huaweicloud-devkit 1.0.0 → 1.0.1

package/README.md

@@ -1,13 +1,19 @@
-# HuaweiCloud DevKit
-
+# HuaweiCloud DevKit
+[![Discussions](https://img.shields.io/badge/Discussions-Join the discussion-blue)]
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/HuaweiCloud-Devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/HuaweiCloud-Devkit/actions/workflows/ci.yml)
 
-帮助 AI 编码助手安全、准确地使用华为云——技能引导、KooCLI 工具、安全策略一站式集成。
+**[中文](README.zh-CN.md) | English**
+
+Help AI coding agents use Huawei Cloud safely and accurately — a single integration that gives agents cloud knowledge, CLI tooling, and safety guardrails.
+
+Supports OpenCode, Codex, CodeArts Agent, and WorkBuddy.
+
+## Prerequisites
 
-HuaweiCloud DevKit 为 AI 编码助手提供操作华为云所需的知识、工具和安全护栏，支持 OpenCode、Codex、码道（CodeArts Agent）等主流 Agent。
+- Node.js >= 22
 
-## 快速开始
+## Quick Start
 
 ### OpenCode
 
@@ -15,13 +21,13 @@ HuaweiCloud DevKit 为 AI 编码助手提供操作华为云所需的知识、工
 npx --yes huaweicloud-devkit install
 ```
 
-自动安装 27 个技能、MCP 服务器和安全策略，并更新 OpenCode 配置。安装后**重启会话**使 MCP 工具生效。
+Installs the DevKit into OpenCode automatically. **Restart the session** after installation.
 
 ```bash
-npx --yes huaweicloud-devkit doctor   # 自检：hcloud、MCP、技能、认证
-npx --yes huaweicloud-devkit status   # 查看安装状态
-npx --yes huaweicloud-devkit update   # 更新到最新版
-npx --yes huaweicloud-devkit uninstall # 卸载
+npx --yes huaweicloud-devkit doctor    # self-check
+npx --yes huaweicloud-devkit status    # show status
+npx --yes huaweicloud-devkit update    # update
+npx --yes huaweicloud-devkit uninstall # uninstall
 ```
 
 ### Codex
@@ -30,127 +36,103 @@ npx --yes huaweicloud-devkit uninstall # 卸载
 npx --yes huaweicloud-devkit install --target codex
 ```
 
-> 需要先安装 Codex CLI。`--target all` 会在 Codex CLI 缺失时跳过 Codex。
+> The Codex CLI must be installed first.
 
-### CodeArts Agent（码道）
+```bash
+npx --yes huaweicloud-devkit doctor                        # self-check
+npx --yes huaweicloud-devkit status --target codex
+npx --yes huaweicloud-devkit update --target codex         # update
+npx --yes huaweicloud-devkit uninstall --target codex
+```
 
-码道没有插件市场，通过技能 + MCP 机制适配：
+> **Codex Desktop** (Windows): use `--target codex-desktop` with the same commands.
+
+### CodeArts Agent
 
 ```bash
 npx --yes huaweicloud-devkit install --target codearts
 ```
 
-自动安装 27 个技能到 `~/.codeartsdoer/skills/` 与项目级 `.codeartsdoer/skills/`，MCP 服务器注册到用户级与项目级 `.codeartsdoer/mcp/mcp_settings.json`。若本机已存在 KooCLI（`~/hcloud/hcloud.exe`），会自动将 `HCLOUD_BIN` 注入 MCP 配置。安装后**重启会话**使 MCP 工具生效。
+**Restart the session** after installation.
 
 ```bash
-npx --yes huaweicloud-devkit install-hcloud   # 安装 KooCLI（自动接受隐私协议）
-npx --yes huaweicloud-devkit doctor           # 自检：hcloud、MCP、技能、沙箱模式
-npx --yes huaweicloud-devkit status --target codearts   # 查看码道安装状态
-npx --yes huaweicloud-devkit uninstall --target codearts # 卸载
+npx --yes huaweicloud-devkit install-hcloud   # install KooCLI
+npx --yes huaweicloud-devkit doctor           # self-check
+npx --yes huaweicloud-devkit status --target codearts
+npx --yes huaweicloud-devkit update --target codearts
+npx --yes huaweicloud-devkit uninstall --target codearts
 ```
 
