huaweicloud-devkit 1.0.2-dev.1 → 1.0.2-dev.11

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -0,0 +1,95 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+
+// Verify a credential file ended up with 0600. On Windows-mounted drives inside WSL
+// (drvfs/9p) chmod is silently ignored, so the file can be world-readable (0777).
+// Native Windows has no POSIX modes (statSync always reports 0666), so skip the check there.
+function ensurePrivateMode(path) {
+  if (process.platform === 'win32') return;
+  try { chmodSync(path, 0o600); } catch {}
+  try {
+    const mode = statSync(path).mode & 0o777;
+    if (mode !== 0o600) {
+      console.warn(`\x1b[33m[WARN]\x1b[0m Could not set 0600 on ${path} (current mode ${mode.toString(8)}). Credentials may be readable by other users.`);
+      console.warn(`\x1b[33m       If running under WSL, move the credential home to the Linux filesystem:\x1b[0m`);
+      console.warn(`\x1b[33m         export HUAWEICLOUD_HOME=$HOME  (then re-run auth init)\x1b[0m`);
+      console.warn(`\x1b[33m       Or skip file storage entirely with HW_ACCESS_KEY/HW_SECRET_KEY environment variables.\x1b[0m`);
+    }
+  } catch {}
+}
+
+function baseHome() {
+  return process.env.HUAWEICLOUD_HOME || homedir();
+}
+
+export function globalCredentialsPath() {
+  return join(baseHome(), '.config', 'huaweicloud', 'credentials.json');
+}
+
+export function obsConfigPath() {
+  return join(baseHome(), '.obsutilconfig');
+}
+
+export function readGlobalCredentials() {
+  const path = globalCredentialsPath();
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export function writeGlobalCredentials(credentials = {}) {
+  const path = globalCredentialsPath();
+  mkdirSync(dirname(path), { recursive: true });
+  const payload = {
+    ak: String(credentials.ak || ''),
+    sk: String(credentials.sk || ''),
+    securityToken: String(credentials.securityToken || ''),
+    region: String(credentials.region || ''),
+  };
+  writeFileSync(path, JSON.stringify(payload, null, 2), { encoding: 'utf8', mode: 0o600 });
+  ensurePrivateMode(path);
+  return path;
+}
+
+export function writeObsConfig(credentials = {}) {
+  const region = String(credentials.region || '');
+  const ak = String(credentials.ak || '');
+  const sk = String(credentials.sk || '');
+  const securityToken = String(credentials.securityToken || '');
+  if (!region || !ak || !sk) {
+    throw new Error('region, ak, and sk are required to write OBS config');
+  }
+  const path = obsConfigPath();
+  const endpoint = credentials.endpoint || `https://obs.${region}.myhuaweicloud.com`;
+  // Flat key=value format (no [default] section) as written by KooCLI 7.x `hcloud OBS config`.
+  const content = `endpoint=${endpoint}\nak=${ak}\nsk=${sk}${securityToken ? `\ntoken=${securityToken}` : ''}\n`;
+  writeFileSync(path, content, { encoding: 'utf8', mode: 0o600 });
+  ensurePrivateMode(path);
+  return { path, endpoint };
+}
+
+export function resolveCredentials(options = {}) {
+  let ak = process.env.HW_ACCESS_KEY;
+  let sk = process.env.HW_SECRET_KEY;
+  let securityToken = process.env.HW_SECURITY_TOKEN;
+  let region = process.env.HW_REGION || process.env.HUAWEICLOUD_REGION || '';
+
+  const stored = readGlobalCredentials();
+  if (stored) {
+    if (!ak && stored.ak) ak = stored.ak;
+    if (!sk && stored.sk) sk = stored.sk;
+    if (!securityToken && stored.securityToken) securityToken = stored.securityToken;
+    if (!region && stored.region) region = stored.region;
+  }
+
+  if (!ak || !sk) {
+    if (options.allowMissing) return null;
+    throw new Error('Huawei Cloud credentials are not configured. Run "npx huaweicloud-devkit auth init" or set HW_ACCESS_KEY/HW_SECRET_KEY.');
+  }
+
+  return { ak, sk, securityToken, region };
+}

