`; image lookup may be under `IMS GlanceShowImage`.
+6. Use `--cli-output=json` for machine-readable responses when supported.
+7. For resource operations, include `--cli-region`, `--cli-profile`, and service-specific project information when required.
+8. Classify every command before running it:
    - Read-only: `List*`, `Show*`, `Get*`, `Describe*`.
    - Write: `Create*`, `Delete*`, `Update*`, `Resize*`, `Start*`, `Stop*`, `Authorize*`, and similar.
    - Secret: any operation returning secret string, binary secret, token, or password.
-8. For write operations, show the exact command and ask for explicit approval.
+9. For write operations, show the exact command and ask for explicit approval.
 
 ## KooCLI Syntax Notes
 

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -592,10 +592,7 @@ async function cmdInstallHcloud() {
   }
 
   console.log('\nAfter install, set HCLOUD_BIN if hcloud is not on PATH.');
-  console.log('\n\x1b[1m\x1b[33m=== Configure credentials SAFELY ===\x1b[0m');
-  console.log('  Interactive (safe): hcloud configure init');
-  console.log('  NEVER: hcloud configure set --cli-access-key=xxx  (AK/SK in shell history!)');
-  console.log('\nThen run: npx huaweicloud-devkit doctor');
+  console.log('Then run: npx huaweicloud-devkit doctor');
 }
 
 async function main() {