-> **沙箱模式**：码道默认 `bash_mode: sandbox` 会阻止 KooCLI 写入配置目录（如 `~/.hcloud/root`），导致隐私协议无法持久化、KooCLI 无法运行。`install-hcloud` 会自动检测沙箱模式并给出明确指引——请在**码道外终端**安装使用 KooCLI，或在码道设置中关闭沙箱模式（设置 → 权限 → Bash 模式）后重试。
+> **Sandbox mode**: CodeArts defaults to sandbox mode which blocks KooCLI. `install-hcloud` detects this and shows how to resolve it — install KooCLI outside the sandbox terminal, or disable sandbox mode in CodeArts settings (Settings → Permissions → Bash mode).
 >
-> **认证**：KooCLI 就绪后，还需在码道外终端执行 `hcloud configure init` 配置 AK/SK 与区域，然后即可在码道中描述你的华为云任务。
+> **Authentication**: Run `npx huaweicloud-devkit auth init` to configure unified AK/SK credentials for KooCLI, OBS, and sandbox APIs.
+
+### WorkBuddy
+
+```bash
+npx --yes huaweicloud-devkit install --target workbuddy
+```
+
+**Restart the session** after installation.
+
+```bash
+npx --yes huaweicloud-devkit doctor
+npx --yes huaweicloud-devkit status --target workbuddy
+npx --yes huaweicloud-devkit update --target workbuddy   # update
+npx --yes huaweicloud-devkit uninstall --target workbuddy
+```
+
+> **Updating**: `update` is incremental per agent — it refreshes only the installed files and leaves your config untouched. Use `update --target all` to update every installed agent at once.
 
-### 其他 Agent
+### Other Agents
 
-对于支持 Model Context Protocol (MCP) 的 Agent，手动配置 MCP 服务器：
+For agents that support the Model Context Protocol (MCP):
 
 ```json
 {
   "mcp": {
     "huaweicloud-devkit": {
       "type": "local",
-      "command": ["node", "<路径>/plugins/huaweicloud-core/src/mcp-server.mjs"],
+      "command": ["node", "<path>/plugins/huaweicloud-core/src/mcp-server.mjs"],
       "enabled": true
     }
   }
 }
 ```
 
-然后安装技能：
+Then install:
 
 ```bash
 npx --yes huaweicloud-devkit install
 ```
 
-> **前置条件：** 需要安装 [KooCLI](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html)（`hcloud`）并完成认证。MCP 服务器需要 Node.js >= 20。如果 `hcloud` 不在 `PATH` 中，请设置 `HCLOUD_BIN` 环境变量指向完整路径。
-
-## 包含内容
-
-### 插件
-
-`huaweicloud-core` 插件将 MCP 服务器配置、27 个 Agent 技能和安全策略打包为一次性安装。
-
-| 插件 | 说明 |
-|------|------|
-| [huaweicloud-core](plugins/huaweicloud-core/) | 核心插件，含技能、MCP 服务器、安全策略。**从这里开始。** |
-
-### 技能
-
-Agent 技能是经过整理的指令和参考材料包，帮助 Agent 完成特定的华为云任务。技能按需加载——Agent 只发现和检索与当前任务相关的内容。
-
-包含 6 个元技能（路由、发现、CLI/认证、API/SDK、安全、排错）和 20 个服务技能（覆盖 ECS、OBS、VPC、IAM、RDS、GaussDB、FunctionGraph、APIG、CCE、SMN/DMS、ModelArts、Cloud Eye、CTS、DEW、Billing、CBR、WAF/AAD、DDS/DCS、Deployment、Getting Started）。
-
-浏览 [`skills/`](plugins/huaweicloud-core/skills/) 目录查看所有可用技能。
-
-### Rules 文件
-
-推荐的项目级配置文件，告诉 Agent 如何高效使用华为云——例如优先使用 MCP 服务器、发现可用技能、遵循最小权限 IAM 原则。
-
-详见 [`rules/huawei-agent-rules.md`](rules/huawei-agent-rules.md)。
-
-### MCP 服务器
-
-本地 MCP 服务器（`plugins/huaweicloud-core/src/mcp-server.mjs`）通过 Model Context Protocol 为 Agent 提供安全的 KooCLI 访问。
-
-- **安全优先执行** — 所有 `hcloud` 命令执行前自动分类（读/写/密钥），写操作需用户明确批准。
-- **输出脱敏** — 凭证形态的值（AK/SK、Token、密码）自动替换为 `***REDACTED***`。
-- **16 个结构化工具** — 技能搜索、CLI 检查、只读命令、区域发现、错误解释、Hook 风险检查等。
-- **零运行时依赖** — 纯 Node.js（>= 20），无需 npm install。
-
-详见 [MCP 工具表](#mcp-工具)。
+> **Prerequisite:** Node.js >= 22. Run `npx huaweicloud-devkit auth init` for unified credentials.
 
