huaweicloud-devkit 1.0.2-dev.8 → 1.0.2-next.0

package/plugins/huaweicloud-core/skills/huawei-getting-started/SKILL.md

@@ -1,65 +1,65 @@
----
-name: huawei-getting-started
-description: "Use when starting fresh with Huawei Cloud or KooCLI, installing prerequisites, setting up authentication, or exploring what is possible. Triggers: getting started, first time, setup, install, explore, quickstart, beginner, tutorial. NOT for: specific service operations (use huawei-ecs, huawei-obs, etc.)."
-version: 1
----
-
-# Huawei Cloud Getting Started
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-## KooCLI Installation
-
-| OS | Command |
-|----|---------|
-| Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download |
-| Linux | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
-| macOS | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
-
-## First-Time Setup
-1. **Install KooCLI** using command above
-2. **Accept privacy policy** (first run only): KooCLI requires one-time privacy agreement. Run `hcloud version` to read the agreement, then respond `y` to accept. Do not pipe `echo "y" |` — you must review the terms first.
-3. **Configure credentials**: `hcloud configure init` (interactive, prompts for AK/SK/region safely)
-4. **Verify**: `hcloud configure list` to confirm profile, then `hcloud ECS ListServersDetails --cli-region=cn-north-4`
-5. For detailed auth guidance, see `huaweicloud-cli-and-auth` skill
-
-> **Security**: Never pass AK/SK as command-line arguments (`--ak=...`). Always use `hcloud configure init` (interactive) or `hcloud configure set` with cached profile to avoid secrets in shell history.
-
-### Non-Interactive Setup (Agent/CI Environments)
-
-When the interactive TUI is unavailable (Agent tools, CI/CD), use `hcloud configure set` — this must be run outside agent chat by the user:
-
-```bash
-# User executes in their terminal (NOT in agent chat):
-hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>
-
-# Agent verifies:
-hcloud configure list
-```
-
-## Critical Warnings
-| Trap | Why |
-|------|-----|
-| AK/SK must be kept secret | Never commit to git or share |
-| Default region applies to all commands | Override with --cli-region= per command |
-| Some services region-specific | Not all services available in all regions |
-| Privacy policy blocks first run | Run `hcloud version` to read and accept the agreement. Review the terms before responding `y` |
-
-## What Can I Do? (Quick Index)
-| Goal | Skill |
-|------|-------|
-| Create a VM | huawei-ecs |
-| Store files | huawei-obs |
-| Set up a database | huawei-rds / huawei-gaussdb |
-| Create a network | huawei-vpc |
-| Manage access | huawei-iam |
-| Deploy an app | huawei-deployment |
-| Run containers | huawei-cce |
-| Build an API | huawei-apig |
-| Run serverless | huawei-functiongraph |
-| Monitor resources | huawei-cloud-eye |
-
-## Pro Tips
-- Use `hcloud <Service> --help` to discover operations (see huaweicloud-capability-discovery)
-- Prepend `hcloud configure set --cli-region=<r>` to avoid per-command region flags
-- Pipe sensitive output through IAM with `--cli-output-format=json`
+---
+name: huawei-getting-started
+description: "Use when starting fresh with Huawei Cloud or KooCLI, installing prerequisites, setting up authentication, or exploring what is possible. Triggers: getting started, first time, setup, install, explore, quickstart, beginner, tutorial. NOT for: specific service operations (use huawei-ecs, huawei-obs, etc.)."
+version: 1
+---
+
+# Huawei Cloud Getting Started
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+## KooCLI Installation
+
+| OS | Command |
+|----|---------|
+| Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download |
+| Linux | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
+| macOS | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
+
+## First-Time Setup
+1. **Install KooCLI** using command above
+2. **Accept privacy policy** (first run only): KooCLI requires one-time privacy agreement. Run `hcloud version` to read the agreement, then respond `y` to accept. Do not pipe `echo "y" |` — you must review the terms first.
+3. **Configure credentials (unified)**: `npx huaweicloud-devkit auth init` — prefer this over `hcloud configure init`, which only covers KooCLI.
