huaweicloud-devkit 0.1.26-dev.0 → 1.0.2-dev.0

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -0,0 +1,44 @@
+{
+  "name": "huaweicloud-core",
+  "version": "1.0.0",
+  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
+  "author": {
+    "name": "HuaweiCloud Mate",
+    "url": "https://github.com/huaweicloud"
+  },
+  "homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+  "repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+  "license": "Apache-2.0",
+  "keywords": [
+    "huaweicloud",
+    "huawei-cloud",
+    "koocli",
+    "hcloud",
+    "agent",
+    "mcp",
+    "api",
+    "sdk",
+    "skills"
+  ],
+  "skills": "./skills/",
+  "mcpServers": "./.mcp.json",
+  "hooks": "./hooks/",
+  "interface": {
+    "displayName": "HuaweiCloud Devkit",
+    "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
+    "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
+    "developerName": "HuaweiCloud Mate",
+    "category": "Cloud",
+    "capabilities": [
+      "Read",
+      "Interactive"
+    ],
+    "websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+    "brandColor": "#C7000B",
+    "defaultPrompt": [
+      "Help me choose the right Huawei Cloud capability.",
+      "Check my Huawei Cloud CLI setup safely.",
+      "Plan this Huawei Cloud API or SDK task."
+    ]
+  }
+}

package/plugins/huaweicloud-core/skills/huawei-apig/SKILL.md

@@ -54,14 +54,34 @@ Key gotchas when creating:
 
 ### Add Public Access (ELB Provider Only)
 
+`BASIC` instances have no public IP. Use `PROFESSIONAL` + `elb` provider for public access (`lvs` is internal-only).
+
 ```bash
 hcloud APIG AddIngressEipV2 \
   --instance_id=<id> \
   --bandwidth_charging_mode=bandwidth \
-  --bandwidth_size=5
+  --bandwidth_size=<size>
+```
+
+To use an existing EIP instead of creating a new one:
+
+```bash
+hcloud APIG AddIngressEipV2 \
+  --instance_id=<id> \
+  --eip_id=<existing-eip-id>
 ```
 
-> `AddIngressEipV2` only works with `elb` provider. `AddEipV2` requires `lvs` provider. Bandwidth minimum is 5 Mbps.
+> `AddIngressEipV2` only works with `elb` provider. `AddEipV2` (without "Ingress") requires `lvs` provider. Bandwidth minimum is 5 Mbps.
+
+**Verification** — After binding, poll the instance to confirm EIP is active:
+
+```bash
+hcloud APIG ListInstancesV2 --cli-region=<region> --instance_id=<id> --cli-output=json | jq '.instances[0].eip_address'
+```
+
+Wait for `eip_address` to show a valid IP (may take up to 2 minutes). If `eip_address` is still `null` after 2 minutes, the EIP may not have been assigned.
+
+> **Trap**: `sl_domain` from `CreateApiGroupV2` is an **internal-only** domain (e.g., `*.apic.cn-north-4.huaweicloudapis.com`). It may resolve to internal IP only (NXDOMAIN from public internet). **For public access, always use the `eip_address` from the instance**, not the `sl_domain` or trigger `invoke_url`.
 
