huaweicloud-devkit 1.0.2-dev.1 → 1.0.2-dev.3

package/README.md

@@ -9,6 +9,10 @@ Help AI coding agents use Huawei Cloud safely and accurately — a single integr
 
 Supports OpenCode, Codex, CodeArts Agent, and WorkBuddy.
 
+## Prerequisites
+
+- Node.js >= 22
+
 ## Quick Start
 
 ### OpenCode
@@ -34,6 +38,15 @@ npx --yes huaweicloud-devkit install --target codex
 
 > The Codex CLI must be installed first.
 
+```bash
+npx --yes huaweicloud-devkit doctor                        # self-check
+npx --yes huaweicloud-devkit status --target codex
+npx --yes huaweicloud-devkit update --target codex         # update
+npx --yes huaweicloud-devkit uninstall --target codex
+```
+
+> **Codex Desktop** (Windows): use `--target codex-desktop` with the same commands.
+
 ### CodeArts Agent
 
 ```bash
@@ -46,12 +59,13 @@ npx --yes huaweicloud-devkit install --target codearts
 npx --yes huaweicloud-devkit install-hcloud   # install KooCLI
 npx --yes huaweicloud-devkit doctor           # self-check
 npx --yes huaweicloud-devkit status --target codearts
+npx --yes huaweicloud-devkit update --target codearts
 npx --yes huaweicloud-devkit uninstall --target codearts
 ```
 
 > **Sandbox mode**: CodeArts defaults to sandbox mode which blocks KooCLI. `install-hcloud` detects this and shows how to resolve it — install KooCLI outside the sandbox terminal, or disable sandbox mode in CodeArts settings (Settings → Permissions → Bash mode).
 >
-> **Authentication**: Run `hcloud configure init` to configure AK/SK and region.
+> **Authentication**: Run `npx huaweicloud-devkit auth init` to configure unified AK/SK credentials for KooCLI, OBS, and sandbox APIs.
 
 ### WorkBuddy
 
@@ -61,6 +75,15 @@ npx --yes huaweicloud-devkit install --target workbuddy
 
 **Restart the session** after installation.
 
+```bash
+npx --yes huaweicloud-devkit doctor
+npx --yes huaweicloud-devkit status --target workbuddy
+npx --yes huaweicloud-devkit update --target workbuddy   # update
+npx --yes huaweicloud-devkit uninstall --target workbuddy
+```
+
+> **Updating**: `update` is incremental per agent — it refreshes only the installed files and leaves your config untouched. Use `update --target all` to update every installed agent at once.
+
 ### Other Agents
 
 For agents that support the Model Context Protocol (MCP):
@@ -83,7 +106,7 @@ Then install:
 npx --yes huaweicloud-devkit install
 ```
 
-> **Prerequisites:** [KooCLI](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html) (`hcloud`) installed and authenticated. Node.js >= 20 required.
+> **Prerequisite:** Node.js >= 22. Run `npx huaweicloud-devkit auth init` for unified credentials.
 
 ## What It Does
 

package/README.zh-CN.md

@@ -9,6 +9,10 @@
 
 支持 OpenCode、Codex、码道（CodeArts Agent）、WorkBuddy。
 
+## 前置条件
+
+- Node.js >= 22
+
 ## 快速开始
 
 ### OpenCode
@@ -34,6 +38,15 @@ npx --yes huaweicloud-devkit install --target codex
 
 > 需要先安装 Codex CLI。
 
+```bash
+npx --yes huaweicloud-devkit doctor                        # 自检
+npx --yes huaweicloud-devkit status --target codex
+npx --yes huaweicloud-devkit update --target codex         # 更新
+npx --yes huaweicloud-devkit uninstall --target codex
+```
+
+> **Codex Desktop**（Windows）：将 `--target codex` 换成 `--target codex-desktop`，命令相同。
+
 ### CodeArts Agent（码道）
 
