huaweicloud-devkit 1.0.2-dev.9 → 1.0.2-next.0

package/plugins/huaweicloud-core/skills/huaweicloud-core/references/report-issue.md

@@ -1,20 +1,20 @@
-# Issue Reporting Procedure
-
-Use when the user reports an issue with a previous routing decision.
-
-## Procedure
-
-1. Acknowledge the feedback without defensiveness
-2. Re-check the Sub-skill registry for a better match
-3. If a different service is clearly right, load that skill
-4. If unclear, broaden the search: use huaweicloud_search_docs
-5. Document the mismatch so the registry can be improved
-
-## Common Corrections
-
-| Wrong Routing | Likely Correct |
-|---------------|---------------|
-| ECS for containers | CCE |
-| OBS for block storage | EVS (via huawei-ecs) |
-| RDS for cache | DCS (via huawei-dds-dcs) |
+# Issue Reporting Procedure
+
+Use when the user reports an issue with a previous routing decision.
+
+## Procedure
+
+1. Acknowledge the feedback without defensiveness
+2. Re-check the Sub-skill registry for a better match
+3. If a different service is clearly right, load that skill
+4. If unclear, broaden the search: use huaweicloud_search_docs
+5. Document the mismatch so the registry can be improved
+
+## Common Corrections
+
+| Wrong Routing | Likely Correct |
+|---------------|---------------|
+| ECS for containers | CCE |
+| OBS for block storage | EVS (via huawei-ecs) |
+| RDS for cache | DCS (via huawei-dds-dcs) |
 | FunctionGraph for long-running tasks | ECS or CCE |

package/plugins/huaweicloud-core/skills/huaweicloud-core/references/select.md

@@ -1,28 +1,28 @@
-# Service Selection Procedure
-
-Use when the user asks which service to use or compares services.
-
-## Decision Flow
-
-1. Classify workload: compute, storage, database, network, serverless, AI, messaging, security, observability
-2. Check Service Map in huaweicloud-core SKILL.md
-3. If multiple services match, ask clarifying questions:
-   - Expected scale (small demo vs production)
-   - Data model (relational vs document vs key-value)
-   - Latency requirements
-   - Budget constraints
-4. Present top 1-2 recommendations with rationale
-5. Hand off to the selected service skill
-
-## Example: I need a database
-
-Ask:
-- What type of data? Structured (tables) or flexible (documents)?
-- What scale? Small app or enterprise?
-- Do you need SQL queries?
-
-Route based on answers:
-- SQL + standard scale -> huawei-rds
-- SQL + massive scale / distributed -> huawei-gaussdb
-- Document model (MongoDB-compatible) -> huawei-dds-dcs
+# Service Selection Procedure
+
+Use when the user asks which service to use or compares services.
+
+## Decision Flow
+
+1. Classify workload: compute, storage, database, network, serverless, AI, messaging, security, observability
+2. Check Service Map in huaweicloud-core SKILL.md
+3. If multiple services match, ask clarifying questions:
+   - Expected scale (small demo vs production)
+   - Data model (relational vs document vs key-value)
+   - Latency requirements
+   - Budget constraints
+4. Present top 1-2 recommendations with rationale
+5. Hand off to the selected service skill
+
+## Example: I need a database
+
+Ask:
+- What type of data? Structured (tables) or flexible (documents)?
+- What scale? Small app or enterprise?
+- Do you need SQL queries?
+
+Route based on answers:
+- SQL + standard scale -> huawei-rds
+- SQL + massive scale / distributed -> huawei-gaussdb
+- Document model (MongoDB-compatible) -> huawei-dds-dcs
 - Cache / key-value -> huawei-dds-dcs (DCS)