-## 安全模型
+## What It Does
 
-三层防御体系：
+- **Guided cloud operations** — agents get step-by-step guidance for 20+ Huawei Cloud services (ECS, OBS, VPC, RDS, GaussDB, FunctionGraph, APIG, CCE, and more)
+- **Safety-first execution** — all write operations require explicit user approval; credentials and secrets are automatically redacted from output
+- **Pre-execution risk checks** — public exposure, credential leaks, and destructive operations are caught before they run
+- **Regional awareness** — auto-discovers available regions and checks service availability before creating resources
 
-| 层级 | 机制 | 说明 |
-|------|------|------|
-| 技能层 | `SKILL.md` 流程文档 | 教会 Agent 正确的行为规则和安全用法 |
-| 钩子层 | `huaweicloud-safety.py` | PreToolUse Hook 阻断高风险工具调用 |
-| MCP 层 | `safety-policy.mjs` | Node.js 安全策略包装器，在所有 Agent 环境中强制执行 |
+## Supported Services
 
-详见 [`docs/safety-model.md`](docs/safety-model.md)。
+ECS, OBS, VPC, IAM, RDS, GaussDB, FunctionGraph, APIG, CCE, SMN/DMS, ModelArts, Cloud Eye, CTS, DEW, Billing, CBR, WAF/AAD, DDS/DCS, Deployment, and Getting Started guides.
 
-## MCP 工具
+## Documentation
 
-| 类别 | 工具 | 说明 |
-|------|------|------|
-| 知识发现 | `huaweicloud_search_docs` | 跨技能文件及文档全文搜索 |
-| 知识发现 | `huaweicloud_retrieve_skill` | 按名称加载完整技能内容及参考文件 |
-| 知识发现 | `huaweicloud_list_regions` | 列出可用华为云区域 |
-| 知识发现 | `huaweicloud_get_regional_availability` | 检查目标区域的服务可用性 |
-| CLI | `huaweicloud_check_cli` | 检查 KooCLI `hcloud` 是否已安装 |
-| CLI | `huaweicloud_plan_cli_command` | 分类计划命令（读/写/密钥）但不执行 |
-| CLI | `huaweicloud_list_operations` | 列出服务的可用 KooCLI 操作 |
-| CLI | `huaweicloud_run_readonly_command` | 执行只读命令并脱敏输出 |
-| CLI | `huaweicloud_run_approved_command` | 经用户明确批准后执行写命令 |
-| 安全 | `huaweicloud_show_profile_redacted` | 安全查看 KooCLI 配置（凭证脱敏） |
-| 安全 | `huaweicloud_hook_check_command` | 执行前检查 Shell/KooCLI 命令风险 |
-| 安全 | `huaweicloud_hook_check_artifacts` | 检查生成的代码、IaC、IAM/OBS 策略和配置文件风险 |
-| 安全 | `huaweicloud_hook_check_deploy_plan` | 检查沙箱、预览环境和云资源部署计划风险 |
-| 路由 | `huaweicloud_service_catalog` | 返回推荐的能力来源排序 |
-| 排错 | `huaweicloud_explain_error` | 解释错误码并建议诊断步骤 |
+- [Architecture](docs/architecture.md)
+- [Safety Model](docs/safety-model.md)
+- [Hook Rule Model](docs/hook-rule-model.md)
+- [Changelog](docs/CHANGELOG.md)
+- [KooCLI official docs](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html)
 
