huaweicloud-devkit 1.0.2-dev.0 → 1.0.2-dev.2

package/plugins/huaweicloud-core/src/sandbox/session-manager.mjs

@@ -0,0 +1,105 @@
+import { spawn } from 'node:child_process';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createConnection, getCredentials } from './hwlink-api.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const WS_EXEC_SRC = join(__dirname, '..', 'ws-exec');
+
+const DEFAULT_WORKSPACE_ID = process.env.HW_WORKSPACE_ID || '0107bd9997aa4287bd2b4890b49af07d';
+
+function resolveEnv() {
+  const env = { ...process.env };
+  env.PATH = `${env.HOME || '/root'}/.huawei/bin:${env.PATH || ''}`;
+  return env;
+}
+
+async function runNodeExec(args, timeoutMs = 30000) {
+  const env = resolveEnv();
+  return new Promise((resolve) => {
+    const proc = spawn('node', args, { env, stdio: ['pipe', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    proc.stdout.on('data', (d) => { stdout += d.toString(); });
+    proc.stderr.on('data', (d) => { stderr += d.toString(); });
+
+    const timer = setTimeout(() => {
+      proc.kill();
+      resolve({ error: 'timed out', exitCode: 124 });
+    }, timeoutMs);
+
+    proc.on('close', (code) => {
+      clearTimeout(timer);
+      const out = stdout.trim();
+      if (out) {
+        try {
+          resolve({ ...JSON.parse(out), exitCode: code || 0 });
+          return;
+        } catch {}
+      }
+      if (code && code !== 0 && !out) {
+        resolve({ error: stderr.trim() || `exit code ${code}`, exitCode: code });
+        return;
+      }
+      resolve({ data: out, exitCode: code || 0 });
+    });
+  });
+}
+
+const sessions = new Map();
+
+async function getSession(workspaceId, username, timeoutMs) {
+  const key = `${workspaceId}:${username}`;
+  if (sessions.has(key)) return sessions.get(key);
+
+  const { ak, sk, securitytoken } = getCredentials();
+  const { wsUrl, source } = await createConnection(workspaceId, ak, sk, securitytoken);
+
+  const { connectHwlinkTerminalSession } = await import(join(WS_EXEC_SRC, 'index.js'));
+  const session = await connectHwlinkTerminalSession({
+    url: wsUrl,
+    source,
+    username,
+    timeoutMs,
+  });
+
+  sessions.set(key, session);
+  return session;
+}
+
+export async function execOneShot(workspaceId, command, username, timeoutMs) {
+  const { ak, sk, securitytoken } = getCredentials();
+  const { wsUrl, source } = await createConnection(workspaceId, ak, sk, securitytoken);
+
+  const { executeHwlinkCommand } = await import(join(WS_EXEC_SRC, 'index.js'));
+  return await executeHwlinkCommand({
+    url: wsUrl,
+    source,
+    username,
+    command,
+    timeoutMs,
+  });
+}
+
+export async function execWithSession(workspaceId, command, username, timeoutMs) {
+  const session = await getSession(workspaceId, username, timeoutMs);
+  return await session.exec(command, { timeoutMs });
+}
+
+export async function closeSession(workspaceId, username) {
+  const key = `${workspaceId}:${username}`;
+  const session = sessions.get(key);
+  if (!session) return false;
+  sessions.delete(key);
+  try { session.close(); } catch {}
+  return true;
+}
+
+export async function closeAllSessions() {
+  for (const [key, session] of sessions) {
+    sessions.delete(key);
+    try { session.close(); } catch {}
+  }
+}
+
+export { DEFAULT_WORKSPACE_ID, runNodeExec };

