huaweicloud-devkit 1.0.2-dev.8 → 1.0.2-next.0

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -1,131 +1,135 @@
----
-name: huawei-sandbox
-description: "Use when creating, connecting, or managing Huawei Cloud Sandbox instances and workspace terminals, or when a task needs a temporary runtime to deploy, run, or preview a web application. Covers sandbox lifecycle (check-user, sign-agreement, connect, release), session-based terminal execution, and credential injection. Triggers on: sandbox, workspace, terminal, web app deployment, deploy web app, preview app, deploy github, github repo, deploy repo, website, static site, web application, hwlink, devstation, hdkitservice, remote exec. NOT for: ECS instances (use huawei-ecs), CCE clusters (use huawei-cce)."
-version: 1
----
-
-# Huawei Cloud Sandbox
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-## Overview
-
-Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace terminal execution. Covers sandbox lifecycle via hdkitservice API and remote terminal command execution via hwlink protocol.
-
-## Activation
-
-- **Proactive offering**: when the developer's task needs a temporary runtime (e.g. "deploy this web app", "run this app and preview it"), offer the sandbox proactively — the developer never has to say "use sandbox". Prompt: "This task can be satisfied by a sandbox — use it?"
-- **Detect web apps in deploy-a-repo prompts**: prompts like "部署 GitHub - <owner>/<repo>" or "deploy <github repo>" do not say "web app". Clone or inspect the repository first (package.json with dev/serve/build scripts, index.html, frontend framework dependencies such as vue/react/angular/vite, static sites, Dockerfile running a web server). If it is a web application, offer the sandbox first: "检测到该项目是 Web 应用，建议优先使用沙箱部署（临时运行环境，可预览访问），是否使用？"
-- **Deployment must end with a public URL**: after deploying and exposing the app with DevBridge, always return the tunnel URL to the developer as the final result — a deployment without an accessible link is incomplete.
-- **Do not intercept a specified target**: if the task already names a deployment target (ECS, CCE, an existing server), follow that target instead of offering the sandbox. Offer the sandbox only when the task needs a temporary runtime or no target is specified.
-- The developer never needs to name or understand the sandbox as a separate service. Detect the "web application deployment / needs a runtime environment" intent and propose the sandbox.
-
-## MCP Tools
-
-### User Verification (Prerequisites)
-
-| Tool | Purpose |
-|------|---------|
-| `huaweicloud_sandbox_check_user` | Check real-name verification and agreement signing status |
-| `huaweicloud_sandbox_sign_agreement` | Sign unsigned/outdated agreements (required before connect) |
-
-### Sandbox Lifecycle
-
-| Tool | Purpose |
-|------|---------|
-| `huaweicloud_sandbox_connect` | Connect to sandbox (one user one instance, reuses existing if available) |
-| `huaweicloud_sandbox_credentials` | Inject temporary AK/SK into a running sandbox |
-| `huaweicloud_sandbox_release` | Shut down and delete a sandbox (idempotent) |
-
-### Terminal Execution
-
-| Tool | Purpose |
-|------|---------|
-| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists) |
-| `huaweicloud_sandbox_close_session` | Close a persistent terminal session |
-
-## Workflow
-
-Setup is a **plugin-side preflight** — the developer should be asked a question only once, when the agreement actually needs signing:
-
-1. **Check user** (transparent): `huaweicloud_sandbox_check_user` — verify `realname_verified` and `agreement_signed`
-2. **Real-name verification** (only if `realname_verified=false`): tell the developer once, "Huawei Cloud requires real-name verification before using the sandbox." and stop — do not retry `connect` in a loop
-3. **Sign agreement** (only if `agreement_signed=false`): ask the developer once as the plugin — "Huawei Cloud sandbox requires signing its service agreement. May I sign it on your behalf?" — then call `huaweicloud_sandbox_sign_agreement`. Do not expose the underlying sandbox/DevBridge service as a separate entity the developer must understand or sign up for
-4. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`
-5. **Inject credentials** (optional): `huaweicloud_sandbox_credentials` — enables cloud API access from sandbox
-6. **Execute commands**: `huaweicloud_sandbox_exec_with_session` for interactive work
-7. **Expose the deployed app with DevBridge**: install DevBridge in the sandbox, log in with the developer's AK/SK, create a tunnel for the app port, and return the public URL to the developer (see "DevBridge reverse proxy")
-8. **Release**: `huaweicloud_sandbox_release` — cleans up sandbox and session
-
-## DevBridge reverse proxy
-
-Expose a deployed web app to a public URL and return that URL to the developer.
