huaweicloud-devkit 1.0.0 → 1.0.2-dev.1

package/README.md

@@ -1,13 +1,15 @@
-# HuaweiCloud DevKit
+# HuaweiCloud DevKit
 
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/HuaweiCloud-Devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/HuaweiCloud-Devkit/actions/workflows/ci.yml)
 
-帮助 AI 编码助手安全、准确地使用华为云——技能引导、KooCLI 工具、安全策略一站式集成。
+**[中文](README.zh-CN.md) | English**
 
-HuaweiCloud DevKit 为 AI 编码助手提供操作华为云所需的知识、工具和安全护栏，支持 OpenCode、Codex、码道（CodeArts Agent）等主流 Agent。
+Help AI coding agents use Huawei Cloud safely and accurately — a single integration that gives agents cloud knowledge, CLI tooling, and safety guardrails.
 
-## 快速开始
+Supports OpenCode, Codex, CodeArts Agent, and WorkBuddy.
+
+## Quick Start
 
 ### OpenCode
 
@@ -15,13 +17,13 @@ HuaweiCloud DevKit 为 AI 编码助手提供操作华为云所需的知识、工
 npx --yes huaweicloud-devkit install
 ```
 
-自动安装 27 个技能、MCP 服务器和安全策略，并更新 OpenCode 配置。安装后**重启会话**使 MCP 工具生效。
+Installs the DevKit into OpenCode automatically. **Restart the session** after installation.
 
 ```bash
-npx --yes huaweicloud-devkit doctor   # 自检：hcloud、MCP、技能、认证
-npx --yes huaweicloud-devkit status   # 查看安装状态
-npx --yes huaweicloud-devkit update   # 更新到最新版
-npx --yes huaweicloud-devkit uninstall # 卸载
+npx --yes huaweicloud-devkit doctor    # self-check
+npx --yes huaweicloud-devkit status    # show status
+npx --yes huaweicloud-devkit update    # update
+npx --yes huaweicloud-devkit uninstall # uninstall
 ```
 
 ### Codex
@@ -30,127 +32,84 @@ npx --yes huaweicloud-devkit uninstall # 卸载
 npx --yes huaweicloud-devkit install --target codex
 ```
 
-> 需要先安装 Codex CLI。`--target all` 会在 Codex CLI 缺失时跳过 Codex。
-
-### CodeArts Agent（码道）
+> The Codex CLI must be installed first.
 
-码道没有插件市场，通过技能 + MCP 机制适配：
+### CodeArts Agent
 
 ```bash
 npx --yes huaweicloud-devkit install --target codearts
 ```
 
-自动安装 27 个技能到 `~/.codeartsdoer/skills/` 与项目级 `.codeartsdoer/skills/`，MCP 服务器注册到用户级与项目级 `.codeartsdoer/mcp/mcp_settings.json`。若本机已存在 KooCLI（`~/hcloud/hcloud.exe`），会自动将 `HCLOUD_BIN` 注入 MCP 配置。安装后**重启会话**使 MCP 工具生效。
+**Restart the session** after installation.
 
 ```bash
-npx --yes huaweicloud-devkit install-hcloud   # 安装 KooCLI（自动接受隐私协议）
-npx --yes huaweicloud-devkit doctor           # 自检：hcloud、MCP、技能、沙箱模式
-npx --yes huaweicloud-devkit status --target codearts   # 查看码道安装状态
-npx --yes huaweicloud-devkit uninstall --target codearts # 卸载
+npx --yes huaweicloud-devkit install-hcloud   # install KooCLI
+npx --yes huaweicloud-devkit doctor           # self-check
+npx --yes huaweicloud-devkit status --target codearts
+npx --yes huaweicloud-devkit uninstall --target codearts
 ```
 
-> **沙箱模式**：码道默认 `bash_mode: sandbox` 会阻止 KooCLI 写入配置目录（如 `~/.hcloud/root`），导致隐私协议无法持久化、KooCLI 无法运行。`install-hcloud` 会自动检测沙箱模式并给出明确指引——请在**码道外终端**安装使用 KooCLI，或在码道设置中关闭沙箱模式（设置 → 权限 → Bash 模式）后重试。
+> **Sandbox mode**: CodeArts defaults to sandbox mode which blocks KooCLI. `install-hcloud` detects this and shows how to resolve it — install KooCLI outside the sandbox terminal, or disable sandbox mode in CodeArts settings (Settings → Permissions → Bash mode).
 >
-> **认证**：KooCLI 就绪后，还需在码道外终端执行 `hcloud configure init` 配置 AK/SK 与区域，然后即可在码道中描述你的华为云任务。
+> **Authentication**: Run `hcloud configure init` to configure AK/SK and region.
+
+### WorkBuddy
+
+```bash
+npx --yes huaweicloud-devkit install --target workbuddy
+```
 
-### 其他 Agent
+**Restart the session** after installation.
 
-对于支持 Model Context Protocol (MCP) 的 Agent，手动配置 MCP 服务器：
+### Other Agents
+
+For agents that support the Model Context Protocol (MCP):
 
 ```json
 {
   "mcp": {
     "huaweicloud-devkit": {
       "type": "local",
-      "command": ["node", "<路径>/plugins/huaweicloud-core/src/mcp-server.mjs"],
+      "command": ["node", "<path>/plugins/huaweicloud-core/src/mcp-server.mjs"],
       "enabled": true
     }
   }
 }
 ```
 
-然后安装技能：
+Then install:
 
 ```bash
 npx --yes huaweicloud-devkit install
 ```
 
-> **前置条件：** 需要安装 [KooCLI](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html)（`hcloud`）并完成认证。MCP 服务器需要 Node.js >= 20。如果 `hcloud` 不在 `PATH` 中，请设置 `HCLOUD_BIN` 环境变量指向完整路径。
-
-## 包含内容
-
-### 插件
-
-`huaweicloud-core` 插件将 MCP 服务器配置、27 个 Agent 技能和安全策略打包为一次性安装。
-
-| 插件 | 说明 |
-|------|------|
-| [huaweicloud-core](plugins/huaweicloud-core/) | 核心插件，含技能、MCP 服务器、安全策略。**从这里开始。** |
-
-### 技能
-
-Agent 技能是经过整理的指令和参考材料包，帮助 Agent 完成特定的华为云任务。技能按需加载——Agent 只发现和检索与当前任务相关的内容。
-
-包含 6 个元技能（路由、发现、CLI/认证、API/SDK、安全、排错）和 20 个服务技能（覆盖 ECS、OBS、VPC、IAM、RDS、GaussDB、FunctionGraph、APIG、CCE、SMN/DMS、ModelArts、Cloud Eye、CTS、DEW、Billing、CBR、WAF/AAD、DDS/DCS、Deployment、Getting Started）。
-
-浏览 [`skills/`](plugins/huaweicloud-core/skills/) 目录查看所有可用技能。
-
-### Rules 文件
-
-推荐的项目级配置文件，告诉 Agent 如何高效使用华为云——例如优先使用 MCP 服务器、发现可用技能、遵循最小权限 IAM 原则。
-
-详见 [`rules/huawei-agent-rules.md`](rules/huawei-agent-rules.md)。
-
-### MCP 服务器
-
-本地 MCP 服务器（`plugins/huaweicloud-core/src/mcp-server.mjs`）通过 Model Context Protocol 为 Agent 提供安全的 KooCLI 访问。
-
-- **安全优先执行** — 所有 `hcloud` 命令执行前自动分类（读/写/密钥），写操作需用户明确批准。
-- **输出脱敏** — 凭证形态的值（AK/SK、Token、密码）自动替换为 `***REDACTED***`。
-- **16 个结构化工具** — 技能搜索、CLI 检查、只读命令、区域发现、错误解释、Hook 风险检查等。
-- **零运行时依赖** — 纯 Node.js（>= 20），无需 npm install。
-
-详见 [MCP 工具表](#mcp-工具)。
+> **Prerequisites:** [KooCLI](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html) (`hcloud`) installed and authenticated. Node.js >= 20 required.
 