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -6,6 +6,8 @@ import { fileURLToPath } from 'node:url';
 import { homedir, platform } from 'node:os';
 import { createInterface } from 'node:readline';
 import { spawnSync } from 'node:child_process';
+import { getAuthStatus, syncAuth } from './auth/service.mjs';
+import { globalCredentialsPath, readGlobalCredentials, writeGlobalCredentials, writeObsConfig } from './auth/credentials.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PLUGIN_ROOT = resolve(__dirname, '..');
@@ -40,7 +42,7 @@ function opencodeConfigFile() {
 function codexDesktopSkillsDir() { return join(homedir(), '.agents', 'skills'); }
 function codexDesktopCommandsDir() { return join(homedir(), '.agents', 'commands'); }
 function codexDesktopPluginsDir() { return join(homedir(), '.agents', 'huaweicloud-plugins'); }
-function codexDesktopConfigFile() { return join(homedir(), '.agents', 'opencode.json'); }
+function codexConfigToml() { return join(homedir(), '.codex', 'config.toml'); }
 
 function codeartsSkillsDir() { return join(homedir(), '.codeartsdoer', 'skills'); }
 function codeartsMcpSettingsDir() { return join(homedir(), '.codeartsdoer', 'mcp'); }
@@ -230,6 +232,14 @@ function uninstallCodex() {
     shell: true, windowsHide: true, stdio: 'pipe',
   });
   console.log(`  ${r.stdout ? r.stdout.toString().trim() : r.stderr.toString().trim()}`);
+
+  for (const name of new Set([marketplaceName, 'HuaweiCloud-Devkit'])) {
+    console.log(`  Removing Codex marketplace: ${name}`);
+    const r2 = spawnSync(`codex plugin marketplace remove "${name}"`, [], {
+      shell: true, windowsHide: true, stdio: 'pipe',
+    });
+    console.log(`  ${r2.stdout ? r2.stdout.toString().trim() : r2.stderr.toString().trim()}`);
+  }
 }
 
 function codexStatus() {
@@ -326,18 +336,27 @@ async function installCodexDesktop() {
   }
 
   const mcpPath = join(codexDesktopPluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
-  const configPath = codexDesktopConfigFile();
-  let config = {};
+  const configPath = codexConfigToml();
+  const section = [
+    '[mcp_servers.huaweicloud-devkit]',
+    'command = "node"',
+    `args = ["${mcpPath}"]`,
+    '',
+    '[mcp_servers.huaweicloud-devkit.env]',
+    'HUAWEICLOUD_AGENT_TOOLKIT_MODE = "local"',
+    '',
+  ].join('\n');
+  let existing = '';
   if (existsSync(configPath)) {
-    try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
+    try { existing = readFileSync(configPath, 'utf8'); } catch {}
+    if (existing.includes('[mcp_servers.huaweicloud-devkit]')) {
+      console.log(`  Config already configured: ${configPath}`);
+      return;
+    }
   }
-  config.mcp = config.mcp || {};
-  config.mcp['huaweicloud-devkit'] = {
-    type: 'local',
-    command: ['node', mcpPath],
-    enabled: true,
-  };
-  writeFileSync(configPath, JSON.stringify(config, null, 2));
+  mkdirSync(dirname(configPath), { recursive: true });
+  if (existing && !existing.endsWith('\n')) existing += '\n';
+  writeFileSync(configPath, existing + section);
   console.log(`  Config updated: ${configPath}`);
 }
 
@@ -369,16 +388,19 @@ function uninstallCodexDesktop() {
   if (removeIfExists(codexDesktopPluginsDir())) {
     console.log('  Removed MCP server and safety policy');
   }
-  const configPath = codexDesktopConfigFile();
+  const configPath = codexConfigToml();
   if (existsSync(configPath)) {
-    let config = {};
-    try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
-    if (config.mcp?.['huaweicloud-devkit']) {
-      delete config.mcp['huaweicloud-devkit'];
-      if (Object.keys(config.mcp).length === 0) delete config.mcp;
-      writeFileSync(configPath, JSON.stringify(config, null, 2));
-      console.log('  Config cleaned');
+    const lines = readFileSync(configPath, 'utf8').split(/\r?\n/);
+    const out = [];
+    let skip = false;
+    for (const line of lines) {
+      if (/^\[mcp_servers\.huaweicloud-devkit(\]|\.)/.test(line)) { skip = true; continue; }
+      if (skip && line.startsWith('[')) skip = false;
+      if (!skip) out.push(line);
     }
+    while (out.length > 0 && out[out.length - 1].trim() === '') out.pop();
+    writeFileSync(configPath, out.join('\n') + (out.length > 0 ? '\n' : ''));
+    console.log('  Config cleaned');
   }
 }
 
