huaweicloud-devkit 0.1.21 → 0.1.25-dev.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.agents/plugins/marketplace.json +20 -20
- package/LICENSE +201 -201
- package/README.md +169 -169
- package/bin/setup.cjs +7 -7
- package/integrations/opencode/commands/huaweicloud-doctor.md +14 -14
- package/integrations/opencode/opencode.json +14 -14
- package/integrations/opencode/skills/huaweicloud-core/SKILL.md +30 -30
- package/package.json +43 -43
- package/plugins/huaweicloud-core/.claude-plugin/plugin.json +43 -43
- package/plugins/huaweicloud-core/.codex-plugin/plugin.json +42 -42
- package/plugins/huaweicloud-core/.cursor-plugin/plugin.json +43 -43
- package/plugins/huaweicloud-core/.mcp.json +13 -13
- package/plugins/huaweicloud-core/hooks/hooks.json +26 -26
- package/plugins/huaweicloud-core/hooks/huaweicloud-safety.py +88 -88
- package/plugins/huaweicloud-core/safety/policy.json +85 -85
- package/plugins/huaweicloud-core/skills/huawei-apig/SKILL.md +144 -144
- package/plugins/huaweicloud-core/skills/huawei-billing/SKILL.md +48 -48
- package/plugins/huaweicloud-core/skills/huawei-cbr/SKILL.md +50 -50
- package/plugins/huaweicloud-core/skills/huawei-cce/SKILL.md +101 -101
- package/plugins/huaweicloud-core/skills/huawei-cloud-eye/SKILL.md +73 -73
- package/plugins/huaweicloud-core/skills/huawei-cts/SKILL.md +55 -55
- package/plugins/huaweicloud-core/skills/huawei-dds-dcs/SKILL.md +70 -70
- package/plugins/huaweicloud-core/skills/huawei-dew/SKILL.md +97 -97
- package/plugins/huaweicloud-core/skills/huawei-dew/references/csms-usage.md +29 -29
- package/plugins/huaweicloud-core/skills/huawei-dew/references/kms-usage.md +23 -23
- package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md +131 -131
- package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md +96 -96
- package/plugins/huaweicloud-core/skills/huawei-ecs/references/evs.md +31 -31
- package/plugins/huaweicloud-core/skills/huawei-ecs/references/flavors.md +28 -28
- package/plugins/huaweicloud-core/skills/huawei-ecs/references/troubleshooting.md +52 -52
- package/plugins/huaweicloud-core/skills/huawei-functiongraph/SKILL.md +132 -132
- package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/apig-event-format.md +58 -58
- package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md +71 -71
- package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/deploy-workflow.md +119 -119
- package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/triggers.md +142 -142
- package/plugins/huaweicloud-core/skills/huawei-gaussdb/SKILL.md +56 -56
- package/plugins/huaweicloud-core/skills/huawei-getting-started/SKILL.md +65 -65
- package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md +111 -111
- package/plugins/huaweicloud-core/skills/huawei-modelarts/SKILL.md +65 -65
- package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md +118 -118
- package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-lifecycle.md +26 -26
- package/plugins/huaweicloud-core/skills/huawei-obs/references/static-website.md +56 -56
- package/plugins/huaweicloud-core/skills/huawei-rds/SKILL.md +181 -181
- package/plugins/huaweicloud-core/skills/huawei-smn-dms/SKILL.md +69 -69
- package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md +78 -78
- package/plugins/huaweicloud-core/skills/huawei-vpc/references/network.md +76 -76
- package/plugins/huaweicloud-core/skills/huawei-vpc/references/security-group.md +59 -59
- package/plugins/huaweicloud-core/skills/huawei-waf-aad/SKILL.md +63 -63
- package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/agents/openai.yaml +4 -4
- package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md +47 -47
- package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/agents/openai.yaml +4 -4
- package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md +127 -127
- package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/agents/openai.yaml +4 -4
- package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md +93 -93
- package/plugins/huaweicloud-core/skills/huaweicloud-core/agents/openai.yaml +4 -4
