huaweicloud-devkit 1.0.2-next.13 → 1.0.2-next.18

package/README.md

@@ -8,7 +8,7 @@
 
 Help AI coding agents use Huawei Cloud safely and accurately — a single integration that gives agents cloud knowledge, CLI tooling, and safety guardrails.
 
-Supports OpenCode, Codex, CodeArts Agent, WorkBuddy, DeepSeek Harness (DSH), and OfficeAce.
+Supports OpenCode, CodeArts Agent, WorkBuddy, DeepSeek Harness (DSH), and OfficeAce.
 
 ## Prerequisites
 
@@ -33,23 +33,6 @@ npx --yes huaweicloud-devkit update --target opencode
 npx --yes huaweicloud-devkit uninstall --target opencode
 ```
 
-### Codex
-
-```bash
-npx --yes huaweicloud-devkit install --target codex
-```
-
-> The Codex CLI must be installed first.
-
-```bash
-npx --yes huaweicloud-devkit doctor --target codex
-npx --yes huaweicloud-devkit status --target codex
-npx --yes huaweicloud-devkit update --target codex
-npx --yes huaweicloud-devkit uninstall --target codex
-```
-
-> **Codex Desktop** (Windows): use `--target codex-desktop` with the same commands.
-
 ### CodeArts Agent
 
 ```bash
@@ -65,7 +48,7 @@ npx --yes huaweicloud-devkit update --target codearts
 npx --yes huaweicloud-devkit uninstall --target codearts
 ```
 
-> **Sandbox mode**: CodeArts defaults to sandbox mode which blocks KooCLI. `install-hcloud` detects this and shows how to resolve it — install KooCLI outside the sandbox terminal, or disable sandbox mode in CodeArts settings (Settings → Permissions → Bash mode).
+> **Sandbox mode**: CodeArts defaults to sandbox mode which blocks KooCLI. `install-hcloud` detects this and shows how to resolve it — install KooCLI outside the sandbox terminal, or disable sandbox mode in CodeArts settings (Settings → Chats → Agents Terminal Command Running Mode → Auto Running).
 
 ### WorkBuddy
 
@@ -116,26 +99,22 @@ npx --yes huaweicloud-devkit uninstall --target officeace
 
 ### Other Agents
 
-For agents that support the Model Context Protocol (MCP), add the MCP server manually:
+Any agent that supports MCP can use the standard config:
 
 ```json
 {
   "mcpServers": {
     "huaweicloud-devkit": {
-      "command": "node",
-      "args": ["<path>/plugins/huaweicloud-core/src/mcp-server.mjs"]
+      "command": "npx",
+      "args": ["-y", "-p", "huaweicloud-devkit@next", "huaweicloud-devkit-mcp"]
     }
   }
 }
 ```
 
-Then install the skills:
-
-```bash
-npx --yes huaweicloud-devkit install
-```
+No installation required — `npx` handles everything.
 
-> For unified credentials across KooCLI and OBS, run `npx huaweicloud-devkit auth init`.
+> Set `HW_ACCESS_KEY`/`HW_SECRET_KEY` in the MCP config `env` field for project-level credentials.
 
 ### Install KooCLI
 
@@ -171,6 +150,7 @@ npx --yes huaweicloud-devkit update --target all
 - **Safety-first execution** — all write operations require explicit user approval; credentials and secrets are automatically redacted from output
 - **Pre-execution risk checks** — public exposure, credential leaks, and destructive operations are caught before they run
 - **Regional awareness** — auto-discovers available regions and checks service availability before creating resources
+- **Sandbox (DevStation)** — temporary cloud runtime for web app deployment with instant public URL preview
 
 ## Supported Services
 

package/README.zh-CN.md

@@ -8,7 +8,7 @@
 
 帮助 AI 编码助手安全、准确地使用华为云——一站式集成云知识、CLI 工具和安全护栏。
 
-支持 OpenCode、Codex、码道（CodeArts Agent）、WorkBuddy、DeepSeek Harness（DSH）、OfficeAce。
+支持 OpenCode、码道（CodeArts Agent）、WorkBuddy、DeepSeek Harness（DSH）、OfficeAce。
 
 ## 前置条件
 
@@ -33,23 +33,6 @@ npx --yes huaweicloud-devkit update --target opencode
 npx --yes huaweicloud-devkit uninstall --target opencode
 ```
 
