huaweicloud-devkit 1.0.2-dev.9 → 1.1.2-next.0

package/README.md

@@ -1,17 +1,18 @@
 # HuaweiCloud DevKit
 
+[![Discussions](https://img.shields.io/badge/Discussions-Join%20the%20discussion-blue)](https://github.com/huaweicloud/huaweicloud-devkit/discussions)
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
-[![CI](https://github.com/huaweicloud/HuaweiCloud-Devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/HuaweiCloud-Devkit/actions/workflows/ci.yml)
+[![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 
 **[中文](README.zh-CN.md) | English**
 
 Help AI coding agents use Huawei Cloud safely and accurately — a single integration that gives agents cloud knowledge, CLI tooling, and safety guardrails.
 
-Supports OpenCode, Codex, CodeArts Agent, and WorkBuddy.
+Supports OpenCode, Codex, CodeArts Agent, WorkBuddy, and DeepSeek Harness (DSH).
 
 ## Prerequisites
 
-- Node.js >= 22
+- Node.js >= 20
 
 ## Quick Start
 
@@ -84,6 +85,29 @@ npx --yes huaweicloud-devkit uninstall --target workbuddy
 
 > **Updating**: `update` is incremental per agent — it refreshes only the installed files and leaves your config untouched. Use `update --target all` to update every installed agent at once.
 
+### DeepSeek Harness (DSH)
+
+```bash
+npx --yes huaweicloud-devkit install --target dsh
+```
+
+The installer copies Skills to `$DSH_HOME/skills`, installs the MCP server and
+safety policy under `$DSH_HOME/huaweicloud-plugins`, and maintains
+`$DSH_HOME/profiles/web/cordis.patch.yml`. **Restart the DSH session** after
+installation.
+
+```bash
+npx --yes huaweicloud-devkit doctor
+npx --yes huaweicloud-devkit status --target dsh
+npx --yes huaweicloud-devkit update --target dsh
+npx --yes huaweicloud-devkit uninstall --target dsh
+```
+
+> DSH V1 reuses the existing MCP server through
+> `@deepseek-ai/dsh-mcp-client`. If the installer reports that the DSH MCP
+> client is not detected, run:
+> `npx @deepseek-ai/dsh plugin --profile web add @deepseek-ai/dsh-mcp-client`.
+
 ### Other Agents
 
