huaweicloud-devkit 1.0.2-next.11 → 1.0.2-next.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.0.2-next.11",
+  "version": "1.0.2-next.13",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
   "files": [
@@ -29,6 +29,7 @@
     "postinstall": "node -e \"console.log('\\nHuaweiCloud DevKit installed. Run: npx huaweicloud-devkit install\\n')\""
   },
   "dependencies": {
+    "better-sqlite3": "^13.0.3",
     "undici": "^8.10.0"
   },
   "devDependencies": {

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.2-next.11",
+  "version": "1.0.2-next.13",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "1.0.2-next.11",
+  "version": "1.0.2-next.13",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.2-next.11",
+  "version": "1.0.2-next.13",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.mcp.json

@@ -5,8 +5,7 @@
       "args": ["./src/mcp-server.mjs"],
       "cwd": ".",
       "env": {
-        "HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local",
-        "HDKITSERVICE_ENDPOINT": ""
+        "HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local"
       }
     }
   }

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "1.0.2-next.11",
+  "version": "1.0.2-next.13",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -42,10 +42,27 @@ Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace t
 
 | Tool                                    | Purpose                                                                  |
 | --------------------------------------- | ------------------------------------------------------------------------ |
-| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists)                                 |
+| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists; best for interactive work)      |
+| `huaweicloud_sandbox_exec_one_shot`     | One-shot execution (fresh connection; best for long/heavy commands)      |
 | `huaweicloud_sandbox_upload_file`       | Upload a local file into the sandbox (chunked base64 write + md5 verify) |
 | `huaweicloud_sandbox_close_session`     | Close a persistent terminal session                                      |
 
+### Tool Selection Guide
+
+| Scenario                           | Use                                | Why                                                     |
+| ---------------------------------- | ---------------------------------- | ------------------------------------------------------- |
+| `cd`, env setup, command chains    | `exec_with_session`                | Needs shared shell state across calls                   |
+| `npm install`, `apt-get`, builds   | `exec_one_shot`                    | Long-running (>30s), no state needed, more stable       |
+| `curl`, health checks, quick tests | Either — `exec_one_shot` preferred | Stateless, fast                                         |
+| Server startup (background)        | `exec_with_session`                | Need to `nohup ... &` then check output in same session |
+| Deployment scripts                 | `exec_one_shot`                    | Long script, fresh connection avoids session timeouts   |
+
+**Timeout tuning**: default is 120s. For commands expected to run longer (e.g. large builds), pass `timeout_ms` explicitly:
+
+```json
+{ "timeout_ms": 300000 }
+```
+
 ## Workflow
 
 Setup is a **plugin-side preflight** — the developer should be asked a question only once, when the agreement actually needs signing:
@@ -59,7 +76,7 @@ Setup is a **plugin-side preflight** — the developer should be asked a questio
 4. **Both missing** (`HDKIT_NOT_REALNAME_AND_AGREEMENT`): present **both** requirements together in one message — the real-name verification steps (console, step 2) **and** the agreement-signing request (step 3, wait for explicit consent) — so the developer can complete both at once
 5. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`
 6. **Inject credentials** (optional): `huaweicloud_sandbox_credentials` — enables cloud API access from sandbox
-7. **Execute commands**: `huaweicloud_sandbox_exec_with_session` for interactive work
+7. **Execute commands**: use `huaweicloud_sandbox_exec_with_session` for interactive work (cd, env setup), or `huaweicloud_sandbox_exec_one_shot` for long-running builds/installs. See [Tool Selection Guide](#tool-selection-guide).
 8. **Expose the deployed app and return the public URL**: set up a public access link for the app port and give the URL to the developer as the final result (see "Expose the deployed app (public URL)") — this step uses an internal tunnel mechanism that must never be mentioned to the developer
 
 ## File Transfer (local → sandbox)
@@ -72,7 +89,7 @@ There is no general file-upload primitive on the sandbox service itself. Get loc
 
