huaweicloud-devkit 1.0.2-dev.9 → 1.0.2-next.10

package/plugins/huaweicloud-core/skills/huawei-deployment/SKILL.md

@@ -1,56 +1,57 @@
----
-name: huawei-deployment
-description: "Use when creating, managing, or running deployment tasks and pipelines on Huawei Cloud CloudDeploy. Triggers: CloudDeploy, deployment, CI/CD, pipeline, release, artifact deployment, deploy task. NOT for: CodeArts Build (build pipeline), SWR container registry."
-version: 1
----
-
-# Huawei Cloud CloudDeploy
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for Huawei Cloud CloudDeploy. Covers application creation, deployment task management, pipeline execution, and artifact configuration.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Service name may be `CodeArtsDeploy` | hcloud service name for deployment may be `CodeArtsDeploy` instead of `CloudDeploy`. Run `hcloud --help` to verify |
-| Deployment hosts need agent | Install CloudDeploy agent on target hosts first |
-| Task must reference application first | Create application before task |
-| Artifact source defaults to OBS | Most deployment tasks pull artifacts from OBS. Ensure bucket and object exist |
-| Parallel deployments may conflict | Lock resources or use deployment groups |
-
-## Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| Create application | `CreateApp --name=<n> --platform=<p> --cli-region=<r>` |
-| Create deployment task | `CreateTask --name=<n> --app_id=<id> --artifact_source_type=OBS` |
-| Start deployment | `StartTask --task_id=<id>` |
-| List tasks | `ListTasks --app_id=<id>` |
-| Delete task | `DeleteTask --task_id=<id>` |
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| Agent offline | Check agent service on target host, network connectivity, firewall rules |
-| Deployment timeout | Check artifact size, increase task timeout, verify target host resources |
-| Artifact not found | Verify OBS bucket and object path, check artifact permissions |
-| Permission denied | Verify IAM roles for deployment: `CodeArtsDeploy FullAccess` or custom policy |
-
-## Security
-
-- MUST use IAM roles for deployment permissions
-- MUST verify artifact integrity before deployment
-- MUST not store credentials in deployment scripts
-
-## Cross-Skill References
-
-- **OBS artifact storage**: See `huawei-obs`
-- **ECS deployment target**: See `huawei-ecs`
-- **IAM permissions**: See `huawei-iam`
+---
+name: huawei-deployment
+description: 'Use when creating, managing, or running deployment tasks and pipelines on Huawei Cloud CloudDeploy. Triggers: CloudDeploy, deployment, CI/CD, pipeline, release, artifact deployment, deploy task. NOT for: CodeArts Build (build pipeline), SWR container registry.'
+version: 1
+---
+
+# Huawei Cloud CloudDeploy
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Huawei Cloud CloudDeploy. Covers application creation, deployment task management, pipeline execution, and artifact configuration.
+
+## Critical Warnings
+
+| Trap                                                  | Why                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| ----------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Flyway SQL dialect mismatch (H2 dev → MySQL prod)** | Spring Boot apps commonly develop with H2 in-memory DB, then deploy to RDS MySQL. Flyway migrations using H2-specific syntax (e.g. `DATEADD`, `CHARACTER_LENGTH`, `BOOLEAN`) silently succeed on H2 but fail on MySQL. Before deploying, audit `V*__*.sql` migration files: replace `DATEADD` with `DATE_ADD`, `BOOLEAN` with `TINYINT(1)`, remove `characterEncoding=utf8mb4` from Spring Boot datasource URL (KooCLI RDS CreateInstance sets charset at the instance level). Use `Flyway.validate-on-migrate=true` in CI to catch dialect issues early. |
+| Service name may be `CodeArtsDeploy`                  | hcloud service name for deployment may be `CodeArtsDeploy` instead of `CloudDeploy`. Run `hcloud --help` to verify                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| Deployment hosts need agent                           | Install CloudDeploy agent on target hosts first                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| Task must reference application first                 | Create application before task                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| Artifact source defaults to OBS                       | Most deployment tasks pull artifacts from OBS. Ensure bucket and object exist                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Parallel deployments may conflict                     | Lock resources or use deployment groups                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+
+## Common Workflows
+
+| Task                   | Operation                                                        |
+| ---------------------- | ---------------------------------------------------------------- |
+| Create application     | `CreateApp --name=<n> --platform=<p> --cli-region=<r>`           |
+| Create deployment task | `CreateTask --name=<n> --app_id=<id> --artifact_source_type=OBS` |
+| Start deployment       | `StartTask --task_id=<id>`                                       |
+| List tasks             | `ListTasks --app_id=<id>`                                        |
+| Delete task            | `DeleteTask --task_id=<id>`                                      |
+
+## Troubleshooting
+
+| Error              | Fix                                                                           |
+| ------------------ | ----------------------------------------------------------------------------- |
+| Agent offline      | Check agent service on target host, network connectivity, firewall rules      |
+| Deployment timeout | Check artifact size, increase task timeout, verify target host resources      |
+| Artifact not found | Verify OBS bucket and object path, check artifact permissions                 |
+| Permission denied  | Verify IAM roles for deployment: `CodeArtsDeploy FullAccess` or custom policy |
+
+## Security
+
+- MUST use IAM roles for deployment permissions
+- MUST verify artifact integrity before deployment
+- MUST not store credentials in deployment scripts
+
+## Cross-Skill References
+
+- **OBS artifact storage**: See `huawei-obs`
+- **ECS deployment target**: See `huawei-ecs`
+- **IAM permissions**: See `huawei-iam`

