huaweicloud-devkit 1.0.2-dev.1 → 1.0.2-dev.3

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -6,6 +6,8 @@ import { fileURLToPath } from 'node:url';
 import { homedir, platform } from 'node:os';
 import { createInterface } from 'node:readline';
 import { spawnSync } from 'node:child_process';
+import { getAuthStatus, syncAuth } from './auth/service.mjs';
+import { globalCredentialsPath, readGlobalCredentials, writeGlobalCredentials, writeObsConfig } from './auth/credentials.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PLUGIN_ROOT = resolve(__dirname, '..');
@@ -127,11 +129,21 @@ function removeIfExists(p) {
 
 function updateOpenCodeConfig(pluginDir) {
   const configPath = opencodeConfigFile();
+  const mcpPath = join(pluginDir, 'src', 'mcp-server.mjs').replace(/\\/g, '/');
   let config = {};
   if (existsSync(configPath)) {
-    try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
+    try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {
+      console.log(`  \x1b[33m[WARN]\x1b[0m Could not parse ${configPath} (jsonc comments?). Skipping MCP config write; ensure "mcp.huaweicloud-devkit" points to ${mcpPath}.`);
+      return;
+    }
+    const existing = config.mcp?.['huaweicloud-devkit'];
+    if (existing && existing.type === 'local'
+        && Array.isArray(existing.command) && existing.command[0] === 'node'
+        && existing.command[1] === mcpPath) {
+      console.log(`  OpenCode MCP config unchanged: ${configPath}`);
+      return;
+    }
   }
-  const mcpPath = join(pluginDir, 'src', 'mcp-server.mjs').replace(/\\/g, '/');
   config.mcp = config.mcp || {};
   config.mcp['huaweicloud-devkit'] = {
     type: 'local',
@@ -296,6 +308,101 @@ function uninstallOpenCode() {
   removeOpenCodeConfig();
 }
 