 ```bash
@@ -46,12 +59,13 @@ npx --yes huaweicloud-devkit install --target codearts
 npx --yes huaweicloud-devkit install-hcloud   # 安装 KooCLI
 npx --yes huaweicloud-devkit doctor           # 自检
 npx --yes huaweicloud-devkit status --target codearts
+npx --yes huaweicloud-devkit update --target codearts
 npx --yes huaweicloud-devkit uninstall --target codearts
 ```
 
 > **沙箱模式**：码道默认沙箱模式会阻止 KooCLI 运行。`install-hcloud` 自动检测并给出指引——请在码道外终端安装使用 KooCLI，或在码道设置中关闭沙箱模式（设置 → 权限 → Bash 模式）。
 >
-> **认证**：执行 `hcloud configure init` 配置 AK/SK 与区域。
+> **认证**：执行 `npx huaweicloud-devkit auth init`，统一配置 KooCLI、OBS 和沙箱接口所需的 AK/SK。
 
 ### WorkBuddy
 
@@ -61,6 +75,15 @@ npx --yes huaweicloud-devkit install --target workbuddy
 
 安装后**重启会话**。
 
+```bash
+npx --yes huaweicloud-devkit doctor
+npx --yes huaweicloud-devkit status --target workbuddy
+npx --yes huaweicloud-devkit update --target workbuddy   # 更新
+npx --yes huaweicloud-devkit uninstall --target workbuddy
+```
+
+> **更新机制**：`update` 按 agent 增量更新，只刷新必要文件、不动你的配置文件。`update --target all` 可一次更新所有已安装的 agent。
+
 ### 其他 Agent
 
 支持 MCP 协议的 Agent，手动配置：
@@ -83,7 +106,7 @@ npx --yes huaweicloud-devkit install --target workbuddy
 npx --yes huaweicloud-devkit install
 ```
 
-> **前置条件：** 需要安装 [KooCLI](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html)（`hcloud`）并完成认证。Node.js >= 20。
+> **前置条件：** Node.js >= 22。执行 `npx huaweicloud-devkit auth init` 完成统一认证。
 
 ## 功能特性
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "huaweicloud-devkit",
-    "version": "1.0.2-dev.1",
+    "version": "1.0.2-dev.3",
     "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
     "type": "module",
     "files": [

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.0",
+  "version": "1.0.2-dev.3",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "1.0.0",
+  "version": "1.0.2-dev.3",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.0",
+  "version": "1.0.2-dev.3",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.mcp.json

@@ -7,7 +7,8 @@
       ],
       "cwd": ".",
       "env": {
-        "HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local"
+        "HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local",
+        "HDKITSERVICE_ENDPOINT": ""
       }
     }
   }

package/plugins/huaweicloud-core/safety/policy.json

@@ -82,5 +82,20 @@
                                  "ls",
                                  "dir",
                                  "Get-ChildItem"
-                             ]
+                             ],
+    "blockedSandboxCommands":  [
+                                  "rm\\s+-rf\\s+/",
+                                  "mkfs",
+                                  "dd\\s+if=",
+                                  ":\\(\\)\\{:\\|:&\\};:",
+                                  "shutdown",
+                                  "reboot",
+                                  "init\\s+[06]",
+                                  "fdisk"
+                              ],
+    "sandboxWriteTools":  [
+                              "huaweicloud_sandbox_connect",
+                              "huaweicloud_sandbox_credentials",
+                              "huaweicloud_sandbox_release"
+                          ]
 }

package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json

@@ -173,6 +173,27 @@
       },
       "message": "The generated plan may create high-cost or unbounded capacity.",
       "remediation": "Use small preview defaults, explicit quotas, budget labels, and user approval before creating high-cost resources."
+    },
+    {
+      "id": "hwc-sandbox-destructive-command",
+      "title": "Destructive command in sandbox terminal",
+      "category": "destructive",
+      "severity": "deny",
+      "stages": ["command"],
+      "match": {
+        "any": [
+          { "field": "text", "regex": "rm\\s+-rf\\s+/" },
+          { "field": "text", "regex": "mkfs" },
+          { "field": "text", "regex": "dd\\s+if=" },
+          { "field": "text", "regex": ":\\\\(\\\\)\\\\{[^}]*\\\\|[^}]*&[^}]*\\\\}[^;]*;:" },
+          { "field": "text", "regex": "\\bshutdown\\b" },
+          { "field": "text", "regex": "\\breboot\\b" },
+          { "field": "text", "regex": "\\binit\\s+[06]\\b" },
+          { "field": "text", "regex": "\\bfdisk\\b" }
+        ]
+      },
+      "message": "The sandbox terminal command is destructively dangerous and could destroy the workspace.",
+      "remediation": "Use targeted deletions instead of recursive root removal. Avoid disk format, fork bombs, and system shutdown commands in sandbox terminals."
     }
   ]
 }

