huaweicloud-devkit 1.0.2-next.12 → 1.0.2-next.17

package/README.md

@@ -8,7 +8,7 @@
 
 Help AI coding agents use Huawei Cloud safely and accurately — a single integration that gives agents cloud knowledge, CLI tooling, and safety guardrails.
 
-Supports OpenCode, Codex, CodeArts Agent, WorkBuddy, DeepSeek Harness (DSH), and OfficeAce.
+Supports OpenCode, CodeArts Agent, WorkBuddy, DeepSeek Harness (DSH), and OfficeAce.
 
 ## Prerequisites
 
@@ -33,23 +33,6 @@ npx --yes huaweicloud-devkit update --target opencode
 npx --yes huaweicloud-devkit uninstall --target opencode
 ```
 
-### Codex
-
-```bash
-npx --yes huaweicloud-devkit install --target codex
-```
-
-> The Codex CLI must be installed first.
-
-```bash
-npx --yes huaweicloud-devkit doctor --target codex
-npx --yes huaweicloud-devkit status --target codex
-npx --yes huaweicloud-devkit update --target codex
-npx --yes huaweicloud-devkit uninstall --target codex
-```
-
-> **Codex Desktop** (Windows): use `--target codex-desktop` with the same commands.
-
 ### CodeArts Agent
 
 ```bash
@@ -65,7 +48,7 @@ npx --yes huaweicloud-devkit update --target codearts
 npx --yes huaweicloud-devkit uninstall --target codearts
 ```
 
-> **Sandbox mode**: CodeArts defaults to sandbox mode which blocks KooCLI. `install-hcloud` detects this and shows how to resolve it — install KooCLI outside the sandbox terminal, or disable sandbox mode in CodeArts settings (Settings → Permissions → Bash mode).
+> **Sandbox mode**: CodeArts defaults to sandbox mode which blocks KooCLI. `install-hcloud` detects this and shows how to resolve it — install KooCLI outside the sandbox terminal, or disable sandbox mode in CodeArts settings (Settings → Chats → Agents Terminal Command Running Mode → Auto Running).
 
 ### WorkBuddy
 
@@ -116,26 +99,22 @@ npx --yes huaweicloud-devkit uninstall --target officeace
 
 ### Other Agents
 
-For agents that support the Model Context Protocol (MCP), add the MCP server manually:
+Any agent that supports MCP can use the standard config:
 
 ```json
 {
   "mcpServers": {
     "huaweicloud-devkit": {
-      "command": "node",
-      "args": ["<path>/plugins/huaweicloud-core/src/mcp-server.mjs"]
+      "command": "npx",
+      "args": ["-y", "-p", "huaweicloud-devkit@next", "huaweicloud-devkit-mcp"]
     }
   }
 }
 ```
 
-Then install the skills:
-
-```bash
-npx --yes huaweicloud-devkit install
-```
+No installation required — `npx` handles everything.
 
-> For unified credentials across KooCLI and OBS, run `npx huaweicloud-devkit auth init`.
+> Set `HW_ACCESS_KEY`/`HW_SECRET_KEY` in the MCP config `env` field for project-level credentials.
 
 ### Install KooCLI
 
@@ -171,6 +150,7 @@ npx --yes huaweicloud-devkit update --target all
 - **Safety-first execution** — all write operations require explicit user approval; credentials and secrets are automatically redacted from output
 - **Pre-execution risk checks** — public exposure, credential leaks, and destructive operations are caught before they run
 - **Regional awareness** — auto-discovers available regions and checks service availability before creating resources
+- **Sandbox (DevStation)** — temporary cloud runtime for web app deployment with instant public URL preview
 
 ## Supported Services
 

package/README.zh-CN.md

@@ -8,7 +8,7 @@
 
 帮助 AI 编码助手安全、准确地使用华为云——一站式集成云知识、CLI 工具和安全护栏。
 
-支持 OpenCode、Codex、码道（CodeArts Agent）、WorkBuddy、DeepSeek Harness（DSH）、OfficeAce。
+支持 OpenCode、码道（CodeArts Agent）、WorkBuddy、DeepSeek Harness（DSH）、OfficeAce。
 
 ## 前置条件
 
@@ -33,23 +33,6 @@ npx --yes huaweicloud-devkit update --target opencode
 npx --yes huaweicloud-devkit uninstall --target opencode
 ```
 