package/plugins/huaweicloud-core/skills/huawei-dew/SKILL.md

@@ -1,97 +1,106 @@
----
-name: huawei-dew
-description: "Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secrets, KMS for encryption keys, and credential rotation. Triggers on: secret, credential, API key, token, password, encrypt, decrypt, KMS, CSMS, DEW, certificate, CSR, rotation. Activates for ANY task involving secrets or credentials — load this skill first before touching secrets."
-version: 1
----
-
-# Huawei Cloud DEW (Data Encryption Workshop)
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for Huawei Cloud Data Encryption Workshop (DEW). Covers CSMS for secret lifecycle management, KMS for encryption key management, credential rotation, and secure application integration patterns.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| NEVER fetch secret values into agent context | Use {{resolve:csms:secret-id:SecretString:key}} runtime injection |
-| NEVER echo credentials in conversation | AK/SK, passwords, tokens must never appear in chat |
-| KMS key deletion is irreversible | 7-30 day pending deletion window. Once gone, data is unrecoverable |
-| Secret rotation requires automation | Manual rotation risks stale credentials |
-| Cross-account KMS needs grants | KMS keys are regional. Cross-region data needs grant setup |
-
-## CSMS Operations
-
-### Read-only (safe — metadata only)
-| Operation | Description |
-|-----------|-------------|
-| ListSecrets | List all secrets (names only, no values) |
-| DescribeSecret | Get secret metadata (rotation config, KMS key, status) |
-| ListSecretVersions | List version IDs and stages (no values) |
-
-### Secret Value (blocked by policy — use runtime injection)
-| Operation | Safe Alternative |
-|-----------|-----------------|
-| DownloadSecret | Use {{resolve:csms:secret-id}} in IaC or SDK |
-| ShowSecretVersion | Use runtime injection, never in agent context |
-| GetSecretValue | Blocked. Use MCP proxy resolve pattern |
-
-## KMS Operations
-
-| Task | Command | Notes |
-|------|---------|-------|
-| List keys | hcloud KMS ListKeys | Read-only |
-| Create key | hcloud KMS CreateKey --key_alias=<name> | Requires write approval |
-| Encrypt | hcloud KMS EncryptData --key_id=<id> --plaintext=<b64> | Prefer SDK offline encrypt |
-| Decrypt | hcloud KMS DecryptData (**BLOCKED**) | Use runtime injection |
-
-## Runtime Injection Pattern
-
-`ash
-# Terraform / IaC
-resource "huaweicloud_csms_secret" "db_password" {
-  secret_string = var.db_password  # NEVER hardcode
-}
-
-# SDK
-secret_value = client.get_secret(secret_id="my-secret")
-# Use immediately, never print or store in context
-
-# hcloud (for approved automation only)
-hcloud CSMS DownloadSecret --secret_name=<name>
-# WARNING: Output goes to stdout. Pipe directly, never capture in agent.
-`
-
-## Troubleshooting
-
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Secret not found | Wrong region or project -> Verify secret ARN includes region/project |
-| AccessDenied on CSMS | Missing IAM CSMS policy -> Add csms:DescribeSecret + kms:Decrypt |
-| KMS key disabled | Key scheduled for deletion or manually disabled -> Enable or create new key |
-| Rotation stuck | Lambda/Python function error -> Check rotation function logs |
-
-## Security Considerations
-
-- MUST use runtime injection. NEVER fetch secrets into agent context
-- MUST rotate credentials every 90 days
-- MUST enable automatic rotation for CSMS secrets
-- MUST audit KMS key usage via CTS
-- SHOULD use customer-managed keys (CMK) for sensitive data
-- MUST NOT use default KMS keys for production workloads
-
-## MCP Tools
-
-- huaweicloud_list_operations service=DEW or CSMS or KMS
-- huaweicloud_run_readonly_command for ListSecrets/ListKeys (metadata only)
-- huaweicloud_safety policy blocks all secret value reads
-
-## References
-
-- DEW Docs: https://support.huaweicloud.com/dew/
-- CSMS usage: references/csms-usage.md
-- KMS usage: references/kms-usage.md
+---
+name: huawei-dew
+description: 'Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secrets, KMS for encryption keys, and credential rotation. Triggers on: secret, credential, API key, token, password, encrypt, decrypt, KMS, CSMS, DEW, certificate, CSR, rotation. Activates for ANY task involving secrets or credentials — load this skill first before touching secrets.'
+version: 1
+---
+
+# Huawei Cloud DEW (Data Encryption Workshop)