 For agents that support the Model Context Protocol (MCP):
@@ -106,7 +130,7 @@ Then install:
 npx --yes huaweicloud-devkit install
 ```
 
-> **Prerequisite:** Node.js >= 22. Run `npx huaweicloud-devkit auth init` for unified credentials.
+> **Prerequisite:** Node.js >= 20. Run `npx huaweicloud-devkit auth init` for unified credentials.
 
 ## What It Does
 
@@ -124,6 +148,7 @@ ECS, OBS, VPC, IAM, RDS, GaussDB, FunctionGraph, APIG, CCE, SMN/DMS, ModelArts,
 - [Architecture](docs/architecture.md)
 - [Safety Model](docs/safety-model.md)
 - [Hook Rule Model](docs/hook-rule-model.md)
+- [DeepSeek Harness Integration](docs/dsh-integration.md)
 - [Changelog](docs/CHANGELOG.md)
 - [KooCLI official docs](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html)
 

package/README.zh-CN.md

@@ -1,17 +1,18 @@
 # HuaweiCloud DevKit
 
+[![参与讨论](https://img.shields.io/badge/参与讨论-Join%20the%20discussion-blue)](https://github.com/huaweicloud/huaweicloud-devkit/discussions)
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
-[![CI](https://github.com/huaweicloud/HuaweiCloud-Devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/HuaweiCloud-Devkit/actions/workflows/ci.yml)
+[![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 
 **中文 | [English](README.md)**
 
 帮助 AI 编码助手安全、准确地使用华为云——一站式集成云知识、CLI 工具和安全护栏。
 
-支持 OpenCode、Codex、码道（CodeArts Agent）、WorkBuddy。
+支持 OpenCode、Codex、码道（CodeArts Agent）、WorkBuddy、DeepSeek Harness（DSH）。
 
 ## 前置条件
 
-- Node.js >= 22
+- Node.js >= 20
 
 ## 快速开始
 
@@ -84,6 +85,27 @@ npx --yes huaweicloud-devkit uninstall --target workbuddy
 
 > **更新机制**：`update` 按 agent 增量更新，只刷新必要文件、不动你的配置文件。`update --target all` 可一次更新所有已安装的 agent。
 
+### DeepSeek Harness（DSH）
+
+```bash
+npx --yes huaweicloud-devkit install --target dsh
+```
+
+安装器会把 Skills 写入 `$DSH_HOME/skills`，把 MCP Server 和安全策略写入
+`$DSH_HOME/huaweicloud-plugins`，并自动维护
+`$DSH_HOME/profiles/web/cordis.patch.yml`。安装后**重启 DSH 会话**。
+
+```bash
+npx --yes huaweicloud-devkit doctor
+npx --yes huaweicloud-devkit status --target dsh
+npx --yes huaweicloud-devkit update --target dsh
+npx --yes huaweicloud-devkit uninstall --target dsh
+```
+
+> DSH V1 通过 `@deepseek-ai/dsh-mcp-client` 复用现有 MCP Server。
+> 如果安装器提示 DSH MCP 客户端未检测到，请按提示执行
+> `npx @deepseek-ai/dsh plugin --profile web add @deepseek-ai/dsh-mcp-client`。
+
 ### 其他 Agent
 
 支持 MCP 协议的 Agent，手动配置：
@@ -106,7 +128,7 @@ npx --yes huaweicloud-devkit uninstall --target workbuddy
 npx --yes huaweicloud-devkit install
 ```
 
-> **前置条件：** Node.js >= 22。执行 `npx huaweicloud-devkit auth init` 完成统一认证。
+> **前置条件：** Node.js >= 20。执行 `npx huaweicloud-devkit auth init` 完成统一认证。
 
 ## 功能特性
 
@@ -124,6 +146,7 @@ ECS、OBS、VPC、IAM、RDS、GaussDB、FunctionGraph、APIG、CCE、SMN/DMS、M
 - [架构](docs/architecture.md)
 - [安全模型](docs/safety-model.md)
 - [Hook 规则模型](docs/hook-rule-model.md)
+- [DeepSeek Harness 集成](docs/dsh-integration.md)
 - [变更记录](docs/CHANGELOG.md)
 - [KooCLI 官方文档](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html)
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "huaweicloud-devkit",
-    "version": "1.0.2-dev.9",
+    "version": "1.1.2-next.0",
     "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
     "type": "module",
     "files": [
@@ -33,6 +33,8 @@
         "codex",
         "opencode",
         "workbuddy",
+        "dsh",
+        "deepseek-harness",
         "mcp",
         "koocli",
         "hcloud"

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.2-dev.9",
+  "version": "1.1.2-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "1.0.2-dev.9",
+  "version": "1.1.2-next.0",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.2-dev.9",
+  "version": "1.1.2-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "1.0.0",
+  "version": "1.1.2-next.0",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md

@@ -8,6 +8,12 @@ version: 1
 
 **STOP - Do not answer from general knowledge.** Follow the procedure below.
 
+## Routing Guard: Deploy vs Store
+
+- If the developer's goal is to **deploy, host, or preview a web app / static website** (temporary hosting, quick preview), do NOT default to OBS. Present deployment-target options with the sandbox first: ① huawei-sandbox (recommended), ② OBS static hosting, ③ ECS, ④ CCE. Ask: "建议优先部署到沙箱（临时运行环境，可预览访问），也可选 OBS 静态托管/ECS/CCE，你想部署到哪里？"
+- Proceed with OBS only when the developer selects OBS, explicitly asks for OBS, or the intent is long-term static hosting / CDN / file storage.
+- OBS is a storage service; it is not a general web-hosting default.
+
 ## Critical: OBS Command Syntax
 