+// Remove huawei* entries in targetDir that no longer exist in sourceDir (stale files from an older version).
+function pruneStale(targetDir, sourceDir) {
+  if (!existsSync(targetDir) || !existsSync(sourceDir)) return 0;
+  const sourceNames = new Set(readdirSync(sourceDir));
+  let removed = 0;
+  for (const entry of readdirSync(targetDir, { withFileTypes: true })) {
+    if (!entry.name.startsWith('huawei')) continue;
+    if (!sourceNames.has(entry.name)) {
+      removeIfExists(join(targetDir, entry.name));
+      removed++;
+    }
+  }
+  return removed;
+}
+
+// Incremental update: overwrite copied files, prune stale ones, and only touch the config when necessary.
+async function updateOpenCode() {
+  const skillsSrc = join(PLUGIN_ROOT, 'skills');
+  const commandsSrc = join(PACKAGE_ROOT, 'integrations', 'opencode', 'commands');
+  const srcDir = join(PLUGIN_ROOT, 'src');
+  const safetyDir = join(PLUGIN_ROOT, 'safety');
+  const pluginDest = opencodePluginsDir();
+
+  copyDir(skillsSrc, opencodeSkillsDir());
+  const staleSkills = pruneStale(opencodeSkillsDir(), skillsSrc);
+  console.log(`  Skills updated -> ${opencodeSkillsDir()}${staleSkills > 0 ? ` (removed ${staleSkills} stale)` : ''}`);
+  copyDir(commandsSrc, opencodeCommandsDir());
+  const staleCommands = pruneStale(opencodeCommandsDir(), commandsSrc);
+  console.log(`  Commands updated -> ${opencodeCommandsDir()}${staleCommands > 0 ? ` (removed ${staleCommands} stale)` : ''}`);
+  copyDir(srcDir, join(pluginDest, 'src'));
+  console.log(`  MCP Server updated -> ${join(pluginDest, 'src')}`);
+  copyDir(safetyDir, join(pluginDest, 'safety'));
+  console.log(`  Safety Policy updated -> ${join(pluginDest, 'safety')}`);
+  updateOpenCodeConfig(pluginDest);
+  mkdirSync(pluginDest, { recursive: true });
+  writeFileSync(join(pluginDest, '.installed'), new Date().toISOString());
+}
+
+function codexMcpServerPath() {
+  return join(codexDesktopPluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
+}
+
+function codexConfigSectionText(mcpPath) {
+  return [
+    '[mcp_servers.huaweicloud-devkit]',
+    'command = "node"',
+    `args = ["${mcpPath}"]`,
+    '',
+    '[mcp_servers.huaweicloud-devkit.env]',
+    'HUAWEICLOUD_AGENT_TOOLKIT_MODE = "local"',
+    '',
+  ].join('\n');
+}
+
+// Returns true when the config file was written, false when it was already correct.
+function ensureCodexConfigSection(mcpPath) {
+  const configPath = codexConfigToml();
+  let existing = '';
+  if (existsSync(configPath)) {
+    try { existing = readFileSync(configPath, 'utf8'); } catch {}
+    if (existing.includes('[mcp_servers.huaweicloud-devkit]')) {
+      if (existing.includes(`args = ["${mcpPath}"]`)) {
+        console.log(`  Config unchanged: ${configPath}`);
+        return false;
+      }
+      removeCodexConfigSection();
+      existing = '';
+      if (existsSync(configPath)) {
+        try { existing = readFileSync(configPath, 'utf8'); } catch {}
+      }
+    }
+  }
+  mkdirSync(dirname(configPath), { recursive: true });
+  if (existing && !existing.endsWith('\n')) existing += '\n';
+  writeFileSync(configPath, existing + codexConfigSectionText(mcpPath));
+  console.log(`  Config updated: ${configPath}`);
+  return true;
+}
+
+function removeCodexConfigSection() {
+  const configPath = codexConfigToml();
+  if (!existsSync(configPath)) return;
+  const lines = readFileSync(configPath, 'utf8').split(/\r?\n/);
+  const out = [];
+  let skip = false;
+  for (const line of lines) {
+    if (/^\[mcp_servers\.huaweicloud-devkit(\]|\.)/.test(line)) { skip = true; continue; }
+    if (skip && line.startsWith('[')) skip = false;
+    if (!skip) out.push(line);
+  }
+  while (out.length > 0 && out[out.length - 1].trim() === '') out.pop();
+  writeFileSync(configPath, out.join('\n') + (out.length > 0 ? '\n' : ''));
+  console.log('  Config cleaned');
+}
+
 async function installCodexDesktop() {
   const skillsSrc = join(PLUGIN_ROOT, 'skills');
   const commandsSrc = join(PACKAGE_ROOT, 'integrations', 'opencode', 'commands');
@@ -313,7 +420,7 @@ async function installCodexDesktop() {
   console.log(`  Safety Policy -> ${join(codexDesktopPluginsDir(), 'safety')}`);
 
   // Generate .mcp.json with absolute paths for Codex Desktop MCP server discovery
-  const mcpServerAbsPath = join(codexDesktopPluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
+  const mcpServerAbsPath = codexMcpServerPath();
   const mcpConfig = {
     mcpServers: {
       'huaweicloud-devkit': {
@@ -333,29 +440,50 @@ async function installCodexDesktop() {
     console.log(`  Plugin Manifest -> ${join(codexDesktopPluginsDir(), '.codex-plugin')}`);
   }
 
