huaweicloud-devkit 0.1.25-dev.0 → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +9 -22
- package/integrations/opencode/opencode.json +1 -1
- package/integrations/opencode/skills/huaweicloud-core/SKILL.md +2 -0
- package/package.json +2 -2
- package/plugins/huaweicloud-core/.claude-plugin/plugin.json +43 -43
- package/plugins/huaweicloud-core/.codex-plugin/plugin.json +42 -42
- package/plugins/huaweicloud-core/.cursor-plugin/plugin.json +43 -43
- package/plugins/huaweicloud-core/.mcp.json +1 -1
- package/plugins/huaweicloud-core/hooks/huaweicloud-safety.py +48 -0
- package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json +178 -0
- package/plugins/huaweicloud-core/skills/huawei-cloud-find-skills/SKILL.md +1 -1
- package/plugins/huaweicloud-core/skills/huawei-dds-dcs/SKILL.md +2 -2
- package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md +4 -0
- package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md +23 -4
- package/plugins/huaweicloud-core/skills/huawei-ecs/references/flavors.md +28 -1
- package/plugins/huaweicloud-core/skills/huawei-functiongraph/SKILL.md +0 -1
- package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/triggers.md +1 -1
- package/plugins/huaweicloud-core/skills/huawei-getting-started/SKILL.md +2 -2
- package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md +2 -11
- package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md +4 -1
- package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md +5 -5
- package/plugins/huaweicloud-core/skills/huaweicloud-safety/SKILL.md +14 -0
- package/plugins/huaweicloud-core/src/mcp-server.mjs +5 -3
- package/plugins/huaweicloud-core/src/risk-rule-engine.mjs +137 -0
- package/plugins/huaweicloud-core/src/safety-policy.mjs +26 -13
- package/plugins/huaweicloud-core/src/setup-cli.mjs +127 -66
- package/plugins/huaweicloud-core/src/tools.mjs +156 -1
package/README.md
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
|
-
# HuaweiCloud DevKit
|
|
1
|
+
# HuaweiCloud DevKit
|
|
2
2
|
|
|
3
3
|
[](LICENSE)
|
|
4
|
-
[](https://github.com/huaweicloud/HuaweiCloud-Devkit/actions/workflows/ci.yml)
|
|
5
5
|
|
|
6
6
|
帮助 AI 编码助手安全、准确地使用华为云——技能引导、KooCLI 工具、安全策略一站式集成。
|
|
7
7
|
|
|
8
|
-
HuaweiCloud DevKit 为 AI 编码助手提供操作华为云所需的知识、工具和安全护栏，支持 OpenCode、Codex
|
|
8
|
+
HuaweiCloud DevKit 为 AI 编码助手提供操作华为云所需的知识、工具和安全护栏，支持 OpenCode、Codex、码道（CodeArts Agent）等主流 Agent。
|
|
9
9
|
|
|
10
10
|
## 快速开始
|
|
11
11
|
|
|
@@ -32,16 +32,6 @@ npx --yes huaweicloud-devkit install --target codex
|
|
|
32
32
|
|
|
33
33
|
> 需要先安装 Codex CLI。`--target all` 会在 Codex CLI 缺失时跳过 Codex。
|
|
34
34
|
|
|
35
|
-
### Claude Code
|
|
36
|
-
|
|
37
|
-
通过 **设置 → 插件 → 团队市场 → 添加市场 → 从仓库导入**，指向 `huaweicloud-mate/huaweicloud-devkit`。Claude Code 会自动索引插件。
|
|
38
|
-
|
|
39
|
-
安装插件：
|
|
40
|
-
|
|
41
|
-
```
|
|
42
|
-
/plugin install huaweicloud-core@huaweicloud-devkit
|
|
43
|
-
```
|
|
44
|
-
|
|
45
35
|
### CodeArts Agent（码道）
|
|
46
36
|
|
|
47
37
|
码道没有插件市场，通过技能 + MCP 机制适配：
|
|
@@ -63,12 +53,6 @@ npx --yes huaweicloud-devkit uninstall --target codearts # 卸载
|
|
|
63
