huaweicloud-devkit 0.1.21 → 0.1.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (66) hide show
  1. package/.agents/plugins/marketplace.json +20 -20
  2. package/LICENSE +201 -201
  3. package/README.md +169 -169
  4. package/bin/setup.cjs +7 -7
  5. package/integrations/opencode/commands/huaweicloud-doctor.md +14 -14
  6. package/integrations/opencode/opencode.json +14 -14
  7. package/integrations/opencode/skills/huaweicloud-core/SKILL.md +30 -30
  8. package/package.json +43 -43
  9. package/plugins/huaweicloud-core/.claude-plugin/plugin.json +43 -43
  10. package/plugins/huaweicloud-core/.codex-plugin/plugin.json +42 -42
  11. package/plugins/huaweicloud-core/.cursor-plugin/plugin.json +43 -43
  12. package/plugins/huaweicloud-core/.mcp.json +13 -13
  13. package/plugins/huaweicloud-core/hooks/hooks.json +26 -26
  14. package/plugins/huaweicloud-core/hooks/huaweicloud-safety.py +88 -88
  15. package/plugins/huaweicloud-core/safety/policy.json +85 -85
  16. package/plugins/huaweicloud-core/skills/huawei-apig/SKILL.md +144 -144
  17. package/plugins/huaweicloud-core/skills/huawei-billing/SKILL.md +48 -48
  18. package/plugins/huaweicloud-core/skills/huawei-cbr/SKILL.md +50 -50
  19. package/plugins/huaweicloud-core/skills/huawei-cce/SKILL.md +101 -101
  20. package/plugins/huaweicloud-core/skills/huawei-cloud-eye/SKILL.md +73 -73
  21. package/plugins/huaweicloud-core/skills/huawei-cts/SKILL.md +55 -55
  22. package/plugins/huaweicloud-core/skills/huawei-dds-dcs/SKILL.md +70 -70
  23. package/plugins/huaweicloud-core/skills/huawei-dew/SKILL.md +97 -97
  24. package/plugins/huaweicloud-core/skills/huawei-dew/references/csms-usage.md +29 -29
  25. package/plugins/huaweicloud-core/skills/huawei-dew/references/kms-usage.md +23 -23
  26. package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md +131 -131
  27. package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md +96 -96
  28. package/plugins/huaweicloud-core/skills/huawei-ecs/references/evs.md +31 -31
  29. package/plugins/huaweicloud-core/skills/huawei-ecs/references/flavors.md +28 -28
  30. package/plugins/huaweicloud-core/skills/huawei-ecs/references/troubleshooting.md +52 -52
  31. package/plugins/huaweicloud-core/skills/huawei-functiongraph/SKILL.md +132 -132
  32. package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/apig-event-format.md +58 -58
  33. package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md +71 -71
  34. package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/deploy-workflow.md +119 -119
  35. package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/triggers.md +142 -142
  36. package/plugins/huaweicloud-core/skills/huawei-gaussdb/SKILL.md +56 -56
  37. package/plugins/huaweicloud-core/skills/huawei-getting-started/SKILL.md +65 -65
  38. package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md +111 -111
  39. package/plugins/huaweicloud-core/skills/huawei-modelarts/SKILL.md +65 -65
  40. package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md +118 -118
  41. package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-lifecycle.md +26 -26
  42. package/plugins/huaweicloud-core/skills/huawei-obs/references/static-website.md +56 -56
  43. package/plugins/huaweicloud-core/skills/huawei-rds/SKILL.md +181 -181
  44. package/plugins/huaweicloud-core/skills/huawei-smn-dms/SKILL.md +69 -69
  45. package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md +78 -78
  46. package/plugins/huaweicloud-core/skills/huawei-vpc/references/network.md +76 -76