package/plugins/huaweicloud-core/skills/huaweicloud-safety/SKILL.md

@@ -1,60 +1,60 @@
----
-name: huaweicloud-safety
-description: Huawei Cloud safety policy for agents. Use when handling credentials, secrets, IAM, public exposure, billing, destructive actions, scaling, write operations, hooks, command approval, output redaction, or risk review.
----
-
-# Huawei Cloud Safety
-
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Use this skill before any Huawei Cloud action that may expose secrets, change resources, affect cost, change IAM, or expose a network endpoint.
-
-## Rules
-
-1. Never ask the user to paste AK/SK, SK, tokens, passwords, private keys, or credential files.
-2. Never read local `.hcloud` or `.huaweicloud` credential files into the agent context.
-3. Never call APIs or CLI operations that return secret values directly into the agent context.
-4. Always classify operations before execution:
-   - read-only
-   - write
-   - secret
-   - IAM/security
-   - cost/payment
-   - public exposure
-5. For any non-read-only operation, show the exact planned change and wait for explicit user approval.
-6. Redact secrets from command output, errors, JSON, logs, and generated reports.
-7. If a command contains `adminPass`, `password`, token, or any secret-like field, warn that plaintext can remain in shell history. Prefer local-only input, runtime injection, or user-side execution.
-
-## Enforcement Layers
-
-- Hooks: `hooks/huaweicloud-safety.py` can block risky tool calls on platforms that support plugin hooks.
-- MCP wrapper: the Node MCP server applies the same safety policy for Codex/OpenCode paths that do not enforce hooks.
-- Skills: this document teaches agents the rule before they act.
-
-## Write Execution Boundary
-
-- Default path: use `huaweicloud_plan_cli_command` to produce a reviewed command block, then let the user or host agent execute it after approval.
-- Approved tool path: use `huaweicloud_run_approved_command` only when the exact planned command has been shown and the user explicitly approved that exact command.
-- After a write, verify with `huaweicloud_run_readonly_command` or another read-only check.
-
-## Proactive Hook Checks
-
-Before executing, deploying, or handing generated cloud artifacts to the user, run the matching check when available:
-
-- `huaweicloud_hook_check_command` for shell or KooCLI command text.
-- `huaweicloud_hook_check_artifacts` for generated policy, IaC, config, workflow, or deployment files.
-- `huaweicloud_hook_check_deploy_plan` for sandbox, preview, FunctionGraph, ECS, CCE, APIG, OBS, IAM, or cost-affecting plans.
-
-If the result is `deny`, repair the command, artifact, or deployment plan before execution. If the result is `warn`, show the warning to the user and repair or ask for explicit confirmation.
-
-## Static Analysis Boundary
-
-Hook checks inspect the command or plan text that is available before execution. If a command builds cloud parameters through shell variables, string concatenation, subshells, encoded payloads, or generated scripts, first expand the final command into reviewable text and run `huaweicloud_hook_check_command` on that final form. When the final values cannot be determined, stop and ask the user to review the expanded command or use `huaweicloud_plan_cli_command` before execution.
-
-## Safe Alternatives
-
-- Use redacted profile inspection instead of raw `hcloud configure show`.
-- Use runtime secret injection instead of fetching secret values into chat.
-- Use read-only verification after a write.
-- Prefer reviewed IaC for durable infrastructure changes.
+---
+name: huaweicloud-safety
+description: Huawei Cloud safety policy for agents. Use when handling credentials, secrets, IAM, public exposure, billing, destructive actions, scaling, write operations, hooks, command approval, output redaction, or risk review.
+---
+
+# Huawei Cloud Safety
+
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Use this skill before any Huawei Cloud action that may expose secrets, change resources, affect cost, change IAM, or expose a network endpoint.
+
+## Rules
+
+1. Never ask the user to paste AK/SK, SK, tokens, passwords, private keys, or credential files.
+2. Never read local `.hcloud` or `.huaweicloud` credential files into the agent context.
+3. Never call APIs or CLI operations that return secret values directly into the agent context.
+4. Always classify operations before execution:
+   - read-only
+   - write
+   - secret
+   - IAM/security
+   - cost/payment
+   - public exposure
+5. For any non-read-only operation, show the exact planned change and wait for explicit user approval.
+6. Redact secrets from command output, errors, JSON, logs, and generated reports.
+7. If a command contains `adminPass`, `password`, token, or any secret-like field, warn that plaintext can remain in shell history. Prefer local-only input, runtime injection, or user-side execution.
+
+## Enforcement Layers
+
+- Hooks: `hooks/huaweicloud-safety.py` can block risky tool calls on platforms that support plugin hooks.
+- MCP wrapper: the Node MCP server applies the same safety policy for Codex/OpenCode paths that do not enforce hooks.
+- Skills: this document teaches agents the rule before they act.
+
+## Write Execution Boundary
+
+- Default path: use `huaweicloud_plan_cli_command` to produce a reviewed command block, then let the user or host agent execute it after approval.
+- Approved tool path: use `huaweicloud_run_approved_command` only when the exact planned command has been shown and the user explicitly approved that exact command.
+- After a write, verify with `huaweicloud_run_readonly_command` or another read-only check.
+
+## Proactive Hook Checks
+
+Before executing, deploying, or handing generated cloud artifacts to the user, run the matching check when available:
+
+- `huaweicloud_hook_check_command` for shell or KooCLI command text.
+- `huaweicloud_hook_check_artifacts` for generated policy, IaC, config, workflow, or deployment files.
+- `huaweicloud_hook_check_deploy_plan` for sandbox, preview, FunctionGraph, ECS, CCE, APIG, OBS, IAM, or cost-affecting plans.
+
+If the result is `deny`, repair the command, artifact, or deployment plan before execution. If the result is `warn`, show the warning to the user and repair or ask for explicit confirmation.
+
+## Static Analysis Boundary
+
+Hook checks inspect the command or plan text that is available before execution. If a command builds cloud parameters through shell variables, string concatenation, subshells, encoded payloads, or generated scripts, first expand the final command into reviewable text and run `huaweicloud_hook_check_command` on that final form. When the final values cannot be determined, stop and ask the user to review the expanded command or use `huaweicloud_plan_cli_command` before execution.
+
+## Safe Alternatives
+
+- Use redacted profile inspection instead of raw `hcloud configure show`.
+- Use runtime secret injection instead of fetching secret values into chat.
+- Use read-only verification after a write.
+- Prefer reviewed IaC for durable infrastructure changes.