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -0,0 +1,63 @@
+import { existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { getAgentRegistrationStatuses } from './agent-registration.mjs';
+import { globalCredentialsPath, obsConfigPath, readGlobalCredentials, writeObsConfig } from './credentials.mjs';
+
+function hcloudInstalled() {
+  const bin = process.env.HCLOUD_BIN || 'hcloud';
+  try {
+    const r = spawnSync(`"${bin}" version`, [], {
+      shell: true,
+      windowsHide: true,
+      stdio: 'pipe',
+      timeout: 5000,
+    });
+    const out = `${r.stdout || ''}${r.stderr || ''}`;
+    return r.status === 0 && /KooCLI|Current.*version|当前KooCLI/i.test(out);
+  } catch {
+    return false;
+  }
+}
+
+export function getAuthStatus(target = 'all') {
+  const credentials = readGlobalCredentials();
+  return {
+    target,
+    credentialsConfigured: Boolean(credentials?.ak && credentials?.sk),
+    credentialsPath: globalCredentialsPath(),
+    obsConfigured: existsSync(obsConfigPath()),
+    obsConfigPath: obsConfigPath(),
+    kooCliInstalled: hcloudInstalled(),
+    agents: getAgentRegistrationStatuses(target).agents,
+  };
+}
+
+export function syncAuth(target = 'all') {
+  const credentials = readGlobalCredentials();
+  if (!credentials?.ak || !credentials?.sk) {
+    return {
+      ok: false,
+      error: 'Global credentials are not configured.',
+      nextStep: 'Run "npx huaweicloud-devkit auth init" first.',
+    };
+  }
+
+  let obs = null;
+  try {
+    obs = writeObsConfig(credentials);
+  } catch (error) {
+    return {
+      ok: false,
+      error: error.message,
+      nextStep: 'Run "npx huaweicloud-devkit auth init" to refresh credentials and region.',
+    };
+  }
+
+  return {
+    ok: true,
+    obs: { configured: true, path: obs.path, endpoint: obs.endpoint },
+    credentialsConfigured: true,
+    agents: getAgentRegistrationStatuses(target).agents,
+    note: 'OBS credentials were synced from the global credential vault. Agent MCP registration is managed by "npx huaweicloud-devkit install --target <agent>".',
+  };
+}

package/plugins/huaweicloud-core/src/mcp-server.mjs

@@ -1,7 +1,18 @@
 #!/usr/bin/env node
 import { stdin, stdout } from 'node:process';
+import { rmSync, existsSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { TOOL_DEFINITIONS, callTool } from './tools.mjs';
 
+// The MCP server is now loaded by a live agent session. Clear the install marker
+// in this plugin dir so `doctor` no longer reports "restart needed".
+try {
+  const pluginDir = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+  const marker = resolve(pluginDir, '.installed');
+  if (existsSync(marker)) rmSync(marker, { force: true });
+} catch {}
+
 let buffer = Buffer.alloc(0);
 let useContentLengthFraming = true;
 

package/plugins/huaweicloud-core/src/sandbox/hdkitservice-api.mjs

@@ -0,0 +1,87 @@
+import { getCredentials } from './hwlink-api.mjs';
+
+const HDKIT_BASE_URL =
+  process.env.HDKITSERVICE_ENDPOINT ||
+  'https://devkit.huaweicloud.com/rest/developer/server/hdkitservice/';
+
+async function hdkitRequest(method, path, body, timeoutMs = 300000) {
+  const { ak, sk, securitytoken } = getCredentials();
+
+  const headers = {
+    'Content-Type': 'application/json',
+    'X-HW-AK': ak,
+    'X-HW-SK': sk,
+  };
+  if (securitytoken) {
+    headers['X-HW-Security-Token'] = securitytoken;
+  }
+
+  const url = `${HDKIT_BASE_URL}${path}`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method,
+      headers,
+      body: body ? JSON.stringify(body) : undefined,
+      signal: controller.signal,
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+
+  const text = await resp.text();
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    throw new Error(`hdkitservice returned non-JSON (status ${resp.status}): ${text.slice(0, 200)}`);
+  }
+
+  if (!resp.ok) {
+    const err = new Error(
+      data.message || `hdkitservice error: ${data.code || resp.status}`
+    );
+    err.code = data.code;
+    err.status = resp.status;
+    err.traceId = data.traceId; // 后端实际返回驼峰 traceId
+    throw err;
+  }
+
+  return data;
+}
+
+export async function hdkitCheckUser() {
+  return await hdkitRequest('GET', 'check-user', undefined, 30000);
+}
+
+export async function hdkitSignAgreement() {
+  return await hdkitRequest('POST', 'sign-agreement', {});
+}
+
+export async function hdkitConnect(options = {}) {
+  const body = {};
+  if (options.source) body.source = options.source;
+  if (options.env) body.env = options.env;
+  if (options.git) body.git = options.git;
+  if (options.template_id) body.template_id = options.template_id;
+  if (options.flavor_id) body.flavor_id = options.flavor_id;
+
+  return await hdkitRequest('POST', 'connect', body);
+}
+
+export async function hdkitCredentials(sessionId, devStageId, enableSts = true) {
+  const body = { enable_sts: enableSts };
+  if (sessionId) body.session_id = sessionId;
+  if (devStageId) body.dev_stage_id = devStageId;
+
+  if (!sessionId && !devStageId) {
+    throw new Error('session_id or dev_stage_id is required');
+  }
+
+  return await hdkitRequest('POST', 'credentials', body);
+}
+
+