-### Codex
-
-```bash
-npx --yes huaweicloud-devkit install --target codex
-```
-
-> 需要先安装 Codex CLI。
-
-```bash
-npx --yes huaweicloud-devkit doctor --target codex
-npx --yes huaweicloud-devkit status --target codex
-npx --yes huaweicloud-devkit update --target codex
-npx --yes huaweicloud-devkit uninstall --target codex
-```
-
-> **Codex Desktop**（Windows）：将 `--target codex` 换成 `--target codex-desktop`，命令相同。
-
 ### CodeArts Agent（码道）
 
 ```bash
@@ -65,7 +48,7 @@ npx --yes huaweicloud-devkit update --target codearts
 npx --yes huaweicloud-devkit uninstall --target codearts
 ```
 
-> **沙箱模式**：码道默认沙箱模式会阻止 KooCLI 运行。`install-hcloud` 自动检测并给出指引——请在码道外终端安装使用 KooCLI，或在码道设置中关闭沙箱模式（设置 → 权限 → Bash 模式）。
+> **沙箱模式**：码道默认沙箱模式会阻止 KooCLI 运行。`install-hcloud` 自动检测并给出指引——请在码道外终端安装使用 KooCLI，或在码道设置中关闭沙箱模式（设置 → 对话流 → 智能体 终端命令运行模式 → 自动运行）。
 
 ### WorkBuddy
 
@@ -116,26 +99,22 @@ npx --yes huaweicloud-devkit uninstall --target officeace
 
 ### 其他 Agent
 
-支持 MCP 协议的 Agent，手动添加 MCP Server 配置：
+任何支持 MCP 协议的 Agent，直接使用标准 MCP 配置：
 
 ```json
 {
   "mcpServers": {
     "huaweicloud-devkit": {
-      "command": "node",
-      "args": ["<路径>/plugins/huaweicloud-core/src/mcp-server.mjs"]
+      "command": "npx",
+      "args": ["-y", "-p", "huaweicloud-devkit@next", "huaweicloud-devkit-mcp"]
     }
   }
 }
 ```
 
-然后安装 skills：
-
-```bash
-npx --yes huaweicloud-devkit install
-```
+无需预安装 — `npx` 自动处理一切。
 
-> 执行 `npx huaweicloud-devkit auth init` 完成 KooCLI、OBS 的统一认证。
+> 项目级 AK/SK 可通过 MCP 配置的 `env` 字段设置 `HW_ACCESS_KEY`/`HW_SECRET_KEY`。
 
 ### 安装 KooCLI
 
@@ -171,6 +150,7 @@ npx --yes huaweicloud-devkit update --target all
 - **安全优先执行** — 所有写操作需用户明确批准；凭证和密钥自动脱敏
 - **执行前风险检查** — 公网暴露、凭证泄露、破坏性操作在执行前即被拦截
 - **区域感知** — 自动发现可用区域，创建资源前检查服务可用性
+- **沙箱（DevStation）** — 临时云端运行环境，部署 Web 应用并即刻获得公网预览地址
 
 ## 支持的服务
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.0.2-next.12",
+  "version": "1.0.2-next.17",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
   "files": [
@@ -15,7 +15,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/huaweicloud/HuaweiCloud-Devkit.git"
+    "url": "https://github.com/huaweicloud/huaweicloud-devkit.git"
   },
   "scripts": {
     "test": "node --test",
@@ -29,6 +29,7 @@
     "postinstall": "node -e \"console.log('\\nHuaweiCloud DevKit installed. Run: npx huaweicloud-devkit install\\n')\""
   },
   "dependencies": {
+    "better-sqlite3": "^13.0.3",
     "undici": "^8.10.0"
   },
   "devDependencies": {

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.2-next.12",
+  "version": "1.0.2-next.17",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "1.0.2-next.12",
+  "version": "1.0.2-next.17",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.2-next.12",
+  "version": "1.0.2-next.17",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "1.0.2-next.12",
+  "version": "1.0.2-next.17",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/hooks/huaweicloud-safety.py

@@ -18,15 +18,38 @@ from pathlib import Path
 
 DENY_PREFIX = "Huawei Cloud safety hook blocked this action: "
 RULES_PATH = Path(__file__).resolve().parents[1] / "safety" / "rules" / "cloud-risk-rules.json"
+POLICY_PATH = Path(__file__).resolve().parents[1] / "safety" / "policy.json"
 
