huaweicloud-devkit 1.0.2-dev.9 → 1.0.2-next.10

package/plugins/huaweicloud-core/skills/huawei-waf-aad/SKILL.md

@@ -1,63 +1,63 @@
----
-name: huawei-waf-aad
-description: "Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts)."
-version: 1
----
-
-# Huawei Cloud WAF / AAD
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud WAF <Operation> --help` before constructing commands to discover exact parameter names and requirements. For AAD operations, use `hcloud AAD --help`.
-
-## Overview
-
-Domain expertise for WAF and Anti-DDoS. Covers WAF policy/rules, AAD protection, IP whitelist/blacklist, and rate limiting.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| WAF needs CNAME redirect | DNS must point to WAF endpoint, not server IP |
-| Premium instance required | Cloud WAF needs a dedicated/premium WAF instance |
-| AAD Standard vs Enterprise | Standard protects single IP. Enterprise protects entire IP ranges |
-| Rule order matters | WAF rules evaluated top-to-bottom within a policy |
-
-## Common Workflows
-
-### WAF
-
-| Task | Operation |
-|------|-----------|
-| List WAF instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| List policies | `ListPolicies --cli-region=<r> --project_id=<p>` |
-| Create custom rule | `BatchCreateCustomRule --cli-region=<r> --project_id=<p>` |
-| Create IP blacklist | `BatchCreateWhiteblackipRule --cli-region=<r> --project_id=<p>` |
-| Create CC rule | `BatchCreateCcRule --cli-region=<r> --project_id=<p>` |
-| Create geo rule | `BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>` |
-
-### AAD
-
-```bash
-hcloud AAD ListInstances --cli-region=<r> --project_id=<p>
-hcloud AAD CreateInstance --cli-region=<r> --project_id=<p>
-```
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| Website unreachable after WAF | Check CNAME record points to WAF endpoint |
-| WAF blocking legitimate traffic | Check rules order, adjust false positive settings |
-| AAD not responding | Standard AAD only protects single EIP. Check EIP binding |
-
-## Security
-
-- MUST use WAF for all public-facing web applications
-- SHOULD enable AAD for DDoS protection
-- MUST test WAF rules in report-only mode before blocking
-
-## Cross-Skill References
-
-- **EIP**: See `huawei-vpc` for elastic IP binding
-- **DNS/CNAME**: Configure via your DNS provider
+---
+name: huawei-waf-aad
+description: 'Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts).'
+version: 1
+---
+
+# Huawei Cloud WAF / AAD
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud WAF <Operation> --help` before constructing commands to discover exact parameter names and requirements. For AAD operations, use `hcloud AAD --help`.
+
+## Overview
+
+Domain expertise for WAF and Anti-DDoS. Covers WAF policy/rules, AAD protection, IP whitelist/blacklist, and rate limiting.
+
+## Critical Warnings
+
+| Trap                       | Why                                                               |
+| -------------------------- | ----------------------------------------------------------------- |
+| WAF needs CNAME redirect   | DNS must point to WAF endpoint, not server IP                     |
+| Premium instance required  | Cloud WAF needs a dedicated/premium WAF instance                  |
+| AAD Standard vs Enterprise | Standard protects single IP. Enterprise protects entire IP ranges |
+| Rule order matters         | WAF rules evaluated top-to-bottom within a policy                 |
+
+## Common Workflows
+
+### WAF
+
+| Task                | Operation                                                       |
+| ------------------- | --------------------------------------------------------------- |
+| List WAF instances  | `ListInstances --cli-region=<r> --project_id=<p>`               |
+| List policies       | `ListPolicies --cli-region=<r> --project_id=<p>`                |
+| Create custom rule  | `BatchCreateCustomRule --cli-region=<r> --project_id=<p>`       |
+| Create IP blacklist | `BatchCreateWhiteblackipRule --cli-region=<r> --project_id=<p>` |
+| Create CC rule      | `BatchCreateCcRule --cli-region=<r> --project_id=<p>`           |
+| Create geo rule     | `BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>`        |
+
+### AAD
+
+```bash
+hcloud AAD ListInstances --cli-region=<r> --project_id=<p>
+hcloud AAD CreateInstance --cli-region=<r> --project_id=<p>
+```
+
+## Troubleshooting
+
+| Error                           | Fix                                                      |
+| ------------------------------- | -------------------------------------------------------- |
+| Website unreachable after WAF   | Check CNAME record points to WAF endpoint                |
+| WAF blocking legitimate traffic | Check rules order, adjust false positive settings        |
+| AAD not responding              | Standard AAD only protects single EIP. Check EIP binding |
+
+## Security
+
+- MUST use WAF for all public-facing web applications
+- SHOULD enable AAD for DDoS protection
+- MUST test WAF rules in report-only mode before blocking
+
+## Cross-Skill References
+
+- **EIP**: See `huawei-vpc` for elastic IP binding
+- **DNS/CNAME**: Configure via your DNS provider

