huaweicloud-devkit 0.1.24 → 0.1.26-dev.0

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { homedir, platform } from 'node:os';
@@ -11,9 +11,14 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const PLUGIN_ROOT = resolve(__dirname, '..');
 const PACKAGE_ROOT = resolve(PLUGIN_ROOT, '..', '..');
 
+let pkgVersion = '0.0.0';
+try {
+  pkgVersion = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8')).version;
+} catch {}
+
 const BANNER = `
 ╔══════════════════════════════════════════════╗
-║     HuaweiCloud DevKit v0.1.0              ║
+║     HuaweiCloud DevKit v${pkgVersion}${' '.repeat(Math.max(0, 22 - String(pkgVersion).length))}║
 ║     https://github.com/huaweicloud-mate   ║
 ╚══════════════════════════════════════════════╝
 `;
@@ -80,20 +85,6 @@ function printSandboxWarning(reason) {
   console.log(`\x1b[31m  关闭沙箱后重新运行: npx huaweicloud-devkit install-hcloud\x1b[0m`);
 }
 
-// Try to auto-accept the KooCLI privacy agreement by answering 'y' on stdin.
-// Returns true when hcloud runs without re-prompting for the agreement.
-function acceptKooCliPrivacy(hcloudBin) {
-  const run = () => spawnSync(hcloudBin, ['version'], {
-    encoding: 'utf8', timeout: 10000, windowsHide: true, input: 'y\n',
-  });
-  const first = run();
-  const out = (first.stdout || '') + (first.stderr || '');
-  if (!/同意并继续使用|agree/i.test(out)) return first.status === 0;
-  const second = run();
-  const out2 = (second.stdout || '') + (second.stderr || '');
-  return second.status === 0 && !/同意并继续使用/.test(out2);
-}
-
 function checkNode() {
   const v = process.versions.node.split('.').map(Number);
   if (v[0] < 20) {
@@ -133,7 +124,7 @@ function updateOpenCodeConfig(pluginDir) {
   }
   const mcpPath = join(pluginDir, 'src', 'mcp-server.mjs').replace(/\\/g, '/');
   config.mcp = config.mcp || {};
-  config.mcp.huaweicloud = {
+  config.mcp['huaweicloud-devkit'] = {
     type: 'local',
     command: ['node', mcpPath],
     enabled: true,
@@ -147,8 +138,8 @@ function removeOpenCodeConfig() {
   if (!existsSync(configPath)) return;
   let config = {};
   try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch { return; }
-  if (!config.mcp?.huaweicloud) return;
-  delete config.mcp.huaweicloud;
+  if (!config.mcp?.['huaweicloud-devkit']) return;
+  delete config.mcp['huaweicloud-devkit'];
   if (Object.keys(config.mcp).length === 0) delete config.mcp;
   writeFileSync(configPath, JSON.stringify(config, null, 2));
   console.log(`  OpenCode MCP config cleaned: ${configPath}`);
@@ -156,14 +147,29 @@ function removeOpenCodeConfig() {
 
 function hasCodexCLI() {
   const r = spawnSync('codex --version', [], { shell: true, windowsHide: true, stdio: 'pipe' });
-  return r.status === 0 && r.stdout && r.stdout.toString().includes('codex');
+  if (r.status === 0 && r.stdout && r.stdout.toString().includes('codex')) return true;
+  // WindowsApps codex.exe may fail with "Access is denied"
+  // Fallback: check if codex exists on PATH via where.exe
+  if (process.platform === 'win32') {
+    const w = spawnSync('where.exe', ['codex'], { windowsHide: true, stdio: 'pipe' });
+    if (w.status === 0 && w.stdout.toString().trim()) return true;
+  }
+  return false;
 }
 
 function checkHcloud() {
   const bin = findHcloudBin() || (process.env.HCLOUD_BIN || 'hcloud');
-  const r = spawnSync(`"${bin}" version`, [], { shell: true, windowsHide: true, stdio: 'pipe', timeout: 5000, input: 'y\n' });
-  const out = (r.stdout ? r.stdout.toString() : '') + (r.stderr ? r.stderr.toString() : '');
-  return r.status === 0 && /KooCLI|Current.*version|当前KooCLI/i.test(out);
+  if (!existsSync(bin)) return false;
+  try {
+    if (statSync(bin).size < 1024) return false;
+  } catch { return false; }
+  try {
+    const r = spawnSync(`"${bin}" version`, [], { shell: true, windowsHide: true, stdio: 'pipe', timeout: 5000 });
+    const out = (r.stdout ? r.stdout.toString() : '') + (r.stderr ? r.stderr.toString() : '');
+    return r.status === 0 && /KooCLI|Current.*version|当前KooCLI/i.test(out);
+  } catch {
+    return false;
+  }
 }
 
 function getMarketplaceName() {
@@ -186,12 +192,25 @@ function installCodex() {
   });
   console.log(`  ${r1.stdout ? r1.stdout.toString().trim() : r1.stderr.toString().trim()}`);
 
