huaweicloud-devkit 0.1.25-dev.0 → 1.0.0

package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json

@@ -0,0 +1,178 @@
+{
+  "version": "0.1.0",
+  "rules": [
+    {
+      "id": "hwc-command-credential-file",
+      "title": "Credential file read",
+      "category": "credential",
+      "severity": "deny",
+      "stages": ["command"],
+      "match": {
+        "any": [
+          { "field": "text", "regex": "(^|\\s)(cat|type|Get-Content|gc|less|more)\\s+[^\\n]*(\\.hcloud|\\.huaweicloud)" },
+          { "field": "text", "regex": "(hcloud|huaweicloud)[/\\\\](config|credentials)" }
+        ]
+      },
+      "message": "The command may read local Huawei Cloud credential or profile files into the agent context.",
+      "remediation": "Use huaweicloud_show_profile_redacted or user-side credential configuration instead of reading credential files."
+    },
+    {
+      "id": "hwc-command-env-dump",
+      "title": "Cloud credential environment dump",
+      "category": "credential",
+      "severity": "deny",
+      "stages": ["command"],
+      "match": {
+        "all": [
+          { "field": "text", "regex": "(^|\\s)(env|printenv|Get-ChildItem\\s+Env:|gci\\s+Env:|dir\\s+Env:)" },
+          { "field": "text", "regex": "(HUAWEICLOUD|HWC_|HCLOUD|OS_)" }
+        ]
+      },
+      "message": "The command may print cloud credential environment variables.",
+      "remediation": "Inspect only required non-secret settings and redact secret-like values before returning output."
+    },
+    {
+      "id": "hwc-command-secret-value-read",
+      "title": "Plaintext secret read",
+      "category": "secret",
+      "severity": "deny",
+      "stages": ["command"],
+      "match": {
+        "any": [
+          { "field": "text", "regex": "(ShowSecretVersion|DownloadSecret|GetSecretValue)" },
+          { "field": "text", "regex": "(secret_string|secret_binary|secretString|secretBinary)" }
+        ]
+      },
+      "message": "The command appears to retrieve plaintext secret values.",
+      "remediation": "Use runtime secret references, user-side inspection, or redacted metadata checks instead of returning secret values to the agent."
+    },
+    {
+      "id": "hwc-command-encoded-shell-exec",
+      "title": "Encoded payload piped to shell",
+      "category": "execution",
+      "severity": "deny",
+      "stages": ["command"],
+      "match": {
+        "all": [
+          { "field": "text", "regex": "(base64\\s+(-d|--decode)|xxd\\s+-r|certutil\\s+-decode|FromBase64String|hex\\s*decode)" },
+          { "field": "text", "regex": "(\\||;|&&)" },
+          { "field": "text", "regex": "\\b(bash|sh|zsh|powershell|pwsh|cmd|python|node)\\b" }
+        ]
+      },
+      "message": "The command decodes an encoded payload and pipes it into an interpreter.",
+      "remediation": "Decode payloads into a reviewable file first, inspect the content, then execute only explicit reviewed commands."
+    },
+    {
+      "id": "hwc-network-public-admin-port",
+      "title": "Public admin port exposure",
+      "category": "public_exposure",
+      "severity": "deny",
+      "stages": ["command", "artifact", "deploy_plan"],
+      "match": {
+        "all": [
+          { "field": "text", "regex": "(0\\.0\\.0\\.0\\s*/\\s*0|::\\s*/\\s*0|remote_ip_prefix\\s*[=:]\\s*0\\.0\\.0\\.0\\s*/\\s*0|cidr\\s*[=:]\\s*0\\.0\\.0\\.0\\s*/\\s*0)" },
+          { "field": "text", "regex": "(port_range_min|port_range_max|from_port|to_port|port|\\b22\\b|\\b3389\\b|\\b3306\\b|\\b5432\\b|\\b6379\\b|\\b9200\\b)" }
+        ]
+      },
+      "message": "The change appears to expose an administrative or database port to the public internet.",
+      "remediation": "Restrict the source CIDR to a trusted range, use a bastion or VPN, and keep public preview endpoints behind authenticated HTTP services."
+    },
+    {
+      "id": "hwc-obs-anonymous-write",
+      "title": "OBS anonymous write",
+      "category": "public_exposure",
+      "severity": "deny",
+      "stages": ["command", "artifact", "deploy_plan"],
+      "match": {
+        "all": [
+          { "field": "text", "regex": "(OBS|obs://|bucket|object|Statement|Principal)" }
+        ],
+        "any": [
+          { "field": "text", "regex": "((Anonymous|Everyone|\\\"Principal\\\"\\s*:\\s*\\\"\\*\\\"|AllUsers).*(PutObject|DeleteObject|PutBucketPolicy|FULL_CONTROL|WRITE|obs:object:PutObject|obs:bucket:PutBucketPolicy)|(PutObject|DeleteObject|PutBucketPolicy|FULL_CONTROL|WRITE|obs:object:PutObject|obs:bucket:PutBucketPolicy).*(Anonymous|Everyone|\\\"Principal\\\"\\s*:\\s*\\\"\\*\\\"|AllUsers))" },
