huaweicloud-devkit 0.1.21 → 0.1.23

package/plugins/huaweicloud-core/skills/huawei-getting-started/SKILL.md

@@ -1,65 +1,65 @@
----
-name: huawei-getting-started
-description: "Use when starting fresh with Huawei Cloud or KooCLI, installing prerequisites, setting up authentication, or exploring what is possible. Triggers: getting started, first time, setup, install, explore, quickstart, beginner, tutorial. NOT for: specific service operations (use huawei-ecs, huawei-obs, etc.)."
-version: 1
----
-
-# Huawei Cloud Getting Started
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-## KooCLI Installation
-
-| OS | Command |
-|----|---------|
-| Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download |
-| Linux | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
-| macOS | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
-
-## First-Time Setup
-1. **Install KooCLI** using command above
-2. **Accept privacy policy** (first run only): KooCLI requires one-time privacy agreement. Run `hcloud version` and respond `y` to the prompt. For non-interactive terminals, use `echo "y" | hcloud version`
-3. **Configure credentials**: `hcloud configure init` (interactive, prompts for AK/SK/region safely)
-4. **Verify**: `hcloud configure list` to confirm profile, then `hcloud ECS ListServersDetails --cli-region=cn-north-4`
-5. For detailed auth guidance, see `huaweicloud-cli-and-auth` skill
-
-> **Security**: Never pass AK/SK as command-line arguments (`--ak=...`). Always use `hcloud configure init` (interactive) or `hcloud configure set` with cached profile to avoid secrets in shell history.
-
-### Non-Interactive Setup (Agent/CI Environments)
-
-When the interactive TUI is unavailable (Agent tools, CI/CD), use `hcloud configure set` — this must be run outside agent chat by the user:
-
-```bash
-# User executes in their terminal (NOT in agent chat):
-hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>
-
-# Agent verifies:
-hcloud configure list
-```
-
-## Critical Warnings
-| Trap | Why |
-|------|-----|
-| AK/SK must be kept secret | Never commit to git or share |
-| Default region applies to all commands | Override with --cli-region= per command |
-| Some services region-specific | Not all services available in all regions |
-| Privacy policy blocks first run | KooCLI requires one-time `y` confirmation. Non-interactive terminals need `echo "y" \| hcloud <cmd>` |
-
-## What Can I Do? (Quick Index)
-| Goal | Skill |
-|------|-------|
-| Create a VM | huawei-ecs |
-| Store files | huawei-obs |
-| Set up a database | huawei-rds / huawei-gaussdb |
-| Create a network | huawei-vpc |
-| Manage access | huawei-iam |
-| Deploy an app | huawei-deployment |
-| Run containers | huawei-cce |
-| Build an API | huawei-apig |
-| Run serverless | huawei-functiongraph |
-| Monitor resources | huawei-cloud-eye |
-
-## Pro Tips
-- Use `hcloud <Service> --help` to discover operations (see huaweicloud-capability-discovery)
-- Prepend `hcloud configure set --cli-region=<r>` to avoid per-command region flags
-- Pipe sensitive output through IAM with `--cli-output-format=json`
+---
+name: huawei-getting-started
+description: "Use when starting fresh with Huawei Cloud or KooCLI, installing prerequisites, setting up authentication, or exploring what is possible. Triggers: getting started, first time, setup, install, explore, quickstart, beginner, tutorial. NOT for: specific service operations (use huawei-ecs, huawei-obs, etc.)."
+version: 1
+---
+
+# Huawei Cloud Getting Started
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+## KooCLI Installation
+
+| OS | Command |
+|----|---------|
+| Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download |
+| Linux | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
+| macOS | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
+
+## First-Time Setup
+1. **Install KooCLI** using command above
+2. **Accept privacy policy** (first run only): KooCLI requires one-time privacy agreement. Run `hcloud version` and respond `y` to the prompt. For non-interactive terminals, use `echo "y" | hcloud version`
+3. **Configure credentials**: `hcloud configure init` (interactive, prompts for AK/SK/region safely)
+4. **Verify**: `hcloud configure list` to confirm profile, then `hcloud ECS ListServersDetails --cli-region=cn-north-4`
+5. For detailed auth guidance, see `huaweicloud-cli-and-auth` skill
+
+> **Security**: Never pass AK/SK as command-line arguments (`--ak=...`). Always use `hcloud configure init` (interactive) or `hcloud configure set` with cached profile to avoid secrets in shell history.
