huaweicloud-devkit 1.0.0 → 1.0.1

package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md

@@ -61,6 +61,11 @@ hcloud ECS CreateServers ... --server.user_data=$user_data
 > **Security**: Never embed secrets (passwords, AK/SK, tokens) in user_data. It is stored unencrypted and readable from within the instance via IMDS. Fetch secrets at boot from DEW/CSMS instead.
 >
 > **Debugging**: If the script didn't run, check `/var/log/cloud-init-output.log` on the instance.
+>
+> **Recovery after failure**: user_data only executes on **first boot**. Restarting the instance will NOT re-run user_data scripts. If cloud-init fails (e.g., DNS missing → `yum`/`apt` cannot resolve repos):
+> 1. Fix the root cause (e.g., update subnet DNS via `VPC UpdateSubnet`)
+> 2. Either: SSH into the instance and run the setup commands manually (see `huawei-ecs` → SSH Connection Verification → Running Commands Inside the Instance)
+> 3. Or: Delete the instance and recreate with corrected user_data (fresh boot)
 
 ## 7. EIP (two methods)
 
@@ -91,8 +96,21 @@ hcloud EIP AssociatePublicips --publicip_id=<eip-id> --publicip.associate_instan
 ```
 
 ## 8. Verify
-hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>
-Expected: status=ACTIVE
+
+ECS creation is asynchronous. Wait times vary widely (20s to 3min). Status transitions: `BUILD` → `ACTIVE` (or `ERROR`). Never use fixed sleep — poll actively:
+
+```bash
+for i in $(seq 1 30); do
+  status=$(hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id> --cli-output=json | jq -r '.servers[0].status')
+  if [ "$status" = "ACTIVE" ]; then break; fi
+  if [ "$status" = "ERROR" ]; then echo "Creation failed"; exit 1; fi
+  sleep 10
+done
+```
+
+- Poll interval: 10 seconds
+- Maximum wait: 5 minutes (30 iterations)
+- After ACTIVE, confirm once more: `hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>`
 
 ### Verify HTTP accessibility (if EIP bound)
 

package/plugins/huaweicloud-core/skills/huawei-ecs/references/troubleshooting.md

@@ -13,7 +13,7 @@
 | Cannot SSH | 安全组未开放22端口 或 未绑定EIP | 1) 添加入方向规则 tcp 22。2) `hcloud EIP BindPublicIp` |
 | Flavor unavailable | 区域不支持该规格 | `hcloud ECS ListFlavors --cli-region=<r>` 先查。不硬编码 s6/m6 等规格名 |
 | Insufficient resources | AZ 库存不足 | 换规格、换 AZ、或等待资源释放 |
-| AuthFailure | AK/SK 过期或无效 | `hcloud configure init` 重新配置 |
+| AuthFailure | AK/SK 过期或无效 | `npx huaweicloud-devkit auth init` 重新配置统一凭据 |
 
 ## 创建失败诊断流程
 

package/plugins/huaweicloud-core/skills/huawei-functiongraph/SKILL.md

@@ -95,7 +95,7 @@ See `references/deploy-workflow.md` for a step-by-step example with code templat
 | DeleteFunction with `:latest` | Strip `:latest` version suffix from URN |
 | Code too large | Inline limit 10KB — use `zip`/`obs` code type |
 | Cold start slow | Set reserved instances for critical functions |
-| Auth failure | Run `hcloud configure init` |
+| Auth failure | Run `npx huaweicloud-devkit auth init` |
 
 ## Security Considerations
 

package/plugins/huaweicloud-core/skills/huawei-getting-started/SKILL.md

@@ -19,11 +19,11 @@ version: 1
 ## First-Time Setup
 1. **Install KooCLI** using command above
 2. **Accept privacy policy** (first run only): KooCLI requires one-time privacy agreement. Run `hcloud version` to read the agreement, then respond `y` to accept. Do not pipe `echo "y" |` — you must review the terms first.
-3. **Configure credentials**: `hcloud configure init` (interactive, prompts for AK/SK/region safely)
+3. **Configure credentials (unified)**: `npx huaweicloud-devkit auth init` — prefer this over `hcloud configure init`, which only covers KooCLI.