-  const mcpPath = join(codexDesktopPluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
-  const configPath = codexConfigToml();
-  const section = [
-    '[mcp_servers.huaweicloud-devkit]',
-    'command = "node"',
-    `args = ["${mcpPath}"]`,
-    '',
-    '[mcp_servers.huaweicloud-devkit.env]',
-    'HUAWEICLOUD_AGENT_TOOLKIT_MODE = "local"',
-    '',
-  ].join('\n');
-  let existing = '';
-  if (existsSync(configPath)) {
-    try { existing = readFileSync(configPath, 'utf8'); } catch {}
-    if (existing.includes('[mcp_servers.huaweicloud-devkit]')) {
-      console.log(`  Config already configured: ${configPath}`);
-      return;
-    }
+  ensureCodexConfigSection(mcpServerAbsPath);
+}
+
+// Incremental update: overwrite copied files, prune stale ones, and only touch the config when necessary.
+async function updateCodexDesktop() {
+  const skillsSrc = join(PLUGIN_ROOT, 'skills');
+  const commandsSrc = join(PACKAGE_ROOT, 'integrations', 'opencode', 'commands');
+  const srcDir = join(PLUGIN_ROOT, 'src');
+  const safetyDir = join(PLUGIN_ROOT, 'safety');
+  const pluginDest = codexDesktopPluginsDir();
+
+  copyDir(skillsSrc, codexDesktopSkillsDir());
+  const staleSkills = pruneStale(codexDesktopSkillsDir(), skillsSrc);
+  console.log(`  Skills updated -> ${codexDesktopSkillsDir()}${staleSkills > 0 ? ` (removed ${staleSkills} stale)` : ''}`);
+  copyDir(commandsSrc, codexDesktopCommandsDir());
+  const staleCommands = pruneStale(codexDesktopCommandsDir(), commandsSrc);
+  console.log(`  Commands updated -> ${codexDesktopCommandsDir()}${staleCommands > 0 ? ` (removed ${staleCommands} stale)` : ''}`);
+  mkdirSync(pluginDest, { recursive: true });
+  copyDir(srcDir, join(pluginDest, 'src'));
+  console.log(`  MCP Server updated -> ${join(pluginDest, 'src')}`);
+  copyDir(safetyDir, join(pluginDest, 'safety'));
+  console.log(`  Safety Policy updated -> ${join(pluginDest, 'safety')}`);
+
+  const mcpServerAbsPath = codexMcpServerPath();
+  const mcpConfig = {
+    mcpServers: {
+      'huaweicloud-devkit': {
+        command: 'node',
+        args: [mcpServerAbsPath],
+        env: { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' },
+      },
+    },
+  };
+  writeFileSync(join(pluginDest, '.mcp.json'), JSON.stringify(mcpConfig, null, 2));
+  console.log(`  MCP Config updated -> ${join(pluginDest, '.mcp.json')}`);
+
+  const codexPluginSrc = join(PLUGIN_ROOT, '.codex-plugin');
+  if (existsSync(codexPluginSrc)) {
+    copyDir(codexPluginSrc, join(pluginDest, '.codex-plugin'));
+    console.log(`  Plugin Manifest updated -> ${join(pluginDest, '.codex-plugin')}`);
   }
-  mkdirSync(dirname(configPath), { recursive: true });
-  if (existing && !existing.endsWith('\n')) existing += '\n';
-  writeFileSync(configPath, existing + section);
-  console.log(`  Config updated: ${configPath}`);
+
+  ensureCodexConfigSection(mcpServerAbsPath);
+  writeFileSync(join(pluginDest, '.installed'), new Date().toISOString());
 }
 
 function uninstallCodexDesktop() {
@@ -386,32 +514,28 @@ function uninstallCodexDesktop() {
   if (removeIfExists(codexDesktopPluginsDir())) {
     console.log('  Removed MCP server and safety policy');
   }
-  const configPath = codexConfigToml();
-  if (existsSync(configPath)) {
-    const lines = readFileSync(configPath, 'utf8').split(/\r?\n/);
-    const out = [];
-    let skip = false;
-    for (const line of lines) {
-      if (/^\[mcp_servers\.huaweicloud-devkit(\]|\.)/.test(line)) { skip = true; continue; }
-      if (skip && line.startsWith('[')) skip = false;
-      if (!skip) out.push(line);
-    }
-    while (out.length > 0 && out[out.length - 1].trim() === '') out.pop();
-    writeFileSync(configPath, out.join('\n') + (out.length > 0 ? '\n' : ''));
-    console.log('  Config cleaned');
-  }
+  removeCodexConfigSection();
 }
 