package/plugins/huaweicloud-core/skills/huaweicloud-safety/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Huawei Cloud Safety"
-  short_description: "Keep Huawei Cloud agent operations safe and redacted."
-  default_prompt: "Use $huaweicloud-safety to review this Huawei Cloud operation."
+interface:
+  display_name: "Huawei Cloud Safety"
+  short_description: "Keep Huawei Cloud agent operations safe and redacted."
+  default_prompt: "Use $huaweicloud-safety to review this Huawei Cloud operation."

package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/SKILL.md

@@ -1,83 +1,83 @@
----
-name: huaweicloud-troubleshooting
-description: Troubleshoot Huawei Cloud CLI, API, SDK, deployment, permission, region, quota, endpoint, and resource errors. Use when commands fail, APIs return errors, resources are missing, or the user needs a structured diagnosis.
----
-
-# Huawei Cloud Troubleshooting
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Use evidence before fixes. Do not guess service behavior when request IDs, region, project_id, and exact errors can identify the issue.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Error in response body, not HTTP status | Many APIs return HTTP 200 with error in JSON body. Always check `error_code` and `error_msg` |
-| Missing `project_id` is common | New users often omit project_id from API path or CLI. Get it from `IAM KeystoneListProjects` |
-| Sandbox may block hcloud | OpenCode/Codex sandbox can block hcloud metadata files in `~/.hcloud/`. Use `dangerouslyDisableSandbox` or Bash tool |
-| KooCLI param prefix varies | VPC params need `--vpc.x`, ECS params need `--server.x`, ALWAYS check `--help` first |
-
-## Workflow
-
-1. Capture the redacted error message, service, operation, region, project_id, and request_id.
-2. Classify likely cause:
-   - auth or permission
-   - wrong region or endpoint
-   - wrong project_id
-   - missing resource
-   - quota or account limit
-   - invalid request body
-   - service-side failure
-3. Run the smallest read-only check that can prove or disprove the cause.
-4. Compare with official API/SDK docs or Huawei Cloud Skills if the operation contract is uncertain.
-5. Propose one fix at a time.
-6. Verify with read-only observation after the fix.
-
-## Common Checks
-
-| Check | Command |
-|-------|---------|
-| Authentication | `hcloud configure list` (redacted) |
-| Region | Match CLI region, endpoint, and resource region |
-| Project ID | `hcloud IAM KeystoneListProjects` |
-| Pagination | Add `--limit=100` and check `marker` |
-| Quota | Check service quotas in console or API |
-| IAM Permission | Verify user/role has required action — see `huawei-iam` skill |
-| KooCLI version | `hcloud version` |
-
-## Common Error Codes
-
-| Error | Likely Cause | Fix |
-|-------|-------------|-----|
-| AuthFailure / 401 | AK/SK invalid or expired | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init` |
-| AccessDenied / 403 | IAM permission missing | Check `huawei-iam` skill, add required policy action |
-| NoSuchKey / 404 | Resource not found | Verify resource ID, region, and project_id |
-| QuotaExceeded | Account limit reached | Request quota increase in console |
-| [USE_ERROR] 不正确的参数 | Wrong param name | Run `--help`, check `--param=value` format and nested prefix |
-| Ecs.0005 | Flavor-image mismatch | Check image `__support_*` against flavor virtualization type |
-| FSS.0400 | FunctionGraph latest version error | Strip `:latest` from function URN |
-| FSS.1417 | DEDICATEDGATEWAY missing params | Add instance_id, group_id, protocol, env_name, env_id |
-| APIC.7201 | Missing security_group_id | Add `--security_group_id` param for APIG CreateInstanceV2 |
-| [NETWORK_ERROR] | Transient network failure | Retry with `maxRetries` param or wait and retry |
-
-## KooCLI Error Types
-
-KooCLI classifies errors into 5 types. The error type prefix in the message guides initial diagnosis:
-
-| Type | Meaning | First Check |
-|------|---------|-------------|
-| `[NETWORK_ERROR]` | HTTP request exception | Network connectivity, firewall, endpoint reachability |
-| `[CLI_ERROR]` | KooCLI internal error | Contact KooCLI support |
-| `[USE_ERROR]` | Incorrect command parameters | Run `--help`, check param names and format |
-| `[OPENAPI_ERROR]` | Cloud service API error | Check service docs, contact service support |
-| `[APIE_ERROR]` | API Explorer metadata error | Contact API Explorer support |
-