-## 文档
+## Contributors
 
-- [系统架构设计](docs/01-系统架构设计.md)
-- [核心技能设计](docs/02-核心技能设计.md)
-- [安全模型](docs/safety-model.md)
-- [KooCLI 官方文档](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html)
+<a href="https://github.com/huaweicloud/huaweicloud-devkit/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=huaweicloud/huaweicloud-devkit" />
+</a>
 
-## 许可证
+## License
 
-本项目基于 Apache-2.0 许可证发布。详见 [LICENSE](LICENSE)。
+This project is licensed under the Apache-2.0 License. See [LICENSE](LICENSE).

package/README.zh-CN.md

@@ -0,0 +1,138 @@
+# HuaweiCloud DevKit
+[![Discussions](https://img.shields.io/badge/Discussions-参与讨论-blue)]
+[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
+[![CI](https://github.com/huaweicloud/HuaweiCloud-Devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/HuaweiCloud-Devkit/actions/workflows/ci.yml)
+
+**中文 | [English](README.md)**
+
+帮助 AI 编码助手安全、准确地使用华为云——一站式集成云知识、CLI 工具和安全护栏。
+
+支持 OpenCode、Codex、码道（CodeArts Agent）、WorkBuddy。
+
+## 前置条件
+
+- Node.js >= 22
+
+## 快速开始
+
+### OpenCode
+
+```bash
+npx --yes huaweicloud-devkit install
+```
+
+自动安装 DevKit。安装后**重启会话**。
+
+```bash
+npx --yes huaweicloud-devkit doctor   # 自检
+npx --yes huaweicloud-devkit status   # 查看状态
+npx --yes huaweicloud-devkit update   # 更新
+npx --yes huaweicloud-devkit uninstall # 卸载
+```
+
+### Codex
+
+```bash
+npx --yes huaweicloud-devkit install --target codex
+```
+
+> 需要先安装 Codex CLI。
+
+```bash
+npx --yes huaweicloud-devkit doctor                        # 自检
+npx --yes huaweicloud-devkit status --target codex
+npx --yes huaweicloud-devkit update --target codex         # 更新
+npx --yes huaweicloud-devkit uninstall --target codex
+```
+
+> **Codex Desktop**（Windows）：将 `--target codex` 换成 `--target codex-desktop`，命令相同。
+
+### CodeArts Agent（码道）
+
+```bash
+npx --yes huaweicloud-devkit install --target codearts
+```
+
+安装后**重启会话**。
+
+```bash
+npx --yes huaweicloud-devkit install-hcloud   # 安装 KooCLI
+npx --yes huaweicloud-devkit doctor           # 自检
+npx --yes huaweicloud-devkit status --target codearts
+npx --yes huaweicloud-devkit update --target codearts
+npx --yes huaweicloud-devkit uninstall --target codearts
+```
+
+> **沙箱模式**：码道默认沙箱模式会阻止 KooCLI 运行。`install-hcloud` 自动检测并给出指引——请在码道外终端安装使用 KooCLI，或在码道设置中关闭沙箱模式（设置 → 权限 → Bash 模式）。
+>
+> **认证**：执行 `npx huaweicloud-devkit auth init`，统一配置 KooCLI、OBS 和沙箱接口所需的 AK/SK。
+
+### WorkBuddy
+
+```bash
+npx --yes huaweicloud-devkit install --target workbuddy
+```
+
+安装后**重启会话**。
+
+```bash
+npx --yes huaweicloud-devkit doctor
+npx --yes huaweicloud-devkit status --target workbuddy
+npx --yes huaweicloud-devkit update --target workbuddy   # 更新
+npx --yes huaweicloud-devkit uninstall --target workbuddy
+```
+
+> **更新机制**：`update` 按 agent 增量更新，只刷新必要文件、不动你的配置文件。`update --target all` 可一次更新所有已安装的 agent。
+
+### 其他 Agent
+
+支持 MCP 协议的 Agent，手动配置：
+
+```json
+{
+  "mcp": {
+    "huaweicloud-devkit": {
+      "type": "local",
+      "command": ["node", "<路径>/plugins/huaweicloud-core/src/mcp-server.mjs"],
+      "enabled": true
+    }
+  }
+}
+```
+
+然后安装：
+
+```bash
+npx --yes huaweicloud-devkit install
+```
+
+> **前置条件：** Node.js >= 22。执行 `npx huaweicloud-devkit auth init` 完成统一认证。
+
+## 功能特性
+
+- **引导式云操作** — Agent 获得 20+ 华为云服务的分步操作指引（ECS、OBS、VPC、RDS、GaussDB、FunctionGraph、APIG、CCE 等）
+- **安全优先执行** — 所有写操作需用户明确批准；凭证和密钥自动脱敏
+- **执行前风险检查** — 公网暴露、凭证泄露、破坏性操作在执行前即被拦截
+- **区域感知** — 自动发现可用区域，创建资源前检查服务可用性
+
+## 支持的服务
+
+ECS、OBS、VPC、IAM、RDS、GaussDB、FunctionGraph、APIG、CCE、SMN/DMS、ModelArts、Cloud Eye、CTS、DEW、Billing、CBR、WAF/AAD、DDS/DCS、Deployment，以及入门指南。
+
+## 文档
+
+- [架构](docs/architecture.md)
+- [安全模型](docs/safety-model.md)
+- [Hook 规则模型](docs/hook-rule-model.md)
+- [变更记录](docs/CHANGELOG.md)
+- [KooCLI 官方文档](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html)
+
+## 贡献者
+
+<a href="https://github.com/huaweicloud/huaweicloud-devkit/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=huaweicloud/huaweicloud-devkit" />
+</a>
+
+## 许可证
+
+本项目基于 Apache-2.0 许可证发布。详见 [LICENSE](LICENSE)。