  47. package/plugins/huaweicloud-core/skills/huawei-vpc/references/security-group.md +59 -59
  48. package/plugins/huaweicloud-core/skills/huawei-waf-aad/SKILL.md +63 -63
  49. package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/agents/openai.yaml +4 -4
  50. package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md +47 -47
  51. package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/agents/openai.yaml +4 -4
  52. package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md +127 -127
  53. package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/agents/openai.yaml +4 -4
  54. package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md +93 -93
  55. package/plugins/huaweicloud-core/skills/huaweicloud-core/agents/openai.yaml +4 -4
  56. package/plugins/huaweicloud-core/skills/huaweicloud-core/references/report-issue.md +19 -19
  57. package/plugins/huaweicloud-core/skills/huaweicloud-core/references/select.md +27 -27
  58. package/plugins/huaweicloud-core/skills/huaweicloud-safety/SKILL.md +46 -46
  59. package/plugins/huaweicloud-core/skills/huaweicloud-safety/agents/openai.yaml +4 -4
  60. package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/SKILL.md +83 -83
  61. package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/agents/openai.yaml +4 -4
  62. package/plugins/huaweicloud-core/src/hcloud-cli.mjs +265 -265
  63. package/plugins/huaweicloud-core/src/mcp-server.mjs +93 -93
  64. package/plugins/huaweicloud-core/src/safety-policy.mjs +289 -289
  65. package/plugins/huaweicloud-core/src/setup-cli.mjs +874 -869
  66. package/plugins/huaweicloud-core/src/tools.mjs +677 -677
@@ -1,44 +1,44 @@
1
1
  {
2
- "interface": {
3
- "displayName": "HuaweiCloud Devkit",
4
- "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
5
- "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
6
- "developerName": "HuaweiCloud Mate",
7
- "category": "Cloud",
8
- "capabilities": [
9
- "Read",
10
- "Interactive"
11
- ],
12
- "websiteURL": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
13
- "brandColor": "#C7000B",
14
- "defaultPrompt": [
15
- "Help me choose the right Huawei Cloud capability.",
16
- "Check my Huawei Cloud CLI setup safely.",
17
- "Plan this Huawei Cloud API or SDK task."
18
- ]
19
- },
20
- "mcpServers": "./.mcp.json",
21
- "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
22
- "skills": "./skills/",
23
- "version": "0.1.21",
24
- "author": {
25
- "name": "HuaweiCloud Mate",
26
- "url": "https://github.com/huaweicloud-mate"
27
- },
28
- "hooks": "./hooks/",
29
- "name": "huaweicloud-core",
30
- "homepage": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
31
- "repository": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
32
- "license": "Apache-2.0",
33
- "keywords": [
34
- "huaweicloud",
35
- "huawei-cloud",
36
- "koocli",
37
- "hcloud",
38
- "agent",
39
- "mcp",
40
- "api",
41
- "sdk",
42
- "skills"
43
- ]
44
- }
2
+ "interface": {
3
+ "displayName": "HuaweiCloud Devkit",
4
+ "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
5
+ "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
6
+ "developerName": "HuaweiCloud Mate",
7
+ "category": "Cloud",
8
+ "capabilities": [
9
+ "Read",
10
+ "Interactive"
11
+ ],
12
+ "websiteURL": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
13
+ "brandColor": "#C7000B",
14
+ "defaultPrompt": [
15
+ "Help me choose the right Huawei Cloud capability.",
16
+ "Check my Huawei Cloud CLI setup safely.",
17
+ "Plan this Huawei Cloud API or SDK task."