- package/plugins/huaweicloud-core/skills/huaweicloud-core/references/report-issue.md +19 -19
- package/plugins/huaweicloud-core/skills/huaweicloud-core/references/select.md +27 -27
- package/plugins/huaweicloud-core/skills/huaweicloud-safety/SKILL.md +46 -46
- package/plugins/huaweicloud-core/skills/huaweicloud-safety/agents/openai.yaml +4 -4
- package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/SKILL.md +83 -83
- package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/agents/openai.yaml +4 -4
- package/plugins/huaweicloud-core/src/hcloud-cli.mjs +265 -265
- package/plugins/huaweicloud-core/src/mcp-server.mjs +116 -93
- package/plugins/huaweicloud-core/src/safety-policy.mjs +289 -289
- package/plugins/huaweicloud-core/src/setup-cli.mjs +874 -869
- package/plugins/huaweicloud-core/src/tools.mjs +677 -677
|
@@ -1,44 +1,44 @@
|
|
|
1
1
|
{
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
}
|
|
2
|
+
"interface": {
|
|
3
|
+
"displayName": "HuaweiCloud Devkit",
|
|
4
|
+
"shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
|
|
5
|
+
"longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
|
|
6
|
+
"developerName": "HuaweiCloud Mate",
|
|
7
|
+
"category": "Cloud",
|
|
8
|
+
"capabilities": [
|
|
9
|
+
"Read",
|
|
10
|
+
"Interactive"
|
|
11
|
+
],
|
|
12
|
+
"websiteURL": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
|
|
13
|
+
"brandColor": "#C7000B",
|
|
14
|
+
"defaultPrompt": [
|
|
15
|
+
"Help me choose the right Huawei Cloud capability.",
|
|
16
|
+
"Check my Huawei Cloud CLI setup safely.",
|
|
17
|
+
"Plan this Huawei Cloud API or SDK task."
|
|
18
|
+
]
|
|
19
|
+
},
|
|
20
|
+
"mcpServers": "./.mcp.json",
|
|
21
|
+
"description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
|
|
22
|
+
"skills": "./skills/",
|
|
23
|
+
"version": "0.1.23",
|
|
24
|
+
"author": {
|
|
25
|
+
"name": "HuaweiCloud Mate",
|
|
26
|
+
"url": "https://github.com/huaweicloud-mate"
|
|
27
|
+
},
|
|
28
|
+
"hooks": "./hooks/",
|
|
29
|
+
"name": "huaweicloud-core",
|
|
30
|
+
"homepage": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
|
|
31
|
+
"repository": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
|
|
32
|
+
"license": "Apache-2.0",
|
|
33
|
+
"keywords": [
|
|
34
|
+
"huaweicloud",
|
|
35
|
+
"huawei-cloud",
|
|
36
|
+
"koocli",
|
|
37
|
+
"hcloud",
|
|
38
|
+
"agent",
|
|
39
|
+
"mcp",
|
|
40
|
+
"api",
|
|
41
|
+
"sdk",
|
|
42
|
+
"skills"
|
|
43
|
+
]
|
|
44
|
+
}
|
|
@@ -1,43 +1,43 @@
|
|
|
1
1
|
{
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
}
|
|
2
|
+
"name": "huaweicloud-core",
|
|
3
|
+
"version": "0.1.23",
|
|
4
|
+
"description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
|
|
5
|
+
"author": {
|
|
6
|
+
"name": "HuaweiCloud Mate",
|
|
7
|
+
"url": "https://github.com/huaweicloud-mate"
|
|
8
|
+
},
|
|
9
|
+
"homepage": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
|
|
10
|
+
"repository": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
|
|
11
|
+
"license": "Apache-2.0",
|
|
12
|
+
"keywords": [
|
|
13
|
+
"huaweicloud",
|
|
14
|
+
"huawei-cloud",
|
|
15
|
+
"koocli",
|
|
16
|
+
"hcloud",
|
|
17
|
+
"agent",
|
|
18
|
+
"mcp",
|
|
19
|
+
"api",
|
|
20
|
+
"sdk",
|
|
21
|
+
"skills"
|
|
22
|
+
],
|
|
23
|
+
"skills": "./skills/",
|
|
24
|
+
"mcpServers": "./.mcp.json",
|
|
25
|
+
"interface": {
|
|
26
|
+
"displayName": "HuaweiCloud Devkit",
|
|
27
|
+
"shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
|
|
28
|
+
"longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
|
|
29
|
+
"developerName": "HuaweiCloud Mate",
|
|
30
|
+
"category": "Cloud",
|
|
31
|
+
"capabilities": [
|
|
32
|
+
"Read",
|
|
33
|
+
"Interactive"
|
|
34
|
+
],
|
|
35
|
+
"websiteURL": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
|
|
36
|
+
"brandColor": "#C7000B",
|
|
37
|
+
"defaultPrompt": [
|
|
38
|
+
"Help me choose the right Huawei Cloud capability.",
|
|
39
|
+
"Check my Huawei Cloud CLI setup safely.",
|
|
40
|
+
"Plan this Huawei Cloud API or SDK task."