 ## API Group
 

package/plugins/huaweicloud-core/skills/huawei-cloud-eye/SKILL.md

@@ -53,6 +53,23 @@ hcloud CES CreateAlarm --help
 # --condition.comparison_operator, --condition.count
 ```
 
+### `--condition.comparison_operator` Legal Values
+
+For metric alarms use **symbols** (NOT words like `gt`/`lt`):
+
+| Value | Meaning |
+|-------|---------|
+| `>` | Greater than |
+| `>=` | Greater than or equal |
+| `<` | Less than |
+| `<=` | Less than or equal |
+| `=` | Equal |
+| `!=` | Not equal |
+
+For event alarms: `cycle_decrease`, `cycle_increase`, `cycle_wave`.
+
+> **Trap**: Shell may interpret `>` and `<` as redirect operators. Always quote: `--condition.comparison_operator=">="` or use `--cli-jsonInput=<file>`.
+
 ## Troubleshooting
 
 | Error | Fix |

package/plugins/huaweicloud-core/skills/huawei-cloud-find-skills/SKILL.md

@@ -12,7 +12,7 @@ description: |
 
 # Huawei Cloud Agent Skills Search and Discovery
 
-This skill enables users to efficiently search, discover, and install Huawei Cloud skills. 
+This skill enables users to efficiently search, discover, and install Huawei Cloud skills.
 
 ## Scenario Description
 

package/plugins/huaweicloud-core/skills/huawei-dds-dcs/SKILL.md

@@ -12,7 +12,7 @@ Always run `hcloud DDS <Operation> --help` or `hcloud DCS <Operation> --help` be
 
 ## DDS (Document Database Service — MongoDB Compatible)
 
-## Critical Warnings
+## DDS Critical Warnings
 
 | Trap | Why |
 |------|-----|
@@ -35,7 +35,7 @@ Discover exact parameters with `--help` before executing any command.
 
 ## DCS (Distributed Cache Service — Redis/Memcached)
 
-## Critical Warnings
+## DCS Critical Warnings
 
 | Trap | Why |
 |------|-----|

package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md

@@ -57,6 +57,7 @@ Flavor families are **region-dependent**. Always run `hcloud ECS ListFlavors --c
 | Security group rule | hcloud VPC CreateSecurityGroupRule --security_group_id=<id> --direction=<direction> --protocol=<protocol> | references/sg.md |
 | Attach disk | hcloud EVS AttachVolume --volume_id=<id> --server_id=<id> | references/evs.md |
 | Delete instance | hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true | references/create-instance.md |
+| Reboot instance | hcloud ECS BatchRebootServers --reboot.servers.1.id=<id> --reboot.type=SOFT | NOT `RebootServer` — that operation does not exist |
 
 ## How to Search for Instances
 
@@ -66,8 +67,57 @@ Flavor families are **region-dependent**. Always run `hcloud ECS ListFlavors --c
 2. Filter client-side by name substring, tag, or status
 3. Use `--server_tags` filter if instances are tagged: `hcloud ECS ListServersDetails --server_tags.1.key=Project`
 
+> **Return structure**: `ListServersDetails` returns `{"servers": [...]}` (array), NOT `{"server": ...}`. Parse as `.servers[0].status`, NOT `.server.status`.
+
 Abort if the result set is larger than `--limit` and ask the user to narrow the search.
 
+## Instance Status Polling
+
+ECS creation is asynchronous. Status transitions: `BUILD` → `ACTIVE` (or `ERROR`). Wait times vary widely (20s–3min), never use fixed sleep.
+
+Poll strategy:
+
+```bash
+for i in $(seq 1 30); do
+  status=$(hcloud ECS ListServersDetails --cli-region=<region> --server_id=<id> --cli-output=json | jq -r '.servers[0].status')
+  if [ "$status" = "ACTIVE" ]; then break; fi
+  if [ "$status" = "ERROR" ]; then echo "Creation failed"; exit 1; fi
+  sleep 10
+done
+```
+
+- Poll interval: 10 seconds
+- Maximum wait: 5 minutes (30 iterations)
+- Check for `ERROR` status to detect creation failures early
+
+## SSH Connection Verification
+
+After ECS is ACTIVE and EIP is bound, verify SSH connectivity:
+
+```bash
+hcloud ECS ListServersDetails --cli-region=<region> --server_id=<id>
+# → addresses.<vpc-id>[].OS-EXT-IPS:addr
+
+ssh -o StrictHostKeyChecking=accept-new -i <path-to-private-key> root@<eip-address>
+```
+
+> **SSH verification checklist**: EIP bound → security group has port 22 ingress → keypair private key saved locally → known_hosts handled with `StrictHostKeyChecking=accept-new` (or delete stale entries with `ssh-keygen -R <ip>`).
+
+### Running Commands Inside the Instance
+
+Use SSH for any in-instance operations (install software, check logs, start services):
+
+```bash
+ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'command'
+```
+
+Example — re-run failed cloud-init setup manually:
+```bash
+ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'dnf install -y nginx && systemctl enable --now nginx'
+```
+
+> If SCP blocks SSH, use cloud-init `--server.user_data` for full deployment instead. See `references/create-instance.md` §Bootstrap.
+
 ## Deleting Instances
 
 - Show the user the exact command and get explicit approval before running

package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md

@@ -59,8 +59,13 @@ hcloud ECS CreateServers ... --server.user_data=$user_data
 ```
 