-### Codex
-
-```bash
-npx --yes huaweicloud-devkit install --target codex
-```
-
-> 需要先安装 Codex CLI。
-
-```bash
-npx --yes huaweicloud-devkit doctor --target codex
-npx --yes huaweicloud-devkit status --target codex
-npx --yes huaweicloud-devkit update --target codex
-npx --yes huaweicloud-devkit uninstall --target codex
-```
-
-> **Codex Desktop**（Windows）：将 `--target codex` 换成 `--target codex-desktop`，命令相同。
-
 ### CodeArts Agent（码道）
 
 ```bash
@@ -65,7 +48,7 @@ npx --yes huaweicloud-devkit update --target codearts
 npx --yes huaweicloud-devkit uninstall --target codearts
 ```
 
-> **沙箱模式**：码道默认沙箱模式会阻止 KooCLI 运行。`install-hcloud` 自动检测并给出指引——请在码道外终端安装使用 KooCLI，或在码道设置中关闭沙箱模式（设置 → 权限 → Bash 模式）。
+> **沙箱模式**：码道默认沙箱模式会阻止 KooCLI 运行。`install-hcloud` 自动检测并给出指引——请在码道外终端安装使用 KooCLI，或在码道设置中关闭沙箱模式（设置 → 对话流 → 智能体 终端命令运行模式 → 自动运行）。
 
 ### WorkBuddy
 
@@ -116,26 +99,22 @@ npx --yes huaweicloud-devkit uninstall --target officeace
 
 ### 其他 Agent
 
-支持 MCP 协议的 Agent，手动添加 MCP Server 配置：
+任何支持 MCP 协议的 Agent，直接使用标准 MCP 配置：
 
 ```json
 {
   "mcpServers": {
     "huaweicloud-devkit": {
-      "command": "node",
-      "args": ["<路径>/plugins/huaweicloud-core/src/mcp-server.mjs"]
+      "command": "npx",
+      "args": ["-y", "-p", "huaweicloud-devkit@next", "huaweicloud-devkit-mcp"]
     }
   }
 }
 ```
 
-然后安装 skills：
-
-```bash
-npx --yes huaweicloud-devkit install
-```
+无需预安装 — `npx` 自动处理一切。
 
-> 执行 `npx huaweicloud-devkit auth init` 完成 KooCLI、OBS 的统一认证。
+> 项目级 AK/SK 可通过 MCP 配置的 `env` 字段设置 `HW_ACCESS_KEY`/`HW_SECRET_KEY`。
 
 ### 安装 KooCLI
 
@@ -171,6 +150,7 @@ npx --yes huaweicloud-devkit update --target all
 - **安全优先执行** — 所有写操作需用户明确批准；凭证和密钥自动脱敏
 - **执行前风险检查** — 公网暴露、凭证泄露、破坏性操作在执行前即被拦截
 - **区域感知** — 自动发现可用区域，创建资源前检查服务可用性
+- **沙箱（DevStation）** — 临时云端运行环境，部署 Web 应用并即刻获得公网预览地址
 
 ## 支持的服务
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.0.2-next.13",
+  "version": "1.0.2-next.18",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
   "files": [
@@ -15,7 +15,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/huaweicloud/HuaweiCloud-Devkit.git"
+    "url": "https://github.com/huaweicloud/huaweicloud-devkit.git"
   },
   "scripts": {
     "test": "node --test",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.2-next.13",
+  "version": "1.0.2-next.18",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "1.0.2-next.13",
+  "version": "1.0.2-next.18",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.2-next.13",
+  "version": "1.0.2-next.18",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "1.0.2-next.13",
+  "version": "1.0.2-next.18",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/hooks/huaweicloud-safety.py

@@ -18,15 +18,38 @@ from pathlib import Path
 
 DENY_PREFIX = "Huawei Cloud safety hook blocked this action: "
 RULES_PATH = Path(__file__).resolve().parents[1] / "safety" / "rules" / "cloud-risk-rules.json"
+POLICY_PATH = Path(__file__).resolve().parents[1] / "safety" / "policy.json"
 