53
|
>
|
|
64
54
|
> **认证**：KooCLI 就绪后，还需在码道外终端执行 `hcloud configure init` 配置 AK/SK 与区域，然后即可在码道中描述你的华为云任务。
|
|
65
55
|
|
|
66
|
-
### Cursor
|
|
67
|
-
|
|
68
|
-
通过 **设置 → 插件 → 团队市场 → 添加市场 → 从仓库导入**，指向 `huaweicloud-mate/huaweicloud-devkit`。
|
|
69
|
-
|
|
70
|
-
然后在**插件**面板中安装 **huaweicloud-core** 插件。
|
|
71
|
-
|
|
72
56
|
### 其他 Agent
|
|
73
57
|
|
|
74
58
|
对于支持 Model Context Protocol (MCP) 的 Agent，手动配置 MCP 服务器：
|
|
@@ -76,7 +60,7 @@ npx --yes huaweicloud-devkit uninstall --target codearts # 卸载
|
|
|
76
60
|
```json
|
|
77
61
|
{
|
|
78
62
|
"mcp": {
|
|
79
|
-
"huaweicloud": {
|
|
63
|
+
"huaweicloud-devkit": {
|
|
80
64
|
"type": "local",
|
|
81
65
|
"command": ["node", "<路径>/plugins/huaweicloud-core/src/mcp-server.mjs"],
|
|
82
66
|
"enabled": true
|
|
@@ -123,7 +107,7 @@ Agent 技能是经过整理的指令和参考材料包，帮助 Agent 完成特
|
|
|
123
107
|
|
|
124
108
|
- **安全优先执行** — 所有 `hcloud` 命令执行前自动分类（读/写/密钥），写操作需用户明确批准。
|
|
125
109
|
- **输出脱敏** — 凭证形态的值（AK/SK、Token、密码）自动替换为 `***REDACTED***`。
|
|
126
|
-
- **
|
|
110
|
+
- **16 个结构化工具** — 技能搜索、CLI 检查、只读命令、区域发现、错误解释、Hook 风险检查等。
|
|
127
111
|
- **零运行时依赖** — 纯 Node.js（>= 20），无需 npm install。
|
|
128
112
|
|
|
129
113
|
详见 [MCP 工具表](#mcp-工具)。
|
|
@@ -135,7 +119,7 @@ Agent 技能是经过整理的指令和参考材料包，帮助 Agent 完成特
|
|
|
135
119
|
| 层级 | 机制 | 说明 |
|
|
136
120
|
|------|------|------|
|
|
137
121
|
| 技能层 | `SKILL.md` 流程文档 | 教会 Agent 正确的行为规则和安全用法 |
|
|
138
|
-
| 钩子层 | `huaweicloud-safety.py` | PreToolUse Hook
|
|
122
|
+
| 钩子层 | `huaweicloud-safety.py` | PreToolUse Hook 阻断高风险工具调用 |
|
|
139
123
|
| MCP 层 | `safety-policy.mjs` | Node.js 安全策略包装器，在所有 Agent 环境中强制执行 |
|
|
140
124
|
|
|
141
125
|
详见 [`docs/safety-model.md`](docs/safety-model.md)。
|
|
@@ -154,6 +138,9 @@ Agent 技能是经过整理的指令和参考材料包，帮助 Agent 完成特
|
|
|
154
138
|
| CLI | `huaweicloud_run_readonly_command` | 执行只读命令并脱敏输出 |
|
|
155
139
|
| CLI | `huaweicloud_run_approved_command` | 经用户明确批准后执行写命令 |
|
|
156
140
|
| 安全 | `huaweicloud_show_profile_redacted` | 安全查看 KooCLI 配置（凭证脱敏） |
|
|
141
|
+
| 安全 | `huaweicloud_hook_check_command` | 执行前检查 Shell/KooCLI 命令风险 |
|
|
142
|
+
| 安全 | `huaweicloud_hook_check_artifacts` | 检查生成的代码、IaC、IAM/OBS 策略和配置文件风险 |
|
|
143
|
+
| 安全 | `huaweicloud_hook_check_deploy_plan` | 检查沙箱、预览环境和云资源部署计划风险 |
|
|
157
144
|
| 路由 | `huaweicloud_service_catalog` | 返回推荐的能力来源排序 |
|
|
158
145
|
| 排错 | `huaweicloud_explain_error` | 解释错误码并建议诊断步骤 |
|
|
159
146
|
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"$schema": "https://opencode.ai/config.json",
|
|
3
3
|
"_note": "Merge this into ~/.config/opencode/opencode.jsonc. Replace the path with the absolute path to your mcp-server.mjs installation.",
|
|
4
4
|
"mcp": {
|
|
5
|
-
"huaweicloud": {
|
|
5
|
+
"huaweicloud-devkit": {
|
|
6
6
|
"type": "local",
|
|
7
7
|
"command": [
|
|
8
8
|
"node",
|
|
@@ -20,6 +20,8 @@ Use this skill as the OpenCode entry point. Prefer the full skill set under `plu
|
|
|
20
20
|
|
|
21
21
|
Never ask the user to paste credentials. Never read `.hcloud` or `.huaweicloud` files into context. Plan writes first, ask for explicit approval, then verify with read-only checks.