-## 安全模型
+## What It Does
 
-三层防御体系：
+- **Guided cloud operations** — agents get step-by-step guidance for 20+ Huawei Cloud services (ECS, OBS, VPC, RDS, GaussDB, FunctionGraph, APIG, CCE, and more)
+- **Safety-first execution** — all write operations require explicit user approval; credentials and secrets are automatically redacted from output
+- **Pre-execution risk checks** — public exposure, credential leaks, and destructive operations are caught before they run
+- **Regional awareness** — auto-discovers available regions and checks service availability before creating resources
 
-| 层级 | 机制 | 说明 |
-|------|------|------|
-| 技能层 | `SKILL.md` 流程文档 | 教会 Agent 正确的行为规则和安全用法 |
-| 钩子层 | `huaweicloud-safety.py` | PreToolUse Hook 阻断高风险工具调用 |
-| MCP 层 | `safety-policy.mjs` | Node.js 安全策略包装器，在所有 Agent 环境中强制执行 |
+## Supported Services
 
-详见 [`docs/safety-model.md`](docs/safety-model.md)。
+ECS, OBS, VPC, IAM, RDS, GaussDB, FunctionGraph, APIG, CCE, SMN/DMS, ModelArts, Cloud Eye, CTS, DEW, Billing, CBR, WAF/AAD, DDS/DCS, Deployment, and Getting Started guides.
 
-## MCP 工具
+## Documentation
 
-| 类别 | 工具 | 说明 |
-|------|------|------|
-| 知识发现 | `huaweicloud_search_docs` | 跨技能文件及文档全文搜索 |
-| 知识发现 | `huaweicloud_retrieve_skill` | 按名称加载完整技能内容及参考文件 |
-| 知识发现 | `huaweicloud_list_regions` | 列出可用华为云区域 |
-| 知识发现 | `huaweicloud_get_regional_availability` | 检查目标区域的服务可用性 |
-| CLI | `huaweicloud_check_cli` | 检查 KooCLI `hcloud` 是否已安装 |
-| CLI | `huaweicloud_plan_cli_command` | 分类计划命令（读/写/密钥）但不执行 |
-| CLI | `huaweicloud_list_operations` | 列出服务的可用 KooCLI 操作 |
-| CLI | `huaweicloud_run_readonly_command` | 执行只读命令并脱敏输出 |
-| CLI | `huaweicloud_run_approved_command` | 经用户明确批准后执行写命令 |
-| 安全 | `huaweicloud_show_profile_redacted` | 安全查看 KooCLI 配置（凭证脱敏） |
-| 安全 | `huaweicloud_hook_check_command` | 执行前检查 Shell/KooCLI 命令风险 |
-| 安全 | `huaweicloud_hook_check_artifacts` | 检查生成的代码、IaC、IAM/OBS 策略和配置文件风险 |
-| 安全 | `huaweicloud_hook_check_deploy_plan` | 检查沙箱、预览环境和云资源部署计划风险 |
-| 路由 | `huaweicloud_service_catalog` | 返回推荐的能力来源排序 |
-| 排错 | `huaweicloud_explain_error` | 解释错误码并建议诊断步骤 |
+- [Architecture](docs/architecture.md)
+- [Safety Model](docs/safety-model.md)
+- [Hook Rule Model](docs/hook-rule-model.md)
+- [Changelog](docs/CHANGELOG.md)
+- [KooCLI official docs](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html)
 
-## 文档
+## Contributors
 
-- [系统架构设计](docs/01-系统架构设计.md)
-- [核心技能设计](docs/02-核心技能设计.md)
-- [安全模型](docs/safety-model.md)
-- [KooCLI 官方文档](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html)
+<a href="https://github.com/huaweicloud/huaweicloud-devkit/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=huaweicloud/huaweicloud-devkit" />
+</a>
 
-## 许可证
+## License
 
-本项目基于 Apache-2.0 许可证发布。详见 [LICENSE](LICENSE)。
+This project is licensed under the Apache-2.0 License. See [LICENSE](LICENSE).

package/README.zh-CN.md

@@ -0,0 +1,115 @@
+# HuaweiCloud DevKit
+
+[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
+[![CI](https://github.com/huaweicloud/HuaweiCloud-Devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/HuaweiCloud-Devkit/actions/workflows/ci.yml)
+
+**中文 | [English](README.md)**
+
+帮助 AI 编码助手安全、准确地使用华为云——一站式集成云知识、CLI 工具和安全护栏。
+
+支持 OpenCode、Codex、码道（CodeArts Agent）、WorkBuddy。
+
+## 快速开始
+
+### OpenCode
+
+```bash
+npx --yes huaweicloud-devkit install
+```
+
+自动安装 DevKit。安装后**重启会话**。
+
+```bash
+npx --yes huaweicloud-devkit doctor   # 自检
+npx --yes huaweicloud-devkit status   # 查看状态
+npx --yes huaweicloud-devkit update   # 更新
+npx --yes huaweicloud-devkit uninstall # 卸载
+```
+
+### Codex
+
+```bash
+npx --yes huaweicloud-devkit install --target codex
+```
+
+> 需要先安装 Codex CLI。
+
+### CodeArts Agent（码道）
+
+```bash
+npx --yes huaweicloud-devkit install --target codearts
+```
+
+安装后**重启会话**。
+
+```bash
+npx --yes huaweicloud-devkit install-hcloud   # 安装 KooCLI
+npx --yes huaweicloud-devkit doctor           # 自检
+npx --yes huaweicloud-devkit status --target codearts
+npx --yes huaweicloud-devkit uninstall --target codearts
+```
+
+> **沙箱模式**：码道默认沙箱模式会阻止 KooCLI 运行。`install-hcloud` 自动检测并给出指引——请在码道外终端安装使用 KooCLI，或在码道设置中关闭沙箱模式（设置 → 权限 → Bash 模式）。
+>
+> **认证**：执行 `hcloud configure init` 配置 AK/SK 与区域。
+
+### WorkBuddy
+
+```bash
+npx --yes huaweicloud-devkit install --target workbuddy
+```
+
+安装后**重启会话**。
+
+### 其他 Agent
+
+支持 MCP 协议的 Agent，手动配置：
+
+```json
+{
+  "mcp": {
+    "huaweicloud-devkit": {
+      "type": "local",
+      "command": ["node", "<路径>/plugins/huaweicloud-core/src/mcp-server.mjs"],
+      "enabled": true
+    }
+  }
+}
+```
+
+然后安装：
+
+```bash
+npx --yes huaweicloud-devkit install
+```
+
+> **前置条件：** 需要安装 [KooCLI](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html)（`hcloud`）并完成认证。Node.js >= 20。
+
+## 功能特性
+
+- **引导式云操作** — Agent 获得 20+ 华为云服务的分步操作指引（ECS、OBS、VPC、RDS、GaussDB、FunctionGraph、APIG、CCE 等）
+- **安全优先执行** — 所有写操作需用户明确批准；凭证和密钥自动脱敏
+- **执行前风险检查** — 公网暴露、凭证泄露、破坏性操作在执行前即被拦截
+- **区域感知** — 自动发现可用区域，创建资源前检查服务可用性
+
+## 支持的服务
+
+ECS、OBS、VPC、IAM、RDS、GaussDB、FunctionGraph、APIG、CCE、SMN/DMS、ModelArts、Cloud Eye、CTS、DEW、Billing、CBR、WAF/AAD、DDS/DCS、Deployment，以及入门指南。
+
+## 文档
+
+- [架构](docs/architecture.md)
+- [安全模型](docs/safety-model.md)
+- [Hook 规则模型](docs/hook-rule-model.md)
+- [变更记录](docs/CHANGELOG.md)
+- [KooCLI 官方文档](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html)
+
+## 贡献者
+
+<a href="https://github.com/huaweicloud/huaweicloud-devkit/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=huaweicloud/huaweicloud-devkit" />
+</a>
+
+## 许可证
+
+本项目基于 Apache-2.0 许可证发布。详见 [LICENSE](LICENSE)。