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "huaweicloud-devkit",
-    "version": "1.0.0",
+    "version": "1.0.1",
     "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
     "type": "module",
     "files": [
@@ -32,6 +32,7 @@
         "agent",
         "codex",
         "opencode",
+        "workbuddy",
         "mcp",
         "koocli",
         "hcloud"

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.mcp.json

@@ -5,8 +5,10 @@
       "args": [
         "./src/mcp-server.mjs"
       ],
+      "cwd": ".",
       "env": {
-        "HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local"
+        "HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local",
+        "HDKITSERVICE_ENDPOINT": ""
       }
     }
   }

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -0,0 +1,44 @@
+{
+  "name": "huaweicloud-core",
+  "version": "1.0.0",
+  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
+  "author": {
+    "name": "HuaweiCloud Mate",
+    "url": "https://github.com/huaweicloud"
+  },
+  "homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+  "repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+  "license": "Apache-2.0",
+  "keywords": [
+    "huaweicloud",
+    "huawei-cloud",
+    "koocli",
+    "hcloud",
+    "agent",
+    "mcp",
+    "api",
+    "sdk",
+    "skills"
+  ],
+  "skills": "./skills/",
+  "mcpServers": "./.mcp.json",
+  "hooks": "./hooks/",
+  "interface": {
+    "displayName": "HuaweiCloud Devkit",
+    "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
+    "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
+    "developerName": "HuaweiCloud Mate",
+    "category": "Cloud",
+    "capabilities": [
+      "Read",
+      "Interactive"
+    ],
+    "websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+    "brandColor": "#C7000B",
+    "defaultPrompt": [
+      "Help me choose the right Huawei Cloud capability.",
+      "Check my Huawei Cloud CLI setup safely.",
+      "Plan this Huawei Cloud API or SDK task."
+    ]
+  }
+}

package/plugins/huaweicloud-core/safety/policy.json

@@ -82,5 +82,19 @@
                                  "ls",
                                  "dir",
                                  "Get-ChildItem"
-                             ]
+                             ],
+    "blockedSandboxCommands":  [
+                                  "rm\\s+-rf\\s+/",
+                                  "mkfs",
+                                  "dd\\s+if=",
+                                  ":\\(\\)\\{:\\|:&\\};:",
+                                  "shutdown",
+                                  "reboot",
+                                  "init\\s+[06]",
+                                  "fdisk"
+                              ],
+    "sandboxWriteTools":  [
+                               "huaweicloud_sandbox_connect",
+                               "huaweicloud_sandbox_credentials"
+                           ]
 }