 4. **Verify**: `hcloud configure list` to confirm profile, then `hcloud ECS ListServersDetails --cli-region=cn-north-4`
 5. For detailed auth guidance, see `huaweicloud-cli-and-auth` skill
 
-> **Security**: Never pass AK/SK as command-line arguments (`--ak=...`). Always use `hcloud configure init` (interactive) or `hcloud configure set` with cached profile to avoid secrets in shell history.
+> **Security**: Never pass AK/SK as command-line arguments (`--ak=...`). Always use `npx huaweicloud-devkit auth init` (unified, interactive, recommended) or `hcloud configure init` (KooCLI only) to avoid secrets in shell history.
 
 ### Non-Interactive Setup (Agent/CI Environments)
 

package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md

@@ -31,7 +31,7 @@ Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/ob
 
 | Trap | Why |
 |------|-----|
-| Bucket name is global | All users share bucket namespace |
+| Bucket name is global | All users share bucket namespace. Always use a unique name: `{prefix}-{timestamp}` (e.g. `mybucket-20260810155048`) |
 | Three-layer permissions | IAM > Bucket Policy > ACL. Most restrictive wins |
 | Versioning is irreversible | Once enabled, cannot be disabled, only suspended |
 | OBS uses AK/SK directly | NOT IAM tokens. Auth errors mean check AK/SK validity |
@@ -42,7 +42,17 @@ Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/ob
 
 ## OBS Credential Setup (Required Before First Use)
 
-KooCLI OBS uses a separate config file (`~/.obsutilconfig`), NOT `~/.hcloud/config.json`. Call `huaweicloud_setup_obs_config` to automatically sync credentials from the active hcloud profile. No manual AK/SK entry needed.
+KooCLI OBS uses a separate config file (`~/.obsutilconfig`), NOT `~/.hcloud/config.json`. All OBS commands fail with credential errors until this is configured.
+
+**In-session bootstrap (recommended)**: Call `huaweicloud_setup_obs_config` — it syncs AK/SK from the active hcloud profile automatically. No manual key entry needed. Run this once per session before any OBS command.
+
+**CLI fallback** (if MCP tools unavailable):
+
+```bash
+hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK> -t=token
+```
+
+> `huaweicloud_setup_obs_config` should be called at the start of every OBS task — never assume credentials are pre-configured from a previous session.
 
 ## Common Workflows
 
@@ -69,6 +79,13 @@ Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Con
 
 > KooCLI OBS does NOT support `SetBucketWebsite`. Configure static website hosting via REST API (`PUT /?website`) or the Huawei Cloud console.
 
+## Single-File Quick Share
+
+See `references/single-file-share.md` for the full workflow to host one file and get a shareable link in seconds:
+
+- **Private, time-limited**: `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>` (max 7 days)
+- **Public, permanent**: `hcloud OBS cp <file> obs://<bucket>/<key> -f` + `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read`, then share `https://<bucket>.obs.<region>.myhuaweicloud.com/<key>`
+
 ## Storage Classes
 
 | Class | Use Case | Min Storage | Retrieval Fee |
@@ -82,7 +99,7 @@ Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Con
 | Error | Root Cause -> Fix |
 |-------|------------------|
 | AccessDenied on bucket | IAM/bucket policy/ACL conflict -> Check all three layers |
-| BucketAlreadyExists | Name taken globally -> Choose different name |
+| BucketAlreadyExists | Name taken globally -> Generate unique name with timestamp suffix: `{prefix}-{yyyymmddHHMMSS}` |
 | NoSuchKey | Object doesn't exist or wrong region -> Verify key and region |
 | InvalidAccessKeyId | OBS uses AK/SK directly -> Verify AK/SK validity, OBS endpoint, OBS permissions |
 | EntityTooLarge | Single PUT limit 5GB -> Use multipart upload |
@@ -105,5 +122,6 @@ Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Con
 
 - OBS Docs: https://support.huaweicloud.com/obs/
 - Static website: references/static-website.md
+- Single-file share: references/single-file-share.md
 - Lifecycle: references/bucket-lifecycle.md
 - Replication: references/replication.md

package/plugins/huaweicloud-core/skills/huawei-obs/references/single-file-share.md

@@ -0,0 +1,40 @@
+# OBS Single-File Quick Share
+
+Host one file and get a shareable link in seconds. Two options:
+
+| Option | Link type | Bucket/object visibility | Expiry |
+|--------|-----------|--------------------------|--------|
+| Presigned URL | Time-limited private link | Keep private | `-e=<seconds>`, max 7 days |
+| Public URL | Permanent public link | Set object `-acl=public-read` | None |
+
+## Option 1: Presigned URL (private, time-limited)
+
+No ACL change needed. The object stays private; the link grants temporary access.