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Huawei Cloud Data Encryption Workshop (DEW). Covers CSMS for secret lifecycle management, KMS for encryption key management, credential rotation, and secure application integration patterns.
+
+## Critical Warnings
+
+| Trap                                         | Why                                                                |
+| -------------------------------------------- | ------------------------------------------------------------------ |
+| NEVER fetch secret values into agent context | Use {{resolve:csms:secret-id:SecretString:key}} runtime injection  |
+| NEVER echo credentials in conversation       | AK/SK, passwords, tokens must never appear in chat                 |
+| KMS key deletion is irreversible             | 7-30 day pending deletion window. Once gone, data is unrecoverable |
+| Secret rotation requires automation          | Manual rotation risks stale credentials                            |
+| Cross-account KMS needs grants               | KMS keys are regional. Cross-region data needs grant setup         |
+
+## CSMS Operations
+
+### Read-only (safe — metadata only)
+
+| Operation          | Description                                            |
+| ------------------ | ------------------------------------------------------ |
+| ListSecrets        | List all secrets (names only, no values)               |
+| DescribeSecret     | Get secret metadata (rotation config, KMS key, status) |
+| ListSecretVersions | List version IDs and stages (no values)                |
+
+### Secret Value (blocked by policy — use runtime injection)
+
+| Operation         | Safe Alternative                              |
+| ----------------- | --------------------------------------------- |
+| DownloadSecret    | Use {{resolve:csms:secret-id}} in IaC or SDK  |
+| ShowSecretVersion | Use runtime injection, never in agent context |
+| GetSecretValue    | Blocked. Use MCP proxy resolve pattern        |
+
+## KMS Operations
+
+| Task       | Command                                                | Notes                      |
+| ---------- | ------------------------------------------------------ | -------------------------- |
+| List keys  | hcloud KMS ListKeys                                    | Read-only                  |
+| Create key | hcloud KMS CreateKey --key_alias=<name>                | Requires write approval    |
+| Encrypt    | hcloud KMS EncryptData --key_id=<id> --plaintext=<b64> | Prefer SDK offline encrypt |
+| Decrypt    | hcloud KMS DecryptData (**BLOCKED**)                   | Use runtime injection      |
+
+## Runtime Injection Pattern
+
+`ash
+
+# Terraform / IaC
+
+resource "huaweicloud_csms_secret" "db_password" {
+secret_string = var.db_password # NEVER hardcode
+}
+
+# SDK
+
+secret_value = client.get_secret(secret_id="my-secret")
+
+# Use immediately, never print or store in context
+
+# hcloud (for approved automation only)
+
+hcloud CSMS DownloadSecret --secret_name=<name>
+
+# WARNING: Output goes to stdout. Pipe directly, never capture in agent.
+
+`
+
+## Troubleshooting
+
+| Error                | Root Cause -> Fix                                                           |
+| -------------------- | --------------------------------------------------------------------------- |
+| Secret not found     | Wrong region or project -> Verify secret ARN includes region/project        |
+| AccessDenied on CSMS | Missing IAM CSMS policy -> Add csms:DescribeSecret + kms:Decrypt            |
+| KMS key disabled     | Key scheduled for deletion or manually disabled -> Enable or create new key |
+| Rotation stuck       | Lambda/Python function error -> Check rotation function logs                |
+
+## Security Considerations
+
+- MUST use runtime injection. NEVER fetch secrets into agent context
+- MUST rotate credentials every 90 days
+- MUST enable automatic rotation for CSMS secrets
+- MUST audit KMS key usage via CTS
+- SHOULD use customer-managed keys (CMK) for sensitive data
+- MUST NOT use default KMS keys for production workloads
+
+## MCP Tools
+
+- huaweicloud_list_operations service=DEW or CSMS or KMS
+- huaweicloud_run_readonly_command for ListSecrets/ListKeys (metadata only)
+- huaweicloud_safety policy blocks all secret value reads
+
+## References
+
+- DEW Docs: https://support.huaweicloud.com/dew/
+- CSMS usage: references/csms-usage.md
+- KMS usage: references/kms-usage.md