package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/SKILL.md

@@ -1,56 +1,56 @@
----
-name: huaweicloud-api-and-sdk
-description: Huawei Cloud API and SDK guidance for application development. Use when writing code that calls Huawei Cloud services, choosing SDKs, building API requests, handling project_id, endpoint, auth, pagination, retries, error codes, or request IDs.
----
-
-# Huawei Cloud API And SDK
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Use this skill when the deliverable is application code, API integration, or precise request construction.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| `project_id` in path for most services | Many Huawei Cloud APIs require `project_id` in the URL path. Get it from IAM or KooCLI profile |
-| Pagination is not automatic | APIs return paginated results. Always check for `next_marker` or `page_info` to avoid partial data |
-| AK/SK signing algorithm | Huawei Cloud uses HMAC-SHA256 signing with specific header ordering. Use SDK, don't implement manually |
-| Endpoint varies by service and region | Always verify at https://developer.huaweicloud.com/endpoint |
-| Error response in `body` not HTTP status | Many errors return HTTP 200 with error details in the JSON body. Check `error_code` or `error_msg` fields |
-
-## API Workflow
-
-1. Identify service, region, endpoint, API version, and whether `project_id` is required in the path.
-2. Verify the exact request body and response schema from official API documentation.
-3. Handle pagination explicitly. Do not assume a single page.
-4. Preserve `request_id` from errors and responses for troubleshooting.
-5. Classify operation risk before running a live call.
-6. For write APIs, produce a dry plan and ask the user before execution.
-
-## SDK Workflow
-
-1. Pick the SDK that matches the user's application language and existing dependency style.
-2. Use the official SDK client for the target service.
-3. Keep credentials out of source code. Use environment, profile, workload identity, or runtime secret injection.
-4. Add timeout, retry, and pagination handling.
-5. Return typed or structured results instead of unbounded raw logs.
-
-## Troubleshooting
-
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| Invalid project_id | Wrong or missing project_id in URL path. Use `hcloud IAM KeystoneListProjects` or KooCLI profile |
-| 401/AuthFailure | Expired AK/SK or wrong signing algorithm. Regenerate AK/SK or check SDK version |
-| 403/Forbidden | IAM permission missing. Check user/role has required action permissions |
-| Empty results | Pagination missing — add `limit` and check `marker` |
-| Endpoint not reachable | Wrong region/service endpoint. Verify at developer.huaweicloud.com/endpoint |
-
-## Terraform Priority
-
-Terraform Provider is low priority in V1. Mention it when the user needs reviewed, repeatable infrastructure changes. Do not default to Terraform for quick discovery or app-level SDK integration.
-
-## Cross-Skill References
-
-- **CLI setup**: See `huaweicloud-cli-and-auth` for KooCLI credential setup
-- **Safety**: See `huaweicloud-safety` for write operation approval flow
+---
+name: huaweicloud-api-and-sdk
+description: Huawei Cloud API and SDK guidance for application development. Use when writing code that calls Huawei Cloud services, choosing SDKs, building API requests, handling project_id, endpoint, auth, pagination, retries, error codes, or request IDs.
+---
+
+# Huawei Cloud API And SDK
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Use this skill when the deliverable is application code, API integration, or precise request construction.
+
+## Critical Warnings
+
+| Trap                                     | Why                                                                                                       |
+| ---------------------------------------- | --------------------------------------------------------------------------------------------------------- |
+| `project_id` in path for most services   | Many Huawei Cloud APIs require `project_id` in the URL path. Get it from IAM or KooCLI profile            |
+| Pagination is not automatic              | APIs return paginated results. Always check for `next_marker` or `page_info` to avoid partial data        |
+| AK/SK signing algorithm                  | Huawei Cloud uses HMAC-SHA256 signing with specific header ordering. Use SDK, don't implement manually    |
+| Endpoint varies by service and region    | Always verify at https://developer.huaweicloud.com/endpoint                                               |
+| Error response in `body` not HTTP status | Many errors return HTTP 200 with error details in the JSON body. Check `error_code` or `error_msg` fields |
+
+## API Workflow
+
+1. Identify service, region, endpoint, API version, and whether `project_id` is required in the path.
+2. Verify the exact request body and response schema from official API documentation.
+3. Handle pagination explicitly. Do not assume a single page.
+4. Preserve `request_id` from errors and responses for troubleshooting.
+5. Classify operation risk before running a live call.
+6. For write APIs, produce a dry plan and ask the user before execution.
+
+## SDK Workflow
+
+1. Pick the SDK that matches the user's application language and existing dependency style.
+2. Use the official SDK client for the target service.
+3. Keep credentials out of source code. Use environment, profile, workload identity, or runtime secret injection.
+4. Add timeout, retry, and pagination handling.
+5. Return typed or structured results instead of unbounded raw logs.
+
+## Troubleshooting
+
+| Error                  | Root Cause -> Fix                                                                                |
+| ---------------------- | ------------------------------------------------------------------------------------------------ |
+| Invalid project_id     | Wrong or missing project_id in URL path. Use `hcloud IAM KeystoneListProjects` or KooCLI profile |
+| 401/AuthFailure        | Expired AK/SK or wrong signing algorithm. Regenerate AK/SK or check SDK version                  |
+| 403/Forbidden          | IAM permission missing. Check user/role has required action permissions                          |
+| Empty results          | Pagination missing — add `limit` and check `marker`                                              |
+| Endpoint not reachable | Wrong region/service endpoint. Verify at developer.huaweicloud.com/endpoint                      |
+
+## Terraform Priority
+
+Terraform Provider is low priority in V1. Mention it when the user needs reviewed, repeatable infrastructure changes. Do not default to Terraform for quick discovery or app-level SDK integration.
+
+## Cross-Skill References
+
+- **CLI setup**: See `huaweicloud-cli-and-auth` for KooCLI credential setup
+- **Safety**: See `huaweicloud-safety` for write operation approval flow