|
|
41
|
+
]
|
|
42
|
+
}
|
|
43
|
+
}
|
|
@@ -1,44 +1,44 @@
|
|
|
1
1
|
{
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
}
|
|
2
|
+
"interface": {
|
|
3
|
+
"displayName": "HuaweiCloud Devkit",
|
|
4
|
+
"shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
|
|
5
|
+
"longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
|
|
6
|
+
"developerName": "HuaweiCloud Mate",
|
|
7
|
+
"category": "Cloud",
|
|
8
|
+
"capabilities": [
|
|
9
|
+
"Read",
|
|
10
|
+
"Interactive"
|
|
11
|
+
],
|
|
12
|
+
"websiteURL": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
|
|
13
|
+
"brandColor": "#C7000B",
|
|
14
|
+
"defaultPrompt": [
|
|
15
|
+
"Help me choose the right Huawei Cloud capability.",
|
|
16
|
+
"Check my Huawei Cloud CLI setup safely.",
|
|
17
|
+
"Plan this Huawei Cloud API or SDK task."
|
|
18
|
+
]
|
|
19
|
+
},
|
|
20
|
+
"mcpServers": "./.mcp.json",
|
|
21
|
+
"description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
|
|
22
|
+
"skills": "./skills/",
|
|
23
|
+
"version": "0.1.23",
|
|
24
|
+
"author": {
|
|
25
|
+
"name": "HuaweiCloud Mate",
|
|
26
|
+
"url": "https://github.com/huaweicloud-mate"
|
|
27
|
+
},
|
|
28
|
+
"hooks": "./hooks/",
|
|
29
|
+
"name": "huaweicloud-core",
|
|
30
|
+
"homepage": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
|
|
31
|
+
"repository": "https://github.com/huaweicloud-mate/huaweicloud-devkit",
|
|
32
|
+
"license": "Apache-2.0",
|
|
33
|
+
"keywords": [
|
|
34
|
+
"huaweicloud",
|
|
35
|
+
"huawei-cloud",
|
|
36
|
+
"koocli",
|
|
37
|
+
"hcloud",
|
|
38
|
+
"agent",
|
|
39
|
+
"mcp",
|
|
40
|
+
"api",
|
|
41
|
+
"sdk",
|
|
42
|
+
"skills"
|
|
43
|
+
]
|
|
44
|
+
}
|
|
@@ -1,13 +1,13 @@
|
|
|
1
|
-
{
|
|
2
|
-
"mcpServers": {
|
|
3
|
-
"huaweicloud": {
|
|
4
|
-
"command": "node",
|
|
5
|
-
"args": [
|
|
6
|
-
"./src/mcp-server.mjs"
|
|
7
|
-
],
|
|
8
|
-
"env": {
|
|
9
|
-
"HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local"
|
|
10
|
-
}
|
|
11
|
-
}
|
|
12
|
-
}
|
|
13
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"mcpServers": {
|
|
3
|
+
"huaweicloud": {
|
|
4
|
+
"command": "node",