 > **Security**: Never embed secrets (passwords, AK/SK, tokens) in user_data. It is stored unencrypted and readable from within the instance via IMDS. Fetch secrets at boot from DEW/CSMS instead.
-
+>
 > **Debugging**: If the script didn't run, check `/var/log/cloud-init-output.log` on the instance.
+>
+> **Recovery after failure**: user_data only executes on **first boot**. Restarting the instance will NOT re-run user_data scripts. If cloud-init fails (e.g., DNS missing → `yum`/`apt` cannot resolve repos):
+> 1. Fix the root cause (e.g., update subnet DNS via `VPC UpdateSubnet`)
+> 2. Either: SSH into the instance and run the setup commands manually (see `huawei-ecs` → SSH Connection Verification → Running Commands Inside the Instance)
+> 3. Or: Delete the instance and recreate with corrected user_data (fresh boot)
 
 ## 7. EIP (two methods)
 
@@ -81,16 +86,31 @@ hcloud ECS CreateServers \
 ### Method B: Create and bind separately
 hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
 
+```bash
 # Get the ECS network port ID
 hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>
 # → addresses.<vpc-id>[].OS-EXT-IPS:port_id
 
 # Bind EIP via port
 hcloud EIP AssociatePublicips --publicip_id=<eip-id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT
+```
 
 ## 8. Verify
-hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>
-Expected: status=ACTIVE
+
+ECS creation is asynchronous. Wait times vary widely (20s to 3min). Status transitions: `BUILD` → `ACTIVE` (or `ERROR`). Never use fixed sleep — poll actively:
+
+```bash
+for i in $(seq 1 30); do
+  status=$(hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id> --cli-output=json | jq -r '.servers[0].status')
+  if [ "$status" = "ACTIVE" ]; then break; fi
+  if [ "$status" = "ERROR" ]; then echo "Creation failed"; exit 1; fi
+  sleep 10
+done
+```
+
+- Poll interval: 10 seconds
+- Maximum wait: 5 minutes (30 iterations)
+- After ACTIVE, confirm once more: `hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>`
 