-CONFIG_FILE_RE = re.compile(r"(\.hcloud|\.huaweicloud|hcloud[/\\](config|credentials)|huaweicloud[/\\](config|credentials))", re.I)
-ENV_DUMP_RE = re.compile(r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I)
-SECRET_READ_RE = re.compile(r"(ShowSecretVersion|GetSecretValue|secret_string|secret_binary)", re.I)
-HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
-WRITE_OPERATION_RE = re.compile(
-    r"\b(BatchCreate|BatchDelete|Create|Delete|Update|Modify|Resize|Reboot|Stop|Start|Restart|Authorize|Revoke|Add|Remove|Associate|Disassociate|Attach|Detach|Enable|Disable)\w*",
-    re.I,
+CONFIG_FILE_RE = None
+SECRET_READ_RE = None
+WRITE_OPERATION_RE = None
+
+
+def load_policy():
+    global CONFIG_FILE_RE, SECRET_READ_RE, WRITE_OPERATION_RE
+    try:
+        with POLICY_PATH.open("r", encoding="utf-8") as file_obj:
+            policy = json.load(file_obj)
+        cred_patterns = policy.get("credentialFilePatterns", [])
+        if cred_patterns:
+            CONFIG_FILE_RE = re.compile("|".join(cred_patterns), re.I)
+        blocked_secrets = policy.get("blockedSecretOperations", [])
+        if blocked_secrets:
+            SECRET_READ_RE = re.compile("|".join(re.escape(op) for op in blocked_secrets), re.I)
+        write_prefixes = policy.get("writeOperationPrefixes", [])
+        if write_prefixes:
+            WRITE_OPERATION_RE = re.compile(r"\b(" + "|".join(write_prefixes) + r")\w*", re.I)
+    except Exception:
+        pass
+
+
+load_policy()
+
+ENV_DUMP_RE = re.compile(
+    r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I,
 )
+HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
+READ_OPERATION_RE = re.compile(r"\b(List|Show|Get|Describe|NovaList|NovaShow)\w*", re.I)
 READ_OPERATION_RE = re.compile(r"\b(List|Show|Get|Describe|NovaList|NovaShow)\w*", re.I)
 
 
@@ -117,11 +140,11 @@ def main():
     tool_name = data.get("tool_name", "")
     text = command_text(data.get("tool_input", {}))
 
-    if CONFIG_FILE_RE.search(text):
+    if CONFIG_FILE_RE and CONFIG_FILE_RE.search(text):
         deny("reading Huawei Cloud credential/profile files can expose AK/SK or tokens. Use redacted toolkit tools.")
     if ENV_DUMP_RE.search(text):
         deny("dumping cloud credential environment variables is not allowed.")
-    if SECRET_READ_RE.search(text):
+    if SECRET_READ_RE and SECRET_READ_RE.search(text):
         deny("direct secret value retrieval would put plaintext secrets into the agent context.")
     denied_rule = first_denied_command_rule(text)
     if denied_rule:

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -0,0 +1,19 @@
+{
+  "name": "huaweicloud-devkit",
+  "displayName": "HuaweiCloud DevKit",
+  "version": "1.0.2-next.16",
+  "family": "bundle-plugin",
+  "bundleFormat": "codex",
+  "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",
+  "author": {
+    "name": "HuaweiCloud Mate",
+    "url": "https://github.com/huaweicloud"
+  },
+  "homepage": "https://github.com/huaweicloud/huaweicloud-devkit",
+  "repository": "https://github.com/huaweicloud/huaweicloud-devkit",
+  "license": "Apache-2.0",
+  "keywords": ["huaweicloud", "huawei-cloud", "koocli", "hcloud", "agent", "mcp", "api", "sdk", "skills", "cloud"],
+  "category": "Cloud",
+  "capabilities": ["Read", "Interactive"],
+  "brandColor": "#C7000B"
+}