package/plugins/huaweicloud-core/src/sandbox/hwlink-api.mjs

@@ -0,0 +1,153 @@
+import crypto from 'node:crypto';
+import { resolveCredentials } from '../auth/credentials.mjs';
+
+const BASE_URL = process.env.HWLINK_ENDPOINT || 'https://devstation.myhuaweicloud.com';
+
+function sha256Hex(data) {
+  return crypto.createHash('sha256').update(data).digest('hex');
+}
+
+function hmacSha256(key, data) {
+  return crypto.createHmac('sha256', key).update(data).digest('hex');
+}
+
+function urlEncode(str) {
+  const hex = (c) => '%' + (c < 16 ? '0' : '') + c.toString(16).toUpperCase();
+  const noEscape = new Set(
+    'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~'.split('')
+  );
+  let out = '';
+  for (const ch of str) {
+    const c = ch.codePointAt(0);
+    out += noEscape.has(ch) && c < 0x80 ? ch : c < 0x80 ? hex(c) : encodeURIComponent(ch);
+  }
+  return out;
+}
+
+function timestamp() {
+  return new Date().toISOString().replace(/[-:]/g, '').replace(/\.\d+/, '') + 'Z';
+}
+
+function sortedQs(query) {
+  return Object.entries(query)
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
+    .join('&');
+}
+
+function signRequest(method, path, query, body, ak, sk, securitytoken) {
+  const ts = timestamp();
+  const host = new URL(BASE_URL).host;
+
+  const cqs = Object.entries(query)
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([k, v]) => `${urlEncode(k)}=${urlEncode(v)}`)
+    .join('&');
+
+  const curi =
+    '/' +
+    path
+      .split('/')
+      .filter(Boolean)
+      .map((s) => urlEncode(s))
+      .join('/') +
+    '/';
+
+  const signedHeaders = securitytoken
+    ? 'host;x-sdk-date;x-security-token'
+    : 'host;x-sdk-date';
+  const canonicalHeaders = securitytoken
+    ? `host:${host}\nx-sdk-date:${ts}\nx-security-token:${securitytoken}\n`
+    : `host:${host}\nx-sdk-date:${ts}\n`;
+
+  const bodyStr = body ? JSON.stringify(body) : '';
+  const payloadHash = sha256Hex(bodyStr);
+
+  const canonicalRequest = [
+    method,
+    curi,
+    cqs,
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash,
+  ].join('\n');
+
+  const stringToSign = `SDK-HMAC-SHA256\n${ts}\n${sha256Hex(canonicalRequest)}`;
+  const signature = hmacSha256(sk, stringToSign);
+
+  const headers = {
+    host,
+    'x-sdk-date': ts,
+    Authorization: `SDK-HMAC-SHA256 Access=${ak}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
+  };
+  if (securitytoken) {
+    headers['x-security-token'] = securitytoken;
+  }
+  return headers;
+}
+
+export function getCredentials() {
+  const credentials = resolveCredentials();
+  return { ak: credentials.ak, sk: credentials.sk, securitytoken: credentials.securityToken };
+}
+
+async function apiGet(path, query, ak, sk, securitytoken) {
+  query = query || {};
+  const qs = sortedQs(query);
+  const fullPath = qs ? `${path}?${qs}` : path;
+  const headers = signRequest('GET', path, query, undefined, ak, sk, securitytoken);
+  const resp = await fetch(`${BASE_URL}${fullPath}`, { headers });
+  return { status: resp.status, data: await resp.json() };
+}
+
+async function apiPost(path, body, ak, sk, securitytoken) {
+  const headers = signRequest('POST', path, {}, body, ak, sk, securitytoken);
+  const resp = await fetch(`${BASE_URL}${path}`, {
+    method: 'POST',
+    headers: { ...headers, 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  return { status: resp.status, data: await resp.json() };
+}
+
+export async function createConnection(envId, ak, sk, securitytoken) {
+  const { status, data } = await apiPost(
+    `/open-api-public/v1/devenvs/${envId}/connections`,
+    { source: 'CLI' },
+    ak, sk, securitytoken
+  );
+
+  if (status !== 200 || data?.error_code !== '0000' || !data?.result?.connection_id) {
+    throw new Error(`Failed to create connection: ${JSON.stringify(data)}`);
+  }
+
+  const connectionId = data.result.connection_id;
+  const maxAttempts = 60;
+
+  for (let i = 0; i < maxAttempts; i++) {
+    process.stderr.write(`\rWaiting for connection ${connectionId}... (${i}s)`);
+    const { data: getData } = await apiGet(
+      `/open-api-public/v1/devenvs/${envId}/connections/${connectionId}`,
+      {},
+      ak, sk, securitytoken
+    );
+
+    if (
+      getData?.result?.connection_info?.url &&
+      getData.result.connection_info.extensions?.source != null
+    ) {
+      const u = new URL(getData.result.connection_info.url);
+      u.searchParams.set('source', String(getData.result.connection_info.extensions.source));
+      process.stderr.write(`\rConnection ${connectionId} established (${i}s).\n`);
+      return {
+        wsUrl: u.toString(),
+        source: getData.result.connection_info.extensions.source,
+      };
+    }
+    await new Promise((resolve) => setTimeout(resolve, 1000));
+  }
+
+  throw new Error(`Timed out waiting for connection ${connectionId}`);
+}
+
+