+          { "field": "text", "regex": "(-acl\\s*=?\\s*public-read-write|acl\\s*[=:]\\s*[\\\"']?public-read-write|public-write)" }
+        ]
+      },
+      "message": "The change may grant anonymous write or full-control access to OBS data.",
+      "remediation": "Use private buckets by default. Grant object read only when required, and avoid anonymous write permissions."
+    },
+    {
+      "id": "hwc-functiongraph-public-no-auth",
+      "title": "Public FunctionGraph trigger without auth",
+      "category": "public_exposure",
+      "severity": "warn",
+      "stages": ["command", "artifact", "deploy_plan"],
+      "match": {
+        "all": [
+          { "field": "text", "regex": "(FunctionGraph|APIG|CreateTrigger|CreateApi|DEDICATEDGATEWAY|API Gateway)" },
+          { "field": "text", "regex": "(public|PUBLIC|0\\.0\\.0\\.0\\s*/\\s*0|auth[\\\"']?\\s*[=:]\\s*[\\\"']?(NONE|none|false)|security_authentication[\\\"']?\\s*[=:]\\s*[\\\"']?(NONE|none))" }
+        ]
+      },
+      "message": "The generated FunctionGraph or API Gateway path may be publicly reachable without authentication.",
+      "remediation": "Require IAM, app authentication, JWT, or another explicit auth layer before exposing generated application endpoints."
+    },
+    {
+      "id": "hwc-iam-admin-policy",
+      "title": "Broad IAM administrator grant",
+      "category": "iam",
+      "severity": "deny",
+      "stages": ["command", "artifact", "deploy_plan"],
+      "match": {
+        "all": [
+          { "field": "text", "regex": "(IAM|policy|role|agency|Statement|Action)" },
+          { "field": "text", "regex": "(\\\"Action\\\"\\s*:\\s*(\\\"(\\*|\\*:\\*)\\\"|\\[\\s*\\\"(\\*|\\*:\\*)\\\")|Action\\s*[=:]\\s*(\\*|\\*:\\*)|AdministratorAccess|FullAccess)" },
+          { "field": "text", "regex": "(\\\"Effect\\\"\\s*:\\s*\\\"Allow\\\"|Effect\\s*[=:]\\s*Allow)" }
+        ]
+      },
+      "message": "The change appears to grant broad administrator permissions.",
+      "remediation": "Use least-privilege service actions, resource constraints, and short-lived credentials for generated application workflows."
+    },
+    {
+      "id": "hwc-destructive-delete-force",
+      "title": "Forced destructive operation",
+      "category": "destructive",
+      "severity": "deny",
+      "stages": ["command"],
+      "match": {
+        "all": [
+          { "field": "text", "regex": "(Delete|BatchDelete|Remove|\\brm\\b|delete)" },
+          { "field": "text", "regex": "(--force|-f|--recursive|-r|delete_publicip\\s*[=:]\\s*true)" }
+        ]
+      },
+      "message": "The command combines deletion with force, recursive, or cascading deletion behavior.",
+      "remediation": "Show the exact resources to be deleted, confirm backups or recovery path, and require explicit user approval for the exact command."
+    },
+    {
+      "id": "hwc-sandbox-missing-ttl",
+      "title": "Sandbox deployment missing cleanup metadata",
+      "category": "sandbox",
+      "severity": "warn",
+      "stages": ["artifact", "deploy_plan"],
+      "match": {
+        "all": [
+          { "field": "text", "regex": "(sandbox|preview|temporary|ephemeral|dev environment|FunctionGraph|ECS|CCE|APIG)" },
+          { "field": "text", "regex": "(Create|Deploy|Provision|resource|stack|environment)" }
+        ],
+        "none": [
+          { "field": "text", "regex": "(ttl|expires_at|expire_at|cleanup|owner|cost_center|auto_delete|auto-delete)" }
+        ]
+      },
+      "message": "The preview or sandbox deployment does not show cleanup or ownership metadata.",
+      "remediation": "Add owner, purpose, expiration time, and cleanup command before creating preview cloud resources."
+    },
+    {
+      "id": "hwc-cost-unbounded-scale",
+      "title": "Unbounded scale or high-cost resource",
+      "category": "cost",
+      "severity": "warn",
+      "stages": ["command", "artifact", "deploy_plan"],
+      "match": {
+        "any": [
+          { "field": "text", "regex": "(max_instances|max_node_count|max_replica|desired\\s*[=:]\\s*[5-9][0-9]|replicas\\s*[=:]\\s*[5-9][0-9])" },
+          { "field": "text", "regex": "(GPU|gpu|large|xlarge|charging_mode\\s*[=:]\\s*prePaid|period_type|period_num)" }
+        ]
+      },
+      "message": "The generated plan may create high-cost or unbounded capacity.",
+      "remediation": "Use small preview defaults, explicit quotas, budget labels, and user approval before creating high-cost resources."
+    }
+  ]
+}