 ### Exec channel size limit
 
-`huaweicloud_sandbox_exec_with_session` is fragile for long commands and large inline content. Do NOT paste a file's base64 directly into a single command:
+`huaweicloud_sandbox_exec_with_session` and `huaweicloud_sandbox_exec_one_shot` are fragile for long commands and large inline content. Do NOT paste a file's base64 directly into a single command:
 
 | Payload                     | Result                                 |
 | --------------------------- | -------------------------------------- |
@@ -104,7 +121,11 @@ Expose a deployed web app to a public URL and return that URL to the developer.
 **Install** (internal tooling; skip if `devbridge version` already works):
 
 ```bash
-curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash
+if command -v devbridge >/dev/null 2>&1; then
+  echo "devbridge already installed"
+else
+  curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash
+fi
 export PATH=$PATH:$HOME/.huawei/bin   # installer only writes ~/.bashrc; session shells do not re-source it
 ```
 
@@ -143,6 +164,7 @@ sleep 10 && cat /tmp/host.log
 | Never install tunnel tooling locally | If the sandbox cannot install it, report a generic error and stop — installing on the developer's machine defeats sandbox deployment                                                                         |
 | Return the deployment URL            | Always hand the public URL from the host log to the developer as the final result                                                                                                                            |
 | Session state persists               | `exec_with_session` preserves `cd`, env vars, aliases between calls                                                                                                                                          |
+| Long commands prefer one-shot        | `exec_one_shot` creates a fresh connection per call — more stable for builds, installs, and scripts >30s. See [Tool Selection Guide](#tool-selection-guide).                                                 |
 | Destructive commands blocked         | `rm -rf /`, `mkfs`, `dd if=`, fork bombs are denied by safety policy                                                                                                                                         |
 | Workspace ID = dev_stage_id          | Use `dev_stage_id` from `sandbox_connect` as `workspace_id` for terminal exec                                                                                                                                |
 | Projects live in `/workspace`        | Clone/install project code under `/workspace/<repo-name>` (filesystem-root workspace mount, not `$HOME/workspace`), never in `/tmp` — ephemeral locations lose the project when the sandbox session restarts |
@@ -163,11 +185,11 @@ node --version
 
 ## Environment Variables
 
-| Variable                | Required | Description               |
-| ----------------------- | -------- | ------------------------- |
-| `HW_ACCESS_KEY`         | Yes      | Huawei Cloud AK           |
-| `HW_SECRET_KEY`         | Yes      | Huawei Cloud SK           |
-| `HW_SECURITY_TOKEN`     | No       | STS security token        |
-| `HW_WORKSPACE_ID`       | No       | Default workspace ID      |
-| `HDKITSERVICE_ENDPOINT` | No       | hdkitservice API endpoint |
-| `HWLINK_ENDPOINT`       | No       | DevStation API endpoint   |
+| Variable                | Required | Description                                                     |
+| ----------------------- | -------- | --------------------------------------------------------------- |
+| `HW_ACCESS_KEY`         | Yes      | Huawei Cloud AK                                                 |
+| `HW_SECRET_KEY`         | Yes      | Huawei Cloud SK                                                 |
+| `HW_SECURITY_TOKEN`     | No       | STS security token                                              |
+| `HW_WORKSPACE_ID`       | No       | Default workspace ID                                            |
+| `HDKITSERVICE_ENDPOINT` | No       | hdkitservice API endpoint (default: devkit.huaweicloud.com)     |
+| `HWLINK_ENDPOINT`       | No       | DevStation API endpoint (default: devstation.myhuaweicloud.com) |

package/plugins/huaweicloud-core/src/auth/agent-registration.mjs

@@ -1,7 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
 
 export const SUPPORTED_AGENT_TARGETS = [
   'opencode',
@@ -113,12 +114,28 @@ function officeaceCapabilitiesDir() {
   return dotDir;
 }
 
+function officeaceSqlitePath() {
+  const capDir = officeaceCapabilitiesDir();
+  return join(resolve(capDir, '..'), 'data', 'mcp-connectors.sqlite');
+}
+
 function officeaceRegistered() {
+  let hasMcp = false;
+  const dbPath = officeaceSqlitePath();
+  if (existsSync(dbPath)) {
+    try {
+      const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
+      const db = new DatabaseSync(dbPath, { readonly: true });
+      const row = db.prepare("SELECT enabled FROM mcp_connectors WHERE name = 'huaweicloud-devkit'").get();
+      db.close();
+      hasMcp = Boolean(row?.enabled);
+    } catch {}
+  }
+
   const capFile = join(officeaceCapabilitiesDir(), 'capabilities.json');
   const cfg = readJsonSafe(capFile);
-  if (!cfg?.capabilities) return false;
-  const hasMcp = cfg.capabilities.some((c) => c.id === 'huaweicloud-devkit' && c.type === 'mcp');
-  const hasSkills = cfg.capabilities.some((c) => c.id === 'huaweicloud-core' && c.type === 'skill');
+  const hasSkills = cfg?.capabilities?.some((c) => c.id === 'huaweicloud-core' && c.type === 'skill') ?? false;
+
   return hasMcp || hasSkills;
 }
 

