huaweicloud-devkit 1.0.2-dev.11 → 1.0.2-dev.12

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "huaweicloud-devkit",
-    "version": "1.0.2-dev.11",
+    "version": "1.0.2-dev.12",
     "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
     "type": "module",
     "files": [

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.2-dev.11",
+  "version": "1.0.2-dev.12",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "1.0.2-dev.11",
+  "version": "1.0.2-dev.12",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.2-dev.11",
+  "version": "1.0.2-dev.12",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md

@@ -8,6 +8,12 @@ version: 1
 
 **STOP - Do not answer from general knowledge.** Follow the procedure below.
 
+## Routing Guard: Deploy vs Store
+
+- If the developer's goal is to **deploy, host, or preview a web app / static website** (temporary hosting, quick preview), do NOT default to OBS. Present deployment-target options with the sandbox first: ① huawei-sandbox (recommended), ② OBS static hosting, ③ ECS, ④ CCE. Ask: "建议优先部署到沙箱（临时运行环境，可预览访问），也可选 OBS 静态托管/ECS/CCE，你想部署到哪里？"
+- Proceed with OBS only when the developer selects OBS, explicitly asks for OBS, or the intent is long-term static hosting / CDN / file storage.
+- OBS is a storage service; it is not a general web-hosting default.
+
 ## Critical: OBS Command Syntax
 
 KooCLI OBS uses **obsutil-style** commands, NOT API-style operations. Always run `hcloud OBS help` (no `--`) before constructing commands:

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -15,6 +15,7 @@ Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace t
 ## Activation
 
 - **Proactive offering**: when the developer's task needs a temporary runtime (e.g. "deploy this web app", "run this app and preview it"), offer the sandbox proactively — the developer never has to say "use sandbox". Prompt: "This task can be satisfied by a sandbox — use it?"
+- **Static website hosting — present options, sandbox first**: when the developer asks to deploy/host/publish a static website or web app without naming a target, do NOT silently pick a service. Present the target options in this order: ① 沙箱 (recommended — temporary runtime, instant preview URL) ② OBS 静态托管 (long-term static hosting/CDN) ③ ECS ④ CCE, then follow the developer's choice. Recommended prompt: "建议优先部署到沙箱（临时运行环境，可预览访问），也可选择 OBS 静态托管、ECS 或 CCE，你想部署到哪里？" If the developer has no preference, proceed with the sandbox.
 - **Detect web apps in deploy-a-repo prompts**: prompts like "部署 GitHub - <owner>/<repo>" or "deploy <github repo>" do not say "web app". Clone or inspect the repository first (package.json with dev/serve/build scripts, index.html, frontend framework dependencies such as vue/react/angular/vite, static sites, Dockerfile running a web server). If it is a web application, offer the sandbox first: "检测到该项目是 Web 应用，建议优先使用沙箱部署（临时运行环境，可预览访问），是否使用？"
 - **Clone into the sandbox workspace directory**: always put project code under `/workspace/<repo-name>` (create the directory if missing) — `/workspace` is the sandbox's dedicated workspace mount at the filesystem root, not `$HOME/workspace`. Never use `/tmp` or other ephemeral locations. This keeps the project with the sandbox session, is easy to reference for serving/exposing, and survives session-level restarts of the shell.
 - **Deployment must end with a public URL**: after deploying and exposing the app with DevBridge, always return the tunnel URL to the developer as the final result — a deployment without an accessible link is incomplete.
@@ -48,9 +49,9 @@ Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace t
 
 Setup is a **plugin-side preflight** — the developer should be asked a question only once, when the agreement actually needs signing:
 