|
|
22
22
|
|
|
23
|
+
For commands that assemble Huawei Cloud parameters through variables, string concatenation, subshells, encoded payloads, or generated scripts, inspect the final expanded command text before execution. If OpenCode cannot determine the final values, ask for explicit review or run the planning/check tool on the expanded command.
|
|
24
|
+
|
|
23
25
|
## KooCLI Basics
|
|
24
26
|
|
|
25
27
|
- Install guide: `https://support.huaweicloud.com/qs-hcli/hcli_02_003.html`.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "huaweicloud-devkit",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "1.0.0",
|
|
4
4
|
"description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"files": [
|
|
@@ -14,7 +14,7 @@
|
|
|
14
14
|
},
|
|
15
15
|
"repository": {
|
|
16
16
|
"type": "git",
|
|
17
|
-
"url": "https://github.com/huaweicloud
|
|
17
|
+
"url": "https://github.com/huaweicloud/HuaweiCloud-Devkit.git"
|
|
18
18
|
},
|
|
19
19
|
"scripts": {
|
|
20
20
|
"test": "node --test",
|
|
@@ -1,44 +1,44 @@
|
|
|
1
1
|
{
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
}
|
|
2
|
+
"interface": {
|
|
3
|
+
"displayName": "HuaweiCloud Devkit",
|
|
4
|
+
"shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
|
|
5
|
+
"longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
|
|
6
|
+
"developerName": "HuaweiCloud Mate",
|
|
7
|
+
"category": "Cloud",
|
|
8
|
+
"capabilities": [
|
|
9
|
+
"Read",
|
|
10
|
+
"Interactive"
|
|
11
|
+
],
|
|
12
|
+
"websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
|
|
13
|
+
"brandColor": "#C7000B",
|
|
14
|
+
"defaultPrompt": [
|
|
15
|
+
"Help me choose the right Huawei Cloud capability.",
|
|
16
|
+
"Check my Huawei Cloud CLI setup safely.",
|
|
17
|
+
"Plan this Huawei Cloud API or SDK task."