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: huawei-sandbox
+description: "Use when creating, connecting, or managing Huawei Cloud Sandbox instances and workspace terminals. Covers sandbox lifecycle (check-user, sign-agreement, connect, release), terminal execution (one-shot and session-based), and credential injection. Triggers on: sandbox, workspace, terminal, hwlink, devstation, hdkitservice, remote exec. NOT for: ECS instances (use huawei-ecs), CCE clusters (use huawei-cce)."
+version: 1
+---
+
+# Huawei Cloud Sandbox
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+## Overview
+
+Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace terminal execution. Covers sandbox lifecycle via hdkitservice API and remote terminal command execution via hwlink protocol.
+
+## MCP Tools
+
+### User Verification (Prerequisites)
+
+| Tool | Purpose |
+|------|---------|
+| `huaweicloud_sandbox_check_user` | Check real-name verification and agreement signing status |
+| `huaweicloud_sandbox_sign_agreement` | Sign unsigned/outdated agreements (required before connect) |
+
+### Sandbox Lifecycle
+
+| Tool | Purpose |
+|------|---------|
+| `huaweicloud_sandbox_connect` | Connect to sandbox (one user one instance, reuses existing if available) |
+| `huaweicloud_sandbox_credentials` | Inject temporary AK/SK into a running sandbox |
+| `huaweicloud_sandbox_release` | Shut down and delete a sandbox (idempotent) |
+
+### Terminal Execution
+
+| Tool | Purpose |
+|------|---------|
+| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists) |
+| `huaweicloud_sandbox_close_session` | Close a persistent terminal session |
+
+## Workflow
+
+1. **Check user**: `huaweicloud_sandbox_check_user` — verify `realname_verified` and `agreement_signed`
+2. **Sign agreement** (if needed): `huaweicloud_sandbox_sign_agreement` — when `agreement_signed=false`
+3. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`
+4. **Inject credentials** (optional): `huaweicloud_sandbox_credentials` — enables cloud API access from sandbox
+5. **Execute commands**: `huaweicloud_sandbox_exec_with_session` for interactive work
+6. **Release**: `huaweicloud_sandbox_release` — cleans up sandbox and session
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Agreement required first | `sandbox_connect` fails if user hasn't signed agreements; run `sandbox_check_user` first |
+| Session state persists | `exec_with_session` preserves `cd`, env vars, aliases between calls |
+| Destructive commands blocked | `rm -rf /`, `mkfs`, `dd if=`, fork bombs are denied by safety policy |
+| Workspace ID = dev_stage_id | Use `dev_stage_id` from `sandbox_connect` as `workspace_id` for terminal exec |
+| Node.js >= 22 required | Sandbox terminal uses built-in WebSocket (globalThis.WebSocket) |
+
+## Environment Variables
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `HW_ACCESS_KEY` | Yes | Huawei Cloud AK |
+| `HW_SECRET_KEY` | Yes | Huawei Cloud SK |
+| `HW_SECURITY_TOKEN` | No | STS security token |
+| `HW_WORKSPACE_ID` | No | Default workspace ID |
+| `HDKITSERVICE_ENDPOINT` | No | hdkitservice API endpoint |
+| `HWLINK_ENDPOINT` | No | DevStation API endpoint |

package/plugins/huaweicloud-core/src/auth/agent-registration.mjs

@@ -0,0 +1,87 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { spawnSync } from 'node:child_process';
+
+export const SUPPORTED_AGENT_TARGETS = ['opencode', 'codex', 'codex-desktop', 'codearts', 'workbuddy'];
+
+function baseHome() {
+  return process.env.HUAWEICLOUD_HOME || homedir();
+}
+
+function opencodeConfigFile() {
+  const jsonc = join(baseHome(), '.config', 'opencode', 'opencode.jsonc');
+  if (existsSync(jsonc)) return jsonc;
+  return join(baseHome(), '.config', 'opencode', 'opencode.json');
+}
+
+function readJsonSafe(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function opencodeRegistered() {
+  const path = opencodeConfigFile();
+  const cfg = readJsonSafe(path);
+  return Boolean(cfg?.mcp?.['huaweicloud-devkit']);
+}
+
+function codexDesktopRegistered() {
+  const path = join(baseHome(), '.codex', 'config.toml');
+  if (!existsSync(path)) return false;
+  try {
+    return readFileSync(path, 'utf8').includes('[mcp_servers.huaweicloud-devkit]');
+  } catch {
+    return false;
+  }
+}
+
+function codexCliRegistered() {
+  try {
+    const r = spawnSync('codex', ['plugin', 'list'], {
+      shell: false,
+      windowsHide: true,
+      stdio: 'pipe',
+      timeout: 10000,
+    });
+    const out = `${r.stdout || ''}${r.stderr || ''}`;
+    return out.includes('huaweicloud-core');
+  } catch {
+    return false;
+  }
+}
+
+function codeartsRegistered() {
+  const paths = [
+    join(baseHome(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+    join(process.cwd(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+  ];
+  return paths.some((path) => {
+    const cfg = readJsonSafe(path);
+    return Boolean(cfg?.mcpServers?.['huaweicloud-devkit']);
+  });
+}
+
+function workbuddyRegistered() {
+  const cfg = readJsonSafe(join(baseHome(), '.workbuddy', 'mcp.json'));
+  return Boolean(cfg?.mcpServers?.['huaweicloud-devkit']);
+}
+
+export function getAgentRegistrationStatuses(target = 'all') {
+  const requested = target === 'all' ? SUPPORTED_AGENT_TARGETS : [target];
+  const result = { target, agents: {} };
+  for (const agent of requested) {
+    let configured = false;
+    if (agent === 'opencode') configured = opencodeRegistered();
+    if (agent === 'codex-desktop') configured = codexDesktopRegistered();
+    if (agent === 'codex') configured = codexCliRegistered();
+    if (agent === 'codearts') configured = codeartsRegistered();
+    if (agent === 'workbuddy') configured = workbuddyRegistered();
+    result.agents[agent] = { configured };
+  }
+  return result;
+}