 KooCLI OBS uses **obsutil-style** commands, NOT API-style operations. Always run `hcloud OBS help` (no `--`) before constructing commands:

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -15,6 +15,7 @@ Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace t
 ## Activation
 
 - **Proactive offering**: when the developer's task needs a temporary runtime (e.g. "deploy this web app", "run this app and preview it"), offer the sandbox proactively — the developer never has to say "use sandbox". Prompt: "This task can be satisfied by a sandbox — use it?"
+- **Static website hosting — present options, sandbox first**: when the developer asks to deploy/host/publish a static website or web app without naming a target, do NOT silently pick a service. Present the target options in this order: ① 沙箱 (recommended — temporary runtime, instant preview URL) ② OBS 静态托管 (long-term static hosting/CDN) ③ ECS ④ CCE, then follow the developer's choice. Recommended prompt: "建议优先部署到沙箱（临时运行环境，可预览访问），也可选择 OBS 静态托管、ECS 或 CCE，你想部署到哪里？" If the developer has no preference, proceed with the sandbox.
 - **Detect web apps in deploy-a-repo prompts**: prompts like "部署 GitHub - <owner>/<repo>" or "deploy <github repo>" do not say "web app". Clone or inspect the repository first (package.json with dev/serve/build scripts, index.html, frontend framework dependencies such as vue/react/angular/vite, static sites, Dockerfile running a web server). If it is a web application, offer the sandbox first: "检测到该项目是 Web 应用，建议优先使用沙箱部署（临时运行环境，可预览访问），是否使用？"
 - **Clone into the sandbox workspace directory**: always put project code under `/workspace/<repo-name>` (create the directory if missing) — `/workspace` is the sandbox's dedicated workspace mount at the filesystem root, not `$HOME/workspace`. Never use `/tmp` or other ephemeral locations. This keeps the project with the sandbox session, is easy to reference for serving/exposing, and survives session-level restarts of the shell.
 - **Deployment must end with a public URL**: after deploying and exposing the app with DevBridge, always return the tunnel URL to the developer as the final result — a deployment without an accessible link is incomplete.
@@ -48,13 +49,17 @@ Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace t
 
 Setup is a **plugin-side preflight** — the developer should be asked a question only once, when the agreement actually needs signing:
 
-1. **Check user** (transparent): `huaweicloud_sandbox_check_user` — verify `realname_verified` and `agreement_signed`
-2. **Real-name verification** (only if `realname_verified=false`): tell the developer once, "Huawei Cloud requires real-name verification before using the sandbox." and stop — do not retry `connect` in a loop
-3. **Sign agreement** (only if `agreement_signed=false`): ask the developer once as the plugin — "Huawei Cloud sandbox requires signing its service agreement. May I sign it on your behalf?" — then call `huaweicloud_sandbox_sign_agreement`. Do not expose the underlying sandbox/DevBridge service as a separate entity the developer must understand or sign up for
-4. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`
-5. **Inject credentials** (optional): `huaweicloud_sandbox_credentials` — enables cloud API access from sandbox
-6. **Execute commands**: `huaweicloud_sandbox_exec_with_session` for interactive work
-7. **Expose the deployed app and return the public URL**: set up a public access link for the app port and give the URL to the developer as the final result (see "Expose the deployed app (public URL)") — this step uses an internal tunnel mechanism that must never be mentioned to the developer
+1. **Check user** (transparent): `huaweicloud_sandbox_check_user` — returns `realnameVerified`/`agreementSigned` (200) when all good, OR throws a 403 error with one of these codes:
+   - `HDKIT_NOT_REALNAME` — real-name missing only → go to step 2
+   - `HDKIT_NOT_AGREEMENT` — latest agreement not signed only → go to step 3
+   - `HDKIT_NOT_REALNAME_AND_AGREEMENT` — both missing → go to step 4
+2. **Real-name verification only** (`HDKIT_NOT_REALNAME`): tell the developer once, "Huawei Cloud requires real-name verification before using the sandbox — please complete it in the Huawei Cloud console (实名认证)." and stop — do not retry `connect` in a loop
+3. **Sign agreement only** (`HDKIT_NOT_AGREEMENT`): **STOP and do NOT sign on your own.** Ask the developer: "Huawei Cloud sandbox requires signing the latest developer service agreement. May I sign it for you?" Then **wait for the developer to explicitly agree** (e.g. "签署" / "确认" / "sign it"). Only after explicit consent call `huaweicloud_sandbox_sign_agreement` and return its result (`signed`/`signedCount`) to the developer. **Never sign a legal agreement on the developer's behalf without their explicit, unambiguous consent.** Do not expose the underlying sandbox/DevBridge service as a separate entity the developer must understand or sign up for
+4. **Both missing** (`HDKIT_NOT_REALNAME_AND_AGREEMENT`): present **both** requirements together in one message — the real-name verification steps (console, step 2) **and** the agreement-signing request (step 3, wait for explicit consent) — so the developer can complete both at once
+5. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`
+6. **Inject credentials** (optional): `huaweicloud_sandbox_credentials` — enables cloud API access from sandbox
+7. **Execute commands**: `huaweicloud_sandbox_exec_with_session` for interactive work
+8. **Expose the deployed app and return the public URL**: set up a public access link for the app port and give the URL to the developer as the final result (see "Expose the deployed app (public URL)") — this step uses an internal tunnel mechanism that must never be mentioned to the developer
 