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -13,6 +13,8 @@ import { fileURLToPath } from 'node:url';
 import { homedir, platform } from 'node:os';
 import { createInterface } from 'node:readline';
 import { spawnSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import Database from 'better-sqlite3';
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
 import { SUPPORTED_AGENT_TARGETS } from './auth/agent-registration.mjs';
 import {
@@ -150,69 +152,128 @@ function officeacePluginsDir() {
   return join(officeaceCapabilitiesDir(), 'huaweicloud-plugins');
 }
 
-function readCapabilitiesJson() {
-  const capFile = officeaceCapabilitiesFile();
-  if (!existsSync(capFile)) return { capabilities: [] };
+function officeaceSqlitePath() {
+  const capDir = officeaceCapabilitiesDir();
+  return join(resolve(capDir, '..'), 'data', 'mcp-connectors.sqlite');
+}
+
+function openOfficeaceDb() {
+  return new Database(officeaceSqlitePath());
+}
+
+function officeaceGetOwnerUserId() {
+  if (!existsSync(officeaceSqlitePath())) return null;
   try {
-    return JSON.parse(readFileSync(capFile, 'utf8'));
+    const db = openOfficeaceDb();
+    const row = db.prepare('SELECT owner_user_id FROM mcp_connectors WHERE owner_user_id IS NOT NULL LIMIT 1').get();
+    db.close();
+    return row?.owner_user_id || null;
   } catch {
-    return { capabilities: [] };
+    return null;
   }
 }
 
-function writeCapabilitiesJson(config) {
-  mkdirSync(officeaceCapabilitiesDir(), { recursive: true });
-  writeFileSync(officeaceCapabilitiesFile(), JSON.stringify(config, null, 2));
-}
+function ensureOfficeaceMcpInSqlite() {
+  const dbPath = officeaceSqlitePath();
+  if (!existsSync(dbPath)) {
+    console.log(`  \x1b[31mOfficeAce database not found: ${dbPath}\x1b[0m`);
+    console.log(`  \x1b[33mPlease ensure OfficeAce is installed and has been launched at least once.\x1b[0m`);
+    return false;
+  }
 
-function ensureOfficeaceCapabilities() {
-  const capFile = officeaceCapabilitiesFile();
   const mcpPath = join(officeacePluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
-  const env = { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' };
+  const env = [{ key: 'HUAWEICLOUD_AGENT_TOOLKIT_MODE', value: 'local', sensitive: false }];
   const hcloudBin = findHcloudBin();
-  if (hcloudBin) env.HCLOUD_BIN = hcloudBin.replace(/\\/g, '/');
+  if (hcloudBin) env.push({ key: 'HCLOUD_BIN', value: hcloudBin.replace(/\\/g, '/'), sensitive: false });
 
-  const config = readCapabilitiesJson();
-  let changed = false;
+  const now = Date.now();
+  let db;
+  try {
+    db = openOfficeaceDb();
 