 function registerCodeartsMcp(configPath) {
   const mcpPath = join(codeartsPluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
+  const env = { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' };
+  const hcloudBin = findHcloudBin();
+  if (hcloudBin) env.HCLOUD_BIN = hcloudBin.replace(/\\/g, '/');
   let config = {};
   if (existsSync(configPath)) {
-    try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
+    try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {
+      console.log(`  \x1b[33m[WARN]\x1b[0m Could not parse ${configPath}. Skipping MCP config write; ensure "mcpServers.huaweicloud-devkit" points to ${mcpPath}.`);
+      return;
+    }
+    const existing = config.mcpServers?.['huaweicloud-devkit'];
+    if (existing && existing.command === 'node'
+        && Array.isArray(existing.args) && existing.args[0] === mcpPath) {
+      console.log(`  MCP config unchanged: ${configPath}`);
+      return;
+    }
   }
   config.mcpServers = config.mcpServers || {};
-  const env = { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' };
-  const hcloudBin = findHcloudBin();
-  if (hcloudBin) env.HCLOUD_BIN = hcloudBin.replace(/\\/g, '/');
   config.mcpServers['huaweicloud-devkit'] = {
     command: 'node',
     args: [mcpPath],
@@ -443,6 +567,28 @@ async function installCodeArts() {
   registerCodeartsMcp(codeartsProjectMcpSettingsFile());
 }
 
+// Incremental update: overwrite copied files, prune stale ones, and only touch the config when necessary.
+async function updateCodeArts() {
+  const skillsSrc = join(PLUGIN_ROOT, 'skills');
+  const srcDir = join(PLUGIN_ROOT, 'src');
+  const safetyDir = join(PLUGIN_ROOT, 'safety');
+  const pluginDest = codeartsPluginsDir();
+
+  for (const dir of [codeartsSkillsDir(), codeartsProjectSkillsDir()]) {
+    copyDir(skillsSrc, dir);
+    const stale = pruneStale(dir, skillsSrc);
+    console.log(`  Skills updated -> ${dir}${stale > 0 ? ` (removed ${stale} stale)` : ''}`);
+  }
+  copyDir(srcDir, join(pluginDest, 'src'));
+  console.log(`  MCP Server updated -> ${join(pluginDest, 'src')}`);
+  copyDir(safetyDir, join(pluginDest, 'safety'));
+  console.log(`  Safety Policy updated -> ${join(pluginDest, 'safety')}`);
+  registerCodeartsMcp(codeartsMcpSettingsFile());
+  registerCodeartsMcp(codeartsProjectMcpSettingsFile());
+  mkdirSync(pluginDest, { recursive: true });
+  writeFileSync(join(pluginDest, '.installed'), new Date().toISOString());
+}
+
 function uninstallCodeArts() {
   let removed = 0;
   for (const skillsDir of [codeartsSkillsDir(), codeartsProjectSkillsDir()]) {
@@ -492,6 +638,38 @@ function codeartsStatus() {
   }
 }
 