 ## Expose the deployed app (public URL)
 
@@ -97,7 +102,7 @@ sleep 10 && cat /tmp/host.log
 | Trap | Why |
 |------|-----|
 | Agreement required first | `sandbox_connect` fails if the agreement isn't signed; the `sandbox_check_user` preflight detects this, so surface it to the developer only when signing is needed |
-| Real-name required | `sandbox_connect` fails if `realname_verified=false`; tell the developer once and stop, don't loop on connect |
+| Real-name required | `sandbox_connect` fails if `realnameVerified=false`; tell the developer once and stop, don't loop on connect |
 | Never expose tunnel details | Do not mention "DevBridge"/"tunnel"/"devbridge" to the developer — say "正在生成访问地址..." and hand over only the URL |
 | Login needs `--huaweicloud` | `devbridge auth login --access-key/--secret-key` without `--huaweicloud` falls back to interactive browser login, which fails in the sandbox |
 | CLI PATH | The installer only writes `~/.bashrc`; run `export PATH=$PATH:$HOME/.huawei/bin` in the session before using `devbridge` |

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md

@@ -22,6 +22,10 @@ Use this skill to turn vague developer intent into a precise Huawei Cloud capabi
 8. Treat Terraform as a secondary V1 path for reviewed IaC, not the default.
 9. When no built-in devkit skill matches, browse the community skill marketplace at https://github.com/huaweicloud/huaweicloud-skills. Fetch the index from https://raw.githubusercontent.com/huaweicloud/huaweicloud-skills/master/skills-index/index.json.
 
+## Deployment Target Options
+
+When the intent is to **deploy, host, or preview a web app or static website** and the developer has not named a target, do NOT default to OBS or any single service. Present the options and let the developer choose, recommending the sandbox first: ① huawei-sandbox (recommended — temporary runtime, instant preview URL) ② huawei-obs (long-term static hosting/CDN) ③ huawei-ecs ④ huawei-cce. Only follow an explicit target when the developer names one.
+
 ## Region Intent
 
 - Extract region intent from the user's words before querying. Examples: Singapore -> `ap-southeast-3` first, Hong Kong -> `ap-southeast-2`, Beijing -> `cn-north-4`, Shanghai -> `cn-east-3`.