package/plugins/huaweicloud-core/skills/huawei-cloud-find-skills/SKILL.md

@@ -12,7 +12,7 @@ description: |
 
 # Huawei Cloud Agent Skills Search and Discovery
 
-This skill enables users to efficiently search, discover, and install Huawei Cloud skills. 
+This skill enables users to efficiently search, discover, and install Huawei Cloud skills.
 
 ## Scenario Description
 

package/plugins/huaweicloud-core/skills/huawei-dds-dcs/SKILL.md

@@ -12,7 +12,7 @@ Always run `hcloud DDS <Operation> --help` or `hcloud DCS <Operation> --help` be
 
 ## DDS (Document Database Service — MongoDB Compatible)
 
-## Critical Warnings
+## DDS Critical Warnings
 
 | Trap | Why |
 |------|-----|
@@ -35,7 +35,7 @@ Discover exact parameters with `--help` before executing any command.
 
 ## DCS (Distributed Cache Service — Redis/Memcached)
 
-## Critical Warnings
+## DCS Critical Warnings
 
 | Trap | Why |
 |------|-----|

package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md

@@ -84,6 +84,7 @@ Abort if the result set is larger than `--limit` and ask the user to narrow the
 | Insufficient resources | Stock depleted -> Change flavor or AZ |
 | AuthFailure | Expired AK/SK -> hcloud configure init |
 | APIGW.0802 / region permission | IAM user has no access to this region -> IAM console → User → Permissions → add region, or switch to another region |
+| Cannot SSH (port 22 open) | SCP policy may be blocking SSH. Check `SYS.0403` errors in command output -> Use cloud-init/user_data for initial setup instead. See `references/create-instance.md` §Bootstrap |
 
 ## Security Considerations
 
@@ -98,9 +99,12 @@ Prefer these tools over raw hcloud CLI — they enforce safety policies:
 
 - huaweicloud_list_operations service=ECS
 - huaweicloud_run_readonly_command for discovery (auto-redacts output)
+- huaweicloud_plan_cli_command for command planning (returns command text + safety classification)
 - huaweicloud_run_approved_command for writes (requires exact command approval)
 - huaweicloud_check_cli to verify hcloud is available
 
+> **approvedCommand trap**: `huaweicloud_run_approved_command` validates that `approvedCommand` matches the planned command EXACTLY (including `<redacted>` placeholders). Always use the `command` field value returned by `huaweicloud_plan_cli_command` verbatim — never reconstruct or retype it. Mismatches cause rejection with "approvedCommand must exactly match the planned hcloud command."
+
 ## Without MCP (Fallback)
 
 If MCP tools are NOT available (new install, session not restarted):

package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md

@@ -4,6 +4,7 @@
 
 ## 1. Discover flavors
 hcloud ECS ListFlavors --cli-region=<region> --cli-output=json
+Filter for `os_extra_specs.cond:operation:status == normal` — most results are abandoned. See references/flavors.md.
 