 ### Verify HTTP accessibility (if EIP bound)
 

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/triggers.md

@@ -138,5 +138,5 @@ hcloud FunctionGraph DeleteFunctionTrigger --function_urn=<urn> --trigger_type_c
 ```
 
 > Deleting a trigger does NOT cascade-delete the associated APIG API. After `DeleteFunctionTrigger`, also run `hcloud APIG ListApisV2 --instance_id=<id>` and delete orphaned APIs to avoid resource residue.
-
+>
 > **APIG event format**: When using DEDICATEDGATEWAY, the event body is Base64 encoded and uses a non-standard structure. See `apig-event-format.md` for handler templates.

package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md

@@ -31,7 +31,7 @@ Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/ob
 
 | Trap | Why |
 |------|-----|
-| Bucket name is global | All users share bucket namespace |
+| Bucket name is global | All users share bucket namespace. Always use a unique name: `{prefix}-{timestamp}` (e.g. `mybucket-20260810155048`) |
 | Three-layer permissions | IAM > Bucket Policy > ACL. Most restrictive wins |
 | Versioning is irreversible | Once enabled, cannot be disabled, only suspended |
 | OBS uses AK/SK directly | NOT IAM tokens. Auth errors mean check AK/SK validity |
@@ -42,7 +42,17 @@ Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/ob
 
 ## OBS Credential Setup (Required Before First Use)
 
-KooCLI OBS uses a separate config file (`~/.obsutilconfig`), NOT `~/.hcloud/config.json`. Call `huaweicloud_setup_obs_config` to automatically sync credentials from the active hcloud profile. No manual AK/SK entry needed.
+KooCLI OBS uses a separate config file (`~/.obsutilconfig`), NOT `~/.hcloud/config.json`. All OBS commands fail with credential errors until this is configured.
+
+**In-session bootstrap (recommended)**: Call `huaweicloud_setup_obs_config` — it syncs AK/SK from the active hcloud profile automatically. No manual key entry needed. Run this once per session before any OBS command.
+
+**CLI fallback** (if MCP tools unavailable):
+
+```bash
+hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK> -t=token
+```
+
+> `huaweicloud_setup_obs_config` should be called at the start of every OBS task — never assume credentials are pre-configured from a previous session.
 
 ## Common Workflows
 
@@ -82,7 +92,7 @@ Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Con
 | Error | Root Cause -> Fix |
 |-------|------------------|
 | AccessDenied on bucket | IAM/bucket policy/ACL conflict -> Check all three layers |
-| BucketAlreadyExists | Name taken globally -> Choose different name |
+| BucketAlreadyExists | Name taken globally -> Generate unique name with timestamp suffix: `{prefix}-{yyyymmddHHMMSS}` |
 | NoSuchKey | Object doesn't exist or wrong region -> Verify key and region |
 | InvalidAccessKeyId | OBS uses AK/SK directly -> Verify AK/SK validity, OBS endpoint, OBS permissions |
 | EntityTooLarge | Single PUT limit 5GB -> Use multipart upload |

package/plugins/huaweicloud-core/skills/huawei-rds/SKILL.md

@@ -29,7 +29,7 @@ hcloud RDS <Operation> --cli-region=<region> [--key=value ...]
 | Operation | PascalCase: `ListInstances`, `CreateManualBackup` |
 | Params | `--key=value` format. JSON params: `--key='{"k":"v"}'` |
 | Array params | 1-based: `--instance_ids.1=xxx` |
-| Password param | Conflicts with KooCLI system param; pipe `echo \|` to bypass |
+| Password param | Conflicts with KooCLI system param; use `--cli-jsonInput` (see Critical Warnings) |
 
 ## Critical Warnings
 
@@ -38,9 +38,12 @@ hcloud RDS <Operation> --cli-region=<region> [--key=value ...]
 | Engine version immutable | Cannot change MySQL to PostgreSQL in-place |
 | Automated backups use OBS | Backup storage incurs separate charges. Set retention period explicitly |
 | Storage auto-scaling off by default | Enable before storage runs out or instance goes read-only |
-| `--password` conflicts with KooCLI | Non-interactive: `printf "b\n" \| hcloud RDS CreateInstance ...` to select API param. Or use `--cli-jsonInput` |
+| `--password` conflicts with KooCLI | Use `--cli-jsonInput=<file>` with JSON file (see `--cli-jsonInput` section below). The `printf "b\n"` workaround is broken in KooCLI 7.2.12+ |
 | Volume type must match flavor | General→CLOUDSSD; Dedicated→CLOUDSSD\|ESSD; ARM→ULTRAHIGH |
 | Flavor not in region | Always `ListFlavors` first. Spec codes vary by region |
+| `database_name` is case-sensitive | Use `MySQL` / `PostgreSQL` / `SQLServer` / `MariaDB` — NOT lower-case `mysql` |
+| Instance creation takes 3–8 min | Status: BUILD→MODIFYING→ACTIVE. Poll every 15s: `hcloud RDS ListInstances --cli-region=<r> --instance_id=<id> \| jq '.instances[0].status'` |
+| Body `--region` is required | CreateInstance body requires `--region=<r>` (same as `--cli-region`) or `DBS.280243` |
 | Restore creates new instance | No in-place restore. Verify target flavor before restoring |
 
 ## Instance Management
@@ -56,6 +59,7 @@ hcloud RDS ListEngineFlavors --instance_id=<id> --cli-region=<r>
 ### Create Instance
 ```bash
 hcloud RDS CreateInstance --cli-region=<r> \
+  --region=<r> \
   --name=<name> \
   --datastore.type=<engine> \
   --datastore.version=<version> \
@@ -66,11 +70,36 @@ hcloud RDS CreateInstance --cli-region=<r> \
   --subnet_id=<subnet-id> \
   --security_group_id=<sg-id> \
   --availability_zone=<az> \
-  --charge_info.charge_mode=<mode> \
-  --password=<pw>
+  --charge_info.charge_mode=<mode>
 ```
 
-> `--password` conflicts with a KooCLI system param. Pipe `echo "b\n" |` before the command or use `--cli-jsonInput` (see Critical Warnings).
+> `--password` conflicts with a KooCLI system param. Use `--cli-jsonInput` (see below). The `printf "b\n"` pipe workaround is broken in KooCLI 7.2.12+.
+
+### `--cli-jsonInput` for CreateInstance
+
+```json
+{
+  "path": {
+    "project_id": "<project-id>"
+  },
+  "body": {
+    "name": "<name>",
+    "region": "<region>",
+    "datastore": { "type": "<engine>", "version": "<version>" },