@@ -663,7 +685,9 @@ async function cmdInstall() {
   // Write install marker for doctor to detect
   const markerDir = target === 'codearts' ? codeartsPluginsDir()
     : target === 'workbuddy' ? workbuddyPluginsDir()
+    : target === 'codex-desktop' ? codexDesktopPluginsDir()
     : opencodePluginsDir();
+  mkdirSync(markerDir, { recursive: true });
   writeFileSync(join(markerDir, '.installed'), new Date().toISOString());
   if (target === 'opencode' || target === 'all') {
     console.log('Or describe your Huawei Cloud task in OpenCode');
@@ -696,13 +720,15 @@ async function cmdUninstall() {
     console.log('\n[WorkBuddy]');
     uninstallWorkBuddy();
   }
-  if (target === 'codex' || target === 'all') {
+  if (target === 'codex-desktop' || target === 'codex' || target === 'all') {
     console.log('\n[Codex]');
     uninstallCodexDesktop();
-    if (!hasCodexCLI()) {
-      console.log('  \x1b[33mCodex CLI not found. Run "npm uninstall -g codex" to fully remove.\x1b[0m');
-    } else {
-      uninstallCodex();
+    if (target === 'codex' || target === 'all') {
+      if (!hasCodexCLI()) {
+        console.log('  \x1b[33mCodex CLI not found. Run "npm uninstall -g codex" to fully remove.\x1b[0m');
+      } else {
+        uninstallCodex();
+      }
     }
   }
   console.log(`\n\x1b[32mUninstall complete.\x1b[0m`);
@@ -783,11 +809,11 @@ async function cmdDoctor() {
       if (cfg.mcp && cfg.mcp['huaweicloud-devkit']) { mcpConfigured = true; mcpCfgTarget = 'OpenCode'; }
     } catch {}
   }
-  const codexCfg = codexDesktopConfigFile();
+  const codexCfg = codexConfigToml();
   if (!mcpConfigured && existsSync(codexCfg)) {
     try {
-      const cfg = JSON.parse(readFileSync(codexCfg, 'utf8'));
-      if (cfg.mcp && cfg.mcp['huaweicloud-devkit']) { mcpConfigured = true; mcpCfgTarget = 'Codex Desktop'; }
+      const cfg = readFileSync(codexCfg, 'utf8');
+      if (cfg.includes('[mcp_servers.huaweicloud-devkit]')) { mcpConfigured = true; mcpCfgTarget = 'Codex Desktop'; }
     } catch {}
   }
   const workbuddyCfg = workbuddyMcpConfigFile();
@@ -860,6 +886,7 @@ async function cmdDoctor() {
   // Detect "installed but not restarted" — check all supported agents
   const installedMarkers = [
     { path: join(opencodePluginsDir(), '.installed'), name: 'OpenCode' },
+    { path: join(codexDesktopPluginsDir(), '.installed'), name: 'Codex Desktop' },
     { path: join(workbuddyPluginsDir(), '.installed'), name: 'WorkBuddy' },
     { path: join(codeartsPluginsDir(), '.installed'), name: 'CodeArts' },
   ];
@@ -1017,6 +1044,175 @@ async function cmdInstallHcloud() {
   console.log('\nThen run: npx huaweicloud-devkit doctor');
 }
 