 ## 2. Find availability zones
 hcloud ECS NovaListAvailabilityZones --cli-region=<region>
@@ -30,7 +31,7 @@ hcloud VPC ListSubnets --vpc_id=<vpc-id> --cli-region=<region>
 If no VPC/subnet exists: load `huawei-vpc` skill → create VPC → create subnet (with DNS) → create security group → return here.
 
 ## 5. Create keypair (recommended over adminPass)
-hcloud ECS NovaCreateKeypair --keypair_name=<name>
+hcloud ECS NovaCreateKeypair --keypair.name=<name>
 Save the returned private key to a local file. The public key is auto-injected.
 
 Password alternative:
@@ -43,7 +44,7 @@ hcloud ECS CreateServers --cli-region=<region> --server.name=<name> --server.fla
 
 ### Bootstrap with user_data (cloud-init)
 
-Use `--server.user_data` to run a cloud-init script at first boot. The value must be **base64-encoded**:
+Use `--server.user_data` to run a cloud-init script at first boot. The value must be **base64-encoded**. This is also the recommended bootstrap path when SCP policies block SSH access — user_data serves as the full deployment path, no SSH needed.
 
 ```bash
 # Encode the script
@@ -58,18 +59,36 @@ hcloud ECS CreateServers ... --server.user_data=$user_data
 ```
 
 > **Security**: Never embed secrets (passwords, AK/SK, tokens) in user_data. It is stored unencrypted and readable from within the instance via IMDS. Fetch secrets at boot from DEW/CSMS instead.
-
+>
 > **Debugging**: If the script didn't run, check `/var/log/cloud-init-output.log` on the instance.
 
-## 7. EIP (optional)
+## 7. EIP (two methods)
+
+### Method A: Inline with CreateServers (Recommended)
+Add EIP parameters to the `CreateServers` command in step 6:
+
+```bash
+hcloud ECS CreateServers \
+  --server.publicip.eip.iptype=<type> \
+  --server.publicip.eip.bandwidth.sharetype=<share-type> \
+  --server.publicip.eip.bandwidth.size=<size> \
+  --server.publicip.eip.bandwidth.chargemode=traffic \
+  ...
+```
+
+> **Trap**: Parameter names differ from `EIP CreatePublicip`. Use `iptype` (not `type`), `sharetype` (not `share_type`), and `chargemode` (not `charging_mode`). Always verify with `hcloud ECS CreateServers --help`.
+
+### Method B: Create and bind separately
 hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
 
+```bash
 # Get the ECS network port ID
 hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>
 # → addresses.<vpc-id>[].OS-EXT-IPS:port_id
 
 # Bind EIP via port
 hcloud EIP AssociatePublicips --publicip_id=<eip-id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT
+```
 
 ## 8. Verify
 hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>

package/plugins/huaweicloud-core/skills/huawei-ecs/references/flavors.md

@@ -3,7 +3,20 @@
 **Always discover flavors dynamically before recommending a specific flavor name.** Flavor availability varies by region and changes over time.
 
 ## Step 1: List available flavors
-hcloud ECS ListFlavors --cli-region=<region> --cli-output=json
+
+Use JMESPath to filter in-line — raw output returns hundreds of records and floods context:
+
+```bash
+# Filter by family prefix (e.g. ac7), return name + specs only
+hcloud ECS ListFlavors --cli-region=<region> --cli-output=json \
+  --cli-query="flavors[?contains(name, 'ac7')].{name:name, vcpus:vcpus, ram:ram}"
+
+# Filter by vCPU range
+hcloud ECS ListFlavors --cli-region=<region> --cli-output=json \
+  --cli-query="flavors[?vcpus >= '2' && vcpus <= '4'].{name:name, vcpus:vcpus, ram:ram}"
+```
+
+> Always use `--cli-query` with JMESPath to narrow results. Never run bare `ListFlavors` without filtering.
 