package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md

@@ -26,7 +26,7 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 |----|------|----------------|------------|
 | select | Service Selection | which service, what should I use, compare, recommend | Read references/select.md | select
 | compute | Compute Routing | server, VM, instance, ECS, BMS, GPU, HPC | Handoff to huawei-ecs or huawei-cce |
-| storage | Storage Routing | store files, bucket, OBS, backup, disk, EVS, SFS | Handoff to huawei-obs or huawei-cbr |
+| storage | Storage Routing | store files, bucket, OBS, backup, disk, EVS, SFS (long-term storage/CDN intent only) | Handoff to huawei-obs or huawei-cbr |
 | database | Database Routing | database, SQL, NoSQL, cache, RDS, GaussDB, DDS, DCS | Handoff to huawei-rds or huawei-gaussdb |
 | network | Network Routing | VPC, subnet, security group, EIP, NAT, VPN | Handoff to huawei-vpc |
 | serverless | Serverless Routing | function, Lambda, serverless, FunctionGraph, API gateway | Handoff to huawei-functiongraph or huawei-apig |
@@ -36,7 +36,7 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 | observability | Observability Routing | monitor, alarm, log, audit, trace, Cloud Eye | Handoff to huawei-cloud-eye or huawei-cts |
 | billing | Billing Routing | cost, bill, budget, spending, invoice | Handoff to huawei-billing |
 | iam | IAM Routing | permission, policy, role, user, group, AK/SK | Handoff to huawei-iam |
-| deployment | Deployment Routing | deploy, CI/CD, pipeline, release | CI/CD pipeline -> huawei-deployment; deploy a web app or a GitHub repo (no CI/CD target) -> huawei-sandbox |
+| deployment | Deployment Routing | deploy, host, publish, CI/CD, pipeline, release | CI/CD pipeline -> huawei-deployment; deploy/host/preview a web app or static website (no CI/CD target) -> present deployment-target options first, see "Deployment Target Options" below |
 | sandbox | Sandbox Routing | sandbox, DevStation, workspace, terminal, preview, temporary runtime | Handoff to huawei-sandbox |
 | cli | CLI and Auth Routing | install hcloud, configure KooCLI, AK/SK setup | Handoff to huaweicloud-cli-and-auth |
 | safety | Safety Routing | is this safe, approve command, risk review | Handoff to huaweicloud-safety |
@@ -50,7 +50,7 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 |----------|----------------|-------|
 | Web application hosting | ECS | huawei-ecs |
 | Containerized microservices | CCE | huawei-cce |
-| Static file storage / CDN | OBS | huawei-obs |
+| Static file storage / CDN (long-term) | OBS | huawei-obs |
 | Relational database (MySQL/PG) | RDS | huawei-rds |
 | Distributed SQL database | GaussDB | huawei-gaussdb |
 | Document database (MongoDB API) | DDS | huawei-dds-dcs |
@@ -71,6 +71,21 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 | Temporary runtime / web app preview | Sandbox (DevStation) | huawei-sandbox |
 | Getting started | Account setup | huaweicloud-cli-and-auth |
 
+## Deployment Target Options
+
+When the intent is to **deploy, host, or preview a web app or static website** (no explicit target named), NEVER default to a single service such as OBS. Ask the developer to choose a target and present the options in this order:
+
+| # | Option | When to choose | Skill |
+|---|--------|----------------|-------|
+| 1 | **Sandbox (DevStation) — recommended** | Temporary runtime, quick preview, demo; instant public URL | huawei-sandbox |
+| 2 | OBS static website hosting | Long-term static hosting / CDN, no backend | huawei-obs |
+| 3 | ECS | Needs a server runtime (backend, custom server) | huawei-ecs |
+| 4 | CCE | Containerized workloads, scaling | huawei-cce |
+
+- Recommended prompt: "这个项目是 Web 应用/静态网站，建议优先部署到沙箱（临时运行环境，立即可预览）。也可选择 OBS 静态托管、ECS 或 CCE，你想部署到哪里？"
+- If the developer explicitly names a target (e.g. "deploy to OBS"), follow that target and hand off to the corresponding service skill.
+- If the developer has no preference, recommend the sandbox first.
+
 ## Capability Sources
 