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "huaweicloud-devkit",
-    "version": "1.0.0",
+    "version": "1.0.2-dev.1",
     "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
     "type": "module",
     "files": [
@@ -32,6 +32,7 @@
         "agent",
         "codex",
         "opencode",
+        "workbuddy",
         "mcp",
         "koocli",
         "hcloud"

package/plugins/huaweicloud-core/.mcp.json

@@ -5,6 +5,7 @@
       "args": [
         "./src/mcp-server.mjs"
       ],
+      "cwd": ".",
       "env": {
         "HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local"
       }

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -0,0 +1,44 @@
+{
+  "name": "huaweicloud-core",
+  "version": "1.0.0",
+  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
+  "author": {
+    "name": "HuaweiCloud Mate",
+    "url": "https://github.com/huaweicloud"
+  },
+  "homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+  "repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+  "license": "Apache-2.0",
+  "keywords": [
+    "huaweicloud",
+    "huawei-cloud",
+    "koocli",
+    "hcloud",
+    "agent",
+    "mcp",
+    "api",
+    "sdk",
+    "skills"
+  ],
+  "skills": "./skills/",
+  "mcpServers": "./.mcp.json",
+  "hooks": "./hooks/",
+  "interface": {
+    "displayName": "HuaweiCloud Devkit",
+    "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
+    "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
+    "developerName": "HuaweiCloud Mate",
+    "category": "Cloud",
+    "capabilities": [
+      "Read",
+      "Interactive"
+    ],
+    "websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+    "brandColor": "#C7000B",
+    "defaultPrompt": [
+      "Help me choose the right Huawei Cloud capability.",
+      "Check my Huawei Cloud CLI setup safely.",
+      "Plan this Huawei Cloud API or SDK task."
+    ]
+  }
+}

package/plugins/huaweicloud-core/skills/huawei-apig/SKILL.md

@@ -54,14 +54,34 @@ Key gotchas when creating:
 
 ### Add Public Access (ELB Provider Only)
 
+`BASIC` instances have no public IP. Use `PROFESSIONAL` + `elb` provider for public access (`lvs` is internal-only).
+
 ```bash
 hcloud APIG AddIngressEipV2 \
   --instance_id=<id> \
   --bandwidth_charging_mode=bandwidth \
-  --bandwidth_size=5
+  --bandwidth_size=<size>
+```
+
+To use an existing EIP instead of creating a new one:
+
+```bash
+hcloud APIG AddIngressEipV2 \
+  --instance_id=<id> \
+  --eip_id=<existing-eip-id>
 ```
 
-> `AddIngressEipV2` only works with `elb` provider. `AddEipV2` requires `lvs` provider. Bandwidth minimum is 5 Mbps.
+> `AddIngressEipV2` only works with `elb` provider. `AddEipV2` (without "Ingress") requires `lvs` provider. Bandwidth minimum is 5 Mbps.
+
+**Verification** — After binding, poll the instance to confirm EIP is active:
+
+```bash
+hcloud APIG ListInstancesV2 --cli-region=<region> --instance_id=<id> --cli-output=json | jq '.instances[0].eip_address'
+```
+
+Wait for `eip_address` to show a valid IP (may take up to 2 minutes). If `eip_address` is still `null` after 2 minutes, the EIP may not have been assigned.
+
+> **Trap**: `sl_domain` from `CreateApiGroupV2` is an **internal-only** domain (e.g., `*.apic.cn-north-4.huaweicloudapis.com`). It may resolve to internal IP only (NXDOMAIN from public internet). **For public access, always use the `eip_address` from the instance**, not the `sl_domain` or trigger `invoke_url`.
 
 ## API Group
 

package/plugins/huaweicloud-core/skills/huawei-cloud-eye/SKILL.md

@@ -53,6 +53,23 @@ hcloud CES CreateAlarm --help
 # --condition.comparison_operator, --condition.count
 ```
 
+### `--condition.comparison_operator` Legal Values
+
+For metric alarms use **symbols** (NOT words like `gt`/`lt`):
+
+| Value | Meaning |
+|-------|---------|
+| `>` | Greater than |
+| `>=` | Greater than or equal |
+| `<` | Less than |
+| `<=` | Less than or equal |
+| `=` | Equal |
+| `!=` | Not equal |
+
+For event alarms: `cycle_decrease`, `cycle_increase`, `cycle_wave`.
+
+> **Trap**: Shell may interpret `>` and `<` as redirect operators. Always quote: `--condition.comparison_operator=">="` or use `--cli-jsonInput=<file>`.
+
 ## Troubleshooting
 
 | Error | Fix |

package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md

@@ -57,6 +57,7 @@ Flavor families are **region-dependent**. Always run `hcloud ECS ListFlavors --c
 | Security group rule | hcloud VPC CreateSecurityGroupRule --security_group_id=<id> --direction=<direction> --protocol=<protocol> | references/sg.md |
 | Attach disk | hcloud EVS AttachVolume --volume_id=<id> --server_id=<id> | references/evs.md |
 | Delete instance | hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true | references/create-instance.md |
+| Reboot instance | hcloud ECS BatchRebootServers --reboot.servers.1.id=<id> --reboot.type=SOFT | NOT `RebootServer` — that operation does not exist |
 
 ## How to Search for Instances
 
@@ -66,8 +67,57 @@ Flavor families are **region-dependent**. Always run `hcloud ECS ListFlavors --c
 2. Filter client-side by name substring, tag, or status
 3. Use `--server_tags` filter if instances are tagged: `hcloud ECS ListServersDetails --server_tags.1.key=Project`
 
+> **Return structure**: `ListServersDetails` returns `{"servers": [...]}` (array), NOT `{"server": ...}`. Parse as `.servers[0].status`, NOT `.server.status`.
+
 Abort if the result set is larger than `--limit` and ask the user to narrow the search.
 
+## Instance Status Polling
+
+ECS creation is asynchronous. Status transitions: `BUILD` → `ACTIVE` (or `ERROR`). Wait times vary widely (20s–3min), never use fixed sleep.
+
+Poll strategy:
+
+```bash
+for i in $(seq 1 30); do
+  status=$(hcloud ECS ListServersDetails --cli-region=<region> --server_id=<id> --cli-output=json | jq -r '.servers[0].status')
+  if [ "$status" = "ACTIVE" ]; then break; fi
+  if [ "$status" = "ERROR" ]; then echo "Creation failed"; exit 1; fi
+  sleep 10
+done
+```
+
+- Poll interval: 10 seconds
+- Maximum wait: 5 minutes (30 iterations)
+- Check for `ERROR` status to detect creation failures early
+
+## SSH Connection Verification
+
+After ECS is ACTIVE and EIP is bound, verify SSH connectivity:
+
+```bash
+hcloud ECS ListServersDetails --cli-region=<region> --server_id=<id>
+# → addresses.<vpc-id>[].OS-EXT-IPS:addr
+
+ssh -o StrictHostKeyChecking=accept-new -i <path-to-private-key> root@<eip-address>
+```
+
+> **SSH verification checklist**: EIP bound → security group has port 22 ingress → keypair private key saved locally → known_hosts handled with `StrictHostKeyChecking=accept-new` (or delete stale entries with `ssh-keygen -R <ip>`).
+
+### Running Commands Inside the Instance
+
+Use SSH for any in-instance operations (install software, check logs, start services):
+
+```bash
+ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'command'
+```
+
+Example — re-run failed cloud-init setup manually:
+```bash
+ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'dnf install -y nginx && systemctl enable --now nginx'
+```
+
+> If SCP blocks SSH, use cloud-init `--server.user_data` for full deployment instead. See `references/create-instance.md` §Bootstrap.
+
 ## Deleting Instances
 
 - Show the user the exact command and get explicit approval before running

package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md

@@ -61,6 +61,11 @@ hcloud ECS CreateServers ... --server.user_data=$user_data
 > **Security**: Never embed secrets (passwords, AK/SK, tokens) in user_data. It is stored unencrypted and readable from within the instance via IMDS. Fetch secrets at boot from DEW/CSMS instead.
 >
 > **Debugging**: If the script didn't run, check `/var/log/cloud-init-output.log` on the instance.
+>
+> **Recovery after failure**: user_data only executes on **first boot**. Restarting the instance will NOT re-run user_data scripts. If cloud-init fails (e.g., DNS missing → `yum`/`apt` cannot resolve repos):
+> 1. Fix the root cause (e.g., update subnet DNS via `VPC UpdateSubnet`)
+> 2. Either: SSH into the instance and run the setup commands manually (see `huawei-ecs` → SSH Connection Verification → Running Commands Inside the Instance)
+> 3. Or: Delete the instance and recreate with corrected user_data (fresh boot)
 
 ## 7. EIP (two methods)
 
@@ -91,8 +96,21 @@ hcloud EIP AssociatePublicips --publicip_id=<eip-id> --publicip.associate_instan
 ```
 