+  if (r1.status !== 0 && /Access is denied/i.test((r1.stderr || '').toString())) {
+    console.log(`  \x1b[33mWindowsApps codex.exe permission denied.\x1b[0m`);
+    console.log(`  \x1b[33mUse: npx huaweicloud-devkit install --target codex-desktop\x1b[0m`);
+    return false;
+  }
+
   console.log(`  Installing plugin: ${pluginName}@${marketplaceName}`);
   const r2 = spawnSync(`codex plugin add "${pluginName}@${marketplaceName}"`, [], {
     shell: true, windowsHide: true, stdio: 'pipe',
   });
   console.log(`  ${r2.stdout ? r2.stdout.toString().trim() : r2.stderr.toString().trim()}`);
-  return r2.status === 0;
+
+  if (r2.status !== 0 && /Access is denied/i.test((r2.stderr || '').toString())) {
+    console.log(`  \x1b[33mWindowsApps codex.exe permission denied.\x1b[0m`);
+    console.log(`  \x1b[33mUse: npx huaweicloud-devkit install --target codex-desktop\x1b[0m`);
+    return false;
+  }
+
+  return true;
 }
 
 function uninstallCodex() {
@@ -276,6 +295,27 @@ async function installCodexDesktop() {
   copyDir(safetyDir, join(codexDesktopPluginsDir(), 'safety'));
   console.log(`  Safety Policy -> ${join(codexDesktopPluginsDir(), 'safety')}`);
 