-Enable debug with `--cli-debug=true` to see the underlying HTTP request/response and pinpoint network or endpoint issues.
-
-## Cross-Skill References
-
-- **IAM permissions**: See `huawei-iam`
-- **CLI auth setup**: See `huaweicloud-cli-and-auth`
-- **ECS specific errors**: See `huawei-ecs`
-- **FunctionGraph specific**: See `huawei-functiongraph`
+---
+name: huaweicloud-troubleshooting
+description: Troubleshoot Huawei Cloud CLI, API, SDK, deployment, permission, region, quota, endpoint, and resource errors. Use when commands fail, APIs return errors, resources are missing, or the user needs a structured diagnosis.
+---
+
+# Huawei Cloud Troubleshooting
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Use evidence before fixes. Do not guess service behavior when request IDs, region, project_id, and exact errors can identify the issue.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Error in response body, not HTTP status | Many APIs return HTTP 200 with error in JSON body. Always check `error_code` and `error_msg` |
+| Missing `project_id` is common | New users often omit project_id from API path or CLI. Get it from `IAM KeystoneListProjects` |
+| Sandbox may block hcloud | OpenCode/Codex sandbox can block hcloud metadata files in `~/.hcloud/`. Use `dangerouslyDisableSandbox` or Bash tool |
+| KooCLI param prefix varies | VPC params need `--vpc.x`, ECS params need `--server.x`, ALWAYS check `--help` first |
+
+## Workflow
+
+1. Capture the redacted error message, service, operation, region, project_id, and request_id.
+2. Classify likely cause:
+   - auth or permission
+   - wrong region or endpoint
+   - wrong project_id
+   - missing resource
+   - quota or account limit
+   - invalid request body
+   - service-side failure
+3. Run the smallest read-only check that can prove or disprove the cause.
+4. Compare with official API/SDK docs or Huawei Cloud Skills if the operation contract is uncertain.
+5. Propose one fix at a time.
+6. Verify with read-only observation after the fix.
+
+## Common Checks
+
+| Check | Command |
+|-------|---------|
+| Authentication | `hcloud configure list` (redacted) |
+| Region | Match CLI region, endpoint, and resource region |
+| Project ID | `hcloud IAM KeystoneListProjects` |
+| Pagination | Add `--limit=100` and check `marker` |
+| Quota | Check service quotas in console or API |
+| IAM Permission | Verify user/role has required action — see `huawei-iam` skill |
+| KooCLI version | `hcloud version` |
+
+## Common Error Codes
+
+| Error | Likely Cause | Fix |
+|-------|-------------|-----|
+| AuthFailure / 401 | AK/SK invalid or expired | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init` |
+| AccessDenied / 403 | IAM permission missing | Check `huawei-iam` skill, add required policy action |
+| NoSuchKey / 404 | Resource not found | Verify resource ID, region, and project_id |
+| QuotaExceeded | Account limit reached | Request quota increase in console |
+| [USE_ERROR] 不正确的参数 | Wrong param name | Run `--help`, check `--param=value` format and nested prefix |
+| Ecs.0005 | Flavor-image mismatch | Check image `__support_*` against flavor virtualization type |
+| FSS.0400 | FunctionGraph latest version error | Strip `:latest` from function URN |
+| FSS.1417 | DEDICATEDGATEWAY missing params | Add instance_id, group_id, protocol, env_name, env_id |
+| APIC.7201 | Missing security_group_id | Add `--security_group_id` param for APIG CreateInstanceV2 |
+| [NETWORK_ERROR] | Transient network failure | Retry with `maxRetries` param or wait and retry |
+
+## KooCLI Error Types
+
+KooCLI classifies errors into 5 types. The error type prefix in the message guides initial diagnosis:
+
+| Type | Meaning | First Check |
+|------|---------|-------------|
+| `[NETWORK_ERROR]` | HTTP request exception | Network connectivity, firewall, endpoint reachability |
+| `[CLI_ERROR]` | KooCLI internal error | Contact KooCLI support |
+| `[USE_ERROR]` | Incorrect command parameters | Run `--help`, check param names and format |
+| `[OPENAPI_ERROR]` | Cloud service API error | Check service docs, contact service support |
+| `[APIE_ERROR]` | API Explorer metadata error | Contact API Explorer support |
+
+Enable debug with `--cli-debug=true` to see the underlying HTTP request/response and pinpoint network or endpoint issues.
+
+## Cross-Skill References
+
+- **IAM permissions**: See `huawei-iam`
+- **CLI auth setup**: See `huaweicloud-cli-and-auth`
+- **ECS specific errors**: See `huawei-ecs`
+- **FunctionGraph specific**: See `huawei-functiongraph`