 ## 8. Verify
-hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>
-Expected: status=ACTIVE
+
+ECS creation is asynchronous. Wait times vary widely (20s to 3min). Status transitions: `BUILD` → `ACTIVE` (or `ERROR`). Never use fixed sleep — poll actively:
+
+```bash
+for i in $(seq 1 30); do
+  status=$(hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id> --cli-output=json | jq -r '.servers[0].status')
+  if [ "$status" = "ACTIVE" ]; then break; fi
+  if [ "$status" = "ERROR" ]; then echo "Creation failed"; exit 1; fi
+  sleep 10
+done
+```
+
+- Poll interval: 10 seconds
+- Maximum wait: 5 minutes (30 iterations)
+- After ACTIVE, confirm once more: `hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>`
 
 ### Verify HTTP accessibility (if EIP bound)
 

package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md

@@ -31,7 +31,7 @@ Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/ob
 
 | Trap | Why |
 |------|-----|
-| Bucket name is global | All users share bucket namespace |
+| Bucket name is global | All users share bucket namespace. Always use a unique name: `{prefix}-{timestamp}` (e.g. `mybucket-20260810155048`) |
 | Three-layer permissions | IAM > Bucket Policy > ACL. Most restrictive wins |
 | Versioning is irreversible | Once enabled, cannot be disabled, only suspended |
 | OBS uses AK/SK directly | NOT IAM tokens. Auth errors mean check AK/SK validity |
@@ -42,7 +42,17 @@ Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/ob
 
 ## OBS Credential Setup (Required Before First Use)
 
-KooCLI OBS uses a separate config file (`~/.obsutilconfig`), NOT `~/.hcloud/config.json`. Call `huaweicloud_setup_obs_config` to automatically sync credentials from the active hcloud profile. No manual AK/SK entry needed.
+KooCLI OBS uses a separate config file (`~/.obsutilconfig`), NOT `~/.hcloud/config.json`. All OBS commands fail with credential errors until this is configured.
+
+**In-session bootstrap (recommended)**: Call `huaweicloud_setup_obs_config` — it syncs AK/SK from the active hcloud profile automatically. No manual key entry needed. Run this once per session before any OBS command.
+
+**CLI fallback** (if MCP tools unavailable):
+
+```bash
+hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK> -t=token
+```
+
+> `huaweicloud_setup_obs_config` should be called at the start of every OBS task — never assume credentials are pre-configured from a previous session.
 
 ## Common Workflows
 
@@ -69,6 +79,13 @@ Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Con
 
 > KooCLI OBS does NOT support `SetBucketWebsite`. Configure static website hosting via REST API (`PUT /?website`) or the Huawei Cloud console.
 
+## Single-File Quick Share
+
+See `references/single-file-share.md` for the full workflow to host one file and get a shareable link in seconds:
+
+- **Private, time-limited**: `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>` (max 7 days)
+- **Public, permanent**: `hcloud OBS cp <file> obs://<bucket>/<key> -f` + `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read`, then share `https://<bucket>.obs.<region>.myhuaweicloud.com/<key>`
+
 ## Storage Classes
 
 | Class | Use Case | Min Storage | Retrieval Fee |
@@ -82,7 +99,7 @@ Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Con
 | Error | Root Cause -> Fix |
 |-------|------------------|
 | AccessDenied on bucket | IAM/bucket policy/ACL conflict -> Check all three layers |
-| BucketAlreadyExists | Name taken globally -> Choose different name |
+| BucketAlreadyExists | Name taken globally -> Generate unique name with timestamp suffix: `{prefix}-{yyyymmddHHMMSS}` |
 | NoSuchKey | Object doesn't exist or wrong region -> Verify key and region |
 | InvalidAccessKeyId | OBS uses AK/SK directly -> Verify AK/SK validity, OBS endpoint, OBS permissions |
 | EntityTooLarge | Single PUT limit 5GB -> Use multipart upload |
@@ -105,5 +122,6 @@ Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Con
 
 - OBS Docs: https://support.huaweicloud.com/obs/
 - Static website: references/static-website.md
+- Single-file share: references/single-file-share.md
 - Lifecycle: references/bucket-lifecycle.md
 - Replication: references/replication.md

package/plugins/huaweicloud-core/skills/huawei-obs/references/single-file-share.md

@@ -0,0 +1,40 @@
+# OBS Single-File Quick Share
+
+Host one file and get a shareable link in seconds. Two options:
+
+| Option | Link type | Bucket/object visibility | Expiry |
+|--------|-----------|--------------------------|--------|
+| Presigned URL | Time-limited private link | Keep private | `-e=<seconds>`, max 7 days |
+| Public URL | Permanent public link | Set object `-acl=public-read` | None |
+
+## Option 1: Presigned URL (private, time-limited)
+
+No ACL change needed. The object stays private; the link grants temporary access.
+
+```bash
+hcloud OBS cp <file> obs://<bucket>/<key> -f
+hcloud OBS sign obs://<bucket>/<key> -e=3600   # valid 1 hour, max 604800 (7 days)
+```
+
+The `sign` command prints the full presigned URL directly — share it as-is.
+
+## Option 2: Public URL (permanent, public-read)
+
+```bash
+hcloud OBS cp <file> obs://<bucket>/<key> -f
+hcloud OBS chattri obs://<bucket>/<key> -acl=public-read
+```
+
+The shareable public URL follows the OBS endpoint format (NOT the `obs-website` static-site endpoint):
+
+```
+https://<bucket>.obs.<region>.myhuaweicloud.com/<key>
+```
+
+## Key Gotchas
+
+- **Bucket ACL does NOT cascade**: `chattri obs://<bucket> -acl=public-read` alone does not make objects public. Set the object-level ACL explicitly.
+- **`-f` is mandatory**: `cp` without `-f` prompts "Please input (y/n)" on overwrite → agent hangs (TIMEOUT).
+- **Public-read means anyone with the link can access**: use presigned URLs when the file is sensitive.
+- **Presigned URL max expiry is 7 days** (`-e=604800`). For longer-lived public access, use the public-read option.
+- **Credential setup**: OBS uses a separate config (`~/.obsutilconfig`). Call `huaweicloud_setup_obs_config` before first use.