+  // Generate .mcp.json with absolute paths for Codex Desktop MCP server discovery
+  const mcpServerAbsPath = join(codexDesktopPluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
+  const mcpConfig = {
+    mcpServers: {
+      'huaweicloud-devkit': {
+        command: 'node',
+        args: [mcpServerAbsPath],
+        env: { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' },
+      },
+    },
+  };
+  writeFileSync(join(codexDesktopPluginsDir(), '.mcp.json'), JSON.stringify(mcpConfig, null, 2));
+  console.log(`  MCP Config -> ${join(codexDesktopPluginsDir(), '.mcp.json')}`);
+
+  // Copy .codex-plugin manifest for Codex Desktop plugin registration
+  const codexPluginSrc = join(PLUGIN_ROOT, '.codex-plugin');
+  if (existsSync(codexPluginSrc)) {
+    copyDir(codexPluginSrc, join(codexDesktopPluginsDir(), '.codex-plugin'));
+    console.log(`  Plugin Manifest -> ${join(codexDesktopPluginsDir(), '.codex-plugin')}`);
+  }
+
   const mcpPath = join(codexDesktopPluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
   const configPath = codexDesktopConfigFile();
   let config = {};
@@ -283,7 +323,7 @@ async function installCodexDesktop() {
     try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
   }
   config.mcp = config.mcp || {};
-  config.mcp.huaweicloud = {
+  config.mcp['huaweicloud-devkit'] = {
     type: 'local',
     command: ['node', mcpPath],
     enabled: true,
@@ -324,8 +364,8 @@ function uninstallCodexDesktop() {
   if (existsSync(configPath)) {
     let config = {};
     try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
-    if (config.mcp?.huaweicloud) {
-      delete config.mcp.huaweicloud;
+    if (config.mcp?.['huaweicloud-devkit']) {
+      delete config.mcp['huaweicloud-devkit'];
       if (Object.keys(config.mcp).length === 0) delete config.mcp;
       writeFileSync(configPath, JSON.stringify(config, null, 2));
       console.log('  Config cleaned');
@@ -343,7 +383,7 @@ function registerCodeartsMcp(configPath) {
   const env = { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' };
   const hcloudBin = findHcloudBin();
   if (hcloudBin) env.HCLOUD_BIN = hcloudBin.replace(/\\/g, '/');
-  config.mcpServers.huaweicloud = {
+  config.mcpServers['huaweicloud-devkit'] = {
     command: 'node',
     args: [mcpPath],
     env,
@@ -394,8 +434,8 @@ function uninstallCodeArts() {
     if (!existsSync(configPath)) continue;
     let config = {};
     try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
-    if (config.mcpServers?.huaweicloud) {
-      delete config.mcpServers.huaweicloud;
+    if (config.mcpServers?.['huaweicloud-devkit']) {
+      delete config.mcpServers['huaweicloud-devkit'];
       if (Object.keys(config.mcpServers).length === 0) delete config.mcpServers;
       writeFileSync(configPath, JSON.stringify(config, null, 2));
       console.log(`  Config cleaned: ${configPath}`);
@@ -416,7 +456,7 @@ function codeartsStatus() {
   if (existsSync(codeartsMcpSettingsFile())) {
     try {
       const config = JSON.parse(readFileSync(codeartsMcpSettingsFile(), 'utf8'));
-      console.log(`  MCP config: ${config.mcpServers?.huaweicloud ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`);
+      console.log(`  MCP config: ${config.mcpServers?.['huaweicloud-devkit'] ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`);
     } catch {
       console.log(`  MCP config: \x1b[31mInvalid\x1b[0m`);
     }
@@ -438,7 +478,7 @@ function opencodeStatus() {
   if (existsSync(configPath)) {
     try {
       const config = JSON.parse(readFileSync(configPath, 'utf8'));
-      console.log(`  MCP config: ${config.mcp?.huaweicloud ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`);
+      console.log(`  MCP config: ${config.mcp?.['huaweicloud-devkit'] ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`);
     } catch {
       console.log(`  MCP config: \x1b[31mInvalid\x1b[0m`);
     }
@@ -478,18 +518,25 @@ async function cmdInstall() {
     console.log('\n[Codex]');
     if (!hasCodexCLI()) {
       if (target === 'codex') {
-        console.log(`  \x1b[31mCodex CLI not found. Install Codex first: https://github.com/openai/codex-cli\x1b[0m`);
-        console.log(`  Then re-run: npx huaweicloud-devkit install --target codex`);
+        console.log(`  \x1b[31mCodex CLI not found.\x1b[0m`);
+        if (process.platform === 'win32') {
+          console.log(`  \x1b[33mTip: Codex Desktop on Windows installs codex.exe under WindowsApps,\x1b[0m`);
+          console.log(`  \x1b[33m     which may fail with "Access is denied". Try instead:\x1b[0m`);
+          console.log(`  \x1b[33m     npx huaweicloud-devkit install --target codex-desktop\x1b[0m`);
+        }
+        console.log(`  \x1b[31mOr install Codex CLI: https://github.com/openai/codex-cli\x1b[0m`);
         process.exit(1);
       }
       console.log(`  \x1b[33mCodex CLI not found. Skipping Codex.\x1b[0m`);
-      console.log('  Install Codex CLI to enable: npx huaweicloud-devkit install --target codex');
+      if (process.platform === 'win32') {
+        console.log('  \x1b[33mTip: try --target codex-desktop for Codex Desktop on Windows\x1b[0m');
+      } else {
+        console.log('  Install Codex CLI to enable: npx huaweicloud-devkit install --target codex');
+      }
     } else {
       installCodex();
     }
-  }
-
-  console.log(`\n\x1b[32mInstallation complete!\x1b[0m`);
+  }  console.log(`\n\x1b[32mInstallation complete!\x1b[0m`);
   const appName = target === 'codearts' ? 'CodeArts'
     : target === 'codex-desktop' ? 'Codex Desktop'
     : target === 'codex' ? 'Codex' : 'OpenCode';
@@ -589,38 +636,45 @@ async function cmdDoctor() {
   // Node.js
   check('Node.js >= 20', process.versions.node.split('.')[0] >= 20, 'Run: nvm install 20 && nvm use 20');
 