-1. **Check user** (transparent): `huaweicloud_sandbox_check_user` — verify `realnameVerified` and `agreementSigned`
+1. **Check user** (transparent): `huaweicloud_sandbox_check_user` — verify `realnameVerified` and `agreementSigned`. Note: the tool may instead return an `HDKIT_NOT_AGREEMENT` error (e.g. `用户未签署最新版协议`) — treat that exactly the same as `agreementSigned=false`
 2. **Real-name verification** (only if `realnameVerified=false`): tell the developer once, "Huawei Cloud requires real-name verification before using the sandbox." and stop — do not retry `connect` in a loop
-3. **Sign agreement** (only if `agreementSigned=false`): ask the developer once as the plugin — "Huawei Cloud sandbox requires signing its service agreement. May I sign it on your behalf?" — then call `huaweicloud_sandbox_sign_agreement`. Do not expose the underlying sandbox/DevBridge service as a separate entity the developer must understand or sign up for
+3. **Sign agreement** (only if `agreementSigned=false`, or when step 1 returned an `HDKIT_NOT_AGREEMENT` error): **STOP and do NOT sign.** Tell the developer the sandbox requires signing the latest Huawei Cloud developer service agreement, then **wait for the developer to explicitly agree to sign** (e.g. the developer says "签署" / "sign it"). Only then call `huaweicloud_sandbox_sign_agreement`. **Never call `sign_agreement` on your own initiative** — the signing decision always belongs to the developer, and you must never sign a legal agreement on the developer's behalf without their explicit, unambiguous consent. Do not expose the underlying sandbox/DevBridge service as a separate entity the developer must understand or sign up for
 4. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`
 5. **Inject credentials** (optional): `huaweicloud_sandbox_credentials` — enables cloud API access from sandbox
 6. **Execute commands**: `huaweicloud_sandbox_exec_with_session` for interactive work

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md

@@ -22,6 +22,10 @@ Use this skill to turn vague developer intent into a precise Huawei Cloud capabi
 8. Treat Terraform as a secondary V1 path for reviewed IaC, not the default.
 9. When no built-in devkit skill matches, browse the community skill marketplace at https://github.com/huaweicloud/huaweicloud-skills. Fetch the index from https://raw.githubusercontent.com/huaweicloud/huaweicloud-skills/master/skills-index/index.json.
 
+## Deployment Target Options
+
+When the intent is to **deploy, host, or preview a web app or static website** and the developer has not named a target, do NOT default to OBS or any single service. Present the options and let the developer choose, recommending the sandbox first: ① huawei-sandbox (recommended — temporary runtime, instant preview URL) ② huawei-obs (long-term static hosting/CDN) ③ huawei-ecs ④ huawei-cce. Only follow an explicit target when the developer names one.
+
 ## Region Intent
 
 - Extract region intent from the user's words before querying. Examples: Singapore -> `ap-southeast-3` first, Hong Kong -> `ap-southeast-2`, Beijing -> `cn-north-4`, Shanghai -> `cn-east-3`.

package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md

@@ -26,7 +26,7 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 |----|------|----------------|------------|
 | select | Service Selection | which service, what should I use, compare, recommend | Read references/select.md | select
 | compute | Compute Routing | server, VM, instance, ECS, BMS, GPU, HPC | Handoff to huawei-ecs or huawei-cce |
-| storage | Storage Routing | store files, bucket, OBS, backup, disk, EVS, SFS | Handoff to huawei-obs or huawei-cbr |
+| storage | Storage Routing | store files, bucket, OBS, backup, disk, EVS, SFS (long-term storage/CDN intent only) | Handoff to huawei-obs or huawei-cbr |
 | database | Database Routing | database, SQL, NoSQL, cache, RDS, GaussDB, DDS, DCS | Handoff to huawei-rds or huawei-gaussdb |
 | network | Network Routing | VPC, subnet, security group, EIP, NAT, VPN | Handoff to huawei-vpc |
 | serverless | Serverless Routing | function, Lambda, serverless, FunctionGraph, API gateway | Handoff to huawei-functiongraph or huawei-apig |
@@ -36,7 +36,7 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 | observability | Observability Routing | monitor, alarm, log, audit, trace, Cloud Eye | Handoff to huawei-cloud-eye or huawei-cts |
 | billing | Billing Routing | cost, bill, budget, spending, invoice | Handoff to huawei-billing |
 | iam | IAM Routing | permission, policy, role, user, group, AK/SK | Handoff to huawei-iam |
-| deployment | Deployment Routing | deploy, CI/CD, pipeline, release | CI/CD pipeline -> huawei-deployment; deploy a web app or a GitHub repo (no CI/CD target) -> huawei-sandbox |
+| deployment | Deployment Routing | deploy, host, publish, CI/CD, pipeline, release | CI/CD pipeline -> huawei-deployment; deploy/host/preview a web app or static website (no CI/CD target) -> present deployment-target options first, see "Deployment Target Options" below |
 | sandbox | Sandbox Routing | sandbox, DevStation, workspace, terminal, preview, temporary runtime | Handoff to huawei-sandbox |
 | cli | CLI and Auth Routing | install hcloud, configure KooCLI, AK/SK setup | Handoff to huaweicloud-cli-and-auth |
 | safety | Safety Routing | is this safe, approve command, risk review | Handoff to huaweicloud-safety |
@@ -50,7 +50,7 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 |----------|----------------|-------|
 | Web application hosting | ECS | huawei-ecs |
 | Containerized microservices | CCE | huawei-cce |
-| Static file storage / CDN | OBS | huawei-obs |
+| Static file storage / CDN (long-term) | OBS | huawei-obs |
 | Relational database (MySQL/PG) | RDS | huawei-rds |
 | Distributed SQL database | GaussDB | huawei-gaussdb |
 | Document database (MongoDB API) | DDS | huawei-dds-dcs |
@@ -71,6 +71,21 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 | Temporary runtime / web app preview | Sandbox (DevStation) | huawei-sandbox |
 | Getting started | Account setup | huaweicloud-cli-and-auth |
 