+    "ha": { "mode": "single", "replication_mode": "semisync" },
+    "flavor_ref": "<flavor-id>",
+    "volume": { "type": "<vol-type>", "size": <gb> },
+    "vpc_id": "<vpc-id>",
+    "subnet_id": "<subnet-id>",
+    "security_group_id": "<sg-id>",
+    "availability_zone": "<az>",
+    "password": "<pw>",
+    "charge_info": { "charge_mode": "postPaid" }
+  }
+}
+```
+
+> Save as `rds-create.json` then: `hcloud RDS CreateInstance --cli-jsonInput=rds-create.json`. For `project_id`, run `hcloud IAM KeystoneListProjects`.
 
 | Param | Required | Note |
 |-------|----------|------|
@@ -139,6 +168,20 @@ psql -h <private_ip> -p 5432 -U root -d postgres
 > hcloud does NOT support SQL execution. Use a database client.
 > For public access, bind an EIP (see `huawei-vpc`).
 
+### Database Client Acquisition
+
+If a database client is not installed on the agent's machine, install one:
+
+| Platform | MySQL | PostgreSQL |
+|----------|-------|------------|
+| **Linux** | `apt install mysql-client` / `yum install mysql` | `apt install postgresql-client` |
+| **macOS** | `brew install mysql-client` | `brew install libpq` |
+| **Windows** | Download MySQL Workbench or `winget install Oracle.MySQL` | Download pgAdmin or `winget install PostgreSQL.PostgreSQL` |
+| **Python (any)** | `pip install pymysql` then `python -c "import pymysql; ..."` | `pip install psycopg2` then `python -c "import psycopg2; ..."` |
+| **Docker (any)** | `docker run -it --rm mysql:8 mysql -h <ip> -u root -p` | `docker run -it --rm postgres:16 psql -h <ip> -U root` |
+
+> If no client can be installed, use the Huawei Cloud **Data Studio** console: https://console.huaweicloud.com/dms/
+
 ## Mutating Operations (Require Approval)
 
 | Operation | Effect |

package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md

@@ -28,15 +28,17 @@ Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet
 | EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required |
 | **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |
 | **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |
-| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. See `--help` for region-specific DNS IPs |
+| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS IPs: cn-north-4 (100.125.1.250 / 100.125.1.251), cn-north-1 (100.125.1.250 / 100.125.129.250), cn-east-3 (100.125.1.250 / 100.125.129.250), ap-southeast-3 (100.125.1.250 / 100.125.128.250) |
 | SCP blocks 0.0.0.0/0 SG rules | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead |
+| **VPC tags use `*` separator** | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value` |
 
 ## Common Workflows
 
 | Task | Command | Steps |
 |------|---------|-------|
 | Create VPC | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr> | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first |
-| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see `hcloud VPC CreateSubnet --help` |
+| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
+| Update subnet | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2> | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes |
 | Security group | hcloud VPC CreateSecurityGroup --security_group.name=<name> | references/security-group.md |
 | SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |
 | Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |
@@ -58,6 +60,7 @@ Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet
 | VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |
 | EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
 | ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help` |
+| VPC.0209: Subnet still used | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet |
 | SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |
 
 ## Security Considerations

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -72,14 +72,14 @@ Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `
 2. **KooCLI first-run privacy agreement**: On a fresh KooCLI install, `hcloud` blocks with `同意并继续使用(y)/不同意并退出(N)` and fails with `[USE_ERROR]您输入的是无效字符` in non-interactive mode. Detection: check command output for these strings. Ask the user: "KooCLI needs to accept its privacy agreement. May I accept it on your behalf?" If the user agrees, run `huaweicloud_run_readonly_command` with `args=["version"]` and `stdin="y\n"`. This accepts the agreement once, after which hcloud works normally.
 3. Ask the user to configure credentials outside the agent conversation when setup is needed.
 4. Inspect profile and region only through redacted tooling.
-4. Discover exact operation names with `hcloud <Service> --help` before guessing. Example: ECS instance listing is commonly `ECS ListServersDetails`; ECS creation is commonly `ECS CreateServers`; image lookup may be under `IMS GlanceShowImage`.
-5. Use `--cli-output=json` for machine-readable responses when supported.
-6. For resource operations, include `--cli-region`, `--cli-profile`, and service-specific project information when required.
-7. Classify every command before running it:
+5. Discover exact operation names with `hcloud <Service> --help` before guessing. Example: ECS instance listing is commonly `ECS ListServersDetails`; ECS creation is commonly `ECS CreateServers`; image lookup may be under `IMS GlanceShowImage`.
+6. Use `--cli-output=json` for machine-readable responses when supported.
+7. For resource operations, include `--cli-region`, `--cli-profile`, and service-specific project information when required.
+8. Classify every command before running it:
    - Read-only: `List*`, `Show*`, `Get*`, `Describe*`.
    - Write: `Create*`, `Delete*`, `Update*`, `Resize*`, `Start*`, `Stop*`, `Authorize*`, and similar.
    - Secret: any operation returning secret string, binary secret, token, or password.
-8. For write operations, show the exact command and ask for explicit approval.
+9. For write operations, show the exact command and ask for explicit approval.
 
 ## KooCLI Syntax Notes