18
+ ]
19
+ },
20
+ "mcpServers": "./.mcp.json",
21
+ "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
22
+ "skills": "./skills/",
23
+ "version": "0.1.23",
24
+ "author": {
25
+ "name": "HuaweiCloud Mate",
26
+ "url": "https://github.com/huaweicloud-mate"
27
+ },
28
+ "hooks": "./hooks/",
29
+ "name": "huaweicloud-core",
30
+ "homepage": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
31
+ "repository": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
32
+ "license": "Apache-2.0",
33
+ "keywords": [
34
+ "huaweicloud",
35
+ "huawei-cloud",
36
+ "koocli",
37
+ "hcloud",
38
+ "agent",
39
+ "mcp",
40
+ "api",
41
+ "sdk",
42
+ "skills"
43
+ ]
44
+ }
@@ -1,43 +1,43 @@
1
1
  {
2
- "name": "huaweicloud-core",
3
- "version": "0.1.21",
4
- "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
5
- "author": {
6
- "name": "HuaweiCloud Mate",
7
- "url": "https://github.com/huaweicloud-mate"
8
- },
9
- "homepage": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
10
- "repository": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
11
- "license": "Apache-2.0",
12
- "keywords": [
13
- "huaweicloud",
14
- "huawei-cloud",
15
- "koocli",
16
- "hcloud",
17
- "agent",
18
- "mcp",
19
- "api",
20
- "sdk",
21
- "skills"
22
- ],
23
- "skills": "./skills/",
24
- "mcpServers": "./.mcp.json",
25
- "interface": {
26
- "displayName": "HuaweiCloud Devkit",
27
- "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
28
- "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
29
- "developerName": "HuaweiCloud Mate",
30
- "category": "Cloud",
31
- "capabilities": [
32
- "Read",
33
- "Interactive"
34
- ],
35
- "websiteURL": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
36
- "brandColor": "#C7000B",
37
- "defaultPrompt": [
38
- "Help me choose the right Huawei Cloud capability.",
39
- "Check my Huawei Cloud CLI setup safely.",
40
- "Plan this Huawei Cloud API or SDK task."
41
- ]
42
- }
43
- }
2
+ "name": "huaweicloud-core",
3
+ "version": "0.1.23",
4
+ "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
5
+ "author": {
6
+ "name": "HuaweiCloud Mate",
7
+ "url": "https://github.com/huaweicloud-mate"
8
+ },
9
+ "homepage": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
10
+ "repository": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
11
+ "license": "Apache-2.0",
12
+ "keywords": [
13
+ "huaweicloud",
14
+ "huawei-cloud",
15
+ "koocli",
16
+ "hcloud",
17
+ "agent",
18
+ "mcp",
19
+ "api",
20
+ "sdk",
21
+ "skills"
22
+ ],
23
+ "skills": "./skills/",
24
+ "mcpServers": "./.mcp.json",
25
+ "interface": {
26
+ "displayName": "HuaweiCloud Devkit",
27
+ "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
28
+ "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
29
+ "developerName": "HuaweiCloud Mate",
30
+ "category": "Cloud",
31
+ "capabilities": [
32
+ "Read",
33
+ "Interactive"
34
+ ],
35
+ "websiteURL": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
36
+ "brandColor": "#C7000B",
37
+ "defaultPrompt": [
38
+ "Help me choose the right Huawei Cloud capability.",
39
+ "Check my Huawei Cloud CLI setup safely.",
40
+ "Plan this Huawei Cloud API or SDK task."
41
+ ]
42
+ }
43
+ }
@@ -1,44 +1,44 @@
1
1
  {
2
- "interface": {
3
- "displayName": "HuaweiCloud Devkit",
4
- "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
5
- "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
6
- "developerName": "HuaweiCloud Mate",
7
- "category": "Cloud",
8
- "capabilities": [
9
- "Read",
10
- "Interactive"
11
- ],
12
- "websiteURL": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
13
- "brandColor": "#C7000B",
14
- "defaultPrompt": [
15
- "Help me choose the right Huawei Cloud capability.",
16
- "Check my Huawei Cloud CLI setup safely.",
17
- "Plan this Huawei Cloud API or SDK task."