+## Deployment Target Options
+
+When the intent is to **deploy, host, or preview a web app or static website** (no explicit target named), NEVER default to a single service such as OBS. Ask the developer to choose a target and present the options in this order:
+
+| # | Option | When to choose | Skill |
+|---|--------|----------------|-------|
+| 1 | **Sandbox (DevStation) — recommended** | Temporary runtime, quick preview, demo; instant public URL | huawei-sandbox |
+| 2 | OBS static website hosting | Long-term static hosting / CDN, no backend | huawei-obs |
+| 3 | ECS | Needs a server runtime (backend, custom server) | huawei-ecs |
+| 4 | CCE | Containerized workloads, scaling | huawei-cce |
+
+- Recommended prompt: "这个项目是 Web 应用/静态网站，建议优先部署到沙箱（临时运行环境，立即可预览）。也可选择 OBS 静态托管、ECS 或 CCE，你想部署到哪里？"
+- If the developer explicitly names a target (e.g. "deploy to OBS"), follow that target and hand off to the corresponding service skill.
+- If the developer has no preference, recommend the sandbox first.
+
 ## Capability Sources
 
 - Huawei Cloud Skills: scenario workflows and recipes (check first)

package/plugins/huaweicloud-core/src/proxy/proxy-agent.mjs

@@ -0,0 +1,155 @@
+import { getProxyUrlForTarget } from './proxy-config.mjs';
+
+let cachedDispatcher = undefined;
+let cachedDispatcherProxyUrl = null;
+
+export async function getProxyDispatcher(targetUrl) {
+  const proxyUrl = getProxyUrlForTarget(targetUrl);
+  if (!proxyUrl) return undefined;
+
+  if (cachedDispatcher && cachedDispatcherProxyUrl === proxyUrl) {
+    return cachedDispatcher;
+  }
+
+  const { ProxyAgent } = await import('undici');
+  cachedDispatcher = new ProxyAgent(proxyUrl);
+  cachedDispatcherProxyUrl = proxyUrl;
+  return cachedDispatcher;
+}
+
+export function clearProxyDispatcherCache() {
+  cachedDispatcher = undefined;
+  cachedDispatcherProxyUrl = null;
+}
+
+export async function createProxyWebSocket(url, protocols) {
+  const proxyUrl = getProxyUrlForTarget(url);
+  if (!proxyUrl) {
+    return new globalThis.WebSocket(url, protocols);
+  }
+
+  const dispatcher = await getProxyDispatcher(url);
+  const { WebSocket: UndiciWebSocket } = await import('undici');
+
+  const wsOptions = { dispatcher };
+  if (protocols) {
+    if (Array.isArray(protocols)) {
+      wsOptions.protocols = protocols;
+    } else {
+      wsOptions.protocols = [protocols];
+    }
+  }
+
+  return new UndiciWebSocket(url, wsOptions);
+}
+
+export function getWebSocketImpl(targetUrl) {
+  const proxyUrl = getProxyUrlForTarget(targetUrl);
+  if (!proxyUrl) return globalThis.WebSocket;
+
+  return (url, protocols) => {
+    const proxyUrlForTarget = getProxyUrlForTarget(url);
+    if (!proxyUrlForTarget) {
+      return new globalThis.WebSocket(url, protocols);
+    }
+
+    const wsPromise = (async () => {
+      const dispatcher = await getProxyDispatcher(url);
+      const { WebSocket: UndiciWebSocket } = await import('undici');
+
+      const wsOptions = { dispatcher };
+      if (protocols) {
+        if (Array.isArray(protocols)) {