package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Huawei Cloud API And SDK"
-  short_description: "Build correct Huawei Cloud API requests and SDK integrations."
-  default_prompt: "Use $huaweicloud-api-and-sdk to plan this Huawei Cloud API or SDK integration."
+interface:
+  display_name: 'Huawei Cloud API And SDK'
+  short_description: 'Build correct Huawei Cloud API requests and SDK integrations.'
+  default_prompt: 'Use $huaweicloud-api-and-sdk to plan this Huawei Cloud API or SDK integration.'

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md

@@ -1,47 +1,56 @@
----
-name: huaweicloud-capability-discovery
-description: Discover Huawei Cloud capabilities for an agent task. Use when the user asks what Huawei Cloud service, Skill, CLI command, API, SDK, or document should be used, or when a request is scenario-shaped and needs capability selection before implementation.
----
-
-# Huawei Cloud Capability Discovery
-
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Use this skill to turn vague developer intent into a precise Huawei Cloud capability path.
-
-## Workflow
-
-1. Classify the goal: application hosting, compute, container, serverless, storage, database, network, security, observability, AI, data, migration, cost, or troubleshooting.
-2. Search Huawei Cloud Skills first when the task is scenario-based or operational.
-3. Use official docs for exact service limits, API request/response fields, regions, and pricing-sensitive behavior.
-4. Prefer KooCLI for local read-only discovery after auth is configured.
-5. Before using KooCLI, discover exact operation names with `hcloud <Service> --help`; do not guess from intuition. Examples: list ECS instances with `ECS ListServersDetails`, create ECS with `ECS CreateServers`, inspect images through `IMS GlanceShowImage`.
-6. Prefer SDK docs when the deliverable is application code.
-7. Prefer MCP only when an approved Huawei Cloud MCP tool exists for the needed operation.
-8. Treat Terraform as a secondary V1 path for reviewed IaC, not the default.
-9. When no built-in devkit skill matches, browse the community skill marketplace at https://github.com/huaweicloud/huaweicloud-skills. Fetch the index from https://raw.githubusercontent.com/huaweicloud/huaweicloud-skills/master/skills-index/index.json.
-
-## Region Intent
-
-- Extract region intent from the user's words before querying. Examples: Singapore -> `ap-southeast-3` first, Hong Kong -> `ap-southeast-2`, Beijing -> `cn-north-4`, Shanghai -> `cn-east-3`.
-- Target operation region wins over reference-resource uncertainty. If the user says "buy ECS in Singapore, reference SSY", inspect Singapore first.
-- No blind all-region scans. If the reference resource location is unknown and the target region is not enough, ask the user for the region instead of scanning unrelated regions.
-- For unfamiliar names, check Huawei Cloud API Explorer or official endpoint documentation for the region and service endpoint mapping.
-
-## Output Format
-
-When routing a task, return:
-
-- `intent`: one concise sentence
-- `recommended_path`: Skills, CLI, API, SDK, MCP, or Terraform
-- `why`: why this path is shortest and safest
-- `next_action`: exact next command, document lookup, or code file to inspect
-- `risk`: read-only, write, secret, permission, cost, or public exposure
-
-## Avoid
-
-- Do not guess a service when Huawei Cloud Skills or official docs should be checked.
-- Do not load many service references. Pick the next one that matches the intent.
-- Do not propose write operations before the user has seen the plan.
-- Do not query every region just to find a reference resource.
+---
+name: huaweicloud-capability-discovery
+description: Discover Huawei Cloud capabilities for an agent task. Use when the user asks what Huawei Cloud service, Skill, CLI command, API, SDK, or document should be used, or when a request is scenario-shaped and needs capability selection before implementation.
+---
+
+# Huawei Cloud Capability Discovery
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Use this skill to turn vague developer intent into a precise Huawei Cloud capability path.
+
+## Workflow
+