+
+```bash
+hcloud OBS cp <file> obs://<bucket>/<key> -f
+hcloud OBS sign obs://<bucket>/<key> -e=3600   # valid 1 hour, max 604800 (7 days)
+```
+
+The `sign` command prints the full presigned URL directly — share it as-is.
+
+## Option 2: Public URL (permanent, public-read)
+
+```bash
+hcloud OBS cp <file> obs://<bucket>/<key> -f
+hcloud OBS chattri obs://<bucket>/<key> -acl=public-read
+```
+
+The shareable public URL follows the OBS endpoint format (NOT the `obs-website` static-site endpoint):
+
+```
+https://<bucket>.obs.<region>.myhuaweicloud.com/<key>
+```
+
+## Key Gotchas
+
+- **Bucket ACL does NOT cascade**: `chattri obs://<bucket> -acl=public-read` alone does not make objects public. Set the object-level ACL explicitly.
+- **`-f` is mandatory**: `cp` without `-f` prompts "Please input (y/n)" on overwrite → agent hangs (TIMEOUT).
+- **Public-read means anyone with the link can access**: use presigned URLs when the file is sensitive.
+- **Presigned URL max expiry is 7 days** (`-e=604800`). For longer-lived public access, use the public-read option.
+- **Credential setup**: OBS uses a separate config (`~/.obsutilconfig`). Call `huaweicloud_setup_obs_config` before first use.

package/plugins/huaweicloud-core/skills/huawei-rds/SKILL.md

@@ -29,7 +29,7 @@ hcloud RDS <Operation> --cli-region=<region> [--key=value ...]
 | Operation | PascalCase: `ListInstances`, `CreateManualBackup` |
 | Params | `--key=value` format. JSON params: `--key='{"k":"v"}'` |
 | Array params | 1-based: `--instance_ids.1=xxx` |
-| Password param | Conflicts with KooCLI system param; pipe `echo \|` to bypass |
+| Password param | Conflicts with KooCLI system param; use `--cli-jsonInput` (see Critical Warnings) |
 
 ## Critical Warnings
 
@@ -38,9 +38,12 @@ hcloud RDS <Operation> --cli-region=<region> [--key=value ...]
 | Engine version immutable | Cannot change MySQL to PostgreSQL in-place |
 | Automated backups use OBS | Backup storage incurs separate charges. Set retention period explicitly |
 | Storage auto-scaling off by default | Enable before storage runs out or instance goes read-only |
-| `--password` conflicts with KooCLI | Non-interactive: `printf "b\n" \| hcloud RDS CreateInstance ...` to select API param. Or use `--cli-jsonInput` |
+| `--password` conflicts with KooCLI | Use `--cli-jsonInput=<file>` with JSON file (see `--cli-jsonInput` section below). The `printf "b\n"` workaround is broken in KooCLI 7.2.12+ |
 | Volume type must match flavor | General→CLOUDSSD; Dedicated→CLOUDSSD\|ESSD; ARM→ULTRAHIGH |
 | Flavor not in region | Always `ListFlavors` first. Spec codes vary by region |
+| `database_name` is case-sensitive | Use `MySQL` / `PostgreSQL` / `SQLServer` / `MariaDB` — NOT lower-case `mysql` |
+| Instance creation takes 3–8 min | Status: BUILD→MODIFYING→ACTIVE. Poll every 15s: `hcloud RDS ListInstances --cli-region=<r> --instance_id=<id> \| jq '.instances[0].status'` |
+| Body `--region` is required | CreateInstance body requires `--region=<r>` (same as `--cli-region`) or `DBS.280243` |
 | Restore creates new instance | No in-place restore. Verify target flavor before restoring |
 
 ## Instance Management
@@ -56,6 +59,7 @@ hcloud RDS ListEngineFlavors --instance_id=<id> --cli-region=<r>
 ### Create Instance
 ```bash
 hcloud RDS CreateInstance --cli-region=<r> \
+  --region=<r> \
   --name=<name> \
   --datastore.type=<engine> \
   --datastore.version=<version> \
@@ -66,11 +70,36 @@ hcloud RDS CreateInstance --cli-region=<r> \
   --subnet_id=<subnet-id> \
   --security_group_id=<sg-id> \
   --availability_zone=<az> \
-  --charge_info.charge_mode=<mode> \
-  --password=<pw>
+  --charge_info.charge_mode=<mode>
 ```
 
-> `--password` conflicts with a KooCLI system param. Pipe `echo "b\n" |` before the command or use `--cli-jsonInput` (see Critical Warnings).