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -121,8 +121,24 @@ hcloud <Service> <ListOp> --cli-output=json --cli-query "items[?status=='ACTIVE'
 hcloud <Service> <Op> --cli-debug=true
 ```
 
+## Credential Resolution Priority
+
+Credentials are resolved in this order (highest priority first):
+
+| Priority | Source                  | Mechanism                                                  | Persistence                     |
+| -------- | ----------------------- | ---------------------------------------------------------- | ------------------------------- |
+| 1        | Runtime credentials     | `huaweicloud_auth_init` tool                               | Memory (cleared on MCP restart) |
+| 2        | Environment variables   | `HW_ACCESS_KEY` / `HW_SECRET_KEY`                          | MCP process lifetime            |
+| 3        | CodeArts project config | `.codeartsdoer/mcp/mcp_settings.json` (project, then user) | File                            |
+| 4        | Global config file      | `~/.config/huaweicloud/credentials.json`                   | Permanent                       |
+| 5        | KooCLI profile          | `~/.hcloud/config.json` (KooCLI only)                      | Permanent                       |
+
+When switching accounts within the same Agent session, use `huaweicloud_auth_init` to set runtime credentials. This overrides all other sources for the current MCP process.
+
 ## Preferred Toolkit Tools
 
+- `huaweicloud_auth_init`
+- `huaweicloud_auth_status`
 - `huaweicloud_check_cli`
 - `huaweicloud_show_profile_redacted`
 - `huaweicloud_plan_cli_command`

package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md

@@ -100,6 +100,7 @@ When the intent is to **deploy, host, or preview a web app or static website** (
 
 - Use huaweicloud_search_docs to discover skills covering a topic
 - Use huaweicloud_retrieve_skill to load a full SKILL.md after routing
+- Use huaweicloud_auth_init to switch credentials at runtime when different accounts co-exist in the same session
 - If no built-in skill matches, consult huaweicloud-capability-discovery for external marketplace options
 - Use huaweicloud_list_regions before creating regional resources
 - Use huaweicloud_get_regional_availability when unsure about service-region pairs

package/plugins/huaweicloud-core/src/auth/agent-registration.mjs

@@ -1,7 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
 
 export const SUPPORTED_AGENT_TARGETS = [
   'opencode',
@@ -113,12 +114,31 @@ function officeaceCapabilitiesDir() {
   return dotDir;
 }
 
+function officeaceSqlitePath() {
+  const capDir = officeaceCapabilitiesDir();
+  return join(resolve(capDir, '..'), 'data', 'mcp-connectors.sqlite');
+}
+
 function officeaceRegistered() {
+  let hasMcp = false;
+  const dbPath = officeaceSqlitePath();
+  if (existsSync(dbPath)) {
+    const nodeMajor = Number(process.versions.node.split('.')[0]);
+    if (nodeMajor >= 22) {
+      try {
+        const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
+        const db = new DatabaseSync(dbPath, { readonly: true });
+        const row = db.prepare("SELECT enabled FROM mcp_connectors WHERE name = 'huaweicloud-devkit'").get();
+        db.close();
+        hasMcp = Boolean(row?.enabled);
+      } catch {}
+    }
+  }
+
   const capFile = join(officeaceCapabilitiesDir(), 'capabilities.json');
   const cfg = readJsonSafe(capFile);
-  if (!cfg?.capabilities) return false;
-  const hasMcp = cfg.capabilities.some((c) => c.id === 'huaweicloud-devkit' && c.type === 'mcp');
-  const hasSkills = cfg.capabilities.some((c) => c.id === 'huaweicloud-core' && c.type === 'skill');
+  const hasSkills = cfg?.capabilities?.some((c) => c.id === 'huaweicloud-core' && c.type === 'skill') ?? false;
+
   return hasMcp || hasSkills;
 }
 

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -84,6 +84,13 @@ export function resolveCredentials(options = {}) {
   let securityToken = process.env.HW_SECURITY_TOKEN;
   let region = process.env.HW_REGION || process.env.HUAWEICLOUD_REGION || '';
 
+  const codeartsCreds = isCodeArtsContext() ? readCodeArtsCredentials() : null;
+  if (codeartsCreds) {
+    if (!ak && codeartsCreds.ak) ak = codeartsCreds.ak;
+    if (!sk && codeartsCreds.sk) sk = codeartsCreds.sk;
+    if (!region && codeartsCreds.region) region = codeartsCreds.region;
+  }
+
   const stored = readGlobalCredentials();