package/plugins/huaweicloud-core/src/sandbox/session-manager.mjs

@@ -0,0 +1,105 @@
+import { spawn } from 'node:child_process';
+import { join, dirname } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { createConnection, getCredentials } from './hwlink-api.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+export const WS_EXEC_INDEX_URL = pathToFileURL(join(__dirname, '..', 'ws-exec', 'index.js')).href;
+
+const DEFAULT_WORKSPACE_ID = process.env.HW_WORKSPACE_ID || '0107bd9997aa4287bd2b4890b49af07d';
+
+function resolveEnv() {
+  const env = { ...process.env };
+  env.PATH = `${env.HOME || '/root'}/.huawei/bin:${env.PATH || ''}`;
+  return env;
+}
+
+async function runNodeExec(args, timeoutMs = 30000) {
+  const env = resolveEnv();
+  return new Promise((resolve) => {
+    const proc = spawn('node', args, { env, stdio: ['pipe', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    proc.stdout.on('data', (d) => { stdout += d.toString(); });
+    proc.stderr.on('data', (d) => { stderr += d.toString(); });
+
+    const timer = setTimeout(() => {
+      proc.kill();
+      resolve({ error: 'timed out', exitCode: 124 });
+    }, timeoutMs);
+
+    proc.on('close', (code) => {
+      clearTimeout(timer);
+      const out = stdout.trim();
+      if (out) {
+        try {
+          resolve({ ...JSON.parse(out), exitCode: code || 0 });
+          return;
+        } catch {}
+      }
+      if (code && code !== 0 && !out) {
+        resolve({ error: stderr.trim() || `exit code ${code}`, exitCode: code });
+        return;
+      }
+      resolve({ data: out, exitCode: code || 0 });
+    });
+  });
+}
+
+const sessions = new Map();
+
+async function getSession(workspaceId, username, timeoutMs) {
+  const key = `${workspaceId}:${username}`;
+  if (sessions.has(key)) return sessions.get(key);
+
+  const { ak, sk, securitytoken } = getCredentials();
+  const { wsUrl, source } = await createConnection(workspaceId, ak, sk, securitytoken);
+
+  const { connectHwlinkTerminalSession } = await import(WS_EXEC_INDEX_URL);
+  const session = await connectHwlinkTerminalSession({
+    url: wsUrl,
+    source,
+    username,
+    timeoutMs,
+  });
+
+  sessions.set(key, session);
+  return session;
+}
+
+export async function execOneShot(workspaceId, command, username, timeoutMs) {
+  const { ak, sk, securitytoken } = getCredentials();
+  const { wsUrl, source } = await createConnection(workspaceId, ak, sk, securitytoken);
+
+  const { executeHwlinkCommand } = await import(WS_EXEC_INDEX_URL);
+  return await executeHwlinkCommand({
+    url: wsUrl,
+    source,
+    username,
+    command,
+    timeoutMs,
+  });
+}
+
+export async function execWithSession(workspaceId, command, username, timeoutMs) {
+  const session = await getSession(workspaceId, username, timeoutMs);
+  return await session.exec(command, { timeoutMs });
+}
+
+export async function closeSession(workspaceId, username) {
+  const key = `${workspaceId}:${username}`;
+  const session = sessions.get(key);
+  if (!session) return false;
+  sessions.delete(key);
+  try { session.close(); } catch {}
+  return true;
+}
+
+export async function closeAllSessions() {
+  for (const [key, session] of sessions) {
+    sessions.delete(key);
+    try { session.close(); } catch {}
+  }
+}
+
+export { DEFAULT_WORKSPACE_ID, runNodeExec };