18
- ]
19
- },
20
- "mcpServers": "./.mcp.json",
21
- "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
22
- "skills": "./skills/",
23
- "version": "0.1.21",
24
- "author": {
25
- "name": "HuaweiCloud Mate",
26
- "url": "https://github.com/huaweicloud-mate"
27
- },
28
- "hooks": "./hooks/",
29
- "name": "huaweicloud-core",
30
- "homepage": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
31
- "repository": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
32
- "license": "Apache-2.0",
33
- "keywords": [
34
- "huaweicloud",
35
- "huawei-cloud",
36
- "koocli",
37
- "hcloud",
38
- "agent",
39
- "mcp",
40
- "api",
41
- "sdk",
42
- "skills"
43
- ]
44
- }
2
+ "interface": {
3
+ "displayName": "HuaweiCloud Devkit",
4
+ "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
5
+ "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
6
+ "developerName": "HuaweiCloud Mate",
7
+ "category": "Cloud",
8
+ "capabilities": [
9
+ "Read",
10
+ "Interactive"
11
+ ],
12
+ "websiteURL": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
13
+ "brandColor": "#C7000B",
14
+ "defaultPrompt": [
15
+ "Help me choose the right Huawei Cloud capability.",
16
+ "Check my Huawei Cloud CLI setup safely.",
17
+ "Plan this Huawei Cloud API or SDK task."
18
+ ]
19
+ },
20
+ "mcpServers": "./.mcp.json",
21
+ "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
22
+ "skills": "./skills/",
23
+ "version": "0.1.23",
24
+ "author": {
25
+ "name": "HuaweiCloud Mate",
26
+ "url": "https://github.com/huaweicloud-mate"
27
+ },
28
+ "hooks": "./hooks/",
29
+ "name": "huaweicloud-core",
30
+ "homepage": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
31
+ "repository": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
32
+ "license": "Apache-2.0",
33
+ "keywords": [
34
+ "huaweicloud",
35
+ "huawei-cloud",
36
+ "koocli",
37
+ "hcloud",
38
+ "agent",
39
+ "mcp",
40
+ "api",
41
+ "sdk",
42
+ "skills"
43
+ ]
44
+ }
@@ -1,13 +1,13 @@
1
- {
2
- "mcpServers": {
3
- "huaweicloud": {
4
- "command": "node",
5
- "args": [
6
- "./src/mcp-server.mjs"
7
- ],
8
- "env": {
9
- "HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local"
10
- }
11
- }
12
- }
13
- }
1
+ {
2
+ "mcpServers": {
3
+ "huaweicloud": {
4
+ "command": "node",
5
+ "args": [
6
+ "./src/mcp-server.mjs"
7
+ ],
8
+ "env": {
9
+ "HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local"
10
+ }
11
+ }
12
+ }
13
+ }
@@ -1,26 +1,26 @@
1
- {
2
- "hooks": {
3
- "PreToolUse": [
4
- {
5
- "matcher": "Bash",
6
- "hooks": [
7
- {
8
- "type": "command",
9
- "command": "python3 \"${CLAUDE_PLUGIN_ROOT}/hooks/huaweicloud-safety.py\"",
10
- "timeout": 5
11
- }
12
- ]
13
- },
14
- {
15
- "matcher": "mcp__.*huaweicloud.*|huaweicloud_.*",
16
- "hooks": [
17
- {
18
- "type": "command",
19
- "command": "python3 \"${CLAUDE_PLUGIN_ROOT}/hooks/huaweicloud-safety.py\"",
20
- "timeout": 5
21
- }
22
- ]
23
- }
24
- ]
25
- }
26
- }
1
+ {
2
+ "hooks": {
3
+ "PreToolUse": [
4
+ {
5
+ "matcher": "Bash",
6
+ "hooks": [
7
+ {
8
+ "type": "command",
9
+ "command": "python3 \"${CLAUDE_PLUGIN_ROOT}/hooks/huaweicloud-safety.py\"",
10
+ "timeout": 5
11
+ }
12
+ ]
13
+ },
14
+ {
15
+ "matcher": "mcp__.*huaweicloud.*|huaweicloud_.*",
16
+ "hooks": [
17
+ {
18
+ "type": "command",
19
+ "command": "python3 \"${CLAUDE_PLUGIN_ROOT}/hooks/huaweicloud-safety.py\"",
20
+ "timeout": 5
21
+ }
22
+ ]
23
+ }
24
+ ]
25
+ }
26
+ }
@@ -1,88 +1,88 @@
1
- #!/usr/bin/env python3
2
- """PreToolUse hook for Huawei Cloud agent safety.