+          wsOptions.protocols = protocols;
+        } else {
+          wsOptions.protocols = [protocols];
+        }
+      }
+
+      return new UndiciWebSocket(url, wsOptions);
+    })();
+
+    return createSyncProxyWebSocketWrapper(wsPromise);
+  };
+}
+
+function createSyncProxyWebSocketWrapper(wsPromise) {
+  const pendingEvents = [];
+  const eventHandlers = new Map();
+  let ws = null;
+  let settled = false;
+  let readyState = 0;
+  let binaryType = 'arraybuffer';
+
+  const wrapper = {
+    get readyState() { return ws ? ws.readyState : readyState; },
+    get url() { return ws ? ws.url : ''; },
+    get protocol() { return ws ? ws.protocol : ''; },
+    get binaryType() { return ws ? ws.binaryType : binaryType; },
+    set binaryType(v) {
+      binaryType = v;
+      if (ws) ws.binaryType = v;
+    },
+
+    send(data, callback) {
+      if (ws) {
+        if (ws.send.length >= 2) return ws.send(data, callback);
+        try { ws.send(data); if (callback) callback(null); } catch (e) { if (callback) callback(e); }
+        return;
+      }
+      pendingEvents.push({ type: 'send', data, callback });
+    },
+
+    close(code, reason) {
+      if (ws) { ws.close(code, reason); return; }
+      readyState = 3;
+      pendingEvents.push({ type: 'close', code, reason });
+    },
+
+    addEventListener(type, handler) {
+      if (!eventHandlers.has(type)) eventHandlers.set(type, new Set());
+      eventHandlers.get(type).add(handler);
+      if (ws) ws.addEventListener(type, handler);
+    },
+
+    removeEventListener(type, handler) {
+      const handlers = eventHandlers.get(type);
+      if (handlers) handlers.delete(handler);
+      if (ws) ws.removeEventListener(type, handler);
+    },
+
+    on(type, handler) { wrapper.addEventListener(type, handler); },
+    off(type, handler) { wrapper.removeEventListener(type, handler); },
+  };
+
+  function flushPendingEvents() {
+    for (const evt of pendingEvents) {
+      if (evt.type === 'send') {
+        if (ws.send.length >= 2) ws.send(evt.data, evt.callback);
+        else { try { ws.send(evt.data); if (evt.callback) evt.callback(null); } catch (e) { if (evt.callback) evt.callback(e); } }
+      } else if (evt.type === 'close') {
+        ws.close(evt.code, evt.reason);
+      }
+    }
+    pendingEvents.length = 0;
+  }
+
+  wsPromise.then((resolvedWs) => {
+    ws = resolvedWs;
+    if ('binaryType' in ws) ws.binaryType = binaryType;
+    for (const [type, handlers] of eventHandlers) {
+      for (const handler of handlers) {
+        ws.addEventListener(type, handler);
+      }
+    }
+    flushPendingEvents();
+  }).catch((err) => {
+    readyState = 3;
+    const handlers = eventHandlers.get('error');
+    if (handlers) for (const h of handlers) h(err instanceof Error ? err : new Error(String(err)));
+    const closeHandlers = eventHandlers.get('close');
+    if (closeHandlers) for (const h of closeHandlers) h({ code: 1006, reason: err.message || String(err) });
+  });
+
+  return wrapper;
+}