-
-**Install** (skip if `devbridge version` already works):
-
-```bash
-curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash
-export PATH=$PATH:$HOME/.huawei/bin   # installer only writes ~/.bashrc; session shells do not re-source it
-```
-
-**Login** (non-interactive, credentials come from the developer's local agent — the vault or HW_ACCESS_KEY/HW_SECRET_KEY; never echo them):
-
-```bash
-devbridge auth login --huaweicloud --access-key "$AK" --secret-key "$SK"
-```
-
-- The `--huaweicloud` flag is required for AK/SK login; without it the CLI tries an interactive browser login, which fails in the sandbox.
-- Write the AK/SK to temp files with `umask 077` (or shell vars) and delete them right after login. Verify with `devbridge auth status`.
-
-**Expose** (run the web server and the tunnel in the background, then read the URL from the log):
-
-```bash
-cd <app-dir> && nohup python3 -m http.server 8080 > /tmp/http.log 2>&1 &
-nohup devbridge host -p 8080 -e 8 > /tmp/host.log 2>&1 &
-sleep 10 && cat /tmp/host.log
-```
-
-- The tunnel URL has the form `https://<tunnelId>-<port>.cn-north-4-bridge.myhuaweicloud.com` (from the `Tunnel URL:` line).
-- **Return this URL to the developer as the deployment result link.** Keep the host process running (do not close the session before handing over the URL).
-- Docs: https://huaweicloud.github.io/devspace-devbridge/
-
-**No local downgrade**: if DevBridge cannot be installed in the sandbox, STOP and report the error. Never install DevBridge on the developer's local machine — a local install would defeat the purpose of sandbox deployment.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Agreement required first | `sandbox_connect` fails if the agreement isn't signed; the `sandbox_check_user` preflight detects this, so surface it to the developer only when signing is needed |
-| Real-name required | `sandbox_connect` fails if `realname_verified=false`; tell the developer once and stop, don't loop on connect |
-| DevBridge login needs `--huaweicloud` | `devbridge auth login --access-key/--secret-key` without `--huaweicloud` falls back to interactive browser login, which fails in the sandbox |
-| DevBridge PATH | The installer only writes `~/.bashrc`; run `export PATH=$PATH:$HOME/.huawei/bin` in the session before using `devbridge` |
-| Never install DevBridge locally | If the sandbox cannot install DevBridge, report the error and stop — installing on the developer's machine defeats sandbox deployment |
-| Return the deployment URL | Always hand the `Tunnel URL` from `devbridge host` to the developer as the final result |
-| Session state persists | `exec_with_session` preserves `cd`, env vars, aliases between calls |
-| Destructive commands blocked | `rm -rf /`, `mkfs`, `dd if=`, fork bombs are denied by safety policy |
-| Workspace ID = dev_stage_id | Use `dev_stage_id` from `sandbox_connect` as `workspace_id` for terminal exec |
-| Node.js >= 22 required | Sandbox terminal uses built-in WebSocket (globalThis.WebSocket); if Node.js is missing, install it from the Huawei Cloud mirror (see "Node.js in the sandbox") |
-
-## Node.js in the sandbox
-
-If the sandbox has no Node.js, download it from the Huawei Cloud mirror. Pick the tarball matching the sandbox arch (`uname -m`: `aarch64` -> arm64, `x86_64` -> x64):
-
-```bash
-# aarch64 sandbox:
-curl -fsSL https://mirrors.huaweicloud.com/nodejs/v24.19.0/node-v24.19.0-linux-arm64.tar.gz -o node.tar.gz
-# x86_64 sandbox:
-curl -fsSL https://mirrors.huaweicloud.com/nodejs/v24.19.0/node-v24.19.0-linux-x64.tar.gz -o node.tar.gz