-  // OpenCode installed files
-  const pluginDir = opencodePluginsDir();
-  const mcpOk = existsSync(join(pluginDir, 'src', 'mcp-server.mjs'));
-  check('MCP server installed', mcpOk, 'Run: npx huaweicloud-devkit-test install');
+    // MCP server — check OpenCode and Codex Desktop paths
+  const opencodePluginDir = opencodePluginsDir();
+  const codexPluginDir = codexDesktopPluginsDir();
+  const mcpOk = existsSync(join(opencodePluginDir, 'src', 'mcp-server.mjs'))
+    || existsSync(join(codexPluginDir, 'src', 'mcp-server.mjs'));
+  const mcpTarget = existsSync(join(opencodePluginDir, 'src', 'mcp-server.mjs')) ? 'OpenCode'
+    : existsSync(join(codexPluginDir, 'src', 'mcp-server.mjs')) ? 'Codex Desktop' : '';
+  check('MCP server installed', mcpOk, 'Run: npx huaweicloud-devkit install');
 
   if (mcpOk) {
-    // Try to start MCP server briefly
-    const test = spawnSync('node', [join(pluginDir, 'src', 'mcp-server.mjs')], {
-      env: { ...process.env, HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' },
-      timeout: 3000, stdio: 'pipe', windowsHide: true,
-    });
-    // MCP server reads stdin for JSON-RPC, so it will hang briefly then get killed
-    // We just check that the process spawned OK
-    check('MCP server can start', true, '');
+    check(`MCP server can start (${mcpTarget})`, true, '');
   }
 
-  const safetyOk = existsSync(join(pluginDir, 'safety', 'policy.json'));
-  check('Safety policy installed', safetyOk, 'Run: npx huaweicloud-devkit-test install');
+  const safetyOk = existsSync(join(opencodePluginDir, 'safety', 'policy.json'))
+    || existsSync(join(codexPluginDir, 'safety', 'policy.json'));
+  check('Safety policy installed', safetyOk, 'Run: npx huaweicloud-devkit install');
 
-  const opencodeCfg = opencodeConfigFile();
+  // MCP config — check OpenCode and Codex Desktop
   let mcpConfigured = false;
+  let mcpCfgTarget = '';
+  const opencodeCfg = opencodeConfigFile();
   if (existsSync(opencodeCfg)) {
     try {
       const cfg = JSON.parse(readFileSync(opencodeCfg, 'utf8'));
-      mcpConfigured = !!(cfg.mcp && cfg.mcp.huaweicloud);
+      if (cfg.mcp && cfg.mcp['huaweicloud-devkit']) { mcpConfigured = true; mcpCfgTarget = 'OpenCode'; }
+    } catch {}
+  }
+  const codexCfg = codexDesktopConfigFile();
+  if (!mcpConfigured && existsSync(codexCfg)) {
+    try {
+      const cfg = JSON.parse(readFileSync(codexCfg, 'utf8'));
+      if (cfg.mcp && cfg.mcp['huaweicloud-devkit']) { mcpConfigured = true; mcpCfgTarget = 'Codex Desktop'; }
     } catch {}
   }
-  check('OpenCode MCP configured', mcpConfigured, `Add MCP to ${opencodeCfg} — run: npx huaweicloud-devkit-test install`);
+  check('MCP configured', mcpConfigured, mcpCfgTarget ? `Found in ${mcpCfgTarget} config` : 'Run: npx huaweicloud-devkit install');
 
   // hcloud CLI
   const hcloudBin = findHcloudBin() || (process.env.HCLOUD_BIN || 'hcloud');
-  const hcloudCheck = spawnSync(`"${hcloudBin}" version`, [], { shell: true, windowsHide: true, stdio: 'pipe', timeout: 5000, input: 'y\n' });
+  const hcloudCheck = spawnSync(`"${hcloudBin}" version`, [], { shell: true, windowsHide: true, stdio: 'pipe', timeout: 5000 });
   const hcloudOut = (hcloudCheck.stdout || '').toString() + (hcloudCheck.stderr || '').toString();
   const hcloudOk = hcloudCheck.status === 0 && /KooCLI|Current.*version|当前KooCLI/i.test(hcloudOut);
   check('hcloud CLI installed', hcloudOk, 'Run: npx huaweicloud-devkit install-hcloud');
@@ -760,18 +814,25 @@ async function cmdInstallHcloud() {
       console.log(`\n\x1b[32mInstall complete.\x1b[0m`);
       console.log(`  Verify: ${join(installDir, 'hcloud.exe')} version`);
 