   if (stored) {
     if (!ak && stored.ak) ak = stored.ak;
@@ -101,3 +108,61 @@ export function resolveCredentials(options = {}) {
 
   return { ak, sk, securityToken, region };
 }
+
+function isCodeArtsContext() {
+  return existsSync(join(process.cwd(), '.codeartsdoer')) || existsSync(join(homedir(), '.codeartsdoer'));
+}
+
+function readCodeArtsCredentials() {
+  const searchPaths = [
+    join(process.cwd(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+    join(homedir(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+  ];
+
+  for (const path of searchPaths) {
+    try {
+      if (!existsSync(path)) continue;
+      const config = JSON.parse(readFileSync(path, 'utf8'));
+      const server = config?.mcpServers?.['huaweicloud-devkit'];
+      if (!server?.env) continue;
+
+      const ak = server.env.HW_ACCESS_KEY;
+      const sk = server.env.HW_SECRET_KEY;
+      if (ak && sk) {
+        return {
+          ak,
+          sk,
+          securityToken: server.env.HW_SECURITY_TOKEN || '',
+          region: server.env.HW_REGION || server.env.HUAWEICLOUD_REGION || '',
+        };
+      }
+    } catch {
+      // mcp_settings.json missing or invalid — skip
+    }
+  }
+
+  return null;
+}
+
+let runtimeCredentials = null;
+
+export function setRuntimeCredentials(ak, sk, securityToken, region) {
+  runtimeCredentials = { ak, sk, securityToken: securityToken || '', region: region || '' };
+}
+
+export function clearRuntimeCredentials() {
+  runtimeCredentials = null;
+}
+
+export function resolveCredentialsWithRuntime(options = {}) {
+  if (runtimeCredentials) {
+    return {
+      ak: runtimeCredentials.ak,
+      sk: runtimeCredentials.sk,
+      securityToken: runtimeCredentials.securityToken,
+      region: runtimeCredentials.region,
+    };
+  }
+
+  return resolveCredentials(options);
+}

package/plugins/huaweicloud-core/src/mcp-server.mjs

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
-process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
 import { stdin, stdout } from 'node:process';
-import { rmSync, existsSync } from 'node:fs';
-import { resolve, dirname } from 'node:path';
+import { rmSync, existsSync, readFileSync } from 'node:fs';
+import { resolve, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { TOOL_DEFINITIONS, callTool } from './tools.mjs';
 
@@ -27,6 +26,14 @@ try {
   if (existsSync(marker)) rmSync(marker, { force: true });
 } catch {}
 
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const pluginRoot = resolve(__dirname, '..');
+const packageRoot = resolve(pluginRoot, '..', '..');
+let pkgVersion = '0.0.0';
+try {
+  pkgVersion = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8')).version;
+} catch {}
+
 let buffer = Buffer.alloc(0);
 let useContentLengthFraming = true;
 
@@ -104,7 +111,7 @@ async function dispatch(method, params) {
       },
       serverInfo: {
         name: 'huaweicloud-devkit',
-        version: '0.1.0',
+        version: pkgVersion,
       },
     };
   }

package/plugins/huaweicloud-core/src/sandbox/hwlink-api.mjs

@@ -1,5 +1,5 @@
 import crypto from 'node:crypto';
-import { resolveCredentials } from '../auth/credentials.mjs';
+import { resolveCredentialsWithRuntime } from '../auth/credentials.mjs';
 import { getProxyDispatcher } from '../proxy/proxy-agent.mjs';
 
 const BASE_URL = process.env.HWLINK_ENDPOINT || 'https://devstation.myhuaweicloud.com';
@@ -77,7 +77,7 @@ function signRequest(method, path, query, body, ak, sk, securitytoken) {
 }
 
 export function getCredentials() {
-  const credentials = resolveCredentials();
+  const credentials = resolveCredentialsWithRuntime();
   return { ak: credentials.ak, sk: credentials.sk, securitytoken: credentials.securityToken };
 }
 

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -13,6 +13,8 @@ import { fileURLToPath } from 'node:url';
 import { homedir, platform } from 'node:os';
 import { createInterface } from 'node:readline';
 import { spawnSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import Database from 'better-sqlite3';
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
 import { SUPPORTED_AGENT_TARGETS } from './auth/agent-registration.mjs';
 import {
@@ -150,69 +152,128 @@ function officeacePluginsDir() {
   return join(officeaceCapabilitiesDir(), 'huaweicloud-plugins');
 }
 
-function readCapabilitiesJson() {
-  const capFile = officeaceCapabilitiesFile();