 ## Step 2: Filter by scenario
 
@@ -26,3 +39,17 @@ Flavor family names are region-dependent. Example discrepancies seen in testing:
 - Other regions may have s6/m6/g6 families
 
 Always run ListFlavors and pick from actual results.
+
+## Step 3: Filter out abandoned / sold-out specs
+
+`ListFlavors` returns ALL specs including abandoned ones. Before selecting a spec, check the `os_extra_specs` field in the JSON response:
+
+| Field | Values | Meaning |
+|-------|--------|---------|
+| `os_extra_specs.cond:operation:status` | `normal`, `abandon`, `sellout` | Only `normal` specs can be created. `abandon` = deprecated, `sellout` = out of stock |
+| `os_extra_specs.cond:operation:az` | e.g. `cn-north-4g(normal)` | Spec is available in this AZ. Multiple entries = multiple AZ support |
+
+A flavor can be `normal` globally but `abandon` in specific AZs. Selecting an `abandon` or `sellout` spec will fail with **`Ecs.0019`** at creation time — there is no pre-flight validation in `ListFlavors`. If creation fails:
+
+1. Switch to a different AZ: `hcloud ECS NovaListAvailabilityZones --cli-region=<region>`
+2. Or switch to a different flavor family (e.g., `at7` → `ac7`)

package/plugins/huaweicloud-core/skills/huawei-functiongraph/SKILL.md

@@ -63,7 +63,6 @@ Always discover parameters with `--help` before executing. These are the correct
 | Create function | `CreateFunction` | references/create-function.md |
 | Delete function | `DeleteFunction` | Strip `:latest` from URN |
 | Invoke function | `InvokeFunction` | Requires body param (`--name=<value>` becomes event body). Use `--x_cff_request_version=v0` for raw output, `v1` for APIG-wrapped. |
-| List runtimes | `ListRuntimes` | |
 | Create trigger | `CreateFunctionTrigger` | references/triggers.md |
 | List triggers | `ListFunctionTriggers` | |
 | Delete trigger | `DeleteFunctionTrigger` | |