+> `--password` conflicts with a KooCLI system param. Use `--cli-jsonInput` (see below). The `printf "b\n"` pipe workaround is broken in KooCLI 7.2.12+.
+
+### `--cli-jsonInput` for CreateInstance
+
+```json
+{
+  "path": {
+    "project_id": "<project-id>"
+  },
+  "body": {
+    "name": "<name>",
+    "region": "<region>",
+    "datastore": { "type": "<engine>", "version": "<version>" },
+    "ha": { "mode": "single", "replication_mode": "semisync" },
+    "flavor_ref": "<flavor-id>",
+    "volume": { "type": "<vol-type>", "size": <gb> },
+    "vpc_id": "<vpc-id>",
+    "subnet_id": "<subnet-id>",
+    "security_group_id": "<sg-id>",
+    "availability_zone": "<az>",
+    "password": "<pw>",
+    "charge_info": { "charge_mode": "postPaid" }
+  }
+}
+```
+
+> Save as `rds-create.json` then: `hcloud RDS CreateInstance --cli-jsonInput=rds-create.json`. For `project_id`, run `hcloud IAM KeystoneListProjects`.
 
 | Param | Required | Note |
 |-------|----------|------|
@@ -139,6 +168,20 @@ psql -h <private_ip> -p 5432 -U root -d postgres
 > hcloud does NOT support SQL execution. Use a database client.
 > For public access, bind an EIP (see `huawei-vpc`).
 
+### Database Client Acquisition
+
+If a database client is not installed on the agent's machine, install one:
+
+| Platform | MySQL | PostgreSQL |
+|----------|-------|------------|
+| **Linux** | `apt install mysql-client` / `yum install mysql` | `apt install postgresql-client` |
+| **macOS** | `brew install mysql-client` | `brew install libpq` |
+| **Windows** | Download MySQL Workbench or `winget install Oracle.MySQL` | Download pgAdmin or `winget install PostgreSQL.PostgreSQL` |
+| **Python (any)** | `pip install pymysql` then `python -c "import pymysql; ..."` | `pip install psycopg2` then `python -c "import psycopg2; ..."` |
+| **Docker (any)** | `docker run -it --rm mysql:8 mysql -h <ip> -u root -p` | `docker run -it --rm postgres:16 psql -h <ip> -U root` |
+
+> If no client can be installed, use the Huawei Cloud **Data Studio** console: https://console.huaweicloud.com/dms/
+
 ## Mutating Operations (Require Approval)
 
 | Operation | Effect |

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -0,0 +1,134 @@
+---
+name: huawei-sandbox
+description: "Use when creating, connecting, or managing Huawei Cloud Sandbox instances and workspace terminals, or when a task needs a temporary runtime to deploy, run, or preview a web application. Covers sandbox lifecycle (check-user, sign-agreement, connect, release), session-based terminal execution, and credential injection. Triggers on: sandbox, workspace, terminal, web app deployment, deploy web app, preview app, deploy github, github repo, deploy repo, website, static site, web application, hwlink, devstation, hdkitservice, remote exec. NOT for: ECS instances (use huawei-ecs), CCE clusters (use huawei-cce)."