 - Huawei Cloud Skills: scenario workflows and recipes (check first)

package/plugins/huaweicloud-core/src/auth/agent-registration.mjs

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { spawnSync } from 'node:child_process';
 
-export const SUPPORTED_AGENT_TARGETS = ['opencode', 'codex', 'codex-desktop', 'codearts', 'workbuddy'];
+export const SUPPORTED_AGENT_TARGETS = ['opencode', 'codex', 'codex-desktop', 'codearts', 'workbuddy', 'dsh'];
 
 function baseHome() {
   return process.env.HUAWEICLOUD_HOME || homedir();
@@ -71,6 +71,23 @@ function workbuddyRegistered() {
   return Boolean(cfg?.mcpServers?.['huaweicloud-devkit']);
 }
 
+function dshRoot() {
+  return process.env.DSH_HOME || join(baseHome(), '.dsh');
+}
+
+function dshRegistered() {
+  const patchPath = join(dshRoot(), 'profiles', 'web', 'cordis.patch.yml');
+  if (!existsSync(patchPath)) return false;
+  try {
+    const patch = readFileSync(patchPath, 'utf8');
+    return patch.includes('id: mcp-huaweicloud')
+      && patch.includes("@deepseek-ai/dsh-mcp-client")
+      && patch.includes('serverName: huaweicloud');
+  } catch {
+    return false;
+  }
+}
+
 export function getAgentRegistrationStatuses(target = 'all') {
   const requested = target === 'all' ? SUPPORTED_AGENT_TARGETS : [target];
   const result = { target, agents: {} };
@@ -81,6 +98,7 @@ export function getAgentRegistrationStatuses(target = 'all') {
     if (agent === 'codex') configured = codexCliRegistered();
     if (agent === 'codearts') configured = codeartsRegistered();
     if (agent === 'workbuddy') configured = workbuddyRegistered();
+    if (agent === 'dsh') configured = dshRegistered();
     result.agents[agent] = { configured };
   }
   return result;