|
|
5
|
+
"args": [
|
|
6
|
+
"./src/mcp-server.mjs"
|
|
7
|
+
],
|
|
8
|
+
"env": {
|
|
9
|
+
"HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local"
|
|
10
|
+
}
|
|
11
|
+
}
|
|
12
|
+
}
|
|
13
|
+
}
|
|
@@ -1,26 +1,26 @@
|
|
|
1
|
-
{
|
|
2
|
-
"hooks": {
|
|
3
|
-
"PreToolUse": [
|
|
4
|
-
{
|
|
5
|
-
"matcher": "Bash",
|
|
6
|
-
"hooks": [
|
|
7
|
-
{
|
|
8
|
-
"type": "command",
|
|
9
|
-
"command": "python3 \"${CLAUDE_PLUGIN_ROOT}/hooks/huaweicloud-safety.py\"",
|
|
10
|
-
"timeout": 5
|
|
11
|
-
}
|
|
12
|
-
]
|
|
13
|
-
},
|
|
14
|
-
{
|
|
15
|
-
"matcher": "mcp__.*huaweicloud.*|huaweicloud_.*",
|
|
16
|
-
"hooks": [
|
|
17
|
-
{
|
|
18
|
-
"type": "command",
|
|
19
|
-
"command": "python3 \"${CLAUDE_PLUGIN_ROOT}/hooks/huaweicloud-safety.py\"",
|
|
20
|
-
"timeout": 5
|
|
21
|
-
}
|
|
22
|
-
]
|
|
23
|
-
}
|
|
24
|
-
]
|
|
25
|
-
}
|
|
26
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"hooks": {
|
|
3
|
+
"PreToolUse": [
|
|
4
|
+
{
|
|
5
|
+
"matcher": "Bash",
|
|
6
|
+
"hooks": [
|
|
7
|
+
{
|
|
8
|
+
"type": "command",
|
|
9
|
+
"command": "python3 \"${CLAUDE_PLUGIN_ROOT}/hooks/huaweicloud-safety.py\"",
|
|
10
|
+
"timeout": 5
|
|
11
|
+
}
|
|
12
|
+
]
|
|
13
|
+
},
|
|
14
|
+
{
|
|
15
|
+
"matcher": "mcp__.*huaweicloud.*|huaweicloud_.*",
|
|
16
|
+
"hooks": [
|
|
17
|
+
{
|
|
18
|
+
"type": "command",
|
|
19
|
+
"command": "python3 \"${CLAUDE_PLUGIN_ROOT}/hooks/huaweicloud-safety.py\"",
|
|
20
|
+
"timeout": 5
|
|
21
|
+
}
|
|
22
|
+
]
|
|
23
|
+
}
|
|
24
|
+
]
|
|
25
|
+
}
|
|
26
|
+
}
|
|
@@ -1,88 +1,88 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
"""PreToolUse hook for Huawei Cloud agent safety.
|
|
3
|
-
|
|
4
|
-
Blocks the highest-risk leakage paths before an agent tool runs:
|
|
5
|
-
- reading local Huawei Cloud credential files
|
|
6
|
-
- dumping cloud credential environment variables
|
|
7
|
-
- directly retrieving cloud secret values
|
|
8
|
-
- running unapproved write operations through hcloud
|
|
9
|
-
|
|
10
|
-
The MCP server carries the same policy in Node for platforms that do not support
|
|
11
|
-
plugin hooks.