package/plugins/huaweicloud-core/skills/huawei-rds/SKILL.md

@@ -29,7 +29,7 @@ hcloud RDS <Operation> --cli-region=<region> [--key=value ...]
 | Operation | PascalCase: `ListInstances`, `CreateManualBackup` |
 | Params | `--key=value` format. JSON params: `--key='{"k":"v"}'` |
 | Array params | 1-based: `--instance_ids.1=xxx` |
-| Password param | Conflicts with KooCLI system param; pipe `echo \|` to bypass |
+| Password param | Conflicts with KooCLI system param; use `--cli-jsonInput` (see Critical Warnings) |
 
 ## Critical Warnings
 
@@ -38,9 +38,12 @@ hcloud RDS <Operation> --cli-region=<region> [--key=value ...]
 | Engine version immutable | Cannot change MySQL to PostgreSQL in-place |
 | Automated backups use OBS | Backup storage incurs separate charges. Set retention period explicitly |
 | Storage auto-scaling off by default | Enable before storage runs out or instance goes read-only |
-| `--password` conflicts with KooCLI | Non-interactive: `printf "b\n" \| hcloud RDS CreateInstance ...` to select API param. Or use `--cli-jsonInput` |
+| `--password` conflicts with KooCLI | Use `--cli-jsonInput=<file>` with JSON file (see `--cli-jsonInput` section below). The `printf "b\n"` workaround is broken in KooCLI 7.2.12+ |
 | Volume type must match flavor | General→CLOUDSSD; Dedicated→CLOUDSSD\|ESSD; ARM→ULTRAHIGH |
 | Flavor not in region | Always `ListFlavors` first. Spec codes vary by region |
+| `database_name` is case-sensitive | Use `MySQL` / `PostgreSQL` / `SQLServer` / `MariaDB` — NOT lower-case `mysql` |
+| Instance creation takes 3–8 min | Status: BUILD→MODIFYING→ACTIVE. Poll every 15s: `hcloud RDS ListInstances --cli-region=<r> --instance_id=<id> \| jq '.instances[0].status'` |
+| Body `--region` is required | CreateInstance body requires `--region=<r>` (same as `--cli-region`) or `DBS.280243` |
 | Restore creates new instance | No in-place restore. Verify target flavor before restoring |
 
 ## Instance Management
@@ -56,6 +59,7 @@ hcloud RDS ListEngineFlavors --instance_id=<id> --cli-region=<r>
 ### Create Instance
 ```bash
 hcloud RDS CreateInstance --cli-region=<r> \
+  --region=<r> \
   --name=<name> \
   --datastore.type=<engine> \
   --datastore.version=<version> \
@@ -66,11 +70,36 @@ hcloud RDS CreateInstance --cli-region=<r> \
   --subnet_id=<subnet-id> \
   --security_group_id=<sg-id> \
   --availability_zone=<az> \
-  --charge_info.charge_mode=<mode> \
-  --password=<pw>
+  --charge_info.charge_mode=<mode>
 ```
 
-> `--password` conflicts with a KooCLI system param. Pipe `echo "b\n" |` before the command or use `--cli-jsonInput` (see Critical Warnings).
+> `--password` conflicts with a KooCLI system param. Use `--cli-jsonInput` (see below). The `printf "b\n"` pipe workaround is broken in KooCLI 7.2.12+.
+
+### `--cli-jsonInput` for CreateInstance
+
+```json
+{
+  "path": {
+    "project_id": "<project-id>"
+  },
+  "body": {
+    "name": "<name>",
+    "region": "<region>",
+    "datastore": { "type": "<engine>", "version": "<version>" },
+    "ha": { "mode": "single", "replication_mode": "semisync" },
+    "flavor_ref": "<flavor-id>",
+    "volume": { "type": "<vol-type>", "size": <gb> },
+    "vpc_id": "<vpc-id>",
+    "subnet_id": "<subnet-id>",
+    "security_group_id": "<sg-id>",
+    "availability_zone": "<az>",
+    "password": "<pw>",
+    "charge_info": { "charge_mode": "postPaid" }
+  }
+}
+```
+
+> Save as `rds-create.json` then: `hcloud RDS CreateInstance --cli-jsonInput=rds-create.json`. For `project_id`, run `hcloud IAM KeystoneListProjects`.
 
 | Param | Required | Note |
 |-------|----------|------|
@@ -139,6 +168,20 @@ psql -h <private_ip> -p 5432 -U root -d postgres
 > hcloud does NOT support SQL execution. Use a database client.
 > For public access, bind an EIP (see `huawei-vpc`).
 
+### Database Client Acquisition
+
+If a database client is not installed on the agent's machine, install one:
+
+| Platform | MySQL | PostgreSQL |
+|----------|-------|------------|
+| **Linux** | `apt install mysql-client` / `yum install mysql` | `apt install postgresql-client` |
+| **macOS** | `brew install mysql-client` | `brew install libpq` |
+| **Windows** | Download MySQL Workbench or `winget install Oracle.MySQL` | Download pgAdmin or `winget install PostgreSQL.PostgreSQL` |
+| **Python (any)** | `pip install pymysql` then `python -c "import pymysql; ..."` | `pip install psycopg2` then `python -c "import psycopg2; ..."` |
+| **Docker (any)** | `docker run -it --rm mysql:8 mysql -h <ip> -u root -p` | `docker run -it --rm postgres:16 psql -h <ip> -U root` |
+
+> If no client can be installed, use the Huawei Cloud **Data Studio** console: https://console.huaweicloud.com/dms/
+
 ## Mutating Operations (Require Approval)
 
 | Operation | Effect |

package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md

@@ -28,15 +28,17 @@ Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet
 | EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required |
 | **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |
 | **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |
-| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. See `--help` for region-specific DNS IPs |
+| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS IPs: cn-north-4 (100.125.1.250 / 100.125.1.251), cn-north-1 (100.125.1.250 / 100.125.129.250), cn-east-3 (100.125.1.250 / 100.125.129.250), ap-southeast-3 (100.125.1.250 / 100.125.128.250) |
 | SCP blocks 0.0.0.0/0 SG rules | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead |
+| **VPC tags use `*` separator** | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value` |
 
 ## Common Workflows
 
 | Task | Command | Steps |
 |------|---------|-------|
 | Create VPC | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr> | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first |
-| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see `hcloud VPC CreateSubnet --help` |
+| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
+| Update subnet | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2> | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes |
 | Security group | hcloud VPC CreateSecurityGroup --security_group.name=<name> | references/security-group.md |
 | SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |
 | Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |
@@ -58,6 +60,7 @@ Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet
 | VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |
 | EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
 | ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help` |
+| VPC.0209: Subnet still used | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet |
 | SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |
 
 ## Security Considerations

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -40,7 +40,7 @@ function opencodeConfigFile() {
 function codexDesktopSkillsDir() { return join(homedir(), '.agents', 'skills'); }
 function codexDesktopCommandsDir() { return join(homedir(), '.agents', 'commands'); }
 function codexDesktopPluginsDir() { return join(homedir(), '.agents', 'huaweicloud-plugins'); }
-function codexDesktopConfigFile() { return join(homedir(), '.agents', 'opencode.json'); }
+function codexConfigToml() { return join(homedir(), '.codex', 'config.toml'); }
 
 function codeartsSkillsDir() { return join(homedir(), '.codeartsdoer', 'skills'); }
 function codeartsMcpSettingsDir() { return join(homedir(), '.codeartsdoer', 'mcp'); }
@@ -50,6 +50,10 @@ function codeartsProjectSkillsDir() { return join(codeartsProjectDir(), 'skills'
 function codeartsProjectMcpSettingsFile() { return join(codeartsProjectDir(), 'mcp', 'mcp_settings.json'); }
 function codeartsPluginsDir() { return join(homedir(), '.codeartsdoer', 'huaweicloud-plugins'); }
 