+function readLineQuestion(prompt) {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(prompt, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+
+async function readSecret(prompt) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    return readLineQuestion(prompt);
+  }
+
+  process.stdout.write(prompt);
+  const wasRaw = process.stdin.isRaw;
+  process.stdin.setRawMode(true);
+  process.stdin.resume();
+
+  return new Promise((resolve) => {
+    let value = '';
+    const onData = (chunk) => {
+      for (const ch of chunk.toString('utf8')) {
+        if (ch === '\r' || ch === '\n') {
+          cleanup();
+          resolve(value.trim());
+          return;
+        }
+        if (ch === '\u0003') {
+          cleanup();
+          process.exit(130);
+        }
+        if (ch === '\b' || ch === '\u007f') {
+          value = value.slice(0, -1);
+          continue;
+        }
+        value += ch;
+      }
+    };
+    const cleanup = () => {
+      process.stdin.setRawMode(wasRaw);
+      process.stdin.pause();
+      process.stdin.off('data', onData);
+      process.stdout.write('\n');
+    };
+    process.stdin.on('data', onData);
+  });
+}
+
+function configureHcloud(credentials) {
+  const hcloudBin = findHcloudBin() || (process.env.HCLOUD_BIN || 'hcloud');
+  const args = [
+    'configure',
+    'set',
+    `--cli-access-key=${credentials.ak}`,
+    `--cli-secret-key=${credentials.sk}`,
+    `--cli-region=${credentials.region || ''}`,
+  ];
+  const r = spawnSync(hcloudBin, args, {
+    shell: false,
+    windowsHide: true,
+    stdio: 'pipe',
+    timeout: 30000,
+  });
+  return {
+    ok: r.status === 0,
+    code: r.status,
+    error: String(r.stderr || '').trim().slice(0, 240),
+  };
+}
+
+function printAuthAgents(agents = {}) {
+  for (const [agent, info] of Object.entries(agents)) {
+    console.log(`  ${agent}: ${info.configured ? '[OK]' : '[MISSING]'}`);
+  }
+}
+
+function printAuthStatus(status) {
+  console.log(`Credentials vault: ${status.credentialsConfigured ? 'configured' : 'missing'} (${status.credentialsPath})`);
+  console.log(`OBS config: ${status.obsConfigured ? 'configured' : 'missing'} (${status.obsConfigPath})`);
+  console.log(`KooCLI: ${status.kooCliInstalled ? 'installed' : 'missing'}`);
+  console.log('Agent MCP registration:');
+  printAuthAgents(status.agents);
+}
+
+async function cmdAuthInit() {
+  console.log(BANNER);
+  console.log('HuaweiCloud DevKit Unified Authentication Setup\n');
+
+  let ak = process.env.HW_ACCESS_KEY || '';
+  let sk = process.env.HW_SECRET_KEY || '';
+  let securityToken = process.env.HW_SECURITY_TOKEN || '';
+  let region = process.env.HW_REGION || process.env.HUAWEICLOUD_REGION || '';
+
+  if (!ak) ak = await readSecret('Access Key ID (AK): ');
+  if (!sk) sk = await readSecret('Secret Access Key (SK): ');
+  if (!securityToken) securityToken = await readLineQuestion('Security Token (optional, press Enter to skip): ');
+  if (!region) region = await readLineQuestion('Region (e.g. cn-north-4): ');
+
+  if (!ak || !sk) {
+    console.error('\nAK and SK are required.');
+    process.exitCode = 1;
+    return;
+  }
+  if (!region) {
+    console.error('\nRegion is required to generate the OBS endpoint.');
+    process.exitCode = 1;
+    return;
+  }
+
+  const vaultPath = writeGlobalCredentials({ ak, sk, securityToken, region });
+  console.log(`\nCredentials stored: ${vaultPath}`);
+
+  try {
+    const obs = writeObsConfig({ ak, sk, securityToken, region });
+    console.log(`OBS config synced: ${obs.path} (${obs.endpoint})`);
+  } catch (error) {
+    console.log(`OBS config sync failed: ${error.message}`);
+  }
+
+  if (findHcloudBin()) {
+    const result = configureHcloud({ ak, sk, region });
+    console.log(result.ok ? 'KooCLI profile updated.' : `KooCLI update failed: ${result.error || result.code}`);
+  } else {
+    console.log('KooCLI not found. Run "npx huaweicloud-devkit install-hcloud" and then "auth sync".');
+  }
+
+  console.log('\nNext steps:');
+  console.log('  npx huaweicloud-devkit install --target all');
+  console.log('  Restart your agent sessions.');
+}
+
+async function cmdAuthSync() {
+  const target = parseTarget();
+  console.log(BANNER);
+  console.log('Synchronizing Huawei Cloud authentication...\n');
+
+  const credentials = readGlobalCredentials();
+  if (!credentials?.ak || !credentials?.sk) {
+    console.error('No global credentials found. Run "npx huaweicloud-devkit auth init" first.');
+    process.exitCode = 1;
+    return;
+  }
+
+  const result = syncAuth(target);
+  if (result.ok) {
+    console.log(`OBS config synced: ${result.obs.path} (${result.obs.endpoint})`);
+  } else {
+    console.error(result.error);
+  }
+  console.log('Agent MCP registration:');
+  printAuthAgents(result.agents);
+}
+
+async function cmdAuthStatus() {
+  const target = parseTarget();
+  console.log(BANNER);
+  console.log('HuaweiCloud DevKit Authentication Status\n');
+  printAuthStatus(getAuthStatus(target));
+}
+
+async function cmdAuth() {
+  const sub = (process.argv[3] || 'status').toLowerCase();
+  if (sub === 'init' || sub === 'setup') return cmdAuthInit();
+  if (sub === 'sync' || sub === 'refresh') return cmdAuthSync();
+  return cmdAuthStatus();
+}
+
 async function main() {
   const cmd = process.argv[2] || 'help';
 