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/triggers.md

@@ -138,5 +138,5 @@ hcloud FunctionGraph DeleteFunctionTrigger --function_urn=<urn> --trigger_type_c
 ```
 
 > Deleting a trigger does NOT cascade-delete the associated APIG API. After `DeleteFunctionTrigger`, also run `hcloud APIG ListApisV2 --instance_id=<id>` and delete orphaned APIs to avoid resource residue.
-
+>
 > **APIG event format**: When using DEDICATEDGATEWAY, the event body is Base64 encoded and uses a non-standard structure. See `apig-event-format.md` for handler templates.

package/plugins/huaweicloud-core/skills/huawei-getting-started/SKILL.md

@@ -18,7 +18,7 @@ version: 1
 
 ## First-Time Setup
 1. **Install KooCLI** using command above
-2. **Accept privacy policy** (first run only): KooCLI requires one-time privacy agreement. Run `hcloud version` and respond `y` to the prompt. For non-interactive terminals, use `echo "y" | hcloud version`
+2. **Accept privacy policy** (first run only): KooCLI requires one-time privacy agreement. Run `hcloud version` to read the agreement, then respond `y` to accept. Do not pipe `echo "y" |` — you must review the terms first.
 3. **Configure credentials**: `hcloud configure init` (interactive, prompts for AK/SK/region safely)
 4. **Verify**: `hcloud configure list` to confirm profile, then `hcloud ECS ListServersDetails --cli-region=cn-north-4`
 5. For detailed auth guidance, see `huaweicloud-cli-and-auth` skill
@@ -43,7 +43,7 @@ hcloud configure list
 | AK/SK must be kept secret | Never commit to git or share |
 | Default region applies to all commands | Override with --cli-region= per command |
 | Some services region-specific | Not all services available in all regions |
-| Privacy policy blocks first run | KooCLI requires one-time `y` confirmation. Non-interactive terminals need `echo "y" \| hcloud <cmd>` |
+| Privacy policy blocks first run | Run `hcloud version` to read and accept the agreement. Review the terms before responding `y` |
 
 ## What Can I Do? (Quick Index)
 | Goal | Skill |

package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md

@@ -36,22 +36,13 @@ Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/ob
 | Versioning is irreversible | Once enabled, cannot be disabled, only suspended |
 | OBS uses AK/SK directly | NOT IAM tokens. Auth errors mean check AK/SK validity |
 | Static website via CLI missing | KooCLI OBS lacks website config. Use REST API or console |
-| **OBS needs separate cred config** | `hcloud configure` is NOT enough for OBS. Run `hcloud OBS config -i` (interactive) to create `~/.obsutilconfig`. This must be done OUTSIDE agent chat. |
+| **OBS needs separate cred config** | `hcloud configure` is NOT enough for OBS. Before any OBS operation, call `huaweicloud_setup_obs_config` to sync credentials from hcloud profile. |
 | **obsutil interactive prompts** | `cp`/`rm` without `-f` causes "Please input (y/n)" → Agent hangs (TIMEOUT). Always use `-f` for non-interactive. |
 | **Directory upload adds prefix** | `cp <dir>/ obs://<bucket>/ -r` puts files under `bucket/<dir>/...`. Use `-flat` for root-level files (static sites). Preview with `-dryRun` first. |
 
 ## OBS Credential Setup (Required Before First Use)
 
-KooCLI OBS uses a separate config file (`~/.obsutilconfig`), NOT `~/.hcloud/config.json`. Use the **same AK/SK** that you configured for hcloud. Run once outside agent chat:
-
-```bash
-# Preferred: interactive (safe, no AK/SK in shell history)
-hcloud OBS config -i
-# Follow prompts: AK, SK, endpoint (e.g. obs.cn-north-4.myhuaweicloud.com)
-
-# Alternative: non-interactive (use with caution — AK/SK in shell history)
-hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK>
-```
+KooCLI OBS uses a separate config file (`~/.obsutilconfig`), NOT `~/.hcloud/config.json`. Call `huaweicloud_setup_obs_config` to automatically sync credentials from the active hcloud profile. No manual AK/SK entry needed.
 
 ## Common Workflows
 

package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md

@@ -10,6 +10,8 @@ version: 1
 
 Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
 
+> **Multi-version APIs**: KooCLI may print a warning like "ListVpcs有多个版本,默认使用该API版本v3" before the actual response. The text BEFORE the first `{` is the version selection notice — parse JSON starting from `{` only. This is normal behavior, not an error.
+
 ## Overview
 
 Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet lifecycle, security groups, EIP management, NAT gateways, VPN, and network ACLs.
@@ -27,6 +29,7 @@ Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet
 | **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |
 | **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |
 | Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. See `--help` for region-specific DNS IPs |
+| SCP blocks 0.0.0.0/0 SG rules | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead |
 