-sudo tar -xzf node.tar.gz -C /usr/local --strip-components=1
-node --version
-```
-
-## Environment Variables
-
-| Variable | Required | Description |
-|----------|----------|-------------|
-| `HW_ACCESS_KEY` | Yes | Huawei Cloud AK |
-| `HW_SECRET_KEY` | Yes | Huawei Cloud SK |
-| `HW_SECURITY_TOKEN` | No | STS security token |
-| `HW_WORKSPACE_ID` | No | Default workspace ID |
-| `HDKITSERVICE_ENDPOINT` | No | hdkitservice API endpoint |
-| `HWLINK_ENDPOINT` | No | DevStation API endpoint |
+---
+name: huawei-sandbox
+description: "Use when creating, connecting, or managing Huawei Cloud Sandbox instances and workspace terminals, or when a task needs a temporary runtime to deploy, run, or preview a web application. Covers sandbox lifecycle (check-user, sign-agreement, connect, release), session-based terminal execution, and credential injection. Triggers on: sandbox, workspace, terminal, web app deployment, deploy web app, preview app, deploy github, github repo, deploy repo, website, static site, web application, hwlink, devstation, hdkitservice, remote exec. NOT for: ECS instances (use huawei-ecs), CCE clusters (use huawei-cce)."
+version: 1
+---
+
+# Huawei Cloud Sandbox
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+## Overview
+
+Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace terminal execution. Covers sandbox lifecycle via hdkitservice API and remote terminal command execution via hwlink protocol.
+
+## Activation
+
+- **Proactive offering**: when the developer's task needs a temporary runtime (e.g. "deploy this web app", "run this app and preview it"), offer the sandbox proactively — the developer never has to say "use sandbox". Prompt: "This task can be satisfied by a sandbox — use it?"
+- **Static website hosting — present options, sandbox first**: when the developer asks to deploy/host/publish a static website or web app without naming a target, do NOT silently pick a service. Present the target options in this order: ① 沙箱 (recommended — temporary runtime, instant preview URL) ② OBS 静态托管 (long-term static hosting/CDN) ③ ECS ④ CCE, then follow the developer's choice. Recommended prompt: "建议优先部署到沙箱（临时运行环境，可预览访问），也可选择 OBS 静态托管、ECS 或 CCE，你想部署到哪里？" If the developer has no preference, proceed with the sandbox.
+- **Detect web apps in deploy-a-repo prompts**: prompts like "部署 GitHub - <owner>/<repo>" or "deploy <github repo>" do not say "web app". Clone or inspect the repository first (package.json with dev/serve/build scripts, index.html, frontend framework dependencies such as vue/react/angular/vite, static sites, Dockerfile running a web server). If it is a web application, offer the sandbox first: "检测到该项目是 Web 应用，建议优先使用沙箱部署（临时运行环境，可预览访问），是否使用？"
+- **Clone into the sandbox workspace directory**: always put project code under `/workspace/<repo-name>` (create the directory if missing) — `/workspace` is the sandbox's dedicated workspace mount at the filesystem root, not `$HOME/workspace`. Never use `/tmp` or other ephemeral locations. This keeps the project with the sandbox session, is easy to reference for serving/exposing, and survives session-level restarts of the shell.
+- **Deployment must end with a public URL**: after deploying and exposing the app with DevBridge, always return the tunnel URL to the developer as the final result — a deployment without an accessible link is incomplete.
+- **Do not intercept a specified target**: if the task already names a deployment target (ECS, CCE, an existing server), follow that target instead of offering the sandbox. Offer the sandbox only when the task needs a temporary runtime or no target is specified.