|
|
12
|
-
"""
|
|
13
|
-
|
|
14
|
-
import json
|
|
15
|
-
import re
|
|
16
|
-
import sys
|
|
17
|
-
|
|
18
|
-
DENY_PREFIX = "Huawei Cloud safety hook blocked this action: "
|
|
19
|
-
|
|
20
|
-
CONFIG_FILE_RE = re.compile(r"(\.hcloud|\.huaweicloud|hcloud[/\\](config|credentials)|huaweicloud[/\\](config|credentials))", re.I)
|
|
21
|
-
ENV_DUMP_RE = re.compile(r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I)
|
|
22
|
-
SECRET_READ_RE = re.compile(r"(ShowSecretVersion|GetSecretValue|secret_string|secret_binary)", re.I)
|
|
23
|
-
HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
|
|
24
|
-
WRITE_OPERATION_RE = re.compile(
|
|
25
|
-
r"\b(BatchCreate|BatchDelete|Create|Delete|Update|Modify|Resize|Reboot|Stop|Start|Restart|Authorize|Revoke|Add|Remove|Associate|Disassociate|Attach|Detach|Enable|Disable)\w*",
|
|
26
|
-
re.I,
|
|
27
|
-
)
|
|
28
|
-
READ_OPERATION_RE = re.compile(r"\b(List|Show|Get|Describe|NovaList|NovaShow)\w*", re.I)
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
def deny(reason):
|
|
32
|
-
json.dump(
|
|
33
|
-
{
|
|
34
|
-
"hookSpecificOutput": {
|
|
35
|
-
"hookEventName": "PreToolUse",
|
|
36
|
-
"permissionDecision": "deny",
|
|
37
|
-
"permissionDecisionReason": DENY_PREFIX + reason,
|
|
38
|
-
}
|
|
39
|
-
},
|
|
40
|
-
sys.stdout,
|
|
41
|
-
)
|
|
42
|
-
sys.exit(0)
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
def allow():
|
|
46
|
-
sys.exit(0)
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
def command_text(tool_input):
|
|
50
|
-
if isinstance(tool_input, str):
|
|
51
|
-
return tool_input
|
|
52
|
-
if isinstance(tool_input, dict):
|
|
53
|
-
values = []
|
|
54
|
-
for key in ("command", "cmd", "script", "args", "arguments"):
|
|
55
|
-
value = tool_input.get(key)
|
|
56
|
-
if isinstance(value, list):
|
|
57
|
-
values.append(" ".join(str(item) for item in value))
|
|
58
|
-
elif value is not None:
|
|
59
|
-
values.append(str(value))
|
|
60
|
-
if values:
|
|
61
|
-
return "\n".join(values)
|
|
62
|
-
return json.dumps(tool_input)
|
|
63
|
-
return json.dumps(tool_input)
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
def main():
|
|
67
|
-
try:
|
|
68
|
-
data = json.load(sys.stdin)
|
|
69
|
-
except Exception:
|
|
70
|
-
allow()
|
|
71
|
-
|
|
72
|
-
tool_name = data.get("tool_name", "")
|
|
73
|
-
text = command_text(data.get("tool_input", {}))
|
|
74
|
-
|
|
75
|
-
if CONFIG_FILE_RE.search(text):
|
|
76
|
-
deny("reading Huawei Cloud credential/profile files can expose AK/SK or tokens. Use redacted toolkit tools.")
|
|
77
|
-
if ENV_DUMP_RE.search(text):
|
|
78
|
-
deny("dumping cloud credential environment variables is not allowed.")
|
|
79
|
-
if SECRET_READ_RE.search(text):
|
|
80
|
-
deny("direct secret value retrieval would put plaintext secrets into the agent context.")
|
|
81
|
-
if tool_name == "Bash" and HCLOUD_RE.search(text) and WRITE_OPERATION_RE.search(text) and not READ_OPERATION_RE.search(text):
|
|
82
|
-
deny("unapproved Huawei Cloud write operations must be planned first and explicitly approved by the user.")
|
|
83
|
-
|
|
84
|
-
allow()
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
if __name__ == "__main__":
|
|
88
|
-
main()
|
|
1
|
+
#!/usr/bin/env python3
|
|
2
|
+
"""PreToolUse hook for Huawei Cloud agent safety.
|
|
3
|
+
|
|
4
|
+
Blocks the highest-risk leakage paths before an agent tool runs:
|
|
5
|
+
- reading local Huawei Cloud credential files
|
|
6
|
+
- dumping cloud credential environment variables
|
|
7
|
+
- directly retrieving cloud secret values
|
|
8
|
+
- running unapproved write operations through hcloud
|
|
9
|
+
|
|
10
|
+
The MCP server carries the same policy in Node for platforms that do not support
|
|
11
|
+
plugin hooks.