 ## Common Workflows
 
@@ -55,7 +58,7 @@ Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet
 | VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |
 | EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
 | ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help` |
-| SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction |
+| SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |
 
 ## Security Considerations
 

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -72,14 +72,14 @@ Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `
 2. **KooCLI first-run privacy agreement**: On a fresh KooCLI install, `hcloud` blocks with `同意并继续使用(y)/不同意并退出(N)` and fails with `[USE_ERROR]您输入的是无效字符` in non-interactive mode. Detection: check command output for these strings. Ask the user: "KooCLI needs to accept its privacy agreement. May I accept it on your behalf?" If the user agrees, run `huaweicloud_run_readonly_command` with `args=["version"]` and `stdin="y\n"`. This accepts the agreement once, after which hcloud works normally.
 3. Ask the user to configure credentials outside the agent conversation when setup is needed.
 4. Inspect profile and region only through redacted tooling.
-4. Discover exact operation names with `hcloud <Service> --help` before guessing. Example: ECS instance listing is commonly `ECS ListServersDetails`; ECS creation is commonly `ECS CreateServers`; image lookup may be under `IMS GlanceShowImage`.
-5. Use `--cli-output=json` for machine-readable responses when supported.
-6. For resource operations, include `--cli-region`, `--cli-profile`, and service-specific project information when required.
-7. Classify every command before running it:
+5. Discover exact operation names with `hcloud <Service> --help` before guessing. Example: ECS instance listing is commonly `ECS ListServersDetails`; ECS creation is commonly `ECS CreateServers`; image lookup may be under `IMS GlanceShowImage`.
+6. Use `--cli-output=json` for machine-readable responses when supported.
+7. For resource operations, include `--cli-region`, `--cli-profile`, and service-specific project information when required.
+8. Classify every command before running it:
    - Read-only: `List*`, `Show*`, `Get*`, `Describe*`.
    - Write: `Create*`, `Delete*`, `Update*`, `Resize*`, `Start*`, `Stop*`, `Authorize*`, and similar.
    - Secret: any operation returning secret string, binary secret, token, or password.
-8. For write operations, show the exact command and ask for explicit approval.
+9. For write operations, show the exact command and ask for explicit approval.
 
 ## KooCLI Syntax Notes
 

package/plugins/huaweicloud-core/skills/huaweicloud-safety/SKILL.md

@@ -38,6 +38,20 @@ Use this skill before any Huawei Cloud action that may expose secrets, change re
 - Approved tool path: use `huaweicloud_run_approved_command` only when the exact planned command has been shown and the user explicitly approved that exact command.
 - After a write, verify with `huaweicloud_run_readonly_command` or another read-only check.
 
+## Proactive Hook Checks
+
+Before executing, deploying, or handing generated cloud artifacts to the user, run the matching check when available:
+
+- `huaweicloud_hook_check_command` for shell or KooCLI command text.
+- `huaweicloud_hook_check_artifacts` for generated policy, IaC, config, workflow, or deployment files.
+- `huaweicloud_hook_check_deploy_plan` for sandbox, preview, FunctionGraph, ECS, CCE, APIG, OBS, IAM, or cost-affecting plans.
+
+If the result is `deny`, repair the command, artifact, or deployment plan before execution. If the result is `warn`, show the warning to the user and repair or ask for explicit confirmation.
+
+## Static Analysis Boundary
+
+Hook checks inspect the command or plan text that is available before execution. If a command builds cloud parameters through shell variables, string concatenation, subshells, encoded payloads, or generated scripts, first expand the final command into reviewable text and run `huaweicloud_hook_check_command` on that final form. When the final values cannot be determined, stop and ask the user to review the expanded command or use `huaweicloud_plan_cli_command` before execution.
+
 ## Safe Alternatives
 
 - Use redacted profile inspection instead of raw `hcloud configure show`.

package/plugins/huaweicloud-core/src/mcp-server.mjs

@@ -15,7 +15,8 @@ function readFrames() {
     const headerEnd = buffer.indexOf('\r\n\r\n');
     if (headerEnd !== -1) {
       useContentLengthFraming = true;
-      parseContentLengthFrame(headerEnd);
+      const consumed = parseContentLengthFrame(headerEnd);
+      if (!consumed) return;
       continue;
     }
 
@@ -37,15 +38,16 @@ function parseContentLengthFrame(headerEnd) {
   const match = header.match(/Content-Length:\s*(\d+)/i);
   if (!match) {