+// Returns true when the config file was written, false when it was already correct.
+function ensureWorkbuddyMcpConfig() {
+  const configPath = workbuddyMcpConfigFile();
+  const mcpPath = join(workbuddyPluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
+  const env = { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' };
+  const hcloudBin = findHcloudBin();
+  if (hcloudBin) env.HCLOUD_BIN = hcloudBin.replace(/\\/g, '/');
+  let config = {};
+  if (existsSync(configPath)) {
+    try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {
+      console.log(`  \x1b[33m[WARN]\x1b[0m Could not parse ${configPath}. Skipping MCP config write; ensure "mcpServers.huaweicloud-devkit" points to ${mcpPath}.`);
+      return false;
+    }
+    const existing = config.mcpServers?.['huaweicloud-devkit'];
+    if (existing && existing.command === 'node'
+        && Array.isArray(existing.args) && existing.args[0] === mcpPath) {
+      console.log(`  MCP config unchanged: ${configPath}`);
+      return false;
+    }
+  }
+  config.mcpServers = config.mcpServers || {};
+  config.mcpServers['huaweicloud-devkit'] = {
+    command: 'node',
+    args: [mcpPath],
+    env,
+  };
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(configPath, JSON.stringify(config, null, 2));
+  console.log(`  MCP config updated: ${configPath}`);
+  return true;
+}
+
 async function installWorkBuddy() {
   const skillsSrc = join(PLUGIN_ROOT, 'skills');
   const srcDir = join(PLUGIN_ROOT, 'src');
@@ -506,25 +684,26 @@ async function installWorkBuddy() {
   copyDir(safetyDir, join(pluginDest, 'safety'));
   console.log(`  Safety Policy -> ${join(pluginDest, 'safety')}`);
 
-  // Write MCP config to ~/.workbuddy/mcp.json
-  const mcpPath = join(pluginDest, 'src', 'mcp-server.mjs').replace(/\\/g, '/');
-  const configPath = workbuddyMcpConfigFile();
-  let config = {};
-  if (existsSync(configPath)) {
-    try { config = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
-  }
-  const env = { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' };
-  const hcloudBin = findHcloudBin();
-  if (hcloudBin) env.HCLOUD_BIN = hcloudBin.replace(/\\/g, '/');
-  config.mcpServers = config.mcpServers || {};
-  config.mcpServers['huaweicloud-devkit'] = {
-    command: 'node',
-    args: [mcpPath],
-    env,
-  };
-  mkdirSync(dirname(configPath), { recursive: true });
-  writeFileSync(configPath, JSON.stringify(config, null, 2));
-  console.log(`  MCP config updated: ${configPath}`);
+  ensureWorkbuddyMcpConfig();
+}
+
+// Incremental update: overwrite copied files, prune stale ones, and only touch the config when necessary.
+async function updateWorkBuddy() {
+  const skillsSrc = join(PLUGIN_ROOT, 'skills');
+  const srcDir = join(PLUGIN_ROOT, 'src');
+  const safetyDir = join(PLUGIN_ROOT, 'safety');
+  const pluginDest = workbuddyPluginsDir();
+
+  copyDir(skillsSrc, workbuddySkillsDir());
+  const stale = pruneStale(workbuddySkillsDir(), skillsSrc);
+  console.log(`  Skills updated -> ${workbuddySkillsDir()}${stale > 0 ? ` (removed ${stale} stale)` : ''}`);
+  copyDir(srcDir, join(pluginDest, 'src'));
+  console.log(`  MCP Server updated -> ${join(pluginDest, 'src')}`);
+  copyDir(safetyDir, join(pluginDest, 'safety'));
+  console.log(`  Safety Policy updated -> ${join(pluginDest, 'safety')}`);
+  ensureWorkbuddyMcpConfig();
+  mkdirSync(pluginDest, { recursive: true });
+  writeFileSync(join(pluginDest, '.installed'), new Date().toISOString());
 }
 
 function uninstallWorkBuddy() {
@@ -903,13 +1082,105 @@ async function cmdUpdate() {
   console.log(BANNER);
   const target = parseTarget();
 