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -0,0 +1,74 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+
+function baseHome() {
+  return process.env.HUAWEICLOUD_HOME || homedir();
+}
+
+export function globalCredentialsPath() {
+  return join(baseHome(), '.config', 'huaweicloud', 'credentials.json');
+}
+
+export function obsConfigPath() {
+  return join(baseHome(), '.obsutilconfig');
+}
+
+export function readGlobalCredentials() {
+  const path = globalCredentialsPath();
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export function writeGlobalCredentials(credentials = {}) {
+  const path = globalCredentialsPath();
+  mkdirSync(dirname(path), { recursive: true });
+  const payload = {
+    ak: String(credentials.ak || ''),
+    sk: String(credentials.sk || ''),
+    securityToken: String(credentials.securityToken || ''),
+    region: String(credentials.region || ''),
+  };
+  writeFileSync(path, JSON.stringify(payload, null, 2), { encoding: 'utf8', mode: 0o600 });
+  return path;
+}
+
+export function writeObsConfig(credentials = {}) {
+  const region = String(credentials.region || '');
+  const ak = String(credentials.ak || '');
+  const sk = String(credentials.sk || '');
+  if (!region || !ak || !sk) {
+    throw new Error('region, ak, and sk are required to write OBS config');
+  }
+  const path = obsConfigPath();
+  const endpoint = credentials.endpoint || `https://obs.${region}.myhuaweicloud.com`;
+  const content = `[default]\r\nendpoint=${endpoint}\r\nak=${ak}\r\nsk=${sk}\r\n`;
+  writeFileSync(path, content, { encoding: 'utf8', mode: 0o600 });
+  return { path, endpoint };
+}
+
+export function resolveCredentials(options = {}) {
+  let ak = process.env.HW_ACCESS_KEY;
+  let sk = process.env.HW_SECRET_KEY;
+  let securityToken = process.env.HW_SECURITY_TOKEN;
+  let region = process.env.HW_REGION || process.env.HUAWEICLOUD_REGION || '';
+
+  const stored = readGlobalCredentials();
+  if (stored) {
+    if (!ak && stored.ak) ak = stored.ak;
+    if (!sk && stored.sk) sk = stored.sk;
+    if (!securityToken && stored.securityToken) securityToken = stored.securityToken;
+    if (!region && stored.region) region = stored.region;
+  }
+
+  if (!ak || !sk) {
+    if (options.allowMissing) return null;
+    throw new Error('Huawei Cloud credentials are not configured. Run "npx huaweicloud-devkit auth init" or set HW_ACCESS_KEY/HW_SECRET_KEY.');
+  }
+
+  return { ak, sk, securityToken, region };
+}