package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json

@@ -173,6 +173,27 @@
       },
       "message": "The generated plan may create high-cost or unbounded capacity.",
       "remediation": "Use small preview defaults, explicit quotas, budget labels, and user approval before creating high-cost resources."
+    },
+    {
+      "id": "hwc-sandbox-destructive-command",
+      "title": "Destructive command in sandbox terminal",
+      "category": "destructive",
+      "severity": "deny",
+      "stages": ["command"],
+      "match": {
+        "any": [
+          { "field": "text", "regex": "rm\\s+-rf\\s+/" },
+          { "field": "text", "regex": "mkfs" },
+          { "field": "text", "regex": "dd\\s+if=" },
+          { "field": "text", "regex": ":\\\\(\\\\)\\\\{[^}]*\\\\|[^}]*&[^}]*\\\\}[^;]*;:" },
+          { "field": "text", "regex": "\\bshutdown\\b" },
+          { "field": "text", "regex": "\\breboot\\b" },
+          { "field": "text", "regex": "\\binit\\s+[06]\\b" },
+          { "field": "text", "regex": "\\bfdisk\\b" }
+        ]
+      },
+      "message": "The sandbox terminal command is destructively dangerous and could destroy the workspace.",
+      "remediation": "Use targeted deletions instead of recursive root removal. Avoid disk format, fork bombs, and system shutdown commands in sandbox terminals."
     }
   ]
 }

package/plugins/huaweicloud-core/skills/huawei-apig/SKILL.md

@@ -54,14 +54,34 @@ Key gotchas when creating:
 
 ### Add Public Access (ELB Provider Only)
 
+`BASIC` instances have no public IP. Use `PROFESSIONAL` + `elb` provider for public access (`lvs` is internal-only).
+
 ```bash
 hcloud APIG AddIngressEipV2 \
   --instance_id=<id> \
   --bandwidth_charging_mode=bandwidth \
-  --bandwidth_size=5
+  --bandwidth_size=<size>
+```
+
+To use an existing EIP instead of creating a new one:
+
+```bash
+hcloud APIG AddIngressEipV2 \
+  --instance_id=<id> \
+  --eip_id=<existing-eip-id>
 ```
 
-> `AddIngressEipV2` only works with `elb` provider. `AddEipV2` requires `lvs` provider. Bandwidth minimum is 5 Mbps.
+> `AddIngressEipV2` only works with `elb` provider. `AddEipV2` (without "Ingress") requires `lvs` provider. Bandwidth minimum is 5 Mbps.
+
+**Verification** — After binding, poll the instance to confirm EIP is active:
+
+```bash
+hcloud APIG ListInstancesV2 --cli-region=<region> --instance_id=<id> --cli-output=json | jq '.instances[0].eip_address'
+```
+
+Wait for `eip_address` to show a valid IP (may take up to 2 minutes). If `eip_address` is still `null` after 2 minutes, the EIP may not have been assigned.
+
+> **Trap**: `sl_domain` from `CreateApiGroupV2` is an **internal-only** domain (e.g., `*.apic.cn-north-4.huaweicloudapis.com`). It may resolve to internal IP only (NXDOMAIN from public internet). **For public access, always use the `eip_address` from the instance**, not the `sl_domain` or trigger `invoke_url`.
 