+1. Classify the goal: application hosting, compute, container, serverless, storage, database, network, security, observability, AI, data, migration, cost, or troubleshooting.
+2. Search Huawei Cloud Skills first when the task is scenario-based or operational.
+3. Use official docs for exact service limits, API request/response fields, regions, and pricing-sensitive behavior.
+4. Prefer KooCLI for local read-only discovery after auth is configured.
+5. Before using KooCLI, discover exact operation names with `hcloud <Service> --help`; do not guess from intuition. Examples: list ECS instances with `ECS ListServersDetails`, create ECS with `ECS CreateServers`, inspect images through `IMS GlanceShowImage`.
+6. Prefer SDK docs when the deliverable is application code.
+7. Prefer MCP only when an approved Huawei Cloud MCP tool exists for the needed operation.
+8. Treat Terraform as a secondary V1 path for reviewed IaC, not the default.
+9. When no built-in devkit skill matches, browse the community skill marketplace at https://github.com/huaweicloud/huaweicloud-skills. Fetch the index from https://raw.githubusercontent.com/huaweicloud/huaweicloud-skills/master/skills-index/index.json.
+10. When the deliverable is a PPT, architecture diagram (draw.io), or frontend page that needs official Huawei Cloud service logos, use the `huaweicloud_get_service_icon` MCP tool to get logo URLs from the official Icons library instead of guessing or hotlinking unofficial images.
+
+## Official Service Logos
+
+- Use `huaweicloud_get_service_icon` with the service name, alias, or Chinese name (e.g. `ecs`, `obs`, `modelarts`, `对象存储`). It returns the official CDN logo URL (`logo.source_url`), category, and product page link from https://open.huaweicloud.com/openplatform/icons.html.
+- Prefer `logo.source_url` for web deliverables and the Icons library search page for browsing; do not scrape logos from third-party sites.
+
+## Deployment Target Options
+
+When the intent is to **deploy, host, or preview a web app or static website** and the developer has not named a target, do NOT default to OBS or any single service. Present the options and let the developer choose, recommending the sandbox first: ① huawei-sandbox (recommended — temporary runtime, instant preview URL) ② huawei-obs (long-term static hosting/CDN) ③ huawei-ecs ④ huawei-cce. Only follow an explicit target when the developer names one.
+
+## Region Intent
+
+- Extract region intent from the user's words before querying. Examples: Singapore -> `ap-southeast-3` first, Hong Kong -> `ap-southeast-2`, Beijing -> `cn-north-4`, Shanghai -> `cn-east-3`.
+- Target operation region wins over reference-resource uncertainty. If the user says "buy ECS in Singapore, reference SSY", inspect Singapore first.
+- No blind all-region scans. If the reference resource location is unknown and the target region is not enough, ask the user for the region instead of scanning unrelated regions.
+- For unfamiliar names, check Huawei Cloud API Explorer or official endpoint documentation for the region and service endpoint mapping.
+
+## Output Format
+
+When routing a task, return:
+
+- `intent`: one concise sentence
+- `recommended_path`: Skills, CLI, API, SDK, MCP, or Terraform
+- `why`: why this path is shortest and safest
+- `next_action`: exact next command, document lookup, or code file to inspect
+- `risk`: read-only, write, secret, permission, cost, or public exposure
+
+## Avoid
+
+- Do not guess a service when Huawei Cloud Skills or official docs should be checked.
+- Do not load many service references. Pick the next one that matches the intent.
+- Do not propose write operations before the user has seen the plan.
+- Do not query every region just to find a reference resource.

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Huawei Cloud Capability Discovery"
-  short_description: "Find the right Huawei Cloud capability path for a developer task."
-  default_prompt: "Use $huaweicloud-capability-discovery to route this scenario to Huawei Cloud capabilities."
+interface:
+  display_name: 'Huawei Cloud Capability Discovery'
+  short_description: 'Find the right Huawei Cloud capability path for a developer task.'
+  default_prompt: 'Use $huaweicloud-capability-discovery to route this scenario to Huawei Cloud capabilities.'