+4. **Verify**: `hcloud configure list` to confirm profile, then `hcloud ECS ListServersDetails --cli-region=cn-north-4`
+5. For detailed auth guidance, see `huaweicloud-cli-and-auth` skill
+
+> **Security**: Never pass AK/SK as command-line arguments (`--ak=...`). Always use `npx huaweicloud-devkit auth init` (unified, interactive, recommended) or `hcloud configure init` (KooCLI only) to avoid secrets in shell history.
+
+### Non-Interactive Setup (Agent/CI Environments)
+
+When the interactive TUI is unavailable (Agent tools, CI/CD), use `hcloud configure set` — this must be run outside agent chat by the user:
+
+```bash
+# User executes in their terminal (NOT in agent chat):
+hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>
+
+# Agent verifies:
+hcloud configure list
+```
+
+## Critical Warnings
+| Trap | Why |
+|------|-----|
+| AK/SK must be kept secret | Never commit to git or share |
+| Default region applies to all commands | Override with --cli-region= per command |
+| Some services region-specific | Not all services available in all regions |
+| Privacy policy blocks first run | Run `hcloud version` to read and accept the agreement. Review the terms before responding `y` |
+
+## What Can I Do? (Quick Index)
+| Goal | Skill |
+|------|-------|
+| Create a VM | huawei-ecs |
+| Store files | huawei-obs |
+| Set up a database | huawei-rds / huawei-gaussdb |
+| Create a network | huawei-vpc |
+| Manage access | huawei-iam |
+| Deploy an app | huawei-deployment |
+| Run containers | huawei-cce |
+| Build an API | huawei-apig |
+| Run serverless | huawei-functiongraph |
+| Monitor resources | huawei-cloud-eye |
+
+## Pro Tips
+- Use `hcloud <Service> --help` to discover operations (see huaweicloud-capability-discovery)
+- Prepend `hcloud configure set --cli-region=<r>` to avoid per-command region flags
+- Pipe sensitive output through IAM with `--cli-output-format=json`

package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md

@@ -1,111 +1,111 @@
----
-name: huawei-iam
-description: "Use when managing IAM users, groups, roles, policies, agencies, projects, or access keys on Huawei Cloud. Covers IAM policy structure, least-privilege design, temporary credentials (STS), OneAccess integration, and security best practices. Triggers on: IAM, permission, policy, role, user, group, AK/SK, access key, agency, project, authorization. NOT for: DEW secret management (use huawei-dew)."
-version: 1
----
-
-# Huawei Cloud IAM
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers user/group/role lifecycle, policy design, temporary credentials, and security best practices.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
-| NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
-| Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
-| Agency trust is powerful | Agencies let services assume roles. Always add conditions |
-| Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
-
-## Policy Structure
-
-`json
-{
-  "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["ecs:*"],
-    "Resource": ["*"],
-    "Condition": {
-      "StringEquals": {"g:SourceVpc": "vpc-xxx"}
-    }
-  }]
-}
-`
-
-## Common Workflows
-
-| Task | Command | Steps |
-|------|---------|-------|
-| List users | hcloud IAM ListUsers | references/iam-ops.md |
-| Create group | hcloud IAM CreateGroup --group.name=<name> | references/iam-ops.md |
-| Create custom policy | hcloud IAM CreateCustomPolicy --policy.name=<n> --policy.document=<json> | references/policy-examples.md |
-| Create agency | hcloud IAM CreateAgency --agency.name=<n> --agency.domain_id=<id> --agency.trust_policy=<json> | references/agency.md |
-| Get temporary credential | hcloud STS GetTemporaryCredential --agency_name=<n> --domain_id=<id> --duration_seconds=3600 | references/sts.md |
-| Attach policy | hcloud IAM AttachGroupPolicy --group_id=<id> --policy_id=<id> | references/iam-ops.md |
-
-## Policy Examples (Least Privilege)
-
-| Role | Actions | Resource |
-|------|---------|----------|
-| ECS Reader | ecs:List*, ecs:Get*, ecs:Describe* | * |
-| OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List* | obs:*:*:bucket:my-bucket |
-| RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:* |
-
-> See `references/policy-examples.md` for complete policy JSON templates with conditions.