+
+### Non-Interactive Setup (Agent/CI Environments)
+
+When the interactive TUI is unavailable (Agent tools, CI/CD), use `hcloud configure set` — this must be run outside agent chat by the user:
+
+```bash
+# User executes in their terminal (NOT in agent chat):
+hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>
+
+# Agent verifies:
+hcloud configure list
+```
+
+## Critical Warnings
+| Trap | Why |
+|------|-----|
+| AK/SK must be kept secret | Never commit to git or share |
+| Default region applies to all commands | Override with --cli-region= per command |
+| Some services region-specific | Not all services available in all regions |
+| Privacy policy blocks first run | KooCLI requires one-time `y` confirmation. Non-interactive terminals need `echo "y" \| hcloud <cmd>` |
+
+## What Can I Do? (Quick Index)
+| Goal | Skill |
+|------|-------|
+| Create a VM | huawei-ecs |
+| Store files | huawei-obs |
+| Set up a database | huawei-rds / huawei-gaussdb |
+| Create a network | huawei-vpc |
+| Manage access | huawei-iam |
+| Deploy an app | huawei-deployment |
+| Run containers | huawei-cce |
+| Build an API | huawei-apig |
+| Run serverless | huawei-functiongraph |
+| Monitor resources | huawei-cloud-eye |
+
+## Pro Tips
+- Use `hcloud <Service> --help` to discover operations (see huaweicloud-capability-discovery)
+- Prepend `hcloud configure set --cli-region=<r>` to avoid per-command region flags
+- Pipe sensitive output through IAM with `--cli-output-format=json`

package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md

@@ -1,111 +1,111 @@
----
-name: huawei-iam
-description: "Use when managing IAM users, groups, roles, policies, agencies, projects, or access keys on Huawei Cloud. Covers IAM policy structure, least-privilege design, temporary credentials (STS), OneAccess integration, and security best practices. Triggers on: IAM, permission, policy, role, user, group, AK/SK, access key, agency, project, authorization. NOT for: DEW secret management (use huawei-dew)."
-version: 1
----
-
-# Huawei Cloud IAM
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers user/group/role lifecycle, policy design, temporary credentials, and security best practices.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
-| NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
-| Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
-| Agency trust is powerful | Agencies let services assume roles. Always add conditions |
-| Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
-
-## Policy Structure
-
-`json
-{
-  "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["ecs:*"],
-    "Resource": ["*"],
-    "Condition": {
-      "StringEquals": {"g:SourceVpc": "vpc-xxx"}
-    }
-  }]
-}
-`
-
-## Common Workflows
-
-| Task | Command | Steps |
-|------|---------|-------|
-| List users | hcloud IAM ListUsers | references/iam-ops.md |
-| Create group | hcloud IAM CreateGroup --group.name=<name> | references/iam-ops.md |
-| Create custom policy | hcloud IAM CreateCustomPolicy --policy.name=<n> --policy.document=<json> | references/policy-examples.md |
-| Create agency | hcloud IAM CreateAgency --agency.name=<n> --agency.domain_id=<id> --agency.trust_policy=<json> | references/agency.md |
-| Get temporary credential | hcloud STS GetTemporaryCredential --agency_name=<n> --domain_id=<id> --duration_seconds=3600 | references/sts.md |
-| Attach policy | hcloud IAM AttachGroupPolicy --group_id=<id> --policy_id=<id> | references/iam-ops.md |
-
-## Policy Examples (Least Privilege)
-
-| Role | Actions | Resource |
-|------|---------|----------|
-| ECS Reader | ecs:List*, ecs:Get*, ecs:Describe* | * |
-| OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List* | obs:*:*:bucket:my-bucket |
-| RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:* |
-
-> See `references/policy-examples.md` for complete policy JSON templates with conditions.
-
-## Troubleshooting
-
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| AccessDenied | Missing IAM permission -> Check policy action and resource scope |
-| AuthFailure | Expired AK/SK or wrong project -> Renew credentials / Check project ID |
-| Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition |
-| Quota exceeded | IAM user/group/policy limit -> Request quota increase |
-
-## Security Considerations
-
-- MUST NOT create IAM users. Use OneAccess or federated SSO
-- MUST NOT create long-term AK/SK. Use STS temporary tokens
-- MUST scope Resource ARNs. Never use wildcard *
-- MUST add conditions to trust policies (g:SourceAccount, g:SourceUrn)
-- SHOULD rotate credentials every 90 days
-
-## Agencies (Cross-Service Delegation)
-
-Agencies allow one service to act on behalf of another. Common use cases:
-
-### FunctionGraph Agency (VPC Access)
-
-FunctionGraph needs an agency to access VPC resources (RDS, DCS, etc.):
-
-```bash
-# 1. Create agency with FunctionGraph trust
-hcloud IAM CreateAgency --agency_name=<name> --trust_domain_name=functiongraph
-
-# 2. Attach VPC Administrator role
-hcloud IAM GrantRoleToAgency --agency_name=<name> --role_id=<role-id>
-
-# 3. Use in CreateFunction
-hcloud FunctionGraph CreateFunction ... --app_xrole=<agency-name>
-```
-
-Common roles for FunctionGraph: VPC Administrator, RDS Administrator, DCS Administrator.