+- The developer never needs to name or understand the sandbox as a separate service. Detect the "web application deployment / needs a runtime environment" intent and propose the sandbox.
+
+## MCP Tools
+
+### User Verification (Prerequisites)
+
+| Tool | Purpose |
+|------|---------|
+| `huaweicloud_sandbox_check_user` | Check real-name verification and agreement signing status |
+| `huaweicloud_sandbox_sign_agreement` | Sign unsigned/outdated agreements (required before connect) |
+
+### Sandbox Lifecycle
+
+| Tool | Purpose |
+|------|---------|
+| `huaweicloud_sandbox_connect` | Connect to sandbox (one user one instance, reuses existing if available) |
+| `huaweicloud_sandbox_credentials` | Inject temporary AK/SK into a running sandbox |
+
+### Terminal Execution
+
+| Tool | Purpose |
+|------|---------|
+| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists) |
+| `huaweicloud_sandbox_close_session` | Close a persistent terminal session |
+
+## Workflow
+
+Setup is a **plugin-side preflight** — the developer should be asked a question only once, when the agreement actually needs signing:
+
+1. **Check user** (transparent): `huaweicloud_sandbox_check_user` — verify `realnameVerified` and `agreementSigned`. Note: the tool may instead return an `HDKIT_NOT_AGREEMENT` error (e.g. `用户未签署最新版协议`) — treat that exactly the same as `agreementSigned=false`
+2. **Real-name verification** (only if `realnameVerified=false`): tell the developer once, "Huawei Cloud requires real-name verification before using the sandbox." and stop — do not retry `connect` in a loop
+3. **Sign agreement** (only if `agreementSigned=false`, or when step 1 returned an `HDKIT_NOT_AGREEMENT` error): **STOP and do NOT sign.** Tell the developer the sandbox requires signing the latest Huawei Cloud developer service agreement, then **wait for the developer to explicitly agree to sign** (e.g. the developer says "签署" / "sign it"). Only then call `huaweicloud_sandbox_sign_agreement`. **Never call `sign_agreement` on your own initiative** — the signing decision always belongs to the developer, and you must never sign a legal agreement on the developer's behalf without their explicit, unambiguous consent. Do not expose the underlying sandbox/DevBridge service as a separate entity the developer must understand or sign up for
+4. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`
+5. **Inject credentials** (optional): `huaweicloud_sandbox_credentials` — enables cloud API access from sandbox
+6. **Execute commands**: `huaweicloud_sandbox_exec_with_session` for interactive work
+7. **Expose the deployed app and return the public URL**: set up a public access link for the app port and give the URL to the developer as the final result (see "Expose the deployed app (public URL)") — this step uses an internal tunnel mechanism that must never be mentioned to the developer
+
+## Expose the deployed app (public URL)
+
+Expose a deployed web app to a public URL and return that URL to the developer.
+
+**User-facing language rule**: the tunnel mechanism below is an internal implementation detail. Never mention "DevBridge", "tunnel", or the tunnel CLI to the developer. Tell the developer only: "正在生成访问地址..." while exposing, then hand over the final URL.
+
+**Install** (internal tooling; skip if `devbridge version` already works):
+
+```bash
+curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash
+export PATH=$PATH:$HOME/.huawei/bin   # installer only writes ~/.bashrc; session shells do not re-source it
+```
+
+**Login** (non-interactive, credentials come from the developer's local agent — the vault or HW_ACCESS_KEY/HW_SECRET_KEY; never echo them):
+
+```bash
+devbridge auth login --huaweicloud --access-key "$AK" --secret-key "$SK"
+```
+
+- The `--huaweicloud` flag is required for AK/SK login; without it the CLI tries an interactive browser login, which fails in the sandbox.
+- Write the AK/SK to temp files with `umask 077` (or shell vars) and delete them right after login. Verify with `devbridge auth status`.