|
|
18
|
+
]
|
|
19
|
+
},
|
|
20
|
+
"mcpServers": "./.mcp.json",
|
|
21
|
+
"description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
|
|
22
|
+
"skills": "./skills/",
|
|
23
|
+
"version": "1.0.0",
|
|
24
|
+
"author": {
|
|
25
|
+
"name": "HuaweiCloud Mate",
|
|
26
|
+
"url": "https://github.com/huaweicloud"
|
|
27
|
+
},
|
|
28
|
+
"hooks": "./hooks/",
|
|
29
|
+
"name": "huaweicloud-core",
|
|
30
|
+
"homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
|
|
31
|
+
"repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
|
|
32
|
+
"license": "Apache-2.0",
|
|
33
|
+
"keywords": [
|
|
34
|
+
"huaweicloud",
|
|
35
|
+
"huawei-cloud",
|
|
36
|
+
"koocli",
|
|
37
|
+
"hcloud",
|
|
38
|
+
"agent",
|
|
39
|
+
"mcp",
|
|
40
|
+
"api",
|
|
41
|
+
"sdk",
|
|
42
|
+
"skills"
|
|
43
|
+
]
|
|
44
|
+
}
|
|
@@ -1,43 +1,43 @@
|
|
|
1
1
|
{
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
}
|
|
2
|
+
"name": "huaweicloud-core",
|
|
3
|
+
"version": "1.0.0",
|
|
4
|
+
"description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
|
|
5
|
+
"author": {
|
|
6
|
+
"name": "HuaweiCloud Mate",
|
|
7
|
+
"url": "https://github.com/huaweicloud"
|
|
8
|
+
},
|
|
9
|
+
"homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
|
|
10
|
+
"repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
|
|
11
|
+
"license": "Apache-2.0",
|
|
12
|
+
"keywords": [
|
|
13
|
+
"huaweicloud",
|
|
14
|
+
"huawei-cloud",
|
|
15
|
+
"koocli",
|
|
16
|
+
"hcloud",
|
|
17
|
+
"agent",
|
|
18
|
+
"mcp",
|
|
19
|
+
"api",
|
|
20
|
+
"sdk",
|
|
21
|
+
"skills"
|
|
22
|
+
],
|
|
23
|
+
"skills": "./skills/",
|
|
24
|
+
"mcpServers": "./.mcp.json",
|
|
25
|
+
"interface": {
|
|
26
|
+
"displayName": "HuaweiCloud Devkit",
|
|
27
|
+
"shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
|
|
28
|
+
"longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
|
|
29
|
+
"developerName": "HuaweiCloud Mate",
|
|
30
|
+
"category": "Cloud",
|
|
31
|
+
"capabilities": [
|
|
32
|
+
"Read",
|
|
33
|
+
"Interactive"
|
|
34
|
+
],
|
|
35
|
+
"websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
|
|
36
|
+
"brandColor": "#C7000B",
|
|
37
|
+
"defaultPrompt": [
|
|
38
|
+
"Help me choose the right Huawei Cloud capability.",
|
|
39
|
+
"Check my Huawei Cloud CLI setup safely.",
|
|
40
|
+
"Plan this Huawei Cloud API or SDK task."
|
|
41
|
+
]
|
|
42
|
+
}
|
|
43
|
+
}
|
|
@@ -1,44 +1,44 @@
|
|
|
1
1
|
{
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
}
|
|
2
|
+
"interface": {
|
|
3
|
+
"displayName": "HuaweiCloud Devkit",
|
|
4
|
+
"shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
|
|
5
|
+
"longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
|
|
6
|
+
"developerName": "HuaweiCloud Mate",
|
|
7
|
+
"category": "Cloud",
|
|
8
|
+
"capabilities": [
|
|
9
|
+
"Read",
|
|
10
|
+
"Interactive"
|
|
11
|
+
],
|
|
12
|
+
"websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
|
|
13
|
+
"brandColor": "#C7000B",
|
|
14
|
+
"defaultPrompt": [
|
|
15
|
+
"Help me choose the right Huawei Cloud capability.",
|
|
16
|
+
"Check my Huawei Cloud CLI setup safely.",
|
|
17
|
+
"Plan this Huawei Cloud API or SDK task."
|
|
18
|
+
]
|
|
19
|
+
},
|
|
20
|
+
"mcpServers": "./.mcp.json",
|
|
21
|
+
"description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
|
|
22
|
+
"skills": "./skills/",
|
|
23
|
+
"version": "1.0.0",
|
|
24
|
+
"author": {
|
|
25
|
+
"name": "HuaweiCloud Mate",
|
|
26
|
+
"url": "https://github.com/huaweicloud"
|
|
27
|
+
},
|
|
28
|
+
"hooks": "./hooks/",
|
|
29
|
+
"name": "huaweicloud-core",
|
|
30
|
+
"homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
|
|
31
|
+
"repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
|
|
32
|
+
"license": "Apache-2.0",
|
|
33
|
+
"keywords": [
|
|
34
|
+
"huaweicloud",
|
|
35
|
+
"huawei-cloud",
|
|
36
|
+
"koocli",
|
|
37
|
+
"hcloud",
|
|
38
|
+
"agent",
|
|
39
|
+
"mcp",
|
|
40
|
+
"api",
|
|
41
|
+
"sdk",
|
|
42
|
+
"skills"
|
|
43
|
+
]
|
|
44
|
+
}
|
|
@@ -14,8 +14,10 @@ plugin hooks.