package/plugins/huaweicloud-core/src/proxy/proxy-config.mjs

@@ -0,0 +1,87 @@
+import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+
+function baseHome() {
+  return process.env.HUAWEICLOUD_HOME || homedir();
+}
+
+export function proxyConfigPath() {
+  return join(baseHome(), '.config', 'huaweicloud', 'proxy.json');
+}
+
+export function readProxyConfig() {
+  const path = proxyConfigPath();
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export function writeProxyConfig(config = {}) {
+  const path = proxyConfigPath();
+  mkdirSync(dirname(path), { recursive: true });
+  const payload = {
+    https_proxy: String(config.https_proxy || ''),
+    http_proxy: String(config.http_proxy || ''),
+    no_proxy: String(config.no_proxy || ''),
+  };
+  writeFileSync(path, JSON.stringify(payload, null, 2), { encoding: 'utf8' });
+  return path;
+}
+
+export function clearProxyConfig() {
+  const path = proxyConfigPath();
+  if (!existsSync(path)) return false;
+  rmSync(path);
+  return true;
+}
+
+function shouldBypassProxy(hostname, noProxyList) {
+  if (!noProxyList.length) return false;
+  const lower = hostname.toLowerCase();
+  for (const pattern of noProxyList) {
+    const p = pattern.trim().toLowerCase();
+    if (!p) continue;
+    if (p === lower) return true;
+    if (p === '*') return true;
+    if (p.startsWith('.') && lower.endsWith(p)) return true;
+    if (lower.endsWith('.' + p)) return true;
+  }
+  return false;
+}
+
+export function getProxySettings(targetUrl) {
+  const envHttps = process.env.HTTPS_PROXY || process.env.https_proxy || '';
+  const envHttp = process.env.HTTP_PROXY || process.env.http_proxy || '';
+  const envNoProxy = process.env.NO_PROXY || process.env.no_proxy || '';
+
+  const fileConfig = readProxyConfig();
+
+  const https_proxy = envHttps || (fileConfig?.https_proxy || '');
+  const http_proxy = envHttp || (fileConfig?.http_proxy || '');
+  const no_proxy = envNoProxy || (fileConfig?.no_proxy || '');
+
+  if (!https_proxy && !http_proxy) return null;
+
+  const noProxyList = no_proxy.split(',').map((s) => s.trim()).filter(Boolean);
+
+  if (targetUrl) {
+    const parsed = new URL(targetUrl);
+    if (shouldBypassProxy(parsed.hostname, noProxyList)) return null;
+    const isHttps = parsed.protocol === 'https:';
+    const proxyUrl = isHttps ? https_proxy : http_proxy;
+    if (!proxyUrl) return null;
+    return { proxyUrl, noProxyList, targetProtocol: parsed.protocol };
+  }
+
+  return { https_proxy, http_proxy, no_proxy, noProxyList };
+}
+
+export function getProxyUrlForTarget(targetUrl) {
+  const settings = getProxySettings(targetUrl);
+  if (!settings) return null;
+  return settings.proxyUrl || null;
+}

package/plugins/huaweicloud-core/src/sandbox/hdkitservice-api.mjs

@@ -1,4 +1,5 @@
 import { getCredentials } from './hwlink-api.mjs';
+import { getProxyDispatcher } from '../proxy/proxy-agent.mjs';
 
 const HDKIT_BASE_URL =
   process.env.HDKITSERVICE_ENDPOINT ||
@@ -22,12 +23,15 @@ async function hdkitRequest(method, path, body, timeoutMs = 300000) {
 
   let resp;
   try {
-    resp = await fetch(url, {
+    const dispatcher = await getProxyDispatcher(url);
+    const fetchOpts = {
       method,
       headers,
       body: body ? JSON.stringify(body) : undefined,
       signal: controller.signal,
-    });
+    };
+    if (dispatcher) fetchOpts.dispatcher = dispatcher;
+    resp = await fetch(url, fetchOpts);
   } finally {
     clearTimeout(timer);
   }

package/plugins/huaweicloud-core/src/sandbox/hwlink-api.mjs

@@ -1,5 +1,6 @@
 import crypto from 'node:crypto';
 import { resolveCredentials } from '../auth/credentials.mjs';
+import { getProxyDispatcher } from '../proxy/proxy-agent.mjs';
 
 const BASE_URL = process.env.HWLINK_ENDPOINT || 'https://devstation.myhuaweicloud.com';
 
@@ -96,17 +97,25 @@ async function apiGet(path, query, ak, sk, securitytoken) {
   const qs = sortedQs(query);
   const fullPath = qs ? `${path}?${qs}` : path;
   const headers = signRequest('GET', path, query, undefined, ak, sk, securitytoken);
-  const resp = await fetch(`${BASE_URL}${fullPath}`, { headers });
+  const url = `${BASE_URL}${fullPath}`;
+  const dispatcher = await getProxyDispatcher(url);
+  const fetchOpts = { headers };
+  if (dispatcher) fetchOpts.dispatcher = dispatcher;
+  const resp = await fetch(url, fetchOpts);
   return { status: resp.status, data: await resp.json() };
 }
 
 async function apiPost(path, body, ak, sk, securitytoken) {
   const headers = signRequest('POST', path, {}, body, ak, sk, securitytoken);
-  const resp = await fetch(`${BASE_URL}${path}`, {
+  const url = `${BASE_URL}${path}`;
+  const dispatcher = await getProxyDispatcher(url);
+  const fetchOpts = {
     method: 'POST',
     headers: { ...headers, 'Content-Type': 'application/json' },
     body: JSON.stringify(body),
-  });
+  };
+  if (dispatcher) fetchOpts.dispatcher = dispatcher;
+  const resp = await fetch(url, fetchOpts);
   return { status: resp.status, data: await resp.json() };
 }
 