-
-## Troubleshooting
-
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| AccessDenied | Missing IAM permission -> Check policy action and resource scope |
-| AuthFailure | Expired AK/SK or wrong project -> Renew credentials / Check project ID |
-| Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition |
-| Quota exceeded | IAM user/group/policy limit -> Request quota increase |
-
-## Security Considerations
-
-- MUST NOT create IAM users. Use OneAccess or federated SSO
-- MUST NOT create long-term AK/SK. Use STS temporary tokens
-- MUST scope Resource ARNs. Never use wildcard *
-- MUST add conditions to trust policies (g:SourceAccount, g:SourceUrn)
-- SHOULD rotate credentials every 90 days
-
-## Agencies (Cross-Service Delegation)
-
-Agencies allow one service to act on behalf of another. Common use cases:
-
-### FunctionGraph Agency (VPC Access)
-
-FunctionGraph needs an agency to access VPC resources (RDS, DCS, etc.):
-
-```bash
-# 1. Create agency with FunctionGraph trust
-hcloud IAM CreateAgency --agency_name=<name> --trust_domain_name=functiongraph
-
-# 2. Attach VPC Administrator role
-hcloud IAM GrantRoleToAgency --agency_name=<name> --role_id=<role-id>
-
-# 3. Use in CreateFunction
-hcloud FunctionGraph CreateFunction ... --app_xrole=<agency-name>
-```
-
-Common roles for FunctionGraph: VPC Administrator, RDS Administrator, DCS Administrator.
-
-## MCP Tools
-
-- huaweicloud_list_operations service=IAM
-- huaweicloud_run_readonly_command for user/policy discovery
-
-## References
-
-- IAM Docs: https://support.huaweicloud.com/iam/
-- Policy examples: references/policy-examples.md
-- Agency setup: references/agency.md
+---
+name: huawei-iam
+description: "Use when managing IAM users, groups, roles, policies, agencies, projects, or access keys on Huawei Cloud. Covers IAM policy structure, least-privilege design, temporary credentials (STS), OneAccess integration, and security best practices. Triggers on: IAM, permission, policy, role, user, group, AK/SK, access key, agency, project, authorization. NOT for: DEW secret management (use huawei-dew)."
+version: 1
+---
+
+# Huawei Cloud IAM
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers user/group/role lifecycle, policy design, temporary credentials, and security best practices.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
+| NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
+| Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
+| Agency trust is powerful | Agencies let services assume roles. Always add conditions |
+| Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
+
+## Policy Structure
+
+`json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["ecs:*"],
+    "Resource": ["*"],
+    "Condition": {
+      "StringEquals": {"g:SourceVpc": "vpc-xxx"}
+    }
+  }]
+}
+`
+
+## Common Workflows
+
+| Task | Command | Steps |
+|------|---------|-------|
+| List users | hcloud IAM ListUsers | references/iam-ops.md |
+| Create group | hcloud IAM CreateGroup --group.name=<name> | references/iam-ops.md |
+| Create custom policy | hcloud IAM CreateCustomPolicy --policy.name=<n> --policy.document=<json> | references/policy-examples.md |
+| Create agency | hcloud IAM CreateAgency --agency.name=<n> --agency.domain_id=<id> --agency.trust_policy=<json> | references/agency.md |
+| Get temporary credential | hcloud STS GetTemporaryCredential --agency_name=<n> --domain_id=<id> --duration_seconds=3600 | references/sts.md |
+| Attach policy | hcloud IAM AttachGroupPolicy --group_id=<id> --policy_id=<id> | references/iam-ops.md |
+
+## Policy Examples (Least Privilege)
+
+| Role | Actions | Resource |
+|------|---------|----------|
+| ECS Reader | ecs:List*, ecs:Get*, ecs:Describe* | * |
+| OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List* | obs:*:*:bucket:my-bucket |
+| RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:* |
+
+> See `references/policy-examples.md` for complete policy JSON templates with conditions.