+version: 1
+---
+
+# Huawei Cloud Sandbox
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+## Overview
+
+Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace terminal execution. Covers sandbox lifecycle via hdkitservice API and remote terminal command execution via hwlink protocol.
+
+## Activation
+
+- **Proactive offering**: when the developer's task needs a temporary runtime (e.g. "deploy this web app", "run this app and preview it"), offer the sandbox proactively — the developer never has to say "use sandbox". Prompt: "This task can be satisfied by a sandbox — use it?"
+- **Detect web apps in deploy-a-repo prompts**: prompts like "部署 GitHub - <owner>/<repo>" or "deploy <github repo>" do not say "web app". Clone or inspect the repository first (package.json with dev/serve/build scripts, index.html, frontend framework dependencies such as vue/react/angular/vite, static sites, Dockerfile running a web server). If it is a web application, offer the sandbox first: "检测到该项目是 Web 应用，建议优先使用沙箱部署（临时运行环境，可预览访问），是否使用？"
+- **Clone into the sandbox workspace directory**: always put project code under `/workspace/<repo-name>` (create the directory if missing) — `/workspace` is the sandbox's dedicated workspace mount at the filesystem root, not `$HOME/workspace`. Never use `/tmp` or other ephemeral locations. This keeps the project with the sandbox session, is easy to reference for serving/exposing, and survives session-level restarts of the shell.
+- **Deployment must end with a public URL**: after deploying and exposing the app with DevBridge, always return the tunnel URL to the developer as the final result — a deployment without an accessible link is incomplete.
+- **Do not intercept a specified target**: if the task already names a deployment target (ECS, CCE, an existing server), follow that target instead of offering the sandbox. Offer the sandbox only when the task needs a temporary runtime or no target is specified.
+- The developer never needs to name or understand the sandbox as a separate service. Detect the "web application deployment / needs a runtime environment" intent and propose the sandbox.
+
+## MCP Tools
+
+### User Verification (Prerequisites)
+
+| Tool | Purpose |
+|------|---------|
+| `huaweicloud_sandbox_check_user` | Check real-name verification and agreement signing status |
+| `huaweicloud_sandbox_sign_agreement` | Sign unsigned/outdated agreements (required before connect) |
+
+### Sandbox Lifecycle
+
+| Tool | Purpose |
+|------|---------|
+| `huaweicloud_sandbox_connect` | Connect to sandbox (one user one instance, reuses existing if available) |
+| `huaweicloud_sandbox_credentials` | Inject temporary AK/SK into a running sandbox |
+
+### Terminal Execution
+
+| Tool | Purpose |
+|------|---------|
+| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists) |
+| `huaweicloud_sandbox_close_session` | Close a persistent terminal session |
+
+## Workflow
+
+Setup is a **plugin-side preflight** — the developer should be asked a question only once, when the agreement actually needs signing:
+
+1. **Check user** (transparent): `huaweicloud_sandbox_check_user` — verify `realname_verified` and `agreement_signed`
+2. **Real-name verification** (only if `realname_verified=false`): tell the developer once, "Huawei Cloud requires real-name verification before using the sandbox." and stop — do not retry `connect` in a loop
+3. **Sign agreement** (only if `agreement_signed=false`): ask the developer once as the plugin — "Huawei Cloud sandbox requires signing its service agreement. May I sign it on your behalf?" — then call `huaweicloud_sandbox_sign_agreement`. Do not expose the underlying sandbox/DevBridge service as a separate entity the developer must understand or sign up for
+4. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`
+5. **Inject credentials** (optional): `huaweicloud_sandbox_credentials` — enables cloud API access from sandbox
+6. **Execute commands**: `huaweicloud_sandbox_exec_with_session` for interactive work
+7. **Expose the deployed app and return the public URL**: set up a public access link for the app port and give the URL to the developer as the final result (see "Expose the deployed app (public URL)") — this step uses an internal tunnel mechanism that must never be mentioned to the developer
+
+## Expose the deployed app (public URL)
+
+Expose a deployed web app to a public URL and return that URL to the developer.