3
-
4
- Blocks the highest-risk leakage paths before an agent tool runs:
5
- - reading local Huawei Cloud credential files
6
- - dumping cloud credential environment variables
7
- - directly retrieving cloud secret values
8
- - running unapproved write operations through hcloud
9
-
10
- The MCP server carries the same policy in Node for platforms that do not support
11
- plugin hooks.
12
- """
13
-
14
- import json
15
- import re
16
- import sys
17
-
18
- DENY_PREFIX = "Huawei Cloud safety hook blocked this action: "
19
-
20
- CONFIG_FILE_RE = re.compile(r"(\.hcloud|\.huaweicloud|hcloud[/\\](config|credentials)|huaweicloud[/\\](config|credentials))", re.I)
21
- ENV_DUMP_RE = re.compile(r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I)
22
- SECRET_READ_RE = re.compile(r"(ShowSecretVersion|GetSecretValue|secret_string|secret_binary)", re.I)
23
- HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
24
- WRITE_OPERATION_RE = re.compile(
25
- r"\b(BatchCreate|BatchDelete|Create|Delete|Update|Modify|Resize|Reboot|Stop|Start|Restart|Authorize|Revoke|Add|Remove|Associate|Disassociate|Attach|Detach|Enable|Disable)\w*",
26
- re.I,
27
- )
28
- READ_OPERATION_RE = re.compile(r"\b(List|Show|Get|Describe|NovaList|NovaShow)\w*", re.I)
29
-
30
-
31
- def deny(reason):
32
- json.dump(
33
- {
34
- "hookSpecificOutput": {
35
- "hookEventName": "PreToolUse",
36
- "permissionDecision": "deny",
37
- "permissionDecisionReason": DENY_PREFIX + reason,
38
- }
39
- },
40
- sys.stdout,
41
- )
42
- sys.exit(0)
43
-
44
-
45
- def allow():
46
- sys.exit(0)
47
-
48
-
49
- def command_text(tool_input):
50
- if isinstance(tool_input, str):
51
- return tool_input
52
- if isinstance(tool_input, dict):
53
- values = []
54
- for key in ("command", "cmd", "script", "args", "arguments"):
55
- value = tool_input.get(key)
56
- if isinstance(value, list):
57
- values.append(" ".join(str(item) for item in value))
58
- elif value is not None:
59
- values.append(str(value))
60
- if values:
61
- return "\n".join(values)
62
- return json.dumps(tool_input)
63
- return json.dumps(tool_input)
64
-
65
-
66
- def main():
67
- try:
68
- data = json.load(sys.stdin)
69
- except Exception:
70
- allow()
71
-
72
- tool_name = data.get("tool_name", "")
73
- text = command_text(data.get("tool_input", {}))
74
-
75
- if CONFIG_FILE_RE.search(text):
76
- deny("reading Huawei Cloud credential/profile files can expose AK/SK or tokens. Use redacted toolkit tools.")
77
- if ENV_DUMP_RE.search(text):
78
- deny("dumping cloud credential environment variables is not allowed.")
79
- if SECRET_READ_RE.search(text):
80
- deny("direct secret value retrieval would put plaintext secrets into the agent context.")
81
- if tool_name == "Bash" and HCLOUD_RE.search(text) and WRITE_OPERATION_RE.search(text) and not READ_OPERATION_RE.search(text):
82
- deny("unapproved Huawei Cloud write operations must be planned first and explicitly approved by the user.")