-  // Ensure MCP server entry
-  const mcpEntry = {
-    id: 'huaweicloud-devkit',
-    type: 'mcp',
-    enabled: true,
-    source: 'custom',
-    mcpServer: {
-      command: 'node',
-      args: [mcpPath],
-      env,
-    },
-  };
-  const existingMcpIdx = config.capabilities.findIndex((c) => c.id === 'huaweicloud-devkit' && c.type === 'mcp');
-  if (existingMcpIdx >= 0) {
-    const existing = config.capabilities[existingMcpIdx];
-    if (
-      existing.mcpServer?.command === 'node' &&
-      Array.isArray(existing.mcpServer?.args) &&
-      existing.mcpServer.args[0] === mcpPath
-    ) {
-      console.log(`  MCP config unchanged: ${capFile}`);
+    const existing = db
+      .prepare("SELECT id, command, args_json FROM mcp_connectors WHERE name = 'huaweicloud-devkit'")
+      .get();
+
+    const argsJson = JSON.stringify([mcpPath]);
+    const envJson = JSON.stringify(env);
+
+    if (existing) {
+      if (existing.command === 'node' && existing.args_json === argsJson) {
+        console.log(`  MCP config unchanged: ${dbPath}`);
+        db.close();
+        return true;
+      }
+      db.prepare(
+        'UPDATE mcp_connectors SET command = ?, args_json = ?, env_json = ?, updated_at = ?, status = ?, enabled = 1 WHERE id = ?',
+      ).run('node', argsJson, envJson, now, 'disconnected', existing.id);
+      console.log(`  MCP config updated: ${dbPath}`);
     } else {
-      config.capabilities[existingMcpIdx] = mcpEntry;
-      changed = true;
+      const ownerUserId = officeaceGetOwnerUserId();
+      if (!ownerUserId) {
+        console.log(`  \x1b[31mCannot determine owner_user_id from database\x1b[0m`);
+        db.close();
+        return false;
+      }
+      db.prepare(
+        `INSERT INTO mcp_connectors (id, owner_user_id, type, name, normalized_name, transport, timeout_ms, command, args_json, env_json, enabled, status, created_at, updated_at, version, seeded)
+         VALUES (?, ?, 'custom', 'huaweicloud-devkit', 'huaweicloud-devkit', 'stdio', 60000, 'node', ?, ?, 1, 'disconnected', ?, ?, 1, 0)`,
+      ).run(randomUUID(), ownerUserId, argsJson, envJson, now, now);
+      console.log(`  MCP config created: ${dbPath}`);
     }
-  } else {
-    config.capabilities.push(mcpEntry);
-    changed = true;
+    db.close();
+    return true;
+  } catch (err) {
+    if (db) {
+      try {
+        db.close();
+      } catch {}
+    }
+    console.log(`  \x1b[31mFailed to write MCP config: ${err.message}\x1b[0m`);
+    return false;
   }
+}
 
-  if (changed) {
-    writeCapabilitiesJson(config);
-    console.log(`  MCP config updated: ${capFile}`);
+function removeOfficeaceMcpFromSqlite() {
+  const dbPath = officeaceSqlitePath();
+  if (!existsSync(dbPath)) return;
+  let db;
+  try {
+    db = openOfficeaceDb();
+    db.prepare(
+      "DELETE FROM mcp_connector_tools WHERE connector_id IN (SELECT id FROM mcp_connectors WHERE name = 'huaweicloud-devkit')",
+    ).run();
+    const result2 = db.prepare("DELETE FROM mcp_connectors WHERE name = 'huaweicloud-devkit'").run();
+    if (result2.changes > 0) {
+      console.log(`  MCP config removed: ${dbPath}`);
+    }
+    db.close();
+  } catch (err) {
+    if (db) {
+      try {
+        db.close();
+      } catch {}
+    }
+    console.log(`  \x1b[31mFailed to remove MCP config: ${err.message}\x1b[0m`);
   }
-  return changed;
 }
 
-function removeOfficeaceCapabilities() {
+function readCapabilitiesJson() {
+  const capFile = officeaceCapabilitiesFile();
+  if (!existsSync(capFile)) return { capabilities: [] };
+  try {
+    return JSON.parse(readFileSync(capFile, 'utf8'));
+  } catch {
+    return { capabilities: [] };
+  }
+}
+
+function writeCapabilitiesJson(config) {
+  mkdirSync(officeaceCapabilitiesDir(), { recursive: true });
+  writeFileSync(officeaceCapabilitiesFile(), JSON.stringify(config, null, 2));
+}
+
+function removeOfficeaceSkillCapabilities() {
   const capFile = officeaceCapabilitiesFile();
   if (!existsSync(capFile)) return;
   let config;
@@ -226,14 +287,13 @@ function removeOfficeaceCapabilities() {
   config.capabilities = config.capabilities.filter(
     (c) =>
       !(
-        (c.id === 'huaweicloud-devkit' && c.type === 'mcp') ||
         (c.id === 'huaweicloud-core' && c.type === 'skill') ||
         (c.source === 'custom' && c.id && c.id.startsWith('huawei'))
       ),
   );
   if (config.capabilities.length !== origLen) {
     writeCapabilitiesJson(config);
-    console.log(`  Capabilities cleaned: ${capFile}`);
+    console.log(`  Skill capabilities cleaned: ${capFile}`);
   }
 }
 