-  if (!existsSync(capFile)) return { capabilities: [] };
+function officeaceSqlitePath() {
+  const capDir = officeaceCapabilitiesDir();
+  return join(resolve(capDir, '..'), 'data', 'mcp-connectors.sqlite');
+}
+
+function openOfficeaceDb() {
+  return new Database(officeaceSqlitePath());
+}
+
+function officeaceGetOwnerUserId() {
+  if (!existsSync(officeaceSqlitePath())) return null;
   try {
-    return JSON.parse(readFileSync(capFile, 'utf8'));
+    const db = openOfficeaceDb();
+    const row = db.prepare('SELECT owner_user_id FROM mcp_connectors WHERE owner_user_id IS NOT NULL LIMIT 1').get();
+    db.close();
+    return row?.owner_user_id || null;
   } catch {
-    return { capabilities: [] };
+    return null;
   }
 }
 
-function writeCapabilitiesJson(config) {
-  mkdirSync(officeaceCapabilitiesDir(), { recursive: true });
-  writeFileSync(officeaceCapabilitiesFile(), JSON.stringify(config, null, 2));
-}
+function ensureOfficeaceMcpInSqlite() {
+  const dbPath = officeaceSqlitePath();
+  if (!existsSync(dbPath)) {
+    console.log(`  \x1b[31mOfficeAce database not found: ${dbPath}\x1b[0m`);
+    console.log(`  \x1b[33mPlease ensure OfficeAce is installed and has been launched at least once.\x1b[0m`);
+    return false;
+  }
 
-function ensureOfficeaceCapabilities() {
-  const capFile = officeaceCapabilitiesFile();
   const mcpPath = join(officeacePluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
-  const env = { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' };
+  const env = [{ key: 'HUAWEICLOUD_AGENT_TOOLKIT_MODE', value: 'local', sensitive: false }];
   const hcloudBin = findHcloudBin();
-  if (hcloudBin) env.HCLOUD_BIN = hcloudBin.replace(/\\/g, '/');
+  if (hcloudBin) env.push({ key: 'HCLOUD_BIN', value: hcloudBin.replace(/\\/g, '/'), sensitive: false });
 
-  const config = readCapabilitiesJson();
-  let changed = false;
+  const now = Date.now();
+  let db;
+  try {
+    db = openOfficeaceDb();
 
-  // Ensure MCP server entry
-  const mcpEntry = {
-    id: 'huaweicloud-devkit',
-    type: 'mcp',
-    enabled: true,
-    source: 'custom',
-    mcpServer: {
-      command: 'node',
-      args: [mcpPath],
-      env,
-    },
-  };
-  const existingMcpIdx = config.capabilities.findIndex((c) => c.id === 'huaweicloud-devkit' && c.type === 'mcp');
-  if (existingMcpIdx >= 0) {
-    const existing = config.capabilities[existingMcpIdx];
-    if (
-      existing.mcpServer?.command === 'node' &&
-      Array.isArray(existing.mcpServer?.args) &&
-      existing.mcpServer.args[0] === mcpPath
-    ) {
-      console.log(`  MCP config unchanged: ${capFile}`);
+    const existing = db
+      .prepare("SELECT id, command, args_json FROM mcp_connectors WHERE name = 'huaweicloud-devkit'")
+      .get();
+
+    const argsJson = JSON.stringify([mcpPath]);
+    const envJson = JSON.stringify(env);
+
+    if (existing) {
+      if (existing.command === 'node' && existing.args_json === argsJson) {
+        console.log(`  MCP config unchanged: ${dbPath}`);
+        db.close();
+        return true;
+      }
+      db.prepare(
+        'UPDATE mcp_connectors SET command = ?, args_json = ?, env_json = ?, updated_at = ?, status = ?, enabled = 1 WHERE id = ?',
+      ).run('node', argsJson, envJson, now, 'disconnected', existing.id);
+      console.log(`  MCP config updated: ${dbPath}`);
     } else {
-      config.capabilities[existingMcpIdx] = mcpEntry;
-      changed = true;
+      const ownerUserId = officeaceGetOwnerUserId();
+      if (!ownerUserId) {
+        console.log(`  \x1b[31mCannot determine owner_user_id from database\x1b[0m`);
+        db.close();
+        return false;
+      }
+      db.prepare(
+        `INSERT INTO mcp_connectors (id, owner_user_id, type, name, normalized_name, transport, timeout_ms, command, args_json, env_json, enabled, status, created_at, updated_at, version, seeded)
+         VALUES (?, ?, 'custom', 'huaweicloud-devkit', 'huaweicloud-devkit', 'stdio', 60000, 'node', ?, ?, 1, 'disconnected', ?, ?, 1, 0)`,
+      ).run(randomUUID(), ownerUserId, argsJson, envJson, now, now);
+      console.log(`  MCP config created: ${dbPath}`);
     }
-  } else {
-    config.capabilities.push(mcpEntry);
-    changed = true;
+    db.close();
+    return true;
+  } catch (err) {
+    if (db) {
+      try {
+        db.close();
+      } catch {}
+    }