package/plugins/huaweicloud-core/src/sandbox/session-manager.mjs

@@ -2,6 +2,7 @@ import { spawn } from 'node:child_process';
 import { join, dirname } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { createConnection, getCredentials } from './hwlink-api.mjs';
+import { getWebSocketImpl } from '../proxy/proxy-agent.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 export const WS_EXEC_INDEX_URL = pathToFileURL(join(__dirname, '..', 'ws-exec', 'index.js')).href;
@@ -55,12 +56,15 @@ async function getSession(workspaceId, username, timeoutMs) {
   const { ak, sk, securitytoken } = getCredentials();
   const { wsUrl, source } = await createConnection(workspaceId, ak, sk, securitytoken);
 
+  const WebSocketImpl = getWebSocketImpl(wsUrl);
+
   const { connectHwlinkTerminalSession } = await import(WS_EXEC_INDEX_URL);
   const session = await connectHwlinkTerminalSession({
     url: wsUrl,
     source,
     username,
     timeoutMs,
+    WebSocketImpl,
   });
 
   sessions.set(key, session);
@@ -71,6 +75,8 @@ export async function execOneShot(workspaceId, command, username, timeoutMs) {
   const { ak, sk, securitytoken } = getCredentials();
   const { wsUrl, source } = await createConnection(workspaceId, ak, sk, securitytoken);
 
+  const WebSocketImpl = getWebSocketImpl(wsUrl);
+
   const { executeHwlinkCommand } = await import(WS_EXEC_INDEX_URL);
   return await executeHwlinkCommand({
     url: wsUrl,
@@ -78,6 +84,7 @@ export async function execOneShot(workspaceId, command, username, timeoutMs) {
     username,
     command,
     timeoutMs,
+    WebSocketImpl,
   });
 }
 

package/plugins/huaweicloud-core/src/search-market.mjs

@@ -1,3 +1,5 @@
+import { getProxyDispatcher } from './proxy/proxy-agent.mjs';
+
 const INDEX_URL = 'https://gitcode.com/api/v5/repos/2501_91318609/skills-for-index/contents/skills-index/index.json?ref=main';
 const CN_EN_MAP_URL = 'https://gitcode.com/api/v5/repos/2501_91318609/skills-for-index/contents/skills-index/cn-en-map.json?ref=main';
 const HTTP_TIMEOUT_MS = 10000;
@@ -19,10 +21,13 @@ async function fetchJson(url, label = '') {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS);
   try {
-    const resp = await fetch(url, {
+    const dispatcher = await getProxyDispatcher(url);
+    const fetchOpts = {
       headers: { 'User-Agent': 'huaweicloud-devkit/1.0' },
       signal: controller.signal,
-    });
+    };
+    if (dispatcher) fetchOpts.dispatcher = dispatcher;
+    const resp = await fetch(url, fetchOpts);
     const data = await resp.json();
     if (data && data.encoding === 'base64' && data.content) {
       const decoded = Buffer.from(data.content, 'base64').toString('utf8');

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -8,6 +8,7 @@ import { createInterface } from 'node:readline';
 import { spawnSync } from 'node:child_process';
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
 import { globalCredentialsPath, readGlobalCredentials, writeGlobalCredentials, writeObsConfig } from './auth/credentials.mjs';
+import { proxyConfigPath, readProxyConfig, writeProxyConfig, clearProxyConfig, getProxySettings } from './proxy/proxy-config.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PLUGIN_ROOT = resolve(__dirname, '..');
@@ -1064,6 +1065,14 @@ async function cmdDoctor() {
     warn++;
   }
 
+  const proxyConfig = readProxyConfig();
+  const proxyEnv = process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy;
+  if (proxyConfig || proxyEnv) {
+    const source = proxyEnv ? 'env' : 'file';
+    const proxyUrl = proxyEnv || proxyConfig.https_proxy || proxyConfig.http_proxy;
+    console.log(`  \x1b[36m[INFO]\x1b[0m Proxy configured (${source}): ${proxyUrl}`);
+  }
+
   console.log(`\nResults: ${pass} pass, ${warn} warn, ${fail} fail`);
 
   if (mcpConfigured && !hcloudOk) {
@@ -1524,6 +1533,93 @@ async function cmdAuth() {
   return cmdAuthStatus();
 }
 