package/plugins/huaweicloud-core/src/proxy/proxy-agent.mjs

@@ -0,0 +1,155 @@
+import { getProxyUrlForTarget } from './proxy-config.mjs';
+
+let cachedDispatcher = undefined;
+let cachedDispatcherProxyUrl = null;
+
+export async function getProxyDispatcher(targetUrl) {
+  const proxyUrl = getProxyUrlForTarget(targetUrl);
+  if (!proxyUrl) return undefined;
+
+  if (cachedDispatcher && cachedDispatcherProxyUrl === proxyUrl) {
+    return cachedDispatcher;
+  }
+
+  const { ProxyAgent } = await import('undici');
+  cachedDispatcher = new ProxyAgent(proxyUrl);
+  cachedDispatcherProxyUrl = proxyUrl;
+  return cachedDispatcher;
+}
+
+export function clearProxyDispatcherCache() {
+  cachedDispatcher = undefined;
+  cachedDispatcherProxyUrl = null;
+}
+
+export async function createProxyWebSocket(url, protocols) {
+  const proxyUrl = getProxyUrlForTarget(url);
+  if (!proxyUrl) {
+    return new globalThis.WebSocket(url, protocols);
+  }
+
+  const dispatcher = await getProxyDispatcher(url);
+  const { WebSocket: UndiciWebSocket } = await import('undici');
+
+  const wsOptions = { dispatcher };
+  if (protocols) {
+    if (Array.isArray(protocols)) {
+      wsOptions.protocols = protocols;
+    } else {
+      wsOptions.protocols = [protocols];
+    }
+  }
+
+  return new UndiciWebSocket(url, wsOptions);
+}
+
+export function getWebSocketImpl(targetUrl) {
+  const proxyUrl = getProxyUrlForTarget(targetUrl);
+  if (!proxyUrl) return globalThis.WebSocket;
+
+  return (url, protocols) => {
+    const proxyUrlForTarget = getProxyUrlForTarget(url);
+    if (!proxyUrlForTarget) {
+      return new globalThis.WebSocket(url, protocols);
+    }
+
+    const wsPromise = (async () => {
+      const dispatcher = await getProxyDispatcher(url);
+      const { WebSocket: UndiciWebSocket } = await import('undici');
+
+      const wsOptions = { dispatcher };
+      if (protocols) {
+        if (Array.isArray(protocols)) {
+          wsOptions.protocols = protocols;
+        } else {
+          wsOptions.protocols = [protocols];
+        }
+      }
+
+      return new UndiciWebSocket(url, wsOptions);
+    })();
+
+    return createSyncProxyWebSocketWrapper(wsPromise);
+  };
+}
+
+function createSyncProxyWebSocketWrapper(wsPromise) {
+  const pendingEvents = [];
+  const eventHandlers = new Map();
+  let ws = null;
+  let settled = false;
+  let readyState = 0;
+  let binaryType = 'arraybuffer';
+
+  const wrapper = {
+    get readyState() { return ws ? ws.readyState : readyState; },
+    get url() { return ws ? ws.url : ''; },
+    get protocol() { return ws ? ws.protocol : ''; },
+    get binaryType() { return ws ? ws.binaryType : binaryType; },
+    set binaryType(v) {
+      binaryType = v;
+      if (ws) ws.binaryType = v;
+    },
+
+    send(data, callback) {
+      if (ws) {
+        if (ws.send.length >= 2) return ws.send(data, callback);
+        try { ws.send(data); if (callback) callback(null); } catch (e) { if (callback) callback(e); }
+        return;
+      }
+      pendingEvents.push({ type: 'send', data, callback });
+    },
+
+    close(code, reason) {
+      if (ws) { ws.close(code, reason); return; }
+      readyState = 3;
+      pendingEvents.push({ type: 'close', code, reason });
+    },
+
+    addEventListener(type, handler) {
+      if (!eventHandlers.has(type)) eventHandlers.set(type, new Set());
+      eventHandlers.get(type).add(handler);
+      if (ws) ws.addEventListener(type, handler);
+    },
+
+    removeEventListener(type, handler) {
+      const handlers = eventHandlers.get(type);
+      if (handlers) handlers.delete(handler);
+      if (ws) ws.removeEventListener(type, handler);
+    },
+
+    on(type, handler) { wrapper.addEventListener(type, handler); },
+    off(type, handler) { wrapper.removeEventListener(type, handler); },
+  };
+
+  function flushPendingEvents() {
+    for (const evt of pendingEvents) {
+      if (evt.type === 'send') {
+        if (ws.send.length >= 2) ws.send(evt.data, evt.callback);
+        else { try { ws.send(evt.data); if (evt.callback) evt.callback(null); } catch (e) { if (evt.callback) evt.callback(e); } }
+      } else if (evt.type === 'close') {
+        ws.close(evt.code, evt.reason);
+      }
+    }
+    pendingEvents.length = 0;
+  }
+
+  wsPromise.then((resolvedWs) => {
+    ws = resolvedWs;
+    if ('binaryType' in ws) ws.binaryType = binaryType;
+    for (const [type, handlers] of eventHandlers) {
+      for (const handler of handlers) {
+        ws.addEventListener(type, handler);
+      }
+    }
+    flushPendingEvents();
+  }).catch((err) => {
+    readyState = 3;
+    const handlers = eventHandlers.get('error');
+    if (handlers) for (const h of handlers) h(err instanceof Error ? err : new Error(String(err)));
+    const closeHandlers = eventHandlers.get('close');
+    if (closeHandlers) for (const h of closeHandlers) h({ code: 1006, reason: err.message || String(err) });
+  });
+
+  return wrapper;
+}