|
|
12
|
+
"""
|
|
13
|
+
|
|
14
|
+
import json
|
|
15
|
+
import re
|
|
16
|
+
import sys
|
|
17
|
+
|
|
18
|
+
DENY_PREFIX = "Huawei Cloud safety hook blocked this action: "
|
|
19
|
+
|
|
20
|
+
CONFIG_FILE_RE = re.compile(r"(\.hcloud|\.huaweicloud|hcloud[/\\](config|credentials)|huaweicloud[/\\](config|credentials))", re.I)
|
|
21
|
+
ENV_DUMP_RE = re.compile(r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I)
|
|
22
|
+
SECRET_READ_RE = re.compile(r"(ShowSecretVersion|GetSecretValue|secret_string|secret_binary)", re.I)
|
|
23
|
+
HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
|
|
24
|
+
WRITE_OPERATION_RE = re.compile(
|
|
25
|
+
r"\b(BatchCreate|BatchDelete|Create|Delete|Update|Modify|Resize|Reboot|Stop|Start|Restart|Authorize|Revoke|Add|Remove|Associate|Disassociate|Attach|Detach|Enable|Disable)\w*",
|
|
26
|
+
re.I,
|
|
27
|
+
)
|
|
28
|
+
READ_OPERATION_RE = re.compile(r"\b(List|Show|Get|Describe|NovaList|NovaShow)\w*", re.I)
|
|
29
|
+
|
|
30
|
+
|
|
31
|
+
def deny(reason):
|
|
32
|
+
json.dump(
|
|
33
|
+
{
|
|
34
|
+
"hookSpecificOutput": {
|
|
35
|
+
"hookEventName": "PreToolUse",
|
|
36
|
+
"permissionDecision": "deny",
|
|
37
|
+
"permissionDecisionReason": DENY_PREFIX + reason,
|
|
38
|
+
}
|
|
39
|
+
},
|
|
40
|
+
sys.stdout,
|
|
41
|
+
)
|
|
42
|
+
sys.exit(0)
|
|
43
|
+
|
|
44
|
+
|
|
45
|
+
def allow():
|
|
46
|
+
sys.exit(0)
|
|
47
|
+
|
|
48
|
+
|
|
49
|
+
def command_text(tool_input):
|
|
50
|
+
if isinstance(tool_input, str):
|
|
51
|
+
return tool_input
|
|
52
|
+
if isinstance(tool_input, dict):
|
|
53
|
+
values = []
|
|
54
|
+
for key in ("command", "cmd", "script", "args", "arguments"):
|
|
55
|
+
value = tool_input.get(key)
|
|
56
|
+
if isinstance(value, list):
|
|
57
|
+
values.append(" ".join(str(item) for item in value))
|
|
58
|
+
elif value is not None:
|
|
59
|
+
values.append(str(value))
|
|
60
|
+
if values:
|
|
61
|
+
return "\n".join(values)
|
|
62
|
+
return json.dumps(tool_input)
|
|
63
|
+
return json.dumps(tool_input)
|
|
64
|
+
|
|
65
|
+
|
|
66
|
+
def main():
|
|
67
|
+
try:
|
|
68
|
+
data = json.load(sys.stdin)
|
|
69
|
+
except Exception:
|
|
70
|
+
allow()
|
|
71
|
+
|
|
72
|
+
tool_name = data.get("tool_name", "")
|
|
73
|
+
text = command_text(data.get("tool_input", {}))
|
|
74
|
+
|
|
75
|
+
if CONFIG_FILE_RE.search(text):
|
|
76
|
+
deny("reading Huawei Cloud credential/profile files can expose AK/SK or tokens. Use redacted toolkit tools.")
|
|
77
|
+
if ENV_DUMP_RE.search(text):
|
|
78
|
+
deny("dumping cloud credential environment variables is not allowed.")
|
|
79
|
+
if SECRET_READ_RE.search(text):
|
|
80
|
+
deny("direct secret value retrieval would put plaintext secrets into the agent context.")
|
|
81
|
+
if tool_name == "Bash" and HCLOUD_RE.search(text) and WRITE_OPERATION_RE.search(text) and not READ_OPERATION_RE.search(text):
|
|
82
|
+
deny("unapproved Huawei Cloud write operations must be planned first and explicitly approved by the user.")
|
|
83
|
+
|
|
84
|
+
allow()
|
|
85
|
+
|
|
86
|
+
|
|
87
|
+
if __name__ == "__main__":
|
|
88
|
+
main()
|