+async function cmdProxyInit() {
+  console.log(BANNER);
+  console.log('HuaweiCloud DevKit Proxy Configuration\n');
+  console.log('Configure HTTP/HTTPS proxy for connections to Huawei Cloud services.');
+  console.log('Proxy settings are saved to ~/.config/huaweicloud/proxy.json\n');
+
+  const existing = readProxyConfig() || {};
+  const interactive = process.stdin.isTTY && process.stdout.isTTY;
+
+  if (!interactive) {
+    console.error('\x1b[31mNon-interactive session. Set proxy via environment variables:\x1b[0m');
+    console.error('  HTTPS_PROXY=http://proxy:port');
+    console.error('  HTTP_PROXY=http://proxy:port');
+    console.error('  NO_PROXY=localhost,127.0.0.1');
+    console.error('\nOr run "npx huaweicloud-devkit proxy init" in a real terminal.');
+    process.exitCode = 1;
+    return;
+  }
+
+  const httpsProxy = await readLineQuestion(`HTTPS proxy [${existing.https_proxy || 'none'}]: `);
+  const httpProxy = await readLineQuestion(`HTTP proxy [${existing.http_proxy || 'none'}]: `);
+  const noProxy = await readLineQuestion(`NO_PROXY hosts [${existing.no_proxy || 'localhost,127.0.0.1'}]: `);
+
+  const config = {
+    https_proxy: httpsProxy || existing.https_proxy || '',
+    http_proxy: httpProxy || existing.http_proxy || '',
+    no_proxy: noProxy || existing.no_proxy || 'localhost,127.0.0.1',
+  };
+
+  const path = writeProxyConfig(config);
+  console.log(`\nProxy configuration saved to ${path}`);
+  console.log('\nEffective settings:');
+  console.log(`  HTTPS_PROXY: ${config.https_proxy || '(none)'}`);
+  console.log(`  HTTP_PROXY:  ${config.http_proxy || '(none)'}`);
+  console.log(`  NO_PROXY:    ${config.no_proxy || '(none)'}`);
+  console.log('\nEnvironment variables (HTTPS_PROXY, HTTP_PROXY, NO_PROXY) override file settings.');
+}
+
+async function cmdProxyShow() {
+  console.log(BANNER);
+  console.log('HuaweiCloud DevKit Proxy Configuration\n');
+
+  const config = readProxyConfig();
+  const configPath = proxyConfigPath();
+
+  console.log(`Config file: ${configPath}`);
+  console.log(`File exists: ${config ? 'yes' : 'no'}\n`);
+
+  if (config) {
+    console.log('File settings:');
+    console.log(`  https_proxy: ${config.https_proxy || '(empty)'}`);
+    console.log(`  http_proxy:  ${config.http_proxy || '(empty)'}`);
+    console.log(`  no_proxy:    ${config.no_proxy || '(empty)'}`);
+  }
+
+  console.log('\nEnvironment variables:');
+  console.log(`  HTTPS_PROXY: ${process.env.HTTPS_PROXY || process.env.https_proxy || '(not set)'}`);
+  console.log(`  HTTP_PROXY:  ${process.env.HTTP_PROXY || process.env.http_proxy || '(not set)'}`);
+  console.log(`  NO_PROXY:    ${process.env.NO_PROXY || process.env.no_proxy || '(not set)'}`);
+
+  const effective = getProxySettings();
+  console.log('\nEffective (env > file):');
+  if (effective) {
+    console.log(`  https_proxy: ${effective.https_proxy || '(none)'}`);
+    console.log(`  http_proxy:  ${effective.http_proxy || '(none)'}`);
+    console.log(`  no_proxy:    ${effective.no_proxy || '(none)'}`);
+  } else {
+    console.log('  (no proxy configured)');
+  }
+}
+
+async function cmdProxyClear() {
+  const removed = clearProxyConfig();
+  if (removed) {
+    console.log('Proxy configuration removed.');
+  } else {
+    console.log('No proxy configuration file found.');
+  }
+}
+
+async function cmdProxy() {
+  const sub = (process.argv[3] || 'show').toLowerCase();
+  if (sub === 'init' || sub === 'setup') return cmdProxyInit();
+  if (sub === 'clear' || sub === 'remove' || sub === 'reset') return cmdProxyClear();
+  return cmdProxyShow();
+}
+
 async function main() {
   const cmd = process.argv[2] || 'help';
 