@@ -1047,6 +1243,9 @@ async function main() {
     case 'install-hcloud':
       await cmdInstallHcloud();
       break;
+    case 'auth':
+      await cmdAuth();
+      break;
     case 'help':
     case '--help':
     case '-h':
@@ -1061,6 +1260,7 @@ async function main() {
       console.log('  status       Show installation status');
       console.log('  doctor       Self-check: hcloud, MCP, skills, auth');
       console.log('  install-hcloud  Show KooCLI install commands for your OS');
+      console.log('  auth         Manage unified auth: init | sync | status');
       console.log('  help         Show this help');
       console.log('\nOptions:');
       console.log('  --target     Target agent: opencode (default), codex, codearts, workbuddy, all');
@@ -1070,6 +1270,9 @@ async function main() {
       console.log('  npx huaweicloud-devkit install --target codearts');
       console.log('  npx huaweicloud-devkit install --target workbuddy');
       console.log('  npx huaweicloud-devkit install --target all');
+      console.log('  npx huaweicloud-devkit auth init');
+      console.log('  npx huaweicloud-devkit auth sync --target all');
+      console.log('  npx huaweicloud-devkit auth status --target all');
       break;
   }
 }

package/plugins/huaweicloud-core/src/tools.mjs

@@ -6,6 +6,10 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
 import { searchMarketplace } from './search-market.mjs';
+import { execOneShot, execWithSession, closeSession, DEFAULT_WORKSPACE_ID } from './sandbox/session-manager.mjs';
+import { hdkitCheckUser, hdkitSignAgreement, hdkitConnect, hdkitCredentials, hdkitRelease } from './sandbox/hdkitservice-api.mjs';
+import { getAuthStatus, syncAuth } from './auth/service.mjs';
+import { readGlobalCredentials, writeObsConfig as writeObsConfigFile } from './auth/credentials.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const SKILLS_ROOT_DEV = join(__dirname, '..', 'skills');
@@ -285,6 +289,128 @@ export const TOOL_DEFINITIONS = [
       },
     },
   },
+  {
+    name: 'huaweicloud_auth_status',
+    description: 'Check unified Huawei Cloud authentication status across the global credential vault, OBS, KooCLI, and all supported agent MCP registrations. Returns only redacted/status information, never credentials.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        target: { type: 'string', description: 'Agent target to check: opencode, codex, codex-desktop, codearts, workbuddy, or all (default).' },
+      },
+    },
+  },
+  {
+    name: 'huaweicloud_auth_sync',
+    description: 'Synchronize credentials from the global Huawei Cloud credential vault to OBS and report agent registration status. Does not write secrets into any agent config.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        target: { type: 'string', description: 'Agent target to report after sync: opencode, codex, codex-desktop, codearts, workbuddy, or all (default).' },
+      },
+    },
+  },
+  {
+    name: 'huaweicloud_sandbox_exec',
+    description: 'Execute a command on a Huawei Cloud workspace terminal via hwlink (one-shot, no session reuse). Each call creates a new connection. Shell state does NOT persist across calls.',
+    inputSchema: {
+      type: 'object',
+      required: ['command'],
+      properties: {
+        command: { type: 'string', description: 'The shell command to execute on the remote workspace' },
+        workspace_id: { type: 'string', description: 'The workspace ID' },
+        username: { type: 'string', description: 'Login username for the remote terminal (default: root)' },
+        timeout_ms: { type: 'number', description: 'Execution timeout in milliseconds (default: 30000)' },
+      },
+    },
+  },
+  {
+    name: 'huaweicloud_sandbox_exec_with_session',
+    description: 'Execute a command on a workspace terminal with session reuse (state persists across calls). Shell state (cd, env vars, aliases) carries over between calls.',
+    inputSchema: {
+      type: 'object',