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|------------------|
+| AccessDenied | Missing IAM permission -> Check policy action and resource scope |
+| AuthFailure | Expired AK/SK or wrong project -> Renew credentials / Check project ID |
+| Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition |
+| Quota exceeded | IAM user/group/policy limit -> Request quota increase |
+
+## Security Considerations
+
+- MUST NOT create IAM users. Use OneAccess or federated SSO
+- MUST NOT create long-term AK/SK. Use STS temporary tokens
+- MUST scope Resource ARNs. Never use wildcard *
+- MUST add conditions to trust policies (g:SourceAccount, g:SourceUrn)
+- SHOULD rotate credentials every 90 days
+
+## Agencies (Cross-Service Delegation)
+
+Agencies allow one service to act on behalf of another. Common use cases:
+
+### FunctionGraph Agency (VPC Access)
+
+FunctionGraph needs an agency to access VPC resources (RDS, DCS, etc.):
+
+```bash
+# 1. Create agency with FunctionGraph trust
+hcloud IAM CreateAgency --agency_name=<name> --trust_domain_name=functiongraph
+
+# 2. Attach VPC Administrator role
+hcloud IAM GrantRoleToAgency --agency_name=<name> --role_id=<role-id>
+
+# 3. Use in CreateFunction
+hcloud FunctionGraph CreateFunction ... --app_xrole=<agency-name>
+```
+
+Common roles for FunctionGraph: VPC Administrator, RDS Administrator, DCS Administrator.
+
+## MCP Tools
+
+- huaweicloud_list_operations service=IAM
+- huaweicloud_run_readonly_command for user/policy discovery
+
+## References
+
+- IAM Docs: https://support.huaweicloud.com/iam/
+- Policy examples: references/policy-examples.md
+- Agency setup: references/agency.md

package/plugins/huaweicloud-core/skills/huawei-iam/references/policy-examples.md

@@ -1,122 +1,122 @@
-# IAM Policy Examples
-
-## Huawei Cloud IAM Policy Format
-
-Huawei Cloud IAM uses a different action naming convention from AWS. Actions use lowercase service prefixes:
-
-```
-<service>:<resource>:<action>
-```
-
-Examples:
-- `ecs:servers:list` (NOT `ecs:ListInstances`)
-- `obs:bucket:GetBucket` (NOT `s3:GetBucket`)
-- `vpc:vpcs:list` (NOT `vpc:DescribeVpcs`)
-
-Always verify exact action names via `https://support.huaweicloud.com/usermanual-iam/iam_01_0001.html` or KooCLI `--help`.
-
-## Read-Only Policies
-
-### ECS Read-Only
-```json
-{
-  "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["ecs:servers:list", "ecs:servers:get", "ecs:*:list", "ecs:*:get"],
-    "Resource": ["*"]
-  }]
-}
-```
-
-### OBS Read-Only (scoped bucket)
-```json
-{
-  "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["obs:bucket:Get*", "obs:bucket:List*", "obs:object:Get*"],
-    "Resource": ["obs:*:*:bucket:my-bucket", "obs:*:*:bucket:my-bucket/*"]
-  }]
-}
-```
-
-### FunctionGraph Read-Only
-```json
-{
-  "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["functiongraph:function:getConfig", "functiongraph:function:list", "functiongraph:function:invoke", "functiongraph:trigger:list"],
-    "Resource": ["*"]
-  }]
-}
-```
-
-## Full-Access (Scoped)
-
-### RDS Operator
-```json
-{
-  "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["rds:*"],
-    "Resource": ["*"],
-    "Condition": {"StringEquals": {"g:ResourceTag/Environment": ["dev", "staging"]}}
-  }]
-}
-```
-
-### FunctionGraph Developer
-```json
-{
-  "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["functiongraph:function:*", "functiongraph:trigger:*", "functiongraph:runtime:list"],
-    "Resource": ["*"]
-  }]
-}
-```
-
-### APIG Operator
-```json
-{
-  "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["apig:instance:*", "apig:api:*", "apig:group:*", "apig:environment:*"],