|
|
|
14
14
|
import json
|
|
15
15
|
import re
|
|
16
16
|
import sys
|
|
17
|
+
from pathlib import Path
|
|
17
18
|
|
|
18
19
|
DENY_PREFIX = "Huawei Cloud safety hook blocked this action: "
|
|
20
|
+
RULES_PATH = Path(__file__).resolve().parents[1] / "safety" / "rules" / "cloud-risk-rules.json"
|
|
19
21
|
|
|
20
22
|
CONFIG_FILE_RE = re.compile(r"(\.hcloud|\.huaweicloud|hcloud[/\\](config|credentials)|huaweicloud[/\\](config|credentials))", re.I)
|
|
21
23
|
ENV_DUMP_RE = re.compile(r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I)
|
|
@@ -63,6 +65,49 @@ def command_text(tool_input):
|
|
|
63
65
|
return json.dumps(tool_input)
|
|
64
66
|
|
|
65
67
|
|
|
68
|
+
def load_cloud_risk_rules():
|
|
69
|
+
try:
|
|
70
|
+
with RULES_PATH.open("r", encoding="utf-8") as file_obj:
|
|
71
|
+
catalog = json.load(file_obj)
|
|
72
|
+
return catalog.get("rules", [])
|
|
73
|
+
except Exception:
|
|
74
|
+
return []
|
|
75
|
+
|
|
76
|
+
|
|
77
|
+
def condition_matches(condition, text):
|
|
78
|
+
return re.search(condition.get("regex", r"a^"), text, re.I | re.M | re.S) is not None
|
|
79
|
+
|
|
80
|
+
|
|
81
|
+
def rule_matches(rule, text):
|
|
82
|
+
match = rule.get("match") or {}
|
|
83
|
+
all_conditions = match.get("all")
|
|
84
|
+
any_conditions = match.get("any")
|
|
85
|
+
none_conditions = match.get("none")
|
|
86
|
+
|
|
87
|
+
if isinstance(all_conditions, list):
|
|
88
|
+
for condition in all_conditions:
|
|
89
|
+
if not condition_matches(condition, text):
|
|
90
|
+
return False
|
|
91
|
+
if isinstance(any_conditions, list):
|
|
92
|
+
if not any(condition_matches(condition, text) for condition in any_conditions):
|
|
93
|
+
return False
|
|
94
|
+
if isinstance(none_conditions, list):
|
|
95
|
+
if any(condition_matches(condition, text) for condition in none_conditions):
|
|
96
|
+
return False
|
|
97
|
+
return isinstance(all_conditions, list) or isinstance(any_conditions, list)
|
|
98
|
+
|
|
99
|
+
|
|
100
|
+
def first_denied_command_rule(text):
|
|
101
|
+
for rule in load_cloud_risk_rules():
|
|
102
|
+
if "command" not in rule.get("stages", []):
|
|
103
|
+
continue
|
|
104
|
+
if rule.get("severity") != "deny":
|
|
105
|
+
continue
|
|
106
|
+
if rule_matches(rule, text):
|
|
107
|
+
return rule
|
|
108
|
+
return None
|
|
109
|
+
|
|
110
|
+
|
|
66
111
|
def main():
|
|
67
112
|
try:
|
|
68
113
|
data = json.load(sys.stdin)
|
|
@@ -78,6 +123,9 @@ def main():
|
|
|
78
123
|
deny("dumping cloud credential environment variables is not allowed.")
|
|
79
124
|
if SECRET_READ_RE.search(text):
|
|
80
125
|
deny("direct secret value retrieval would put plaintext secrets into the agent context.")
|
|
126
|
+
denied_rule = first_denied_command_rule(text)
|
|
127
|
+
if denied_rule:
|
|
128
|
+
deny(f"{denied_rule.get('message')} Remediation: {denied_rule.get('remediation')}")
|
|
81
129
|
if tool_name == "Bash" and HCLOUD_RE.search(text) and WRITE_OPERATION_RE.search(text) and not READ_OPERATION_RE.search(text):
|
|
82
130
|
deny("unapproved Huawei Cloud write operations must be planned first and explicitly approved by the user.")
|
|
83
131
|
|