+    console.log(`  \x1b[31mFailed to write MCP config: ${err.message}\x1b[0m`);
+    return false;
   }
+}
 
-  if (changed) {
-    writeCapabilitiesJson(config);
-    console.log(`  MCP config updated: ${capFile}`);
+function removeOfficeaceMcpFromSqlite() {
+  const dbPath = officeaceSqlitePath();
+  if (!existsSync(dbPath)) return;
+  let db;
+  try {
+    db = openOfficeaceDb();
+    db.prepare(
+      "DELETE FROM mcp_connector_tools WHERE connector_id IN (SELECT id FROM mcp_connectors WHERE name = 'huaweicloud-devkit')",
+    ).run();
+    const result2 = db.prepare("DELETE FROM mcp_connectors WHERE name = 'huaweicloud-devkit'").run();
+    if (result2.changes > 0) {
+      console.log(`  MCP config removed: ${dbPath}`);
+    }
+    db.close();
+  } catch (err) {
+    if (db) {
+      try {
+        db.close();
+      } catch {}
+    }
+    console.log(`  \x1b[31mFailed to remove MCP config: ${err.message}\x1b[0m`);
   }
-  return changed;
 }
 
-function removeOfficeaceCapabilities() {
+function readCapabilitiesJson() {
+  const capFile = officeaceCapabilitiesFile();
+  if (!existsSync(capFile)) return { capabilities: [] };
+  try {
+    return JSON.parse(readFileSync(capFile, 'utf8'));
+  } catch {
+    return { capabilities: [] };
+  }
+}
+
+function writeCapabilitiesJson(config) {
+  mkdirSync(officeaceCapabilitiesDir(), { recursive: true });
+  writeFileSync(officeaceCapabilitiesFile(), JSON.stringify(config, null, 2));
+}
+
+function removeOfficeaceSkillCapabilities() {
   const capFile = officeaceCapabilitiesFile();
   if (!existsSync(capFile)) return;
   let config;
@@ -226,14 +287,13 @@ function removeOfficeaceCapabilities() {
   config.capabilities = config.capabilities.filter(
     (c) =>
       !(
-        (c.id === 'huaweicloud-devkit' && c.type === 'mcp') ||
         (c.id === 'huaweicloud-core' && c.type === 'skill') ||
         (c.source === 'custom' && c.id && c.id.startsWith('huawei'))
       ),
   );
   if (config.capabilities.length !== origLen) {
     writeCapabilitiesJson(config);
-    console.log(`  Capabilities cleaned: ${capFile}`);
+    console.log(`  Skill capabilities cleaned: ${capFile}`);
   }
 }
 
@@ -317,7 +377,7 @@ function printSandboxWarning(reason) {
   console.log(`\x1b[31m  请任选其一继续:\x1b[0m`);
   console.log(`\x1b[31m  A. 在码道外的终端安装并使用 KooCLI (推荐):`);
   console.log(`\x1b[31m     https://support.huaweicloud.com/qs-hcli/hcli_02_003.html`);
-  console.log(`\x1b[31m  B. 在码道设置中关闭沙箱模式后重试 (设置 → 权限 → Bash 模式)`);
+  console.log(`\x1b[31m  B. 在码道设置中关闭沙箱模式后重试 (设置 → 对话流 → 智能体 终端命令运行模式 → 自动运行)`);
   console.log(`\x1b[31m  关闭沙箱后重新运行: npx huaweicloud-devkit install-hcloud\x1b[0m`);
 }
 
@@ -1367,7 +1427,7 @@ async function installOfficeAce() {
   copyDir(safetyDir, join(pluginDest, 'safety'));
   console.log(`  Safety Policy -> ${join(pluginDest, 'safety')}`);
 
-  ensureOfficeaceCapabilities();
+  ensureOfficeaceMcpInSqlite();
   registerOfficeaceSkillEntries();
 }
 
@@ -1384,7 +1444,7 @@ async function updateOfficeAce() {
   console.log(`  MCP Server updated -> ${join(pluginDest, 'src')}`);
   copyDir(safetyDir, join(pluginDest, 'safety'));
   console.log(`  Safety Policy updated -> ${join(pluginDest, 'safety')}`);
-  ensureOfficeaceCapabilities();
+  ensureOfficeaceMcpInSqlite();
   registerOfficeaceSkillEntries();
   mkdirSync(pluginDest, { recursive: true });
   writeFileSync(join(pluginDest, '.installed'), new Date().toISOString());
@@ -1412,7 +1472,8 @@ function uninstallOfficeAce() {
   if (removeIfExists(officeacePluginsDir())) {
     console.log('  Removed MCP server and safety policy');
   }
-  removeOfficeaceCapabilities();
+  removeOfficeaceSkillCapabilities();
+  removeOfficeaceMcpFromSqlite();
 }
 
 function officeaceStatus() {
@@ -1433,15 +1494,23 @@ function officeaceStatus() {
   console.log(
     `  Skills: ${skillCount > 0 ? `\x1b[32m${skillCount} installed\x1b[0m` : '\x1b[31mNot installed\x1b[0m'}`,
   );
-  const capFile = officeaceCapabilitiesFile();
-  if (existsSync(capFile)) {
+  const dbPath = officeaceSqlitePath();
+  if (existsSync(dbPath)) {
     try {
-      const config = JSON.parse(readFileSync(capFile, 'utf8'));
-      const hasMcp = (config.capabilities || []).some((c) => c.id === 'huaweicloud-devkit' && c.type === 'mcp');
-      console.log(`  MCP config: ${hasMcp ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`);
+      const db = openOfficeaceDb();