     buffer = Buffer.alloc(0);
-    return;
+    return true;
   }
   const length = Number(match[1]);
   const bodyStart = headerEnd + 4;
   const bodyEnd = bodyStart + length;
-  if (buffer.length < bodyEnd) return;
+  if (buffer.length < bodyEnd) return false;
   const body = buffer.subarray(bodyStart, bodyEnd).toString('utf8');
   buffer = buffer.subarray(bodyEnd);
   void handleMessage(JSON.parse(body));
+  return true;
 }
 
 async function handleMessage(message) {

package/plugins/huaweicloud-core/src/risk-rule-engine.mjs

@@ -0,0 +1,137 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const defaultRulesPath = join(__dirname, '..', 'safety', 'rules', 'cloud-risk-rules.json');
+
+const SEVERITY_RANK = {
+  deny: 3,
+  warn: 2,
+  info: 1,
+};
+
+export function loadRiskRules(options = {}) {
+  const path = options.path || defaultRulesPath;
+  return JSON.parse(readFileSync(path, 'utf8'));
+}
+
+function redactEvidence(text) {
+  return String(text)
+    .replace(/((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|authorization|password|passwd|adminPass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi, '$1<redacted>')
+    .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>');
+}
+
+function normalizeText(value) {
+  if (typeof value === 'string') return value;
+  return JSON.stringify(value, null, 2);
+}
+
+function evaluationContext(stage, input) {
+  if (stage === 'command') {
+    const command = normalizeText(input.command || input.text || '');
+    return { text: command, command };
+  }
+  if (stage === 'artifact') {
+    const path = String(input.path || '');
+    const content = normalizeText(input.content || '');
+    return { text: `${path}\n${content}`, path, content };
+  }
+  if (stage === 'deploy_plan') {
+    const plan = normalizeText(input.plan || input.text || input);
+    return { text: plan, plan };
+  }
+  return { text: normalizeText(input) };
+}
+
+function conditionMatches(condition, context) {
+  const field = condition.field || 'text';
+  const value = Object.hasOwn(context, field) ? context[field] : context.text;
+  return new RegExp(condition.regex, 'ims').test(String(value || ''));
+}
+
+function ruleMatches(rule, context) {
+  const match = rule.match || {};
+  const all = match.all;
+  const any = match.any;
+  const none = match.none;
+  if (Array.isArray(all) && !all.every((condition) => conditionMatches(condition, context))) {
+    return false;
+  }
+  if (Array.isArray(any) && !any.some((condition) => conditionMatches(condition, context))) {
+    return false;
+  }
+  if (Array.isArray(none) && none.some((condition) => conditionMatches(condition, context))) {
+    return false;
+  }
+  return Array.isArray(all) || Array.isArray(any);
+}
+
+function excerpt(text) {
+  const compact = redactEvidence(String(text).replace(/\s+/g, ' ').trim());
+  if (compact.length <= 240) return compact;
+  return `${compact.slice(0, 237)}...`;
+}
+
+function evaluate(stage, inputs, options = {}) {
+  const catalog = options.catalog || loadRiskRules(options);
+  const items = Array.isArray(inputs) ? inputs : [inputs];
+  const findings = [];
+
+  for (const input of items) {
+    const context = evaluationContext(stage, input || {});
+    for (const rule of catalog.rules) {
+      if (!rule.stages.includes(stage)) continue;
+      if (!ruleMatches(rule, context)) continue;
+      findings.push({
+        ruleId: rule.id,
+        title: rule.title,
+        category: rule.category,
+        severity: rule.severity,
+        message: rule.message,
+        remediation: rule.remediation,
+        source: input?.path || stage,
+        evidence: excerpt(context.text),
+      });
+    }
+  }
+
+  findings.sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity]);
+  const hasDeny = findings.some((finding) => finding.severity === 'deny');
+  const hasWarn = findings.some((finding) => finding.severity === 'warn');
+  return {
+    decision: hasDeny ? 'deny' : hasWarn ? 'warn' : 'allow',
+    findings,
+  };
+}
+
+export function evaluateCommandRisk(command, options = {}) {
+  return evaluate('command', { command }, options);
+}
+
+export function evaluateArtifacts(artifacts, options = {}) {
+  return evaluate('artifact', Array.isArray(artifacts) ? artifacts : [], options);
+}
+
+export function evaluateDeployPlan(plan, options = {}) {
+  return evaluate('deploy_plan', { plan }, options);
+}
+
+export function mergeRiskDecision(base, risk) {
+  if (!risk || !risk.findings?.length) return base;
+  if (risk.decision === 'deny') {
+    const topFinding = risk.findings[0];
+    return {
+      ...base,
+      decision: 'deny',
+      risk: topFinding.category,
+      reason: topFinding.message,
+      blockedByRiskRule: true,
+      findings: risk.findings,
+    };
+  }
+  return {
+    ...base,
+    warnings: [...(base.warnings || []), ...risk.findings],
+  };
+}