package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Huawei Cloud Troubleshooting"
-  short_description: "Diagnose Huawei Cloud errors using evidence and read-only checks."
-  default_prompt: "Use $huaweicloud-troubleshooting to diagnose this Huawei Cloud error."
+interface:
+  display_name: "Huawei Cloud Troubleshooting"
+  short_description: "Diagnose Huawei Cloud errors using evidence and read-only checks."
+  default_prompt: "Use $huaweicloud-troubleshooting to diagnose this Huawei Cloud error."

package/plugins/huaweicloud-core/src/auth/agent-registration.mjs

@@ -1,87 +1,105 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { homedir } from 'node:os';
-import { spawnSync } from 'node:child_process';
-
-export const SUPPORTED_AGENT_TARGETS = ['opencode', 'codex', 'codex-desktop', 'codearts', 'workbuddy'];
-
-function baseHome() {
-  return process.env.HUAWEICLOUD_HOME || homedir();
-}
-
-function opencodeConfigFile() {
-  const jsonc = join(baseHome(), '.config', 'opencode', 'opencode.jsonc');
-  if (existsSync(jsonc)) return jsonc;
-  return join(baseHome(), '.config', 'opencode', 'opencode.json');
-}
-
-function readJsonSafe(path) {
-  if (!existsSync(path)) return null;
-  try {
-    return JSON.parse(readFileSync(path, 'utf8'));
-  } catch {
-    return null;
-  }
-}
-
-function opencodeRegistered() {
-  const path = opencodeConfigFile();
-  const cfg = readJsonSafe(path);
-  return Boolean(cfg?.mcp?.['huaweicloud-devkit']);
-}
-
-function codexDesktopRegistered() {
-  const path = join(baseHome(), '.codex', 'config.toml');
-  if (!existsSync(path)) return false;
-  try {
-    return readFileSync(path, 'utf8').includes('[mcp_servers.huaweicloud-devkit]');
-  } catch {
-    return false;
-  }
-}
-
-function codexCliRegistered() {
-  try {
-    const r = spawnSync('codex', ['plugin', 'list'], {
-      shell: false,
-      windowsHide: true,
-      stdio: 'pipe',
-      timeout: 10000,
-    });
-    const out = `${r.stdout || ''}${r.stderr || ''}`;
-    return out.includes('huaweicloud-core');
-  } catch {
-    return false;
-  }
-}
-
-function codeartsRegistered() {
-  const paths = [
-    join(baseHome(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
-    join(process.cwd(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
-  ];
-  return paths.some((path) => {
-    const cfg = readJsonSafe(path);
-    return Boolean(cfg?.mcpServers?.['huaweicloud-devkit']);
-  });
-}
-
-function workbuddyRegistered() {
-  const cfg = readJsonSafe(join(baseHome(), '.workbuddy', 'mcp.json'));
-  return Boolean(cfg?.mcpServers?.['huaweicloud-devkit']);
-}
-
-export function getAgentRegistrationStatuses(target = 'all') {
-  const requested = target === 'all' ? SUPPORTED_AGENT_TARGETS : [target];
-  const result = { target, agents: {} };
-  for (const agent of requested) {
-    let configured = false;
-    if (agent === 'opencode') configured = opencodeRegistered();
-    if (agent === 'codex-desktop') configured = codexDesktopRegistered();
-    if (agent === 'codex') configured = codexCliRegistered();
-    if (agent === 'codearts') configured = codeartsRegistered();
-    if (agent === 'workbuddy') configured = workbuddyRegistered();