+function workbuddySkillsDir() { return join(homedir(), '.workbuddy', 'skills'); }
+function workbuddyMcpConfigFile() { return join(homedir(), '.workbuddy', 'mcp.json'); }
+function workbuddyPluginsDir() { return join(homedir(), '.workbuddy', 'huaweicloud-plugins'); }
+
 // Detect CodeArts sandbox mode (bash_mode in permission config).
 function detectCodeartsSandbox() {
   try {
@@ -110,8 +114,13 @@ function copyDir(src, dest) {
 
 function removeIfExists(p) {
   if (existsSync(p)) {
-    rmSync(p, { recursive: true, force: true });
-    return true;
+    try {
+      rmSync(p, { recursive: true, force: true });
+      return true;
+    } catch (e) {
+      console.log(`  \x1b[33m[WARN]\x1b[0m Could not remove ${p}: ${e.message}`);
+      return false;
+    }
   }
   return false;
 }
@@ -221,6 +230,14 @@ function uninstallCodex() {
     shell: true, windowsHide: true, stdio: 'pipe',
   });
   console.log(`  ${r.stdout ? r.stdout.toString().trim() : r.stderr.toString().trim()}`);
+
+  for (const name of new Set([marketplaceName, 'HuaweiCloud-Devkit'])) {
+    console.log(`  Removing Codex marketplace: ${name}`);
+    const r2 = spawnSync(`codex plugin marketplace remove "${name}"`, [], {
+      shell: true, windowsHide: true, stdio: 'pipe',
+    });
+    console.log(`  ${r2.stdout ? r2.stdout.toString().trim() : r2.stderr.toString().trim()}`);
+  }
 }
 
 function codexStatus() {
@@ -317,18 +334,27 @@ async function installCodexDesktop() {
   }
 
   const mcpPath = join(codexDesktopPluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
-  const configPath = codexDesktopConfigFile();
-  let config = {};
+  const configPath = codexConfigToml();
+  const section = [
+    '[mcp_servers.huaweicloud-devkit]',
+    'command = "node"',
+    `args = ["${mcpPath}"]`,
+    '',
+    '[mcp_servers.huaweicloud-devkit.env]',
+    'HUAWEICLOUD_AGENT_TOOLKIT_MODE = "local"',
+    '',
+  ].join('\n');
+  let existing = '';
   if (existsSync(configPath)) {
-    try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
+    try { existing = readFileSync(configPath, 'utf8'); } catch {}
+    if (existing.includes('[mcp_servers.huaweicloud-devkit]')) {
+      console.log(`  Config already configured: ${configPath}`);
+      return;
+    }
   }
-  config.mcp = config.mcp || {};
-  config.mcp['huaweicloud-devkit'] = {
-    type: 'local',
-    command: ['node', mcpPath],
-    enabled: true,
-  };
-  writeFileSync(configPath, JSON.stringify(config, null, 2));
+  mkdirSync(dirname(configPath), { recursive: true });
+  if (existing && !existing.endsWith('\n')) existing += '\n';
+  writeFileSync(configPath, existing + section);
   console.log(`  Config updated: ${configPath}`);
 }
 
@@ -360,16 +386,19 @@ function uninstallCodexDesktop() {
   if (removeIfExists(codexDesktopPluginsDir())) {
     console.log('  Removed MCP server and safety policy');
   }
-  const configPath = codexDesktopConfigFile();
+  const configPath = codexConfigToml();
   if (existsSync(configPath)) {
-    let config = {};
-    try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
-    if (config.mcp?.['huaweicloud-devkit']) {
-      delete config.mcp['huaweicloud-devkit'];
-      if (Object.keys(config.mcp).length === 0) delete config.mcp;
-      writeFileSync(configPath, JSON.stringify(config, null, 2));
-      console.log('  Config cleaned');
+    const lines = readFileSync(configPath, 'utf8').split(/\r?\n/);
+    const out = [];
+    let skip = false;
+    for (const line of lines) {
+      if (/^\[mcp_servers\.huaweicloud-devkit(\]|\.)/.test(line)) { skip = true; continue; }
+      if (skip && line.startsWith('[')) skip = false;
+      if (!skip) out.push(line);
     }
+    while (out.length > 0 && out[out.length - 1].trim() === '') out.pop();
+    writeFileSync(configPath, out.join('\n') + (out.length > 0 ? '\n' : ''));
+    console.log('  Config cleaned');
   }
 }
 
@@ -463,6 +492,93 @@ function codeartsStatus() {
   }
 }
 
+async function installWorkBuddy() {
+  const skillsSrc = join(PLUGIN_ROOT, 'skills');
+  const srcDir = join(PLUGIN_ROOT, 'src');
+  const safetyDir = join(PLUGIN_ROOT, 'safety');
+  const pluginDest = workbuddyPluginsDir();
+
+  copyDir(skillsSrc, workbuddySkillsDir());
+  console.log(`  Skills -> ${workbuddySkillsDir()}`);
+
+  copyDir(srcDir, join(pluginDest, 'src'));
+  console.log(`  MCP Server -> ${join(pluginDest, 'src')}`);
+  copyDir(safetyDir, join(pluginDest, 'safety'));
+  console.log(`  Safety Policy -> ${join(pluginDest, 'safety')}`);
+
+  // Write MCP config to ~/.workbuddy/mcp.json
+  const mcpPath = join(pluginDest, 'src', 'mcp-server.mjs').replace(/\\/g, '/');
+  const configPath = workbuddyMcpConfigFile();
+  let config = {};
+  if (existsSync(configPath)) {
+    try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
+  }
+  const env = { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' };
+  const hcloudBin = findHcloudBin();
+  if (hcloudBin) env.HCLOUD_BIN = hcloudBin.replace(/\\/g, '/');
+  config.mcpServers = config.mcpServers || {};
+  config.mcpServers['huaweicloud-devkit'] = {
+    command: 'node',
+    args: [mcpPath],
+    env,
+  };
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(configPath, JSON.stringify(config, null, 2));
+  console.log(`  MCP config updated: ${configPath}`);
+}
+
+function uninstallWorkBuddy() {
+  const skillsDir = workbuddySkillsDir();
+  let removed = 0;
+  if (existsSync(skillsDir)) {
+    for (const entry of readdirSync(skillsDir, { withFileTypes: true })) {
+      if (entry.name.startsWith('huawei')) {
+        removeIfExists(join(skillsDir, entry.name));
+        removed++;
+      }
+    }
+    if (removed > 0) console.log(`  Removed ${removed} skills`);
+  }
+
+  if (removeIfExists(workbuddyPluginsDir())) {
+    console.log('  Removed MCP server and safety policy');
+  }
+
+  const configPath = workbuddyMcpConfigFile();
+  if (existsSync(configPath)) {
+    let config = {};
+    try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
+    if (config.mcpServers?.['huaweicloud-devkit']) {
+      delete config.mcpServers['huaweicloud-devkit'];
+      if (Object.keys(config.mcpServers).length === 0) delete config.mcpServers;
+      writeFileSync(configPath, JSON.stringify(config, null, 2));
+      console.log(`  MCP config cleaned: ${configPath}`);
+    }
+  }
+}
+
+function workbuddyStatus() {
+  const pluginDir = workbuddyPluginsDir();
+  const skillsDir = workbuddySkillsDir();
+  console.log(`  MCP Server: ${existsSync(join(pluginDir, 'src', 'mcp-server.mjs')) ? '\x1b[32mInstalled\x1b[0m' : '\x1b[31mNot installed\x1b[0m'}`);
+  console.log(`  Safety Policy: ${existsSync(join(pluginDir, 'safety', 'policy.json')) ? '\x1b[32mInstalled\x1b[0m' : '\x1b[31mNot installed\x1b[0m'}`);
+  let skillCount = 0;
+  if (existsSync(skillsDir)) {
+    skillCount = readdirSync(skillsDir, { withFileTypes: true })
+      .filter((d) => d.isDirectory() && d.name.startsWith('huawei')).length;
+  }
+  console.log(`  Skills: ${skillCount > 0 ? `\x1b[32m${skillCount} installed\x1b[0m` : '\x1b[31mNot installed\x1b[0m'}`);
+  const configPath = workbuddyMcpConfigFile();
+  if (existsSync(configPath)) {
+    try {
+      const config = JSON.parse(readFileSync(configPath, 'utf8'));
+      console.log(`  MCP config: ${config.mcpServers?.['huaweicloud-devkit'] ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`);
+    } catch {
+      console.log(`  MCP config: \x1b[31mInvalid\x1b[0m`);
+    }
+  }
+}
+
 function opencodeStatus() {
   const pluginDir = opencodePluginsDir();
   const skillsDir = opencodeSkillsDir();
@@ -492,6 +608,7 @@ function parseTarget() {
   if (val === 'codex') return 'codex';
   if (val === 'codex-desktop') return 'codex-desktop';
   if (val === 'codearts') return 'codearts';
+  if (val === 'workbuddy') return 'workbuddy';
   if (val === 'all') return 'all';
   return 'opencode';
 }
@@ -514,6 +631,10 @@ async function cmdInstall() {
     console.log('\n[CodeArts]');
     await installCodeArts();
   }
+  if (target === 'workbuddy' || target === 'all') {
+    console.log('\n[WorkBuddy]');
+    await installWorkBuddy();
+  }
   if (target === 'codex' || target === 'all') {
     console.log('\n[Codex]');
     if (!hasCodexCLI()) {
@@ -539,7 +660,9 @@ async function cmdInstall() {
   }  console.log(`\n\x1b[32mInstallation complete!\x1b[0m`);
   const appName = target === 'codearts' ? 'CodeArts'
     : target === 'codex-desktop' ? 'Codex Desktop'
-    : target === 'codex' ? 'Codex' : 'OpenCode';
+    : target === 'codex' ? 'Codex'
+    : target === 'workbuddy' ? 'WorkBuddy'
+    : 'OpenCode';
   const pad = ' '.repeat(24 - appName.length);
   console.log(`\n\x1b[1m\x1b[33m╔══════════════════════════════════════════════════════╗`);
   console.log(`\x1b[1m\x1b[33m║  MCP 工具在重启 ${appName} 会话后才生效${pad}║`);
@@ -558,7 +681,11 @@ async function cmdInstall() {
   console.log(`\nAfter restart + hcloud setup, run: npx huaweicloud-devkit doctor`);
 