@@ -1557,6 +1653,9 @@ async function main() {
     case 'auth':
       await cmdAuth();
       break;
+    case 'proxy':
+      await cmdProxy();
+      break;
     case 'help':
     case '--help':
     case '-h':
@@ -1572,6 +1671,7 @@ async function main() {
       console.log('  doctor       Self-check: hcloud, MCP, skills, auth');
       console.log('  install-hcloud  Show KooCLI install commands for your OS');
       console.log('  auth         Manage unified auth: init | sync | status');
+      console.log('  proxy        Manage proxy config: init | show | clear');
       console.log('  help         Show this help');
       console.log('\nOptions:');
       console.log('  --target     Target agent: opencode (default), codex, codearts, workbuddy, all');
@@ -1584,6 +1684,8 @@ async function main() {
       console.log('  npx huaweicloud-devkit auth init');
       console.log('  npx huaweicloud-devkit auth sync --target all');
       console.log('  npx huaweicloud-devkit auth status --target all');
+      console.log('  npx huaweicloud-devkit proxy init');
+      console.log('  npx huaweicloud-devkit proxy show');
       break;
   }
 }

package/plugins/huaweicloud-core/src/tools.mjs

@@ -344,7 +344,7 @@ export const TOOL_DEFINITIONS = [
   },
   {
     name: 'huaweicloud_sandbox_sign_agreement',
-    description: 'Sign all unsigned or outdated agreements for the current user. Required before huaweicloud_sandbox_connect if check-user returns agreementSigned=false.',
+    description: 'Sign all unsigned or outdated agreements for the current user. Required before huaweicloud_sandbox_connect if check-user returns agreementSigned=false. CRITICAL: only call after the user explicitly consents to signing — never sign agreements on the user\'s behalf without their explicit request.',
     inputSchema: {
       type: 'object',
       properties: {},
@@ -709,19 +709,29 @@ function serviceCatalog(intent = '') {
     { keywords: ['cts', 'audit', 'trace', 'tracker'], skills: ['huawei-cts'], services: ['CTS'] },
     { keywords: ['cbr', 'backup', 'restore', 'vault', 'snapshot'], skills: ['huawei-cbr'], services: ['CBR'] },
     { keywords: ['deployment', 'deploy', 'ci/cd', 'pipeline', 'release'], skills: ['huawei-deployment'], services: ['CloudDeploy'] },
-    { keywords: ['sandbox', 'devstation', 'workspace', 'terminal', 'preview', 'hwlink'], skills: ['huawei-sandbox'], services: ['Sandbox', 'DevStation'] },
+    { keywords: ['sandbox', 'devstation', 'workspace', 'terminal', 'preview', 'hwlink', 'website', 'web app', 'webapp', 'hosting', '网站', '网页', '静态'], skills: ['huawei-sandbox'], services: ['Sandbox', 'DevStation'] },
     { keywords: ['dds', 'dcs', 'mongodb', 'redis', 'memcached', 'cache', 'document db'], skills: ['huawei-dds-dcs'], services: ['DDS', 'DCS'] },
 ];
   const matched = [];
   const tokens = it.split(/[\s,./-]+/).filter((t) => t.length > 0);
+  const cjk = /[\u4e00-\u9fff]/;
   for (const route of routeMap) {
-    if (route.keywords.some((kw) => tokens.includes(kw))) {
+    if (route.keywords.some((kw) => (kw.includes(' ') || cjk.test(kw)) ? it.includes(kw) : tokens.includes(kw))) {
       matched.push(route);
     }
   }
   const recommendedSkills = [...new Set(matched.flatMap((r) => r.skills))];
   const recommendedServices = [...new Set(matched.flatMap((r) => r.services))].slice(0, 5);
 
+  // Deployment intent (deploy/host/publish a web app or static website) must never
+  // default to a storage/other service — recommend the sandbox first.
+  const deploymentIntent = /deploy|host|hosting|publish|website|web app|preview|部署|托管|发布|网站|网页/.test(it);
+  if (deploymentIntent && recommendedSkills.includes('huawei-sandbox')) {
+    const idx = recommendedSkills.indexOf('huawei-sandbox');
+    recommendedSkills.splice(idx, 1);
+    recommendedSkills.unshift('huawei-sandbox');
+  }
+
   return {
     intent,
     recommendedSkills: recommendedSkills.length ? recommendedSkills : ['Use huaweicloud-core to route intent.'],