-
-## MCP Tools
-
-- huaweicloud_list_operations service=IAM
-- huaweicloud_run_readonly_command for user/policy discovery
-
-## References
-
-- IAM Docs: https://support.huaweicloud.com/iam/
-- Policy examples: references/policy-examples.md
-- Agency setup: references/agency.md
+---
+name: huawei-iam
+description: "Use when managing IAM users, groups, roles, policies, agencies, projects, or access keys on Huawei Cloud. Covers IAM policy structure, least-privilege design, temporary credentials (STS), OneAccess integration, and security best practices. Triggers on: IAM, permission, policy, role, user, group, AK/SK, access key, agency, project, authorization. NOT for: DEW secret management (use huawei-dew)."
+version: 1
+---
+
+# Huawei Cloud IAM
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers user/group/role lifecycle, policy design, temporary credentials, and security best practices.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
+| NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
+| Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
+| Agency trust is powerful | Agencies let services assume roles. Always add conditions |
+| Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
+
+## Policy Structure
+
+`json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["ecs:*"],
+    "Resource": ["*"],
+    "Condition": {
+      "StringEquals": {"g:SourceVpc": "vpc-xxx"}
+    }
+  }]
+}
+`
+
+## Common Workflows
+
+| Task | Command | Steps |
+|------|---------|-------|
+| List users | hcloud IAM ListUsers | references/iam-ops.md |
+| Create group | hcloud IAM CreateGroup --group.name=<name> | references/iam-ops.md |
+| Create custom policy | hcloud IAM CreateCustomPolicy --policy.name=<n> --policy.document=<json> | references/policy-examples.md |
+| Create agency | hcloud IAM CreateAgency --agency.name=<n> --agency.domain_id=<id> --agency.trust_policy=<json> | references/agency.md |
+| Get temporary credential | hcloud STS GetTemporaryCredential --agency_name=<n> --domain_id=<id> --duration_seconds=3600 | references/sts.md |
+| Attach policy | hcloud IAM AttachGroupPolicy --group_id=<id> --policy_id=<id> | references/iam-ops.md |
+
+## Policy Examples (Least Privilege)
+
+| Role | Actions | Resource |
+|------|---------|----------|
+| ECS Reader | ecs:List*, ecs:Get*, ecs:Describe* | * |
+| OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List* | obs:*:*:bucket:my-bucket |
+| RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:* |
+
+> See `references/policy-examples.md` for complete policy JSON templates with conditions.
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|------------------|
+| AccessDenied | Missing IAM permission -> Check policy action and resource scope |
+| AuthFailure | Expired AK/SK or wrong project -> Renew credentials / Check project ID |
+| Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition |
+| Quota exceeded | IAM user/group/policy limit -> Request quota increase |
+
+## Security Considerations
+
+- MUST NOT create IAM users. Use OneAccess or federated SSO
+- MUST NOT create long-term AK/SK. Use STS temporary tokens
+- MUST scope Resource ARNs. Never use wildcard *
+- MUST add conditions to trust policies (g:SourceAccount, g:SourceUrn)
+- SHOULD rotate credentials every 90 days
+
+## Agencies (Cross-Service Delegation)
+
+Agencies allow one service to act on behalf of another. Common use cases:
+
+### FunctionGraph Agency (VPC Access)
+
+FunctionGraph needs an agency to access VPC resources (RDS, DCS, etc.):
+
+```bash
+# 1. Create agency with FunctionGraph trust
+hcloud IAM CreateAgency --agency_name=<name> --trust_domain_name=functiongraph
+
+# 2. Attach VPC Administrator role
+hcloud IAM GrantRoleToAgency --agency_name=<name> --role_id=<role-id>
+
+# 3. Use in CreateFunction
+hcloud FunctionGraph CreateFunction ... --app_xrole=<agency-name>
+```
+
+Common roles for FunctionGraph: VPC Administrator, RDS Administrator, DCS Administrator.
+
+## MCP Tools
+
+- huaweicloud_list_operations service=IAM
+- huaweicloud_run_readonly_command for user/policy discovery
+
+## References
+
+- IAM Docs: https://support.huaweicloud.com/iam/
+- Policy examples: references/policy-examples.md
+- Agency setup: references/agency.md

package/plugins/huaweicloud-core/skills/huawei-modelarts/SKILL.md

@@ -1,65 +1,65 @@
----
-name: huawei-modelarts
-description: "Use when training, deploying, or managing AI/ML models on Huawei Cloud ModelArts. Covers training jobs, model registry, online services, notebook instances. Triggers: ModelArts, model training, AI, machine learning, deep learning, notebook, inference, deployment. NOT for: general AI/ML concepts, non-Huawei platforms."