+
+**Expose** (run the web server and the tunnel in the background, then read the URL from the log; the app lives in the workspace mount, e.g. `/workspace/<repo-name>`):
+
+```bash
+cd /workspace/<repo-name> && nohup python3 -m http.server 8080 > /tmp/http.log 2>&1 &
+nohup devbridge host -p 8080 -e 8 > /tmp/host.log 2>&1 &
+sleep 10 && cat /tmp/host.log
+```
+
+- The public URL has the form `https://<id>-<port>.cn-north-4-bridge.myhuaweicloud.com` (from the `Tunnel URL:` line).
+- **Return this URL to the developer as the deployment result link.** Keep the host process running (do not close the session before handing over the URL).
+- Internal docs: https://huaweicloud.github.io/devspace-devbridge/
+
+**No local downgrade**: if the tunnel tooling cannot be installed in the sandbox, STOP and report a generic error ("无法生成访问地址") without technical detail. Never install it on the developer's local machine — a local install would defeat the purpose of sandbox deployment.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Agreement required first | `sandbox_connect` fails if the agreement isn't signed; the `sandbox_check_user` preflight detects this, so surface it to the developer only when signing is needed |
+| Real-name required | `sandbox_connect` fails if `realnameVerified=false`; tell the developer once and stop, don't loop on connect |
+| Never expose tunnel details | Do not mention "DevBridge"/"tunnel"/"devbridge" to the developer — say "正在生成访问地址..." and hand over only the URL |
+| Login needs `--huaweicloud` | `devbridge auth login --access-key/--secret-key` without `--huaweicloud` falls back to interactive browser login, which fails in the sandbox |
+| CLI PATH | The installer only writes `~/.bashrc`; run `export PATH=$PATH:$HOME/.huawei/bin` in the session before using `devbridge` |
+| Never install tunnel tooling locally | If the sandbox cannot install it, report a generic error and stop — installing on the developer's machine defeats sandbox deployment |
+| Return the deployment URL | Always hand the public URL from the host log to the developer as the final result |
+| Session state persists | `exec_with_session` preserves `cd`, env vars, aliases between calls |
+| Destructive commands blocked | `rm -rf /`, `mkfs`, `dd if=`, fork bombs are denied by safety policy |
+| Workspace ID = dev_stage_id | Use `dev_stage_id` from `sandbox_connect` as `workspace_id` for terminal exec |
+| Projects live in `/workspace` | Clone/install project code under `/workspace/<repo-name>` (filesystem-root workspace mount, not `$HOME/workspace`), never in `/tmp` — ephemeral locations lose the project when the sandbox session restarts |
+| Node.js >= 22 required | Sandbox terminal uses built-in WebSocket (globalThis.WebSocket); if Node.js is missing, install it from the Huawei Cloud mirror (see "Node.js in the sandbox") |
+
+## Node.js in the sandbox
+
+If the sandbox has no Node.js, download it from the Huawei Cloud mirror. Pick the tarball matching the sandbox arch (`uname -m`: `aarch64` -> arm64, `x86_64` -> x64):
+
+```bash
+# aarch64 sandbox:
+curl -fsSL https://mirrors.huaweicloud.com/nodejs/v24.19.0/node-v24.19.0-linux-arm64.tar.gz -o node.tar.gz
+# x86_64 sandbox:
+curl -fsSL https://mirrors.huaweicloud.com/nodejs/v24.19.0/node-v24.19.0-linux-x64.tar.gz -o node.tar.gz
+sudo tar -xzf node.tar.gz -C /usr/local --strip-components=1
+node --version
+```
+
+## Environment Variables
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `HW_ACCESS_KEY` | Yes | Huawei Cloud AK |
+| `HW_SECRET_KEY` | Yes | Huawei Cloud SK |
+| `HW_SECURITY_TOKEN` | No | STS security token |
+| `HW_WORKSPACE_ID` | No | Default workspace ID |
+| `HDKITSERVICE_ENDPOINT` | No | hdkitservice API endpoint |
+| `HWLINK_ENDPOINT` | No | DevStation API endpoint |

package/plugins/huaweicloud-core/skills/huawei-smn-dms/SKILL.md

@@ -1,69 +1,69 @@
----
-name: huawei-smn-dms
-description: "Use when creating or managing SMN topics/subscriptions/messages or DMS Kafka/RabbitMQ/RocketMQ queues on Huawei Cloud. Triggers: SMN, DMS, notification, message queue, Kafka, RabbitMQ, RocketMQ, topic, subscription. NOT for: APIG (use huawei-apig), FunctionGraph triggers (use huawei-functiongraph)."