+      required: ['command'],
+      properties: {
+        command: { type: 'string', description: 'The shell command to execute on the remote workspace' },
+        workspace_id: { type: 'string', description: 'The workspace ID' },
+        username: { type: 'string', description: 'Login username for the remote terminal (default: root)' },
+        timeout_ms: { type: 'number', description: 'Execution timeout in milliseconds (default: 30000)' },
+      },
+    },
+  },
+  {
+    name: 'huaweicloud_sandbox_close_session',
+    description: 'Close the persistent terminal session for a workspace.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        workspace_id: { type: 'string', description: 'The workspace ID' },
+        username: { type: 'string', description: 'Login username (default: root)' },
+      },
+    },
+  },
+  {
+    name: 'huaweicloud_sandbox_check_user',
+    description: 'Check if the current user has completed real-name verification and signed the required agreements. Returns realname_verified and agreement_signed status.',
+    inputSchema: {
+      type: 'object',
+      properties: {},
+    },
+  },
+  {
+    name: 'huaweicloud_sandbox_sign_agreement',
+    description: 'Sign all unsigned or outdated agreements for the current user. Required before huaweicloud_sandbox_connect if check-user returns agreement_signed=false.',
+    inputSchema: {
+      type: 'object',
+      properties: {},
+    },
+  },
+  {
+    name: 'huaweicloud_sandbox_connect',
+    description: 'Connect to a sandbox via hdkitservice. One user one instance - reuses existing sandbox if available, otherwise creates a new one. Returns session_id, dev_stage_id, connection_id, and connection_address.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        source: { type: 'string', description: 'Source identifier (default: WEB). Options: VSCODE, CLI, WEB, WEBVNC, WEBPTY, WEBIDE, CURSOR, etc.' },
+        template_id: { type: 'string', description: 'Template ID; overrides server default (only for new sandbox)' },
+        flavor_id: { type: 'string', description: 'Flavor ID; overrides server default (only for new sandbox)' },
+        env: { type: 'object', description: 'Environment variables to set in the sandbox (only for new sandbox)' },
+        git: {
+          type: 'object',
+          description: 'Git repo config (only for new sandbox)',
+          properties: {
+            repo_url: { type: 'string', description: 'Git repository URL' },
+            repo_branch: { type: 'string', description: 'Git branch' },
+            repo_name: { type: 'string', description: 'Repository name' },
+            target_path: { type: 'string', description: 'Clone target path in sandbox' },
+            open_type: { type: 'string', description: 'Open type' },
+          },
+        },
+      },
+    },
+  },
+  {
+    name: 'huaweicloud_sandbox_credentials',
+    description: 'Configure temporary AK/SK for a sandbox via hdkitservice. Injects temporary credentials into the sandbox. The sandbox must be in RUNNING state.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        session_id: { type: 'string', description: 'Session ID from huaweicloud_sandbox_connect' },
+        dev_stage_id: { type: 'string', description: 'DevStation environment ID (alternative to session_id)' },
+        enable_sts: { type: 'boolean', description: 'Whether to enable STS temporary AK/SK (default: true)' },
+      },
+    },
+  },
+  {
+    name: 'huaweicloud_sandbox_release',
+    description: 'Release a sandbox via hdkitservice. Shuts down and deletes the sandbox, and cleans up the session. Idempotent - releasing a non-existent sandbox returns success.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        session_id: { type: 'string', description: 'Session ID from huaweicloud_sandbox_connect' },
+        dev_stage_id: { type: 'string', description: 'DevStation environment ID (alternative to session_id)' },
+      },
+    },
+  },
 ];
 