@@ -1367,7 +1427,7 @@ async function installOfficeAce() {
   copyDir(safetyDir, join(pluginDest, 'safety'));
   console.log(`  Safety Policy -> ${join(pluginDest, 'safety')}`);
 
-  ensureOfficeaceCapabilities();
+  ensureOfficeaceMcpInSqlite();
   registerOfficeaceSkillEntries();
 }
 
@@ -1384,7 +1444,7 @@ async function updateOfficeAce() {
   console.log(`  MCP Server updated -> ${join(pluginDest, 'src')}`);
   copyDir(safetyDir, join(pluginDest, 'safety'));
   console.log(`  Safety Policy updated -> ${join(pluginDest, 'safety')}`);
-  ensureOfficeaceCapabilities();
+  ensureOfficeaceMcpInSqlite();
   registerOfficeaceSkillEntries();
   mkdirSync(pluginDest, { recursive: true });
   writeFileSync(join(pluginDest, '.installed'), new Date().toISOString());
@@ -1412,7 +1472,8 @@ function uninstallOfficeAce() {
   if (removeIfExists(officeacePluginsDir())) {
     console.log('  Removed MCP server and safety policy');
   }
-  removeOfficeaceCapabilities();
+  removeOfficeaceSkillCapabilities();
+  removeOfficeaceMcpFromSqlite();
 }
 
 function officeaceStatus() {
@@ -1433,15 +1494,23 @@ function officeaceStatus() {
   console.log(
     `  Skills: ${skillCount > 0 ? `\x1b[32m${skillCount} installed\x1b[0m` : '\x1b[31mNot installed\x1b[0m'}`,
   );
-  const capFile = officeaceCapabilitiesFile();
-  if (existsSync(capFile)) {
+  const dbPath = officeaceSqlitePath();
+  if (existsSync(dbPath)) {
     try {
-      const config = JSON.parse(readFileSync(capFile, 'utf8'));
-      const hasMcp = (config.capabilities || []).some((c) => c.id === 'huaweicloud-devkit' && c.type === 'mcp');
-      console.log(`  MCP config: ${hasMcp ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`);
+      const db = openOfficeaceDb();
+      const row = db.prepare("SELECT enabled, status FROM mcp_connectors WHERE name = 'huaweicloud-devkit'").get();
+      db.close();
+      if (row) {
+        const statusIcon = row.status === 'connected' ? '\x1b[32m' : '\x1b[33m';
+        console.log(`  MCP config: ${statusIcon}${row.status}\x1b[0m (enabled: ${row.enabled ? 'yes' : 'no'})`);
+      } else {
+        console.log(`  MCP config: \x1b[31mNot configured\x1b[0m`);
+      }
     } catch {
       console.log(`  MCP config: \x1b[31mInvalid\x1b[0m`);
     }
+  } else {
+    console.log(`  MCP config: \x1b[31mDatabase not found\x1b[0m`);
   }
 }
 