83
-
84
- allow()
85
-
86
-
87
- if __name__ == "__main__":
88
- main()
1
+ #!/usr/bin/env python3
2
+ """PreToolUse hook for Huawei Cloud agent safety.
3
+
4
+ Blocks the highest-risk leakage paths before an agent tool runs:
5
+ - reading local Huawei Cloud credential files
6
+ - dumping cloud credential environment variables
7
+ - directly retrieving cloud secret values
8
+ - running unapproved write operations through hcloud
9
+
10
+ The MCP server carries the same policy in Node for platforms that do not support
11
+ plugin hooks.
12
+ """
13
+
14
+ import json
15
+ import re
16
+ import sys
17
+
18
+ DENY_PREFIX = "Huawei Cloud safety hook blocked this action: "
19
+
20
+ CONFIG_FILE_RE = re.compile(r"(\.hcloud|\.huaweicloud|hcloud[/\\](config|credentials)|huaweicloud[/\\](config|credentials))", re.I)
21
+ ENV_DUMP_RE = re.compile(r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I)
22
+ SECRET_READ_RE = re.compile(r"(ShowSecretVersion|GetSecretValue|secret_string|secret_binary)", re.I)
23
+ HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
24
+ WRITE_OPERATION_RE = re.compile(
25
+ r"\b(BatchCreate|BatchDelete|Create|Delete|Update|Modify|Resize|Reboot|Stop|Start|Restart|Authorize|Revoke|Add|Remove|Associate|Disassociate|Attach|Detach|Enable|Disable)\w*",
26
+ re.I,
27
+ )
28
+ READ_OPERATION_RE = re.compile(r"\b(List|Show|Get|Describe|NovaList|NovaShow)\w*", re.I)
29
+
30
+
31
+ def deny(reason):
32
+ json.dump(
33
+ {
34
+ "hookSpecificOutput": {
35
+ "hookEventName": "PreToolUse",
36
+ "permissionDecision": "deny",
37
+ "permissionDecisionReason": DENY_PREFIX + reason,
38
+ }
39
+ },
40
+ sys.stdout,
41
+ )
42
+ sys.exit(0)
43
+
44
+
45
+ def allow():
46
+ sys.exit(0)
47
+
48
+
49
+ def command_text(tool_input):
50
+ if isinstance(tool_input, str):
51
+ return tool_input
52
+ if isinstance(tool_input, dict):
53
+ values = []
54
+ for key in ("command", "cmd", "script", "args", "arguments"):
55
+ value = tool_input.get(key)
56
+ if isinstance(value, list):
57
+ values.append(" ".join(str(item) for item in value))
58
+ elif value is not None:
59
+ values.append(str(value))
60
+ if values:
61
+ return "\n".join(values)
62
+ return json.dumps(tool_input)
63
+ return json.dumps(tool_input)
64
+
65
+
66
+ def main():
67
+ try:
68
+ data = json.load(sys.stdin)
69
+ except Exception:
70
+ allow()
71
+
72
+ tool_name = data.get("tool_name", "")
73
+ text = command_text(data.get("tool_input", {}))
74
+
75
+ if CONFIG_FILE_RE.search(text):
76
+ deny("reading Huawei Cloud credential/profile files can expose AK/SK or tokens. Use redacted toolkit tools.")
77
+ if ENV_DUMP_RE.search(text):
78
+ deny("dumping cloud credential environment variables is not allowed.")
79
+ if SECRET_READ_RE.search(text):
80
+ deny("direct secret value retrieval would put plaintext secrets into the agent context.")
81
+ if tool_name == "Bash" and HCLOUD_RE.search(text) and WRITE_OPERATION_RE.search(text) and not READ_OPERATION_RE.search(text):
82
+ deny("unapproved Huawei Cloud write operations must be planned first and explicitly approved by the user.")
83
+
84
+ allow()
85
+
86
+
87
+ if __name__ == "__main__":
88
+ main()