   // Write install marker for doctor to detect
-  const markerDir = target === 'codearts' ? codeartsPluginsDir() : opencodePluginsDir();
+  const markerDir = target === 'codearts' ? codeartsPluginsDir()
+    : target === 'workbuddy' ? workbuddyPluginsDir()
+    : target === 'codex-desktop' ? codexDesktopPluginsDir()
+    : opencodePluginsDir();
+  mkdirSync(markerDir, { recursive: true });
   writeFileSync(join(markerDir, '.installed'), new Date().toISOString());
   if (target === 'opencode' || target === 'all') {
     console.log('Or describe your Huawei Cloud task in OpenCode');
@@ -569,6 +696,9 @@ async function cmdInstall() {
   if (target === 'codex' || target === 'all') {
     console.log('Or mention @huaweicloud-core in Codex');
   }
+  if (target === 'workbuddy' || target === 'all') {
+    console.log('Or describe your Huawei Cloud task in WorkBuddy');
+  }
 }
 
 async function cmdUninstall() {
@@ -584,13 +714,19 @@ async function cmdUninstall() {
     console.log('\n[CodeArts]');
     uninstallCodeArts();
   }
-  if (target === 'codex' || target === 'all') {
+  if (target === 'workbuddy' || target === 'all') {
+    console.log('\n[WorkBuddy]');
+    uninstallWorkBuddy();
+  }
+  if (target === 'codex-desktop' || target === 'codex' || target === 'all') {
     console.log('\n[Codex]');
     uninstallCodexDesktop();
-    if (!hasCodexCLI()) {
-      console.log('  \x1b[33mCodex CLI not found. Run "npm uninstall -g codex" to fully remove.\x1b[0m');
-    } else {
-      uninstallCodex();
+    if (target === 'codex' || target === 'all') {
+      if (!hasCodexCLI()) {
+        console.log('  \x1b[33mCodex CLI not found. Run "npm uninstall -g codex" to fully remove.\x1b[0m');
+      } else {
+        uninstallCodex();
+      }
     }
   }
   console.log(`\n\x1b[32mUninstall complete.\x1b[0m`);
@@ -609,6 +745,10 @@ async function cmdStatus() {
     console.log('\n[CodeArts]');
     codeartsStatus();
   }
+  if (target === 'workbuddy' || target === 'all') {
+    console.log('\n[WorkBuddy]');
+    workbuddyStatus();
+  }
   if (target === 'codex' || target === 'all') {
     console.log('\n[Codex]');
     if (!hasCodexCLI()) {
@@ -636,13 +776,16 @@ async function cmdDoctor() {
   // Node.js
   check('Node.js >= 20', process.versions.node.split('.')[0] >= 20, 'Run: nvm install 20 && nvm use 20');
 
-    // MCP server — check OpenCode and Codex Desktop paths
+    // MCP server — check OpenCode, Codex Desktop, CodeArts, and WorkBuddy paths
   const opencodePluginDir = opencodePluginsDir();
   const codexPluginDir = codexDesktopPluginsDir();
+  const workbuddyPluginDir = workbuddyPluginsDir();
   const mcpOk = existsSync(join(opencodePluginDir, 'src', 'mcp-server.mjs'))
-    || existsSync(join(codexPluginDir, 'src', 'mcp-server.mjs'));
+    || existsSync(join(codexPluginDir, 'src', 'mcp-server.mjs'))
+    || existsSync(join(workbuddyPluginDir, 'src', 'mcp-server.mjs'));
   const mcpTarget = existsSync(join(opencodePluginDir, 'src', 'mcp-server.mjs')) ? 'OpenCode'
-    : existsSync(join(codexPluginDir, 'src', 'mcp-server.mjs')) ? 'Codex Desktop' : '';
+    : existsSync(join(codexPluginDir, 'src', 'mcp-server.mjs')) ? 'Codex Desktop'
+    : existsSync(join(workbuddyPluginDir, 'src', 'mcp-server.mjs')) ? 'WorkBuddy' : '';
   check('MCP server installed', mcpOk, 'Run: npx huaweicloud-devkit install');
 
   if (mcpOk) {
@@ -650,10 +793,11 @@ async function cmdDoctor() {
   }
 
   const safetyOk = existsSync(join(opencodePluginDir, 'safety', 'policy.json'))
-    || existsSync(join(codexPluginDir, 'safety', 'policy.json'));
+    || existsSync(join(codexPluginDir, 'safety', 'policy.json'))
+    || existsSync(join(workbuddyPluginDir, 'safety', 'policy.json'));
   check('Safety policy installed', safetyOk, 'Run: npx huaweicloud-devkit install');
 
-  // MCP config — check OpenCode and Codex Desktop
+  // MCP config — check OpenCode, Codex Desktop, and WorkBuddy
   let mcpConfigured = false;
   let mcpCfgTarget = '';
   const opencodeCfg = opencodeConfigFile();
@@ -663,11 +807,18 @@ async function cmdDoctor() {
       if (cfg.mcp && cfg.mcp['huaweicloud-devkit']) { mcpConfigured = true; mcpCfgTarget = 'OpenCode'; }
     } catch {}
   }
-  const codexCfg = codexDesktopConfigFile();
+  const codexCfg = codexConfigToml();
   if (!mcpConfigured && existsSync(codexCfg)) {
     try {
-      const cfg = JSON.parse(readFileSync(codexCfg, 'utf8'));
-      if (cfg.mcp && cfg.mcp['huaweicloud-devkit']) { mcpConfigured = true; mcpCfgTarget = 'Codex Desktop'; }
+      const cfg = readFileSync(codexCfg, 'utf8');
+      if (cfg.includes('[mcp_servers.huaweicloud-devkit]')) { mcpConfigured = true; mcpCfgTarget = 'Codex Desktop'; }
+    } catch {}
+  }
+  const workbuddyCfg = workbuddyMcpConfigFile();
+  if (!mcpConfigured && existsSync(workbuddyCfg)) {
+    try {
+      const cfg = JSON.parse(readFileSync(workbuddyCfg, 'utf8'));
+      if (cfg.mcpServers && cfg.mcpServers['huaweicloud-devkit']) { mcpConfigured = true; mcpCfgTarget = 'WorkBuddy'; }
     } catch {}
   }
   check('MCP configured', mcpConfigured, mcpCfgTarget ? `Found in ${mcpCfgTarget} config` : 'Run: npx huaweicloud-devkit install');
@@ -699,36 +850,52 @@ async function cmdDoctor() {
   }
 