package/plugins/huaweicloud-core/src/tools.mjs

@@ -9,6 +9,7 @@ import { searchMarketplace } from './search-market.mjs';
 import { getServiceIcon } from './icon-library.mjs';
 import {
   execWithSession,
+  execOneShot,
   closeSession,
   uploadFileWithSession,
   DEFAULT_WORKSPACE_ID,
@@ -406,7 +407,7 @@ export const TOOL_DEFINITIONS = [
   {
     name: 'huaweicloud_sandbox_exec_with_session',
     description:
-      'Execute a command on a workspace terminal with session reuse (state persists across calls). Shell state (cd, env vars, aliases) carries over between calls.',
+      'Execute a command on a workspace terminal with session reuse (state persists across calls). Shell state (cd, env vars, aliases) carries over between calls. Use for interactive work and command sequences that need shared state. NOT for long-running commands (>30s) — prefer exec_one_shot for those.',
     inputSchema: {
       type: 'object',
       required: ['command'],
@@ -414,7 +415,22 @@ export const TOOL_DEFINITIONS = [
         command: { type: 'string', description: 'The shell command to execute on the remote workspace' },
         workspace_id: { type: 'string', description: 'The workspace ID' },
         username: { type: 'string', description: 'Login username for the remote terminal (default: root)' },
-        timeout_ms: { type: 'number', description: 'Execution timeout in milliseconds (default: 30000)' },
+        timeout_ms: { type: 'number', description: 'Execution timeout in milliseconds (default: 120000)' },
+      },
+    },
+  },
+  {
+    name: 'huaweicloud_sandbox_exec_one_shot',
+    description:
+      'Execute a command on a workspace terminal with a fresh connection per call (no session state carries over). Each invocation opens a new WebSocket connection, executes one command, then disconnects. Use for long-running build/deploy/install commands (>30s) that do not need shell state persistence between calls. More stable than session-based execution for heavy workloads.',
+    inputSchema: {
+      type: 'object',
+      required: ['command'],
+      properties: {
+        command: { type: 'string', description: 'The shell command to execute on the remote workspace' },
+        workspace_id: { type: 'string', description: 'The workspace ID' },
+        username: { type: 'string', description: 'Login username for the remote terminal (default: root)' },
+        timeout_ms: { type: 'number', description: 'Execution timeout in milliseconds (default: 120000)' },
       },
     },
   },
@@ -441,7 +457,7 @@ export const TOOL_DEFINITIONS = [
         remote_path: { type: 'string', description: 'Target path in the sandbox, e.g. /workspace/<repo>/index.html.' },
         workspace_id: { type: 'string', description: 'The workspace ID' },
         username: { type: 'string', description: 'Login username (default: root)' },
-        timeout_ms: { type: 'number', description: 'Per-command execution timeout in milliseconds (default: 30000)' },
+        timeout_ms: { type: 'number', description: 'Per-command execution timeout in milliseconds (default: 120000)' },
       },
     },
   },
@@ -557,29 +573,36 @@ export async function callTool(name, args = {}) {
     case 'huaweicloud_sandbox_exec_with_session': {
       const sandboxWsId2 = args.workspace_id || DEFAULT_WORKSPACE_ID;
       const sandboxUser2 = args.username || 'root';
-      const sandboxTimeout2 = args.timeout_ms || 30000;
+      const sandboxTimeout2 = args.timeout_ms || 120000;
       const sandboxResult2 = await execWithSession(sandboxWsId2, args.command, sandboxUser2, sandboxTimeout2);
       return { stdout: sandboxResult2.stdout, exitCode: sandboxResult2.exitCode };
     }
-    case 'huaweicloud_sandbox_close_session': {
+    case 'huaweicloud_sandbox_exec_one_shot': {
       const sandboxWsId3 = args.workspace_id || DEFAULT_WORKSPACE_ID;
       const sandboxUser3 = args.username || 'root';
-      const closed = await closeSession(sandboxWsId3, sandboxUser3);
+      const sandboxTimeout3 = args.timeout_ms || 120000;
+      const sandboxResult3 = await execOneShot(sandboxWsId3, args.command, sandboxUser3, sandboxTimeout3);
+      return { stdout: sandboxResult3.stdout, exitCode: sandboxResult3.exitCode };
+    }
+    case 'huaweicloud_sandbox_close_session': {
+      const sandboxWsId4 = args.workspace_id || DEFAULT_WORKSPACE_ID;
+      const sandboxUser4 = args.username || 'root';
+      const closed = await closeSession(sandboxWsId4, sandboxUser4);
       return closed ? 'ok' : 'not_connected';
     }
     case 'huaweicloud_sandbox_upload_file': {
       if (!args.local_path || !args.remote_path) {
         throw new Error('local_path and remote_path are required.');
       }
-      const sandboxWsId4 = args.workspace_id || DEFAULT_WORKSPACE_ID;
-      const sandboxUser4 = args.username || 'root';
-      const sandboxTimeout4 = args.timeout_ms || 30000;
+      const sandboxWsId5 = args.workspace_id || DEFAULT_WORKSPACE_ID;
+      const sandboxUser5 = args.username || 'root';
+      const sandboxTimeout5 = args.timeout_ms || 120000;
       return await uploadFileWithSession(
-        sandboxWsId4,
+        sandboxWsId5,
         args.local_path,
         args.remote_path,
-        sandboxUser4,
-        sandboxTimeout4,
+        sandboxUser5,
+        sandboxTimeout5,
       );
     }
     case 'huaweicloud_sandbox_check_user':