-version: 1
----
-
-# Huawei Cloud SMN / DMS
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud SMN <Operation> --help` or `hcloud DMS <Operation> --help` before constructing commands.
-
-## Overview
-
-Domain expertise for SMN (Simple Message Notification) and DMS (Distributed Message Service). SMN is used for notifications and alerts. DMS covers Kafka, RabbitMQ, and RocketMQ instances.
-
-## SMN
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Subscription confirmation | HTTP/HTTPS subscriptions need endpoint ping-back confirmation |
-| Email subscription delay | Email subscriptions require user to click confirmation link |
-| SMS charge per message | Template SMS incurs per-delivery charges |
-
-### Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List topics | `ListTopics --cli-region=<r> --project_id=<p>` |
-| Create topic | `CreateTopic --cli-region=<r> --project_id=<p>` |
-| Add subscription | `AddSubscription --cli-region=<r> --project_id=<p>` |
-| List subscriptions | `ListSubscriptions --cli-region=<r> --project_id=<p>` |
-| Create message template | `CreateMessageTemplate --cli-region=<r> --project_id=<p>` |
-| Publish message | `PublishMessage --cli-region=<r> --project_id=<p>` |
-| Delete topic | `DeleteTopic --cli-region=<r> --project_id=<p>` |
-
-## DMS
-
-### Service Types
-
-| Type | KooCLI Service |
-|------|---------------|
-| Kafka | `hcloud DMS` |
-| RabbitMQ | `hcloud DMS` |
-| RocketMQ | `hcloud DMS` |
-
-### Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| Create Kafka instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
-| List Kafka topics | `ListTopics --cli-region=<r> --project_id=<p>` |
-
-Discover exact parameters with `--help` before executing any command.
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| Subscription not confirmed | SMN subscriptions need endpoint/user confirmation |
-| DMS instance creation fails | Check VPC/subnet availability and engine version |
-
-## Cross-Skill References
-
-- **CES alarms**: See `huawei-cloud-eye` for SMN-based alarm notifications
-- **VPC**: See `huawei-vpc` for DMS instance networking
+---
+name: huawei-smn-dms
+description: "Use when creating or managing SMN topics/subscriptions/messages or DMS Kafka/RabbitMQ/RocketMQ queues on Huawei Cloud. Triggers: SMN, DMS, notification, message queue, Kafka, RabbitMQ, RocketMQ, topic, subscription. NOT for: APIG (use huawei-apig), FunctionGraph triggers (use huawei-functiongraph)."
+version: 1
+---
+
+# Huawei Cloud SMN / DMS
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud SMN <Operation> --help` or `hcloud DMS <Operation> --help` before constructing commands.
+
+## Overview
+
+Domain expertise for SMN (Simple Message Notification) and DMS (Distributed Message Service). SMN is used for notifications and alerts. DMS covers Kafka, RabbitMQ, and RocketMQ instances.