-      // Auto-accept the KooCLI privacy agreement so first run does not hang
-      console.log('\n  Accepting KooCLI privacy agreement...');
       const hcloudBin = join(installDir, 'hcloud.exe');
-      if (acceptKooCliPrivacy(hcloudBin)) {
-        console.log('  \x1b[32mPrivacy agreement accepted. KooCLI ready.\x1b[0m');
-      } else {
-        console.log('  \x1b[33m无法自动接受隐私协议（可能因沙箱阻止写入配置目录）。\x1b[0m');
-        if (detectCodeartsSandbox() === 'sandbox') {
-          printSandboxWarning('KooCLI 需要写入配置目录 (如 ~/.hcloud/root) 以保存隐私协议同意状态，但沙箱模式阻止了写入。');
+
+      // Ask user before accepting the privacy agreement — never auto-accept.
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      const agree = await new Promise((resolve) => {
+        rl.question('\n  KooCLI requires accepting its privacy agreement. Do you accept? (y/N) ', (answer) => {
+          rl.close();
+          resolve(/^\s*y\s*$/i.test(answer));
+        });
+      });
+      if (agree) {
+        const r = spawnSync(hcloudBin, ['version'], { input: 'y\n', encoding: 'utf8', timeout: 10000, windowsHide: true });
+        if (r.status === 0) {
+          console.log('  \x1b[32mPrivacy agreement accepted. KooCLI ready.\x1b[0m');
         } else {
-          console.log('  请在码道外终端运行一次: hcloud version 并按提示输入 y');
+          console.log('  \x1b[33m无法写入配置目录。请在码道外终端运行: echo "y" | hcloud version\x1b[0m');
         }
+      } else {
+        console.log('  \x1b[33m请手动接受隐私协议：在终端运行 hcloud version 并按提示操作\x1b[0m');
       }
 
       console.log('  Or restart terminal and: hcloud version');

package/plugins/huaweicloud-core/src/tools.mjs

@@ -1,6 +1,7 @@
 import { planHcloudCommand, runHcloud } from './hcloud-cli.mjs';
 import { classifyTextCommand, redactSecrets } from './safety-policy.mjs';
-import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { evaluateArtifacts, evaluateCommandRisk, evaluateDeployPlan } from './risk-rule-engine.mjs';
+import { readFileSync, readdirSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
@@ -144,6 +145,51 @@ export const TOOL_DEFINITIONS = [
       },
     },
   },
+  {
+    name: 'huaweicloud_hook_check_command',
+    description: 'Check a planned shell or hcloud command against Huawei Cloud hook risk rules without executing it.',
+    inputSchema: {
+      type: 'object',
+      required: ['command'],
+      properties: {
+        command: { type: 'string', description: 'The exact command text to inspect.' },
+      },
+    },
+  },
+  {
+    name: 'huaweicloud_hook_check_artifacts',
+    description: 'Check generated code, IaC, policy, or config artifacts against Huawei Cloud hook risk rules.',
+    inputSchema: {
+      type: 'object',
+      required: ['artifacts'],
+      properties: {
+        artifacts: {
+          type: 'array',
+          items: {
+            type: 'object',
+            required: ['path', 'content'],
+            properties: {
+              path: { type: 'string' },
+              content: { type: 'string' },
+            },
+          },
+        },
+      },
+    },
+  },
+  {
+    name: 'huaweicloud_hook_check_deploy_plan',
+    description: 'Check a structured or textual deployment plan for Huawei Cloud sandbox, exposure, IAM, and cost risks.',
+    inputSchema: {
+      type: 'object',
+      required: ['plan'],
+      properties: {
+        plan: {
+          description: 'Deployment plan as an object, array, or string.',
+        },
+      },
+    },
+  },
   {
     name: 'huaweicloud_service_catalog',
     description: 'Return the recommended capability sources for Huawei Cloud agent tasks.',
@@ -224,6 +270,16 @@ export const TOOL_DEFINITIONS = [
       },
     },
   },
+  {
+    name: 'huaweicloud_setup_obs_config',
+    description: 'Synchronize KooCLI credentials to OBS config (~/.obsutilconfig). KooCLI and OBS use separate credential stores — hcloud commands work fine but OBS commands fail with "Please set ak, sk" unless this sync is done. Run this once to enable OBS operations; re-run after changing hcloud credentials.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        profile: { type: 'string', description: 'Optional KooCLI profile name. Uses the active profile by default.' },
+      },
+    },
+  },
 ];
 
 export async function callTool(name, args = {}) {
@@ -245,6 +301,12 @@ export async function callTool(name, args = {}) {
       return runApprovedCommand(args);
     case 'huaweicloud_show_profile_redacted':
       return showProfileRedacted(args.profile);
+    case 'huaweicloud_hook_check_command':
+      return hookResult(evaluateCommandRisk(args.command || ''));
+    case 'huaweicloud_hook_check_artifacts':
+      return hookResult(evaluateArtifacts(args.artifacts || []));
+    case 'huaweicloud_hook_check_deploy_plan':
+      return hookResult(evaluateDeployPlan(args.plan || {}));
     case 'huaweicloud_service_catalog':
       return serviceCatalog(args.intent);
     case 'huaweicloud_search_docs':
@@ -259,11 +321,26 @@ export async function callTool(name, args = {}) {
       return explainError(args);
     case 'huaweicloud_search_marketplace':
       return searchMarketplace(args.query || '', args.category || '');
+    case 'huaweicloud_setup_obs_config':
+      return setupObsConfig(args.profile);
     default:
       throw new Error(`Unknown tool: ${name}`);
   }
 }
 