-version: 1
----
-
-# Huawei Cloud ModelArts
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud ModelArts <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for ModelArts. Covers training jobs, model deployment, notebook instances, and OBS integration.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| OBS bucket required | All training data, model outputs, and notebook storage use OBS. Create bucket first |
-| Training charges by duration | Pay-per-minute GPU/CPU billing. Stop unused notebooks and services |
-| Notebook auto-stop needed | Default no auto-stop — can run indefinitely and incur charges |
-| Model deployment needs quota | Online services may require service quota approval in new accounts |
-| Training job output must be OBS | Local output not supported. Ensure `--output_path` is a valid OBS path |
-
-## Prerequisites
-
-- Training data must be stored in an OBS bucket (see `huawei-obs`)
-- Output path for trained models must be an OBS path
-- Notebook instances need a VPC/subnet (see `huawei-vpc`)
-
-## Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List models | `ListModels --cli-region=<r> --project_id=<p>` |
-| List training jobs | `ListTrainJobs --cli-region=<r> --project_id=<p>` |
-| List services | `ListServices --cli-region=<r> --project_id=<p>` |
-| List notebooks | `ListNotebooks --cli-region=<r> --project_id=<p>` |
-| Create model | `CreateModel --cli-region=<r> --project_id=<p>` |
-| Create notebook | `CreateNotebook --cli-region=<r> --project_id=<p>` |
-
-Discover operation parameters with `--help` before executing any write operation.
-
-## Service Types
-
-| Type | Purpose |
-|------|---------|
-| Training Job | Train models on GPU/CPU resources |
-| Model | Register trained models for deployment |
-| Service (Online) | Deploy models as REST API endpoints |
-| Notebook | JupyterLab environments for development |
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| OBS path not found | Verify OBS bucket exists and path is correct |
-| Training job fails | Check training data format, resource quotas, and logs in console |
-
-## Cross-Skill References
-
-- **OBS storage**: See `huawei-obs` for bucket and training data management
-- **VPC/Subnet**: See `huawei-vpc` for notebook network configuration
+---
+name: huawei-modelarts
+description: "Use when training, deploying, or managing AI/ML models on Huawei Cloud ModelArts. Covers training jobs, model registry, online services, notebook instances. Triggers: ModelArts, model training, AI, machine learning, deep learning, notebook, inference, deployment. NOT for: general AI/ML concepts, non-Huawei platforms."
+version: 1
+---
+
+# Huawei Cloud ModelArts
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud ModelArts <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for ModelArts. Covers training jobs, model deployment, notebook instances, and OBS integration.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| OBS bucket required | All training data, model outputs, and notebook storage use OBS. Create bucket first |
+| Training charges by duration | Pay-per-minute GPU/CPU billing. Stop unused notebooks and services |
+| Notebook auto-stop needed | Default no auto-stop — can run indefinitely and incur charges |
+| Model deployment needs quota | Online services may require service quota approval in new accounts |
+| Training job output must be OBS | Local output not supported. Ensure `--output_path` is a valid OBS path |
+
+## Prerequisites
+
+- Training data must be stored in an OBS bucket (see `huawei-obs`)
+- Output path for trained models must be an OBS path
+- Notebook instances need a VPC/subnet (see `huawei-vpc`)
+
+## Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List models | `ListModels --cli-region=<r> --project_id=<p>` |
+| List training jobs | `ListTrainJobs --cli-region=<r> --project_id=<p>` |
+| List services | `ListServices --cli-region=<r> --project_id=<p>` |
+| List notebooks | `ListNotebooks --cli-region=<r> --project_id=<p>` |
+| Create model | `CreateModel --cli-region=<r> --project_id=<p>` |
+| Create notebook | `CreateNotebook --cli-region=<r> --project_id=<p>` |
+
+Discover operation parameters with `--help` before executing any write operation.
+
+## Service Types
+
+| Type | Purpose |
+|------|---------|
+| Training Job | Train models on GPU/CPU resources |
+| Model | Register trained models for deployment |
+| Service (Online) | Deploy models as REST API endpoints |
+| Notebook | JupyterLab environments for development |
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| OBS path not found | Verify OBS bucket exists and path is correct |
+| Training job fails | Check training data format, resource quotas, and logs in console |
+
+## Cross-Skill References
+
+- **OBS storage**: See `huawei-obs` for bucket and training data management
+- **VPC/Subnet**: See `huawei-vpc` for notebook network configuration