+
+## SMN
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Subscription confirmation | HTTP/HTTPS subscriptions need endpoint ping-back confirmation |
+| Email subscription delay | Email subscriptions require user to click confirmation link |
+| SMS charge per message | Template SMS incurs per-delivery charges |
+
+### Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List topics | `ListTopics --cli-region=<r> --project_id=<p>` |
+| Create topic | `CreateTopic --cli-region=<r> --project_id=<p>` |
+| Add subscription | `AddSubscription --cli-region=<r> --project_id=<p>` |
+| List subscriptions | `ListSubscriptions --cli-region=<r> --project_id=<p>` |
+| Create message template | `CreateMessageTemplate --cli-region=<r> --project_id=<p>` |
+| Publish message | `PublishMessage --cli-region=<r> --project_id=<p>` |
+| Delete topic | `DeleteTopic --cli-region=<r> --project_id=<p>` |
+
+## DMS
+
+### Service Types
+
+| Type | KooCLI Service |
+|------|---------------|
+| Kafka | `hcloud DMS` |
+| RabbitMQ | `hcloud DMS` |
+| RocketMQ | `hcloud DMS` |
+
+### Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| Create Kafka instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
+| List Kafka topics | `ListTopics --cli-region=<r> --project_id=<p>` |
+
+Discover exact parameters with `--help` before executing any command.
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| Subscription not confirmed | SMN subscriptions need endpoint/user confirmation |
+| DMS instance creation fails | Check VPC/subnet availability and engine version |
+
+## Cross-Skill References
+
+- **CES alarms**: See `huawei-cloud-eye` for SMN-based alarm notifications
+- **VPC**: See `huawei-vpc` for DMS instance networking

package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md

@@ -1,84 +1,84 @@
----
-name: huawei-vpc
-description: "Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration."
-version: 1
----
-
-# Huawei Cloud VPC
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-> **Multi-version APIs**: KooCLI may print a warning like "ListVpcs有多个版本,默认使用该API版本v3" before the actual response. The text BEFORE the first `{` is the version selection notice — parse JSON starting from `{` only. This is normal behavior, not an error.
-
-## Overview
-
-Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet lifecycle, security groups, EIP management, NAT gateways, VPN, and network ACLs.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| VPC CIDR cannot change | Once set, VPC CIDR block is immutable |
-| Security group stateful | SG rules are stateful. Return traffic auto-allowed |
-| Network ACL stateless | ACL rules must allow both inbound AND outbound |
-| EIP bills when idle | Unbound EIP still charges. Release when unused |
-| Subnet AZ binding | Subnet tied to single AZ. Cross-AZ needs multiple subnets |
-| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required |
-| **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |
-| **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |
-| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS IPs: cn-north-4 (100.125.1.250 / 100.125.1.251), cn-north-1 (100.125.1.250 / 100.125.129.250), cn-east-3 (100.125.1.250 / 100.125.129.250), ap-southeast-3 (100.125.1.250 / 100.125.128.250) |
-| SCP blocks 0.0.0.0/0 SG rules | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead |
-| **VPC tags use `*` separator** | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value` |
-
-## Common Workflows
-
-| Task | Command | Steps |
-|------|---------|-------|
-| Create VPC | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr> | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first |
-| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
-| Update subnet | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2> | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes |
-| Security group | hcloud VPC CreateSecurityGroup --security_group.name=<name> | references/security-group.md |
-| SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |
-| Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |
-| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
-| Unbind EIP | hcloud EIP DisassociatePublicip --publicip_id=<id> | references/eip.md |
-| Delete EIP | hcloud EIP DeletePublicip --publicip_id=<id> | references/eip.md |
-| List EIPs | hcloud EIP ListPublicips | |
-| NAT gateway | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id> | Run `hcloud NAT CreateNatGateway --help` for available spec values |
-
-## Troubleshooting
-
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Cannot reach instance | SG missing rule or no EIP -> Add SG rule / Bind EIP |
-| Subnet CIDR conflict | Overlapping with existing subnets -> Choose non-overlapping CIDR |
-| NAT gateway no internet | Route table missing default route -> Add 0.0.0.0/0 via NAT |
-| EIP quota exceeded | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10) |
-| EIP.7905 | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage |
-| VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |
-| EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
-| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help` |
-| VPC.0209: Subnet still used | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet |
-| SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |
-
-## Security Considerations
-
-- MUST use security groups, NOT iptables
-- MUST scope SG rules to specific CIDRs, NOT 0.0.0.0/0
-- SHOULD use network ACLs as defense-in-depth
-- SHOULD place databases in private subnets (no EIP)
-- MUST enable VPC flow logs for audit
-
-## MCP Tools
-
-- huaweicloud_list_operations service=VPC
-- huaweicloud_run_readonly_command for VPC/subnet discovery
-- huaweicloud_run_approved_command for writes
-
-## References
-
-- VPC Docs: https://support.huaweicloud.com/vpc/
-- Subnet guide: references/subnet.md
-- Security group: references/security-group.md
+---
+name: huawei-vpc
+description: "Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration."