-    "Resource": ["*"]
-  }]
-}
-```
-
-## Best Practices
-
-1. **Least privilege**: Start with empty policy, add only needed actions
-2. **No `*` wildcard on Resource**: Scope to specific resources or use tag conditions
-3. **Use Condition keys**: `g:RequestedRegion`, `g:ResourceTag`, `g:CurrentTime` for context-aware policies
-4. **Separate policies per role**: Don't combine read and write in one policy
-
-## Confused Deputy Protection
-
-```json
-{
-  "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["ecs:*"],
-    "Resource": ["*"],
-    "Condition": {
-      "StringEquals": {"g:SourceAccount": "0123456789"},
-      "StringLike": {"g:SourceUrn": "urn:fss:*"}
-    }
-  }]
-}
-```
-
-## References
-
-- IAM Action Reference: https://support.huaweicloud.com/usermanual-iam/iam_01_0001.html
-- Policy Syntax: https://support.huaweicloud.com/usermanual-iam/iam_01_0602.html
+# IAM Policy Examples
+
+## Huawei Cloud IAM Policy Format
+
+Huawei Cloud IAM uses a different action naming convention from AWS. Actions use lowercase service prefixes:
+
+```
+<service>:<resource>:<action>
+```
+
+Examples:
+- `ecs:servers:list` (NOT `ecs:ListInstances`)
+- `obs:bucket:GetBucket` (NOT `s3:GetBucket`)
+- `vpc:vpcs:list` (NOT `vpc:DescribeVpcs`)
+
+Always verify exact action names via `https://support.huaweicloud.com/usermanual-iam/iam_01_0001.html` or KooCLI `--help`.
+
+## Read-Only Policies
+
+### ECS Read-Only
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["ecs:servers:list", "ecs:servers:get", "ecs:*:list", "ecs:*:get"],
+    "Resource": ["*"]
+  }]
+}
+```
+
+### OBS Read-Only (scoped bucket)
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["obs:bucket:Get*", "obs:bucket:List*", "obs:object:Get*"],
+    "Resource": ["obs:*:*:bucket:my-bucket", "obs:*:*:bucket:my-bucket/*"]
+  }]
+}
+```
+
+### FunctionGraph Read-Only
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["functiongraph:function:getConfig", "functiongraph:function:list", "functiongraph:function:invoke", "functiongraph:trigger:list"],
+    "Resource": ["*"]
+  }]
+}
+```
+
+## Full-Access (Scoped)
+
+### RDS Operator
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["rds:*"],
+    "Resource": ["*"],
+    "Condition": {"StringEquals": {"g:ResourceTag/Environment": ["dev", "staging"]}}
+  }]
+}
+```
+
+### FunctionGraph Developer
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["functiongraph:function:*", "functiongraph:trigger:*", "functiongraph:runtime:list"],
+    "Resource": ["*"]
+  }]
+}
+```
+
+### APIG Operator
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["apig:instance:*", "apig:api:*", "apig:group:*", "apig:environment:*"],
+    "Resource": ["*"]
+  }]
+}
+```
+
+## Best Practices
+
+1. **Least privilege**: Start with empty policy, add only needed actions
+2. **No `*` wildcard on Resource**: Scope to specific resources or use tag conditions
+3. **Use Condition keys**: `g:RequestedRegion`, `g:ResourceTag`, `g:CurrentTime` for context-aware policies
+4. **Separate policies per role**: Don't combine read and write in one policy
+
+## Confused Deputy Protection
+
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["ecs:*"],
+    "Resource": ["*"],
+    "Condition": {
+      "StringEquals": {"g:SourceAccount": "0123456789"},
+      "StringLike": {"g:SourceUrn": "urn:fss:*"}
+    }
+  }]
+}
+```
+
+## References
+
+- IAM Action Reference: https://support.huaweicloud.com/usermanual-iam/iam_01_0001.html
+- Policy Syntax: https://support.huaweicloud.com/usermanual-iam/iam_01_0602.html