+function hookResult(result) {
+  return {
+    ok: result.decision !== 'deny',
+    decision: result.decision,
+    findings: result.findings,
+    nextStep: result.decision === 'deny'
+      ? 'Revise the command, artifact, or deployment plan before execution.'
+      : result.decision === 'warn'
+        ? 'Review the warnings with the user before proceeding.'
+        : 'No Huawei Cloud hook risk rule matched.',
+  };
+}
+
 export async function runVersionCheck(options = {}) {
   const result = await runHcloud(['version'], {
     ...options,
@@ -312,6 +389,84 @@ async function showProfileRedacted(profile) {
   };
 }
 
+async function setupObsConfig(profile) {
+  const obsConfigPath = join(homedir(), '.obsutilconfig');
+  if (existsSync(obsConfigPath)) {
+    return { ok: true, existed: true, path: obsConfigPath, note: 'OBS config already exists. Delete ~/.obsutilconfig first if you need to re-sync.' };
+  }
+
+  const args = ['configure', 'show'];
+  if (profile) args.push('--cli-profile', String(profile));
+  const result = await runHcloud(args, { allowWrites: false, allowCredentialRead: true });
+
+  if (!result.ok) {
+    return {
+      ok: false,
+      error: 'Failed to read hcloud profile.',
+      detail: result.error || result.stderr || 'hcloud not installed or not configured',
+      nextStep: 'Run "hcloud configure init" outside agent chat, then retry.',
+    };
+  }
+
+  let accessKeyId = '';
+  let secretAccessKey = '';
+  let region = '';
+
+  try {
+    const parsed = typeof result.stdout === 'string' ? JSON.parse(result.stdout) : result.stdout;
+    const cred = parsed.currentCredential || {};
+    accessKeyId = cred.accessKeyId || cred.ak || cred.access_key || '';
+    secretAccessKey = cred.secretAccessKey || cred.sk || cred.secret_key || '';
+    region = parsed.currentRegion || parsed.region || '';
+  } catch {
+    return {
+      ok: false,
+      error: 'Failed to parse hcloud profile output.',
+      detail: 'hcloud configure show returned unexpected format',
+    };
+  }
+
+  if (!accessKeyId || !secretAccessKey) {
+    return {
+      ok: false,
+      error: 'No credentials found in hcloud profile.',
+      nextStep: 'Run "hcloud configure init" outside agent chat to set up credentials first.',
+    };
+  }
+
+  if (!region) {
+    return {
+      ok: false,
+      error: 'No region found in hcloud profile.',
+      nextStep: 'Run "hcloud configure set --cli-region=<region>" outside agent chat to set a default region.',
+    };
+  }
+
+  const endpoint = `https://obs.${region}.myhuaweicloud.com`;
+  const configContent = `[default]\r\nendpoint=${endpoint}\r\nak=${accessKeyId}\r\nsk=${secretAccessKey}\r\n`;
+
+  try {
+    writeFileSync(obsConfigPath, configContent, { encoding: 'utf8', mode: 0o600 });
+  } catch (e) {
+    return {
+      ok: false,
+      error: 'Failed to write OBS config file.',
+      detail: e.message,
+      path: obsConfigPath,
+    };
+  }
+
+  return {
+    ok: true,
+    existed: false,
+    created: true,
+    path: obsConfigPath,
+    region,
+    endpoint,
+    note: 'OBS credentials synced from hcloud profile. OBS commands (hcloud OBS ls, mb, cp, etc.) should now work.',
+  };
+}
+
 const SERVICE_EXAMPLES = {
   ECS: { list: 'ECS ListServersDetails', create: 'ECS CreateServers', show: 'IMS GlanceShowImage' },
   VPC: { list: 'VPC ListVpcs', create: 'VPC CreateVpc', show: 'VPC ShowVpc' },