-  if (target === 'opencode' || target === 'all') {
-    if (!existsSync(join(opencodePluginsDir(), 'src', 'mcp-server.mjs'))
-        && !existsSync(join(workbuddyPluginsDir(), 'src', 'mcp-server.mjs'))
-        && !codexStatus()) {
+  if (target === 'opencode') {
+    if (!existsSync(join(opencodePluginsDir(), 'src', 'mcp-server.mjs'))) {
+      console.log('\x1b[33mNot installed. Use "install" command first.\x1b[0m');
+      return;
+    }
+    console.log('[OpenCode]');
+    await updateOpenCode();
+    console.log(`\n\x1b[32mUpdate complete.\x1b[0m`);
+    console.log(`\x1b[33mMCP 工具在重启 OpenCode 会话后才生效。\x1b[0m`);
+    return;
+  }
+
+  if (target === 'codex-desktop') {
+    if (!existsSync(join(codexDesktopPluginsDir(), 'src', 'mcp-server.mjs'))) {
       console.log('\x1b[33mNot installed. Use "install" command first.\x1b[0m');
       return;
     }
+    console.log('[Codex Desktop]');
+    await updateCodexDesktop();
+    console.log(`\n\x1b[32mUpdate complete.\x1b[0m`);
+    console.log(`\x1b[33mMCP 工具在重启 Codex Desktop 会话后才生效。\x1b[0m`);
+    return;
+  }
+
+  if (target === 'codex') {
+    if (!hasCodexCLI()) {
+      console.log(`  \x1b[31mCodex CLI not found.\x1b[0m`);
+      if (process.platform === 'win32') {
+        console.log(`  \x1b[33mTip: use --target codex-desktop for Codex Desktop on Windows\x1b[0m`);
+      }
+      console.log(`  \x1b[31mInstall Codex CLI: https://github.com/openai/codex-cli\x1b[0m`);
+      process.exitCode = 1;
+      return;
+    }
+    console.log('[Codex]');
+    installCodex();
+    console.log(`\n\x1b[32mUpdate complete.\x1b[0m`);
+    console.log(`\x1b[33mRestart the Codex session for changes to take effect.\x1b[0m`);
+    return;
+  }
+
+  if (target === 'codearts') {
+    if (!existsSync(join(codeartsPluginsDir(), 'src', 'mcp-server.mjs'))) {
+      console.log('\x1b[33mNot installed. Use "install" command first.\x1b[0m');
+      return;
+    }
+    console.log('[CodeArts]');
+    await updateCodeArts();
+    console.log(`\n\x1b[32mUpdate complete.\x1b[0m`);
+    console.log(`\x1b[33mMCP 工具在重启 CodeArts 会话后才生效。\x1b[0m`);
+    return;
+  }
+
+  if (target === 'workbuddy') {
+    if (!existsSync(join(workbuddyPluginsDir(), 'src', 'mcp-server.mjs'))) {
+      console.log('\x1b[33mNot installed. Use "install" command first.\x1b[0m');
+      return;
+    }
+    console.log('[WorkBuddy]');
+    await updateWorkBuddy();
+    console.log(`\n\x1b[32mUpdate complete.\x1b[0m`);
+    console.log(`\x1b[33mMCP 工具在重启 WorkBuddy 会话后才生效。\x1b[0m`);
+    return;
+  }
+
+  if (target === 'all') {
+    let updatedAny = false;
+    if (existsSync(join(opencodePluginsDir(), 'src', 'mcp-server.mjs'))) {
+      console.log('[OpenCode]');
+      await updateOpenCode();
+      updatedAny = true;
+    }
+    if (existsSync(join(codexDesktopPluginsDir(), 'src', 'mcp-server.mjs'))) {
+      console.log('\n[Codex Desktop]');
+      await updateCodexDesktop();
+      updatedAny = true;
+    }
+    if (existsSync(join(codeartsPluginsDir(), 'src', 'mcp-server.mjs'))) {
+      console.log('\n[CodeArts]');
+      await updateCodeArts();
+      updatedAny = true;
+    }
+    if (existsSync(join(workbuddyPluginsDir(), 'src', 'mcp-server.mjs'))) {
+      console.log('\n[WorkBuddy]');
+      await updateWorkBuddy();
+      updatedAny = true;
+    }
+    if (codexStatus()) {
+      console.log('\n[Codex]');
+      installCodex();
+      updatedAny = true;
+    }
+    if (!updatedAny) {
+      console.log('\x1b[33mNot installed. Use "install" command first.\x1b[0m');
+      return;
+    }
+    console.log(`\n\x1b[32mUpdate complete.\x1b[0m`);
+    console.log(`\x1b[33mMCP 工具在重启各 agent 会话后才生效。\x1b[0m`);
+    return;
   }
 