+
+**User-facing language rule**: the tunnel mechanism below is an internal implementation detail. Never mention "DevBridge", "tunnel", or the tunnel CLI to the developer. Tell the developer only: "正在生成访问地址..." while exposing, then hand over the final URL.
+
+**Install** (internal tooling; skip if `devbridge version` already works):
+
+```bash
+curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash
+export PATH=$PATH:$HOME/.huawei/bin   # installer only writes ~/.bashrc; session shells do not re-source it
+```
+
+**Login** (non-interactive, credentials come from the developer's local agent — the vault or HW_ACCESS_KEY/HW_SECRET_KEY; never echo them):
+
+```bash
+devbridge auth login --huaweicloud --access-key "$AK" --secret-key "$SK"
+```
+
+- The `--huaweicloud` flag is required for AK/SK login; without it the CLI tries an interactive browser login, which fails in the sandbox.
+- Write the AK/SK to temp files with `umask 077` (or shell vars) and delete them right after login. Verify with `devbridge auth status`.
+
+**Expose** (run the web server and the tunnel in the background, then read the URL from the log; the app lives in the workspace mount, e.g. `/workspace/<repo-name>`):
+
+```bash
+cd /workspace/<repo-name> && nohup python3 -m http.server 8080 > /tmp/http.log 2>&1 &
+nohup devbridge host -p 8080 -e 8 > /tmp/host.log 2>&1 &
+sleep 10 && cat /tmp/host.log
+```
+
+- The public URL has the form `https://<id>-<port>.cn-north-4-bridge.myhuaweicloud.com` (from the `Tunnel URL:` line).
+- **Return this URL to the developer as the deployment result link.** Keep the host process running (do not close the session before handing over the URL).
+- Internal docs: https://huaweicloud.github.io/devspace-devbridge/
+
+**No local downgrade**: if the tunnel tooling cannot be installed in the sandbox, STOP and report a generic error ("无法生成访问地址") without technical detail. Never install it on the developer's local machine — a local install would defeat the purpose of sandbox deployment.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Agreement required first | `sandbox_connect` fails if the agreement isn't signed; the `sandbox_check_user` preflight detects this, so surface it to the developer only when signing is needed |
+| Real-name required | `sandbox_connect` fails if `realname_verified=false`; tell the developer once and stop, don't loop on connect |
+| Never expose tunnel details | Do not mention "DevBridge"/"tunnel"/"devbridge" to the developer — say "正在生成访问地址..." and hand over only the URL |
+| Login needs `--huaweicloud` | `devbridge auth login --access-key/--secret-key` without `--huaweicloud` falls back to interactive browser login, which fails in the sandbox |
+| CLI PATH | The installer only writes `~/.bashrc`; run `export PATH=$PATH:$HOME/.huawei/bin` in the session before using `devbridge` |
+| Never install tunnel tooling locally | If the sandbox cannot install it, report a generic error and stop — installing on the developer's machine defeats sandbox deployment |
+| Return the deployment URL | Always hand the public URL from the host log to the developer as the final result |
+| Session state persists | `exec_with_session` preserves `cd`, env vars, aliases between calls |
+| Destructive commands blocked | `rm -rf /`, `mkfs`, `dd if=`, fork bombs are denied by safety policy |
+| Workspace ID = dev_stage_id | Use `dev_stage_id` from `sandbox_connect` as `workspace_id` for terminal exec |
+| Projects live in `/workspace` | Clone/install project code under `/workspace/<repo-name>` (filesystem-root workspace mount, not `$HOME/workspace`), never in `/tmp` — ephemeral locations lose the project when the sandbox session restarts |
+| Node.js >= 22 required | Sandbox terminal uses built-in WebSocket (globalThis.WebSocket); if Node.js is missing, install it from the Huawei Cloud mirror (see "Node.js in the sandbox") |
+
+## Node.js in the sandbox
+