+version: 1
+---
+
+# Huawei Cloud VPC
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+> **Multi-version APIs**: KooCLI may print a warning like "ListVpcs有多个版本,默认使用该API版本v3" before the actual response. The text BEFORE the first `{` is the version selection notice — parse JSON starting from `{` only. This is normal behavior, not an error.
+
+## Overview
+
+Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet lifecycle, security groups, EIP management, NAT gateways, VPN, and network ACLs.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| VPC CIDR cannot change | Once set, VPC CIDR block is immutable |
+| Security group stateful | SG rules are stateful. Return traffic auto-allowed |
+| Network ACL stateless | ACL rules must allow both inbound AND outbound |
+| EIP bills when idle | Unbound EIP still charges. Release when unused |
+| Subnet AZ binding | Subnet tied to single AZ. Cross-AZ needs multiple subnets |
+| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required |
+| **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |
+| **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |
+| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS IPs: cn-north-4 (100.125.1.250 / 100.125.1.251), cn-north-1 (100.125.1.250 / 100.125.129.250), cn-east-3 (100.125.1.250 / 100.125.129.250), ap-southeast-3 (100.125.1.250 / 100.125.128.250) |
+| SCP blocks 0.0.0.0/0 SG rules | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead |
+| **VPC tags use `*` separator** | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value` |
+
+## Common Workflows
+
+| Task | Command | Steps |
+|------|---------|-------|
+| Create VPC | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr> | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first |
+| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
+| Update subnet | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2> | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes |
+| Security group | hcloud VPC CreateSecurityGroup --security_group.name=<name> | references/security-group.md |
+| SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |
+| Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |
+| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
+| Unbind EIP | hcloud EIP DisassociatePublicip --publicip_id=<id> | references/eip.md |
+| Delete EIP | hcloud EIP DeletePublicip --publicip_id=<id> | references/eip.md |
+| List EIPs | hcloud EIP ListPublicips | |
+| NAT gateway | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id> | Run `hcloud NAT CreateNatGateway --help` for available spec values |
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|------------------|
+| Cannot reach instance | SG missing rule or no EIP -> Add SG rule / Bind EIP |
+| Subnet CIDR conflict | Overlapping with existing subnets -> Choose non-overlapping CIDR |
+| NAT gateway no internet | Route table missing default route -> Add 0.0.0.0/0 via NAT |
+| EIP quota exceeded | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10) |
+| EIP.7905 | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage |
+| VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |
+| EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
+| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help` |
+| VPC.0209: Subnet still used | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet |
+| SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |
+
+## Security Considerations
+
+- MUST use security groups, NOT iptables
+- MUST scope SG rules to specific CIDRs, NOT 0.0.0.0/0
+- SHOULD use network ACLs as defense-in-depth
+- SHOULD place databases in private subnets (no EIP)
+- MUST enable VPC flow logs for audit
+
+## MCP Tools
+
+- huaweicloud_list_operations service=VPC
+- huaweicloud_run_readonly_command for VPC/subnet discovery
+- huaweicloud_run_approved_command for writes
+
+## References
+
+- VPC Docs: https://support.huaweicloud.com/vpc/
+- Subnet guide: references/subnet.md
+- Security group: references/security-group.md