 export async function callTool(name, args = {}) {
@@ -328,6 +454,40 @@ export async function callTool(name, args = {}) {
       return searchMarketplace(args.query || '', args.category || '');
     case 'huaweicloud_setup_obs_config':
       return setupObsConfig(args.profile);
+    case 'huaweicloud_auth_status':
+      return getAuthStatus(args.target || 'all');
+    case 'huaweicloud_auth_sync':
+      return syncAuth(args.target || 'all');
+    case 'huaweicloud_sandbox_exec': {
+      const sandboxWsId1 = args.workspace_id || DEFAULT_WORKSPACE_ID;
+      const sandboxUser1 = args.username || 'root';
+      const sandboxTimeout1 = args.timeout_ms || 30000;
+      const sandboxResult1 = await execOneShot(sandboxWsId1, args.command, sandboxUser1, sandboxTimeout1);
+      return { stdout: sandboxResult1.stdout, exitCode: sandboxResult1.exitCode };
+    }
+    case 'huaweicloud_sandbox_exec_with_session': {
+      const sandboxWsId2 = args.workspace_id || DEFAULT_WORKSPACE_ID;
+      const sandboxUser2 = args.username || 'root';
+      const sandboxTimeout2 = args.timeout_ms || 30000;
+      const sandboxResult2 = await execWithSession(sandboxWsId2, args.command, sandboxUser2, sandboxTimeout2);
+      return { stdout: sandboxResult2.stdout, exitCode: sandboxResult2.exitCode };
+    }
+    case 'huaweicloud_sandbox_close_session': {
+      const sandboxWsId3 = args.workspace_id || DEFAULT_WORKSPACE_ID;
+      const sandboxUser3 = args.username || 'root';
+      const closed = await closeSession(sandboxWsId3, sandboxUser3);
+      return closed ? 'ok' : 'not_connected';
+    }
+    case 'huaweicloud_sandbox_check_user':
+      return await hdkitCheckUser();
+    case 'huaweicloud_sandbox_sign_agreement':
+      return await hdkitSignAgreement();
+    case 'huaweicloud_sandbox_connect':
+      return await hdkitConnect(args);
+    case 'huaweicloud_sandbox_credentials':
+      return await hdkitCredentials(args.session_id, args.dev_stage_id, args.enable_sts !== false);
+    case 'huaweicloud_sandbox_release':
+      return await hdkitRelease(args.session_id, args.dev_stage_id);
     default:
       throw new Error(`Unknown tool: ${name}`);
   }
@@ -395,6 +555,33 @@ async function showProfileRedacted(profile) {
 }
 
 async function setupObsConfig(profile) {
+  const stored = readGlobalCredentials();
+  if (stored?.ak && stored?.sk) {
+    try {
+      const obs = writeObsConfigFile(stored);
+      return {
+        ok: true,
+        existed: false,
+        created: true,
+        path: obs.path,
+        region: stored.region,
+        endpoint: obs.endpoint,
+        source: 'global-credentials',
+        note: 'OBS credentials synced from the global credential vault. OBS commands (hcloud OBS ls, mb, cp, etc.) should now work.',
+      };
+    } catch (error) {
+      return {
+        ok: false,
+        error: error.message,
+        nextStep: 'Run "npx huaweicloud-devkit auth init" to refresh credentials and region.',
+      };
+    }
+  }
+
+  return setupObsConfigFromHcloud(profile);
+}
+
+async function setupObsConfigFromHcloud(profile) {
   const obsConfigPath = join(homedir(), '.obsutilconfig');
   if (existsSync(obsConfigPath)) {
     return { ok: true, existed: true, path: obsConfigPath, note: 'OBS config already exists. Delete ~/.obsutilconfig first if you need to re-sync.' };