-    result.agents[agent] = { configured };
-  }
-  return result;
-}
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { spawnSync } from 'node:child_process';
+
+export const SUPPORTED_AGENT_TARGETS = ['opencode', 'codex', 'codex-desktop', 'codearts', 'workbuddy', 'dsh'];
+
+function baseHome() {
+  return process.env.HUAWEICLOUD_HOME || homedir();
+}
+
+function opencodeConfigFile() {
+  const jsonc = join(baseHome(), '.config', 'opencode', 'opencode.jsonc');
+  if (existsSync(jsonc)) return jsonc;
+  return join(baseHome(), '.config', 'opencode', 'opencode.json');
+}
+
+function readJsonSafe(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function opencodeRegistered() {
+  const path = opencodeConfigFile();
+  const cfg = readJsonSafe(path);
+  return Boolean(cfg?.mcp?.['huaweicloud-devkit']);
+}
+
+function codexDesktopRegistered() {
+  const path = join(baseHome(), '.codex', 'config.toml');
+  if (!existsSync(path)) return false;
+  try {
+    return readFileSync(path, 'utf8').includes('[mcp_servers.huaweicloud-devkit]');
+  } catch {
+    return false;
+  }
+}
+
+function codexCliRegistered() {
+  try {
+    const r = spawnSync('codex', ['plugin', 'list'], {
+      shell: false,
+      windowsHide: true,
+      stdio: 'pipe',
+      timeout: 10000,
+    });
+    const out = `${r.stdout || ''}${r.stderr || ''}`;
+    return out.includes('huaweicloud-core');
+  } catch {
+    return false;
+  }
+}
+
+function codeartsRegistered() {
+  const paths = [
+    join(baseHome(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+    join(process.cwd(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+  ];
+  return paths.some((path) => {
+    const cfg = readJsonSafe(path);
+    return Boolean(cfg?.mcpServers?.['huaweicloud-devkit']);
+  });
+}
+
+function workbuddyRegistered() {
+  const cfg = readJsonSafe(join(baseHome(), '.workbuddy', 'mcp.json'));
+  return Boolean(cfg?.mcpServers?.['huaweicloud-devkit']);
+}
+
+function dshRoot() {
+  return process.env.DSH_HOME || join(baseHome(), '.dsh');
+}
+
+function dshRegistered() {
+  const patchPath = join(dshRoot(), 'profiles', 'web', 'cordis.patch.yml');
+  if (!existsSync(patchPath)) return false;
+  try {
+    const patch = readFileSync(patchPath, 'utf8');
+    return patch.includes('id: mcp-huaweicloud')
+      && patch.includes("@deepseek-ai/dsh-mcp-client")
+      && patch.includes('serverName: huaweicloud');
+  } catch {
+    return false;
+  }
+}
+
+export function getAgentRegistrationStatuses(target = 'all') {
+  const requested = target === 'all' ? SUPPORTED_AGENT_TARGETS : [target];
+  const result = { target, agents: {} };
+  for (const agent of requested) {
+    let configured = false;
+    if (agent === 'opencode') configured = opencodeRegistered();
+    if (agent === 'codex-desktop') configured = codexDesktopRegistered();
+    if (agent === 'codex') configured = codexCliRegistered();
+    if (agent === 'codearts') configured = codeartsRegistered();
+    if (agent === 'workbuddy') configured = workbuddyRegistered();
+    if (agent === 'dsh') configured = dshRegistered();
+    result.agents[agent] = { configured };
+  }
+  return result;
+}