   // Skills
-  const skillsOptions = [opencodeSkillsDir(), codexDesktopSkillsDir(), codeartsSkillsDir()];
-  let skillCount = 0, skillsDir = '';
+  const skillsOptions = [opencodeSkillsDir(), codexDesktopSkillsDir(), codeartsSkillsDir(), workbuddySkillsDir()];
+  let skillCount = 0, skillsDir = '', missingSkills = [];
   for (const dir of skillsOptions) {
     if (!existsSync(dir)) continue;
-    const count = readdirSync(dir, { withFileTypes: true })
-      .filter((d) => d.isDirectory() && d.name.startsWith('huawei')).length;
+    const entries = readdirSync(dir, { withFileTypes: true })
+      .filter((d) => d.isDirectory() && d.name.startsWith('huawei'));
+    const count = entries.length;
     if (count > skillCount) { skillCount = count; skillsDir = dir; }
+    for (const d of entries) {
+      if (!existsSync(join(dir, d.name, 'SKILL.md'))) missingSkills.push(d.name);
+    }
   }
   const skillsOk = skillCount >= 6;
-  check(`Skills installed (${skillCount})`, skillsOk, 'Run: npx huaweicloud-devkit-test install');
+  check(`Skills installed (${skillCount})`, skillsOk, 'Run: npx huaweicloud-devkit install');
+  if (missingSkills.length > 0) {
+    console.log(`  \x1b[33m[WARN]\x1b[0m ${missingSkills.length} skill(s) missing SKILL.md: ${missingSkills.join(', ')} — Run: npx huaweicloud-devkit install`);
+    warn++;
+  }
 
   console.log(`\nResults: ${pass} pass, ${warn} warn, ${fail} fail`);
 
   if (mcpConfigured && !hcloudOk) {
-    console.log('\n\x1b[33mMCP is configured but hcloud is not installed. Install hcloud then restart OpenCode.\x1b[0m');
+    console.log('\n\x1b[33mMCP is configured but hcloud is not installed. Install hcloud then restart your session.\x1b[0m');
   }
   if (fail > 0) {
-    console.log('\x1b[33mFix failures above, then restart your OpenCode / Codex session.\x1b[0m');
+    console.log('\x1b[33mFix failures above, then restart your session.\x1b[0m');
   }
   if (fail === 0 && mcpConfigured) {
-    console.log('\n\x1b[32mAll checks passed.\x1b[0m Restart OpenCode, then describe your Huawei Cloud task');
+    console.log('\n\x1b[32mAll checks passed.\x1b[0m Restart your session, then describe your Huawei Cloud task');
   }
 
-  // Detect "installed but not restarted" scenario
-  const installedMarker = join(opencodePluginsDir(), '.installed');
-  if (mcpConfigured && existsSync(installedMarker)) {
-    console.log(`\n\x1b[1m\x1b[31m╔══════════════════════════════════════════╗`);
-    console.log(`\x1b[1m\x1b[31m║  请重启 OpenCode！MCP 工具尚未激活       ║`);
-    console.log(`\x1b[1m\x1b[31m║  关闭当前会话 → 重新打开即可             ║`);
-    console.log(`\x1b[1m\x1b[31m╚══════════════════════════════════════════╝\x1b[0m`);
+  // Detect "installed but not restarted" — check all supported agents
+  const installedMarkers = [
+    { path: join(opencodePluginsDir(), '.installed'), name: 'OpenCode' },
+    { path: join(codexDesktopPluginsDir(), '.installed'), name: 'Codex Desktop' },
+    { path: join(workbuddyPluginsDir(), '.installed'), name: 'WorkBuddy' },
+    { path: join(codeartsPluginsDir(), '.installed'), name: 'CodeArts' },
+  ];
+  for (const marker of installedMarkers) {
+    if (existsSync(marker.path)) {
+      console.log(`\n\x1b[1m\x1b[31m╔══════════════════════════════════════════╗`);
+      console.log(`\x1b[1m\x1b[31m║  请重启 ${marker.name}！MCP 工具尚未激活     ║`);
+      console.log(`\x1b[1m\x1b[31m║  关闭当前会话 → 重新打开即可             ║`);
+      console.log(`\x1b[1m\x1b[31m╚══════════════════════════════════════════╝\x1b[0m`);
+      break;
+    }
   }
 }
 
@@ -737,7 +904,9 @@ async function cmdUpdate() {
   const target = parseTarget();
 
   if (target === 'opencode' || target === 'all') {
-    if (!existsSync(join(opencodePluginsDir(), 'src', 'mcp-server.mjs')) && !codexStatus()) {
+    if (!existsSync(join(opencodePluginsDir(), 'src', 'mcp-server.mjs'))
+        && !existsSync(join(workbuddyPluginsDir(), 'src', 'mcp-server.mjs'))
+        && !codexStatus()) {
       console.log('\x1b[33mNot installed. Use "install" command first.\x1b[0m');
       return;
     }
@@ -908,7 +1077,7 @@ async function main() {
     case '-h':
     default:
       console.log(BANNER);
-      console.log('Usage: npx huaweicloud-devkit <command> [--target <opencode|codex|codearts|all>]\n');
+      console.log('Usage: npx huaweicloud-devkit <command> [--target <opencode|codex|codearts|workbuddy|all>]\n');
       console.log('Commands:');
       console.log('  install      Install skills, MCP server, safety policy');
       console.log('  uninstall    Remove installed files');
@@ -919,11 +1088,12 @@ async function main() {
       console.log('  install-hcloud  Show KooCLI install commands for your OS');
       console.log('  help         Show this help');
       console.log('\nOptions:');
-      console.log('  --target     Target agent: opencode (default), codex, codearts, all');
+      console.log('  --target     Target agent: opencode (default), codex, codearts, workbuddy, all');
       console.log('\nExamples:');
       console.log('  npx huaweicloud-devkit install');
       console.log('  npx huaweicloud-devkit install --target codex');
       console.log('  npx huaweicloud-devkit install --target codearts');
+      console.log('  npx huaweicloud-devkit install --target workbuddy');
       console.log('  npx huaweicloud-devkit install --target all');
       break;
   }

package/plugins/huaweicloud-core/src/tools.mjs

@@ -17,10 +17,15 @@ function codeartsSkillsDir() {
   const home = homedir();
   return join(home, '.codeartsdoer', 'skills');
 }
+function workbuddySkillsDir() {
+  const home = homedir();
+  return join(home, '.workbuddy', 'skills');
+}
 function resolveSkillsRoot() {
   if (existsSync(SKILLS_ROOT_DEV)) return SKILLS_ROOT_DEV;
   if (existsSync(codeartsSkillsDir())) return codeartsSkillsDir();
   if (existsSync(opencodeSkillsDir())) return opencodeSkillsDir();
+  if (existsSync(workbuddySkillsDir())) return workbuddySkillsDir();
   return SKILLS_ROOT_DEV;
 }
 const SKILLS_ROOT = resolveSkillsRoot();