+      const row = db.prepare("SELECT enabled, status FROM mcp_connectors WHERE name = 'huaweicloud-devkit'").get();
+      db.close();
+      if (row) {
+        const statusIcon = row.status === 'connected' ? '\x1b[32m' : '\x1b[33m';
+        console.log(`  MCP config: ${statusIcon}${row.status}\x1b[0m (enabled: ${row.enabled ? 'yes' : 'no'})`);
+      } else {
+        console.log(`  MCP config: \x1b[31mNot configured\x1b[0m`);
+      }
     } catch {
       console.log(`  MCP config: \x1b[31mInvalid\x1b[0m`);
     }
+  } else {
+    console.log(`  MCP config: \x1b[31mDatabase not found\x1b[0m`);
   }
 }
 

package/plugins/huaweicloud-core/src/tools.mjs

@@ -16,7 +16,12 @@ import {
 } from './sandbox/session-manager.mjs';
 import { hdkitCheckUser, hdkitSignAgreement, hdkitConnect, hdkitCredentials } from './sandbox/hdkitservice-api.mjs';
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
-import { readGlobalCredentials, writeObsConfig as writeObsConfigFile } from './auth/credentials.mjs';
+import {
+  readGlobalCredentials,
+  writeObsConfig as writeObsConfigFile,
+  setRuntimeCredentials,
+  clearRuntimeCredentials,
+} from './auth/credentials.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const SKILLS_ROOT_DEV = join(__dirname, '..', 'skills');
@@ -404,6 +409,20 @@ export const TOOL_DEFINITIONS = [
       },
     },
   },
+  {
+    name: 'huaweicloud_auth_init',
+    description:
+      'Set or clear runtime Huawei Cloud credentials (AK/SK) for this MCP session. Runtime credentials take highest priority over environment variables and config files for all subsequent API calls. Use when switching accounts within the same Agent session — call with AK/SK to switch, or with clear=true to fall back to env/file credentials.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ak: { type: 'string', description: 'Huawei Cloud Access Key (required unless clear=true)' },
+        sk: { type: 'string', description: 'Huawei Cloud Secret Key (required unless clear=true)' },
+        region: { type: 'string', description: 'Default region (optional)' },
+        clear: { type: 'boolean', description: 'Set to true to clear runtime credentials and revert to env/file' },
+      },
+    },
+  },
   {
     name: 'huaweicloud_sandbox_exec_with_session',
     description:
@@ -570,6 +589,16 @@ export async function callTool(name, args = {}) {
       return getAuthStatus(args.target || 'all');
     case 'huaweicloud_auth_sync':
       return syncAuth(args.target || 'all');
+    case 'huaweicloud_auth_init':
+      if (args.clear) {
+        clearRuntimeCredentials();
+        return { status: 'cleared', message: 'Runtime credentials cleared. Fallback to env/file.' };
+      }
+      if (!args.ak || !args.sk) {
+        throw new Error('ak and sk are required. Set clear=true to clear runtime credentials.');
+      }
+      setRuntimeCredentials(args.ak, args.sk, undefined, args.region);
+      return { status: 'ok', message: 'Runtime credentials set for this MCP session.' };
     case 'huaweicloud_sandbox_exec_with_session': {
       const sandboxWsId2 = args.workspace_id || DEFAULT_WORKSPACE_ID;
       const sandboxUser2 = args.username || 'root';
@@ -796,7 +825,7 @@ async function setupObsConfigFromHcloud(profile) {
 const SERVICE_EXAMPLES = {
   ECS: { list: 'ECS ListServersDetails', create: 'ECS CreateServers', show: 'IMS GlanceShowImage' },
   VPC: { list: 'VPC ListVpcs', create: 'VPC CreateVpc', show: 'VPC ShowVpc' },
-  FunctionGraph: {
+  FUNCTIONGRAPH: {
     list: 'FunctionGraph ListFunctions',
     create: 'FunctionGraph CreateFunction',
     show: 'FunctionGraph ShowFunctionConfig',
@@ -805,7 +834,7 @@ const SERVICE_EXAMPLES = {
   OBS: { list: 'OBS ls', create: 'OBS mb obs://<bucket>', show: 'OBS stat obs://<bucket>/<key>' },
   RDS: { list: 'RDS ListInstances', create: 'RDS CreateInstance', show: 'RDS ShowInstance' },
   CES: { list: 'CES ListAlarms', create: 'CES CreateAlarm', show: 'CES ListMetrics' },
-  GaussDB: { list: 'GaussDB ListInstances', create: 'GaussDB CreateInstance', show: 'GaussDB ShowInstance' },
+  GAUSSDB: { list: 'GaussDB ListInstances', create: 'GaussDB CreateInstance', show: 'GaussDB ShowInstance' },
   DDS: { list: 'DDS ListInstances', create: 'DDS CreateInstance', show: 'DDS ShowInstance' },
   DCS: { list: 'DCS ListInstances', create: 'DCS CreateInstance', show: 'DCS ShowInstance' },
 };