   await cmdUninstall();
@@ -1042,6 +1313,175 @@ async function cmdInstallHcloud() {
   console.log('\nThen run: npx huaweicloud-devkit doctor');
 }
 
+function readLineQuestion(prompt) {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(prompt, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+
+async function readSecret(prompt) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    return readLineQuestion(prompt);
+  }
+
+  process.stdout.write(prompt);
+  const wasRaw = process.stdin.isRaw;
+  process.stdin.setRawMode(true);
+  process.stdin.resume();
+
+  return new Promise((resolve) => {
+    let value = '';
+    const onData = (chunk) => {
+      for (const ch of chunk.toString('utf8')) {
+        if (ch === '\r' || ch === '\n') {
+          cleanup();
+          resolve(value.trim());
+          return;
+        }
+        if (ch === '\u0003') {
+          cleanup();
+          process.exit(130);
+        }
+        if (ch === '\b' || ch === '\u007f') {
+          value = value.slice(0, -1);
+          continue;
+        }
+        value += ch;
+      }
+    };
+    const cleanup = () => {
+      process.stdin.setRawMode(wasRaw);
+      process.stdin.pause();
+      process.stdin.off('data', onData);
+      process.stdout.write('\n');
+    };
+    process.stdin.on('data', onData);
+  });
+}
+
+function configureHcloud(credentials) {
+  const hcloudBin = findHcloudBin() || (process.env.HCLOUD_BIN || 'hcloud');
+  const args = [
+    'configure',
+    'set',
+    `--cli-access-key=${credentials.ak}`,
+    `--cli-secret-key=${credentials.sk}`,
+    `--cli-region=${credentials.region || ''}`,
+  ];
+  const r = spawnSync(hcloudBin, args, {
+    shell: false,
+    windowsHide: true,
+    stdio: 'pipe',
+    timeout: 30000,
+  });
+  return {
+    ok: r.status === 0,
+    code: r.status,
+    error: String(r.stderr || '').trim().slice(0, 240),
+  };
+}
+
+function printAuthAgents(agents = {}) {
+  for (const [agent, info] of Object.entries(agents)) {
+    console.log(`  ${agent}: ${info.configured ? '[OK]' : '[MISSING]'}`);
+  }
+}
+
+function printAuthStatus(status) {
+  console.log(`Credentials vault: ${status.credentialsConfigured ? 'configured' : 'missing'} (${status.credentialsPath})`);
+  console.log(`OBS config: ${status.obsConfigured ? 'configured' : 'missing'} (${status.obsConfigPath})`);
+  console.log(`KooCLI: ${status.kooCliInstalled ? 'installed' : 'missing'}`);
+  console.log('Agent MCP registration:');
+  printAuthAgents(status.agents);
+}
+
+async function cmdAuthInit() {
+  console.log(BANNER);
+  console.log('HuaweiCloud DevKit Unified Authentication Setup\n');
+
+  let ak = process.env.HW_ACCESS_KEY || '';
+  let sk = process.env.HW_SECRET_KEY || '';
+  let securityToken = process.env.HW_SECURITY_TOKEN || '';
+  let region = process.env.HW_REGION || process.env.HUAWEICLOUD_REGION || '';
+
+  if (!ak) ak = await readSecret('Access Key ID (AK): ');
+  if (!sk) sk = await readSecret('Secret Access Key (SK): ');
+  if (!securityToken) securityToken = await readLineQuestion('Security Token (optional, press Enter to skip): ');
+  if (!region) region = await readLineQuestion('Region (e.g. cn-north-4): ');
+
+  if (!ak || !sk) {
+    console.error('\nAK and SK are required.');
+    process.exitCode = 1;
+    return;
+  }
+  if (!region) {
+    console.error('\nRegion is required to generate the OBS endpoint.');