 ## API Group
 

package/plugins/huaweicloud-core/skills/huawei-cloud-eye/SKILL.md

@@ -53,6 +53,23 @@ hcloud CES CreateAlarm --help
 # --condition.comparison_operator, --condition.count
 ```
 
+### `--condition.comparison_operator` Legal Values
+
+For metric alarms use **symbols** (NOT words like `gt`/`lt`):
+
+| Value | Meaning |
+|-------|---------|
+| `>` | Greater than |
+| `>=` | Greater than or equal |
+| `<` | Less than |
+| `<=` | Less than or equal |
+| `=` | Equal |
+| `!=` | Not equal |
+
+For event alarms: `cycle_decrease`, `cycle_increase`, `cycle_wave`.
+
+> **Trap**: Shell may interpret `>` and `<` as redirect operators. Always quote: `--condition.comparison_operator=">="` or use `--cli-jsonInput=<file>`.
+
 ## Troubleshooting
 
 | Error | Fix |

package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md

@@ -57,6 +57,7 @@ Flavor families are **region-dependent**. Always run `hcloud ECS ListFlavors --c
 | Security group rule | hcloud VPC CreateSecurityGroupRule --security_group_id=<id> --direction=<direction> --protocol=<protocol> | references/sg.md |
 | Attach disk | hcloud EVS AttachVolume --volume_id=<id> --server_id=<id> | references/evs.md |
 | Delete instance | hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true | references/create-instance.md |
+| Reboot instance | hcloud ECS BatchRebootServers --reboot.servers.1.id=<id> --reboot.type=SOFT | NOT `RebootServer` — that operation does not exist |
 
 ## How to Search for Instances
 
@@ -66,8 +67,57 @@ Flavor families are **region-dependent**. Always run `hcloud ECS ListFlavors --c
 2. Filter client-side by name substring, tag, or status
 3. Use `--server_tags` filter if instances are tagged: `hcloud ECS ListServersDetails --server_tags.1.key=Project`
 
+> **Return structure**: `ListServersDetails` returns `{"servers": [...]}` (array), NOT `{"server": ...}`. Parse as `.servers[0].status`, NOT `.server.status`.
+
 Abort if the result set is larger than `--limit` and ask the user to narrow the search.
 
+## Instance Status Polling
+
+ECS creation is asynchronous. Status transitions: `BUILD` → `ACTIVE` (or `ERROR`). Wait times vary widely (20s–3min), never use fixed sleep.
+
+Poll strategy:
+
+```bash
+for i in $(seq 1 30); do
+  status=$(hcloud ECS ListServersDetails --cli-region=<region> --server_id=<id> --cli-output=json | jq -r '.servers[0].status')
+  if [ "$status" = "ACTIVE" ]; then break; fi
+  if [ "$status" = "ERROR" ]; then echo "Creation failed"; exit 1; fi
+  sleep 10
+done
+```
+
+- Poll interval: 10 seconds
+- Maximum wait: 5 minutes (30 iterations)
+- Check for `ERROR` status to detect creation failures early
+
+## SSH Connection Verification
+
+After ECS is ACTIVE and EIP is bound, verify SSH connectivity:
+
+```bash
+hcloud ECS ListServersDetails --cli-region=<region> --server_id=<id>
+# → addresses.<vpc-id>[].OS-EXT-IPS:addr
+
+ssh -o StrictHostKeyChecking=accept-new -i <path-to-private-key> root@<eip-address>
+```
+
+> **SSH verification checklist**: EIP bound → security group has port 22 ingress → keypair private key saved locally → known_hosts handled with `StrictHostKeyChecking=accept-new` (or delete stale entries with `ssh-keygen -R <ip>`).
+
+### Running Commands Inside the Instance
+
+Use SSH for any in-instance operations (install software, check logs, start services):
+
+```bash
+ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'command'
+```
+
+Example — re-run failed cloud-init setup manually:
+```bash
+ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'dnf install -y nginx && systemctl enable --now nginx'
+```
+
+> If SCP blocks SSH, use cloud-init `--server.user_data` for full deployment instead. See `references/create-instance.md` §Bootstrap.
+
 ## Deleting Instances
 
 - Show the user the exact command and get explicit approval before running
@@ -82,7 +132,7 @@ Abort if the result set is larger than `--limit` and ask the user to narrow the
 | Cannot SSH | SG missing port 22 or no EIP -> Add ingress rule / Bind EIP |
 | Flavor unavailable | Region limitation -> ListFlavors in target region |
 | Insufficient resources | Stock depleted -> Change flavor or AZ |
-| AuthFailure | Expired AK/SK -> hcloud configure init |
+| AuthFailure | Expired AK/SK -> re-run `npx huaweicloud-devkit auth init` |
 | APIGW.0802 / region permission | IAM user has no access to this region -> IAM console → User → Permissions → add region, or switch to another region |
 | Cannot SSH (port 22 open) | SCP policy may be blocking SSH. Check `SYS.0403` errors in command output -> Use cloud-init/user_data for initial setup instead. See `references/create-instance.md` §Bootstrap |