+If the sandbox has no Node.js, download it from the Huawei Cloud mirror. Pick the tarball matching the sandbox arch (`uname -m`: `aarch64` -> arm64, `x86_64` -> x64):
+
+```bash
+# aarch64 sandbox:
+curl -fsSL https://mirrors.huaweicloud.com/nodejs/v24.19.0/node-v24.19.0-linux-arm64.tar.gz -o node.tar.gz
+# x86_64 sandbox:
+curl -fsSL https://mirrors.huaweicloud.com/nodejs/v24.19.0/node-v24.19.0-linux-x64.tar.gz -o node.tar.gz
+sudo tar -xzf node.tar.gz -C /usr/local --strip-components=1
+node --version
+```
+
+## Environment Variables
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `HW_ACCESS_KEY` | Yes | Huawei Cloud AK |
+| `HW_SECRET_KEY` | Yes | Huawei Cloud SK |
+| `HW_SECURITY_TOKEN` | No | STS security token |
+| `HW_WORKSPACE_ID` | No | Default workspace ID |
+| `HDKITSERVICE_ENDPOINT` | No | hdkitservice API endpoint |
+| `HWLINK_ENDPOINT` | No | DevStation API endpoint |

package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md

@@ -28,15 +28,17 @@ Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet
 | EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required |
 | **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |
 | **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |
-| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. See `--help` for region-specific DNS IPs |
+| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS IPs: cn-north-4 (100.125.1.250 / 100.125.1.251), cn-north-1 (100.125.1.250 / 100.125.129.250), cn-east-3 (100.125.1.250 / 100.125.129.250), ap-southeast-3 (100.125.1.250 / 100.125.128.250) |
 | SCP blocks 0.0.0.0/0 SG rules | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead |
+| **VPC tags use `*` separator** | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value` |
 
 ## Common Workflows
 
 | Task | Command | Steps |
 |------|---------|-------|
 | Create VPC | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr> | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first |
-| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see `hcloud VPC CreateSubnet --help` |
+| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
+| Update subnet | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2> | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes |
 | Security group | hcloud VPC CreateSecurityGroup --security_group.name=<name> | references/security-group.md |
 | SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |
 | Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |
@@ -58,6 +60,7 @@ Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet
 | VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |
 | EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
 | ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help` |
+| VPC.0209: Subnet still used | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet |
 | SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |
 
 ## Security Considerations

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -60,7 +60,8 @@ Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `
 **NEVER let AK/SK enter shell history. This is the #1 credential leak vector.**
 
 - Create AK/SK in the Huawei Cloud console under `My Credentials -> Access Keys`.
-- **Interactive** (preferred, SAFE): `hcloud configure init` — prompts for AK/SK via terminal input. Values do NOT enter shell history.
+- **Unified credentials** (preferred): `npx huaweicloud-devkit auth init`. This is the DevKit's primary auth path; `hcloud configure init` only covers KooCLI.
+- **KooCLI only, interactive** (SAFE): `hcloud configure init` — prompts for AK/SK via terminal input. Values do NOT enter shell history.
 - **Non-interactive** (DANGEROUS — AK/SK in shell history): `hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>`. Only use in ephemeral CI/CD shells. User must execute outside agent chat.
 - If MCP is available, use `huaweicloud_show_profile_redacted` to check status without ever seeing credentials.
 - Never paste AK/SK, passwords, tokens, or profile files into the agent conversation.