+    process.exitCode = 1;
+    return;
+  }
+
+  const vaultPath = writeGlobalCredentials({ ak, sk, securityToken, region });
+  console.log(`\nCredentials stored: ${vaultPath}`);
+
+  try {
+    const obs = writeObsConfig({ ak, sk, securityToken, region });
+    console.log(`OBS config synced: ${obs.path} (${obs.endpoint})`);
+  } catch (error) {
+    console.log(`OBS config sync failed: ${error.message}`);
+  }
+
+  if (findHcloudBin()) {
+    const result = configureHcloud({ ak, sk, region });
+    console.log(result.ok ? 'KooCLI profile updated.' : `KooCLI update failed: ${result.error || result.code}`);
+  } else {
+    console.log('KooCLI not found. Run "npx huaweicloud-devkit install-hcloud" and then "auth sync".');
+  }
+
+  console.log('\nNext steps:');
+  console.log('  npx huaweicloud-devkit install --target all');
+  console.log('  Restart your agent sessions.');
+}
+
+async function cmdAuthSync() {
+  const target = parseTarget();
+  console.log(BANNER);
+  console.log('Synchronizing Huawei Cloud authentication...\n');
+
+  const credentials = readGlobalCredentials();
+  if (!credentials?.ak || !credentials?.sk) {
+    console.error('No global credentials found. Run "npx huaweicloud-devkit auth init" first.');
+    process.exitCode = 1;
+    return;
+  }
+
+  const result = syncAuth(target);
+  if (result.ok) {
+    console.log(`OBS config synced: ${result.obs.path} (${result.obs.endpoint})`);
+  } else {
+    console.error(result.error);
+  }
+  console.log('Agent MCP registration:');
+  printAuthAgents(result.agents);
+}
+
+async function cmdAuthStatus() {
+  const target = parseTarget();
+  console.log(BANNER);
+  console.log('HuaweiCloud DevKit Authentication Status\n');
+  printAuthStatus(getAuthStatus(target));
+}
+
+async function cmdAuth() {
+  const sub = (process.argv[3] || 'status').toLowerCase();
+  if (sub === 'init' || sub === 'setup') return cmdAuthInit();
+  if (sub === 'sync' || sub === 'refresh') return cmdAuthSync();
+  return cmdAuthStatus();
+}
+
 async function main() {
   const cmd = process.argv[2] || 'help';
 
@@ -1072,6 +1512,9 @@ async function main() {
     case 'install-hcloud':
       await cmdInstallHcloud();
       break;
+    case 'auth':
+      await cmdAuth();
+      break;
     case 'help':
     case '--help':
     case '-h':
@@ -1086,6 +1529,7 @@ async function main() {
       console.log('  status       Show installation status');
       console.log('  doctor       Self-check: hcloud, MCP, skills, auth');
       console.log('  install-hcloud  Show KooCLI install commands for your OS');
+      console.log('  auth         Manage unified auth: init | sync | status');
       console.log('  help         Show this help');
       console.log('\nOptions:');
       console.log('  --target     Target agent: opencode (default), codex, codearts, workbuddy, all');
@@ -1095,6 +1539,9 @@ async function main() {
       console.log('  npx huaweicloud-devkit install --target codearts');
       console.log('  npx huaweicloud-devkit install --target workbuddy');
       console.log('  npx huaweicloud-devkit install --target all');
+      console.log('  npx huaweicloud-devkit auth init');
+      console.log('  npx huaweicloud-devkit auth sync --target all');
+      console.log('  npx huaweicloud-devkit auth status --target all');
       break;
   }
 }