package/plugins/huaweicloud-core/src/proxy/proxy-config.mjs

@@ -0,0 +1,87 @@
+import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+
+function baseHome() {
+  return process.env.HUAWEICLOUD_HOME || homedir();
+}
+
+export function proxyConfigPath() {
+  return join(baseHome(), '.config', 'huaweicloud', 'proxy.json');
+}
+
+export function readProxyConfig() {
+  const path = proxyConfigPath();
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export function writeProxyConfig(config = {}) {
+  const path = proxyConfigPath();
+  mkdirSync(dirname(path), { recursive: true });
+  const payload = {
+    https_proxy: String(config.https_proxy || ''),
+    http_proxy: String(config.http_proxy || ''),
+    no_proxy: String(config.no_proxy || ''),
+  };
+  writeFileSync(path, JSON.stringify(payload, null, 2), { encoding: 'utf8' });
+  return path;
+}
+
+export function clearProxyConfig() {
+  const path = proxyConfigPath();
+  if (!existsSync(path)) return false;
+  rmSync(path);
+  return true;
+}
+
+function shouldBypassProxy(hostname, noProxyList) {
+  if (!noProxyList.length) return false;
+  const lower = hostname.toLowerCase();
+  for (const pattern of noProxyList) {
+    const p = pattern.trim().toLowerCase();
+    if (!p) continue;
+    if (p === lower) return true;
+    if (p === '*') return true;
+    if (p.startsWith('.') && lower.endsWith(p)) return true;
+    if (lower.endsWith('.' + p)) return true;
+  }
+  return false;
+}
+
+export function getProxySettings(targetUrl) {
+  const envHttps = process.env.HTTPS_PROXY || process.env.https_proxy || '';
+  const envHttp = process.env.HTTP_PROXY || process.env.http_proxy || '';
+  const envNoProxy = process.env.NO_PROXY || process.env.no_proxy || '';
+
+  const fileConfig = readProxyConfig();
+
+  const https_proxy = envHttps || (fileConfig?.https_proxy || '');
+  const http_proxy = envHttp || (fileConfig?.http_proxy || '');
+  const no_proxy = envNoProxy || (fileConfig?.no_proxy || '');
+
+  if (!https_proxy && !http_proxy) return null;
+
+  const noProxyList = no_proxy.split(',').map((s) => s.trim()).filter(Boolean);
+
+  if (targetUrl) {
+    const parsed = new URL(targetUrl);
+    if (shouldBypassProxy(parsed.hostname, noProxyList)) return null;
+    const isHttps = parsed.protocol === 'https:';
+    const proxyUrl = isHttps ? https_proxy : http_proxy;
+    if (!proxyUrl) return null;
+    return { proxyUrl, noProxyList, targetProtocol: parsed.protocol };
+  }
+
+  return { https_proxy, http_proxy, no_proxy, noProxyList };
+}
+
+export function getProxyUrlForTarget(targetUrl) {
+  const settings = getProxySettings(targetUrl);
+  if (!settings) return null;
+  return settings.proxyUrl || null;
+}

package/plugins/huaweicloud-core/src/sandbox/hdkitservice-api.mjs

@@ -1,4 +1,5 @@
 import { getCredentials } from './hwlink-api.mjs';
+import { getProxyDispatcher } from '../proxy/proxy-agent.mjs';
 
 const HDKIT_BASE_URL =
   process.env.HDKITSERVICE_ENDPOINT ||
@@ -22,12 +23,15 @@ async function hdkitRequest(method, path, body, timeoutMs = 300000) {
 
   let resp;
   try {
-    resp = await fetch(url, {
+    const dispatcher = await getProxyDispatcher(url);
+    const fetchOpts = {
       method,
       headers,
       body: body ? JSON.stringify(body) : undefined,
       signal: controller.signal,
-    });
+    };
+    if (dispatcher) fetchOpts.dispatcher = dispatcher;
+    resp = await fetch(url, fetchOpts);
   } finally {
     clearTimeout(timer);
   }
@@ -46,7 +50,7 @@ async function hdkitRequest(method, path, body, timeoutMs = 300000) {
     );
     err.code = data.code;
     err.status = resp.status;
-    err.traceId = data.trace_id;
+    err.traceId = data.traceId; // 后端实际返回驼峰 traceId
     throw err;
   }