package/plugins/huaweicloud-core/skills/huawei-dew/references/csms-usage.md

@@ -1,29 +1,36 @@
-# CSMS Usage Guide
-
-## Create Secret
-hcloud CSMS CreateSecret --secret_name=prod-db-password --secret_string='{"password":"CHANGE_ME"}'
-
-## List Secrets (metadata only)
-hcloud CSMS ListSecrets
-
-## Describe Secret
-hcloud CSMS DescribeSecret --secret_name=prod-db-password
-
-## List Versions
-hcloud CSMS ListSecretVersions --secret_name=prod-db-password
-
-## Runtime Injection (Terraform)
-data "huaweicloud_csms_secret" "db" {
-  secret_name = "prod-db-password"
-}
-Use: data.huaweicloud_csms_secret.db.secret_string
-
-## Rotation
-- Enable auto-rotation: hcloud CSMS EnableSecretRotation --secret_name=<name> --rotation_interval=30
-- Rotation function ARN: provide Lambda to generate new secret value
-
-## Policy Rules
-- hcloud CSMS DownloadSecret -> BLOCKED (use runtime injection)
-- hcloud CSMS ShowSecretVersion -> BLOCKED
-- hcloud CSMS ListSecrets -> ALLOWED (metadata only)
-- hcloud CSMS DescribeSecret -> ALLOWED (metadata only)
+# CSMS Usage Guide
+
+## Create Secret
+
+hcloud CSMS CreateSecret --secret_name=prod-db-password --secret_string='{"password":"CHANGE_ME"}'
+
+## List Secrets (metadata only)
+
+hcloud CSMS ListSecrets
+
+## Describe Secret
+
+hcloud CSMS DescribeSecret --secret_name=prod-db-password
+
+## List Versions
+
+hcloud CSMS ListSecretVersions --secret_name=prod-db-password
+
+## Runtime Injection (Terraform)
+
+data "huaweicloud_csms_secret" "db" {
+secret_name = "prod-db-password"
+}
+Use: data.huaweicloud_csms_secret.db.secret_string
+
+## Rotation
+
+- Enable auto-rotation: hcloud CSMS EnableSecretRotation --secret_name=<name> --rotation_interval=30
+- Rotation function ARN: provide Lambda to generate new secret value
+
+## Policy Rules
+
+- hcloud CSMS DownloadSecret -> BLOCKED (use runtime injection)
+- hcloud CSMS ShowSecretVersion -> BLOCKED
+- hcloud CSMS ListSecrets -> ALLOWED (metadata only)
+- hcloud CSMS DescribeSecret -> ALLOWED (metadata only)

package/plugins/huaweicloud-core/skills/huawei-dew/references/kms-usage.md

@@ -1,23 +1,29 @@
-# KMS Usage Guide
-
-## Create Key
-hcloud KMS CreateKey --key_alias=app-encryption-key --key_description="Application data encryption"
-
-## List Keys (metadata only)
-hcloud KMS ListKeys
-
-## Encrypt (offline preferred)
-hcloud KMS EncryptData --key_id=<key-id> --plaintext=<base64-data>
-
-## Decrypt (BLOCKED - use runtime)
-DO NOT use hcloud KMS DecryptData directly.
-Use SDK with KMS client in application runtime.
-
-## Key Rotation
-- Enable: hcloud KMS EnableKeyRotation --key_id=<key-id>
-- Rotation period: 365 days (default)
-
-## Key Deletion
-- Schedule: hcloud KMS ScheduleKeyDeletion --key_id=<key-id> --pending_days=7
-- Cancel during pending window: hcloud KMS CancelKeyDeletion --key_id=<key-id>
-- WARNING: After deletion window passes, data encrypted with this key is UNRECOVERABLE
+# KMS Usage Guide
+
+## Create Key
+
+hcloud KMS CreateKey --key_alias=app-encryption-key --key_description="Application data encryption"
+
+## List Keys (metadata only)
+
+hcloud KMS ListKeys
+
+## Encrypt (offline preferred)
+
+hcloud KMS EncryptData --key_id=<key-id> --plaintext=<base64-data>
+
+## Decrypt (BLOCKED - use runtime)
+
+DO NOT use hcloud KMS DecryptData directly.
+Use SDK with KMS client in application runtime.
+
+## Key Rotation
+
+- Enable: hcloud KMS EnableKeyRotation --key_id=<key-id>
+- Rotation period: 365 days (default)
+
+## Key Deletion
+
+- Schedule: hcloud KMS ScheduleKeyDeletion --key_id=<key-id> --pending_days=7
+- Cancel during pending window: hcloud KMS CancelKeyDeletion --key_id=<key-id>
+- WARNING: After deletion window passes, data encrypted with this key is UNRECOVERABLE