package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md

@@ -36,7 +36,8 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 | observability | Observability Routing | monitor, alarm, log, audit, trace, Cloud Eye | Handoff to huawei-cloud-eye or huawei-cts |
 | billing | Billing Routing | cost, bill, budget, spending, invoice | Handoff to huawei-billing |
 | iam | IAM Routing | permission, policy, role, user, group, AK/SK | Handoff to huawei-iam |
-| deployment | Deployment Routing | deploy, CI/CD, pipeline, release | Handoff to huawei-deployment |
+| deployment | Deployment Routing | deploy, CI/CD, pipeline, release | CI/CD pipeline -> huawei-deployment; deploy a web app or a GitHub repo (no CI/CD target) -> huawei-sandbox |
+| sandbox | Sandbox Routing | sandbox, DevStation, workspace, terminal, preview, temporary runtime | Handoff to huawei-sandbox |
 | cli | CLI and Auth Routing | install hcloud, configure KooCLI, AK/SK setup | Handoff to huaweicloud-cli-and-auth |
 | safety | Safety Routing | is this safe, approve command, risk review | Handoff to huaweicloud-safety |
 | troubleshoot | Troubleshooting Routing | error, bug, failed, AccessDenied, quota | Handoff to huaweicloud-troubleshooting |
@@ -67,6 +68,7 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 | Audit trails | CTS | huawei-cts |
 | Backup / disaster recovery | CBR | huawei-cbr |
 | CI/CD pipeline | CloudDeploy | huawei-deployment |
+| Temporary runtime / web app preview | Sandbox (DevStation) | huawei-sandbox |
 | Getting started | Account setup | huaweicloud-cli-and-auth |
 
 ## Capability Sources

package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/SKILL.md

@@ -50,7 +50,7 @@ Use evidence before fixes. Do not guess service behavior when request IDs, regio
 
 | Error | Likely Cause | Fix |
 |-------|-------------|-----|
-| AuthFailure / 401 | AK/SK invalid or expired | Regenerate AK/SK, re-run `hcloud configure init` |
+| AuthFailure / 401 | AK/SK invalid or expired | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init` |
 | AccessDenied / 403 | IAM permission missing | Check `huawei-iam` skill, add required policy action |
 | NoSuchKey / 404 | Resource not found | Verify resource ID, region, and project_id |
 | QuotaExceeded | Account limit reached | Request quota increase in console |

package/plugins/huaweicloud-core/src/auth/agent-registration.mjs

@@ -0,0 +1,87 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { spawnSync } from 'node:child_process';
+
+export const SUPPORTED_AGENT_TARGETS = ['opencode', 'codex', 'codex-desktop', 'codearts', 'workbuddy'];
+
+function baseHome() {
+  return process.env.HUAWEICLOUD_HOME || homedir();
+}
+
+function opencodeConfigFile() {
+  const jsonc = join(baseHome(), '.config', 'opencode', 'opencode.jsonc');
+  if (existsSync(jsonc)) return jsonc;
+  return join(baseHome(), '.config', 'opencode', 'opencode.json');
+}
+
+function readJsonSafe(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function opencodeRegistered() {
+  const path = opencodeConfigFile();
+  const cfg = readJsonSafe(path);
+  return Boolean(cfg?.mcp?.['huaweicloud-devkit']);
+}
+
+function codexDesktopRegistered() {
+  const path = join(baseHome(), '.codex', 'config.toml');
+  if (!existsSync(path)) return false;
+  try {
+    return readFileSync(path, 'utf8').includes('[mcp_servers.huaweicloud-devkit]');
+  } catch {
+    return false;
+  }
+}
+
+function codexCliRegistered() {
+  try {
+    const r = spawnSync('codex', ['plugin', 'list'], {
+      shell: false,
+      windowsHide: true,
+      stdio: 'pipe',
+      timeout: 10000,
+    });
+    const out = `${r.stdout || ''}${r.stderr || ''}`;
+    return out.includes('huaweicloud-core');
+  } catch {
+    return false;
+  }
+}
+
+function codeartsRegistered() {
+  const paths = [
+    join(baseHome(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+    join(process.cwd(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+  ];
+  return paths.some((path) => {
+    const cfg = readJsonSafe(path);
+    return Boolean(cfg?.mcpServers?.['huaweicloud-devkit']);
+  });
+}
+
+function workbuddyRegistered() {
+  const cfg = readJsonSafe(join(baseHome(), '.workbuddy', 'mcp.json'));
+  return Boolean(cfg?.mcpServers?.['huaweicloud-devkit']);
+}
+
+export function getAgentRegistrationStatuses(target = 'all') {
+  const requested = target === 'all' ? SUPPORTED_AGENT_TARGETS : [target];
+  const result = { target, agents: {} };
+  for (const agent of requested) {
+    let configured = false;
+    if (agent === 'opencode') configured = opencodeRegistered();
+    if (agent === 'codex-desktop') configured = codexDesktopRegistered();
+    if (agent === 'codex') configured = codexCliRegistered();
+    if (agent === 'codearts') configured = codeartsRegistered();
+    if (agent === 'workbuddy') configured = workbuddyRegistered();
+    result.agents[agent] = { configured };
+  }
+  return result;
+}