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -0,0 +1,63 @@
+import { existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { getAgentRegistrationStatuses } from './agent-registration.mjs';
+import { globalCredentialsPath, obsConfigPath, readGlobalCredentials, writeObsConfig } from './credentials.mjs';
+
+function hcloudInstalled() {
+  const bin = process.env.HCLOUD_BIN || 'hcloud';
+  try {
+    const r = spawnSync(`"${bin}" version`, [], {
+      shell: true,
+      windowsHide: true,
+      stdio: 'pipe',
+      timeout: 5000,
+    });
+    const out = `${r.stdout || ''}${r.stderr || ''}`;
+    return r.status === 0 && /KooCLI|Current.*version|当前KooCLI/i.test(out);
+  } catch {
+    return false;
+  }
+}
+
+export function getAuthStatus(target = 'all') {
+  const credentials = readGlobalCredentials();
+  return {
+    target,
+    credentialsConfigured: Boolean(credentials?.ak && credentials?.sk),
+    credentialsPath: globalCredentialsPath(),
+    obsConfigured: existsSync(obsConfigPath()),
+    obsConfigPath: obsConfigPath(),
+    kooCliInstalled: hcloudInstalled(),
+    agents: getAgentRegistrationStatuses(target).agents,
+  };
+}
+
+export function syncAuth(target = 'all') {
+  const credentials = readGlobalCredentials();
+  if (!credentials?.ak || !credentials?.sk) {
+    return {
+      ok: false,
+      error: 'Global credentials are not configured.',
+      nextStep: 'Run "npx huaweicloud-devkit auth init" first.',
+    };
+  }
+
+  let obs = null;
+  try {
+    obs = writeObsConfig(credentials);
+  } catch (error) {
+    return {
+      ok: false,
+      error: error.message,
+      nextStep: 'Run "npx huaweicloud-devkit auth init" to refresh credentials and region.',
+    };
+  }
+
+  return {
+    ok: true,
+    obs: { configured: true, path: obs.path, endpoint: obs.endpoint },
+    credentialsConfigured: true,
+    agents: getAgentRegistrationStatuses(target).agents,
+    note: 'OBS credentials were synced from the global credential vault. Agent MCP registration is managed by "npx huaweicloud-devkit install --target <agent>".',
+  };
+}

package/plugins/huaweicloud-core/src/sandbox/hdkitservice-api.mjs

@@ -0,0 +1,97 @@
+import { getCredentials } from './hwlink-api.mjs';
+
+const HDKIT_BASE_URL =
+  process.env.HDKITSERVICE_ENDPOINT ||
+  'https://devkit.huaweicloud.com/rest/developer/server/hdkitservice/';
+
+async function hdkitRequest(method, path, body, timeoutMs = 300000) {
+  const { ak, sk, securitytoken } = getCredentials();
+
+  const headers = {
+    'Content-Type': 'application/json',
+    'X-HW-AK': ak,
+    'X-HW-SK': sk,
+  };
+  if (securitytoken) {
+    headers['X-HW-Security-Token'] = securitytoken;
+  }
+
+  const url = `${HDKIT_BASE_URL}${path}`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method,
+      headers,
+      body: body ? JSON.stringify(body) : undefined,
+      signal: controller.signal,
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+
+  const text = await resp.text();
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    throw new Error(`hdkitservice returned non-JSON (status ${resp.status}): ${text.slice(0, 200)}`);
+  }
+
+  if (!resp.ok) {
+    const err = new Error(
+      data.message || `hdkitservice error: ${data.code || resp.status}`
+    );
+    err.code = data.code;
+    err.status = resp.status;
+    err.traceId = data.trace_id;
+    throw err;
+  }
+
+  return data;
+}
+
+export async function hdkitCheckUser() {
+  return await hdkitRequest('GET', 'check-user', undefined, 30000);
+}
+
+export async function hdkitSignAgreement() {
+  return await hdkitRequest('POST', 'sign-agreement', {});
+}
+
+export async function hdkitConnect(options = {}) {
+  const body = {};
+  if (options.source) body.source = options.source;
+  if (options.env) body.env = options.env;
+  if (options.git) body.git = options.git;
+  if (options.template_id) body.template_id = options.template_id;
+  if (options.flavor_id) body.flavor_id = options.flavor_id;
+
+  return await hdkitRequest('POST', 'connect', body);
+}
+
+export async function hdkitCredentials(sessionId, devStageId, enableSts = true) {
+  const body = { enable_sts: enableSts };
+  if (sessionId) body.session_id = sessionId;
+  if (devStageId) body.dev_stage_id = devStageId;
+
+  if (!sessionId && !devStageId) {
+    throw new Error('session_id or dev_stage_id is required');
+  }
+
+  return await hdkitRequest('POST', 'credentials', body);
+}
+
+export async function hdkitRelease(sessionId, devStageId) {
+  const body = {};
+  if (sessionId) body.session_id = sessionId;
+  if (devStageId) body.dev_stage_id = devStageId;
+
+  if (!sessionId && !devStageId) {
+    throw new Error('session_id or dev_stage_id is required');
+  }
+
+  return await hdkitRequest('POST', 'release', body);
+}