-CONFIG_FILE_RE = re.compile(r"(\.hcloud|\.huaweicloud|hcloud[/\\](config|credentials)|huaweicloud[/\\](config|credentials))", re.I)
-ENV_DUMP_RE = re.compile(r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I)
-SECRET_READ_RE = re.compile(r"(ShowSecretVersion|GetSecretValue|secret_string|secret_binary)", re.I)
-HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
-WRITE_OPERATION_RE = re.compile(
-    r"\b(BatchCreate|BatchDelete|Create|Delete|Update|Modify|Resize|Reboot|Stop|Start|Restart|Authorize|Revoke|Add|Remove|Associate|Disassociate|Attach|Detach|Enable|Disable)\w*",
-    re.I,
+CONFIG_FILE_RE = None
+SECRET_READ_RE = None
+WRITE_OPERATION_RE = None
+
+
+def load_policy():
+    global CONFIG_FILE_RE, SECRET_READ_RE, WRITE_OPERATION_RE
+    try:
+        with POLICY_PATH.open("r", encoding="utf-8") as file_obj:
+            policy = json.load(file_obj)
+        cred_patterns = policy.get("credentialFilePatterns", [])
+        if cred_patterns:
+            CONFIG_FILE_RE = re.compile("|".join(cred_patterns), re.I)
+        blocked_secrets = policy.get("blockedSecretOperations", [])
+        if blocked_secrets:
+            SECRET_READ_RE = re.compile("|".join(re.escape(op) for op in blocked_secrets), re.I)
+        write_prefixes = policy.get("writeOperationPrefixes", [])
+        if write_prefixes:
+            WRITE_OPERATION_RE = re.compile(r"\b(" + "|".join(write_prefixes) + r")\w*", re.I)
+    except Exception:
+        pass
+
+
+load_policy()
+
+ENV_DUMP_RE = re.compile(
+    r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I,
 )
+HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
+READ_OPERATION_RE = re.compile(r"\b(List|Show|Get|Describe|NovaList|NovaShow)\w*", re.I)
 READ_OPERATION_RE = re.compile(r"\b(List|Show|Get|Describe|NovaList|NovaShow)\w*", re.I)
 
 
@@ -117,11 +140,11 @@ def main():
     tool_name = data.get("tool_name", "")
     text = command_text(data.get("tool_input", {}))
 
-    if CONFIG_FILE_RE.search(text):
+    if CONFIG_FILE_RE and CONFIG_FILE_RE.search(text):
         deny("reading Huawei Cloud credential/profile files can expose AK/SK or tokens. Use redacted toolkit tools.")
     if ENV_DUMP_RE.search(text):
         deny("dumping cloud credential environment variables is not allowed.")
-    if SECRET_READ_RE.search(text):
+    if SECRET_READ_RE and SECRET_READ_RE.search(text):
         deny("direct secret value retrieval would put plaintext secrets into the agent context.")
     denied_rule = first_denied_command_rule(text)
     if denied_rule:

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -0,0 +1,19 @@
+{
+  "name": "huaweicloud-devkit",
+  "displayName": "HuaweiCloud DevKit",
+  "version": "1.0.2-next.18",
+  "family": "bundle-plugin",
+  "bundleFormat": "codex",
+  "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",
+  "author": {
+    "name": "HuaweiCloud Mate",
+    "url": "https://github.com/huaweicloud"
+  },
+  "homepage": "https://github.com/huaweicloud/huaweicloud-devkit",
+  "repository": "https://github.com/huaweicloud/huaweicloud-devkit",
+  "license": "Apache-2.0",
+  "keywords": ["huaweicloud", "huawei-cloud", "koocli", "hcloud", "agent", "mcp", "api", "sdk", "skills", "cloud"],
+  "category": "Cloud",
+  "capabilities": ["Read", "Interactive"],
+  "brandColor": "#C7000B"
+}

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -121,8 +121,24 @@ hcloud <Service> <ListOp> --cli-output=json --cli-query "items[?status=='ACTIVE'
 hcloud <Service> <Op> --cli-debug=true
 ```
 
+## Credential Resolution Priority
+
+Credentials are resolved in this order (highest priority first):
+
+| Priority | Source                  | Mechanism                                                  | Persistence                     |
+| -------- | ----------------------- | ---------------------------------------------------------- | ------------------------------- |
+| 1        | Runtime credentials     | `huaweicloud_auth_init` tool                               | Memory (cleared on MCP restart) |
+| 2        | Environment variables   | `HW_ACCESS_KEY` / `HW_SECRET_KEY`                          | MCP process lifetime            |
+| 3        | CodeArts project config | `.codeartsdoer/mcp/mcp_settings.json` (project, then user) | File                            |
+| 4        | Global config file      | `~/.config/huaweicloud/credentials.json`                   | Permanent                       |
+| 5        | KooCLI profile          | `~/.hcloud/config.json` (KooCLI only)                      | Permanent                       |
+
+When switching accounts within the same Agent session, use `huaweicloud_auth_init` to set runtime credentials. This overrides all other sources for the current MCP process.
+
 ## Preferred Toolkit Tools
 
+- `huaweicloud_auth_init`
+- `huaweicloud_auth_status`
 - `huaweicloud_check_cli`
 - `huaweicloud_show_profile_redacted`
 - `huaweicloud_plan_cli_command`

package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md

@@ -100,6 +100,7 @@ When the intent is to **deploy, host, or preview a web app or static website** (
 
 - Use huaweicloud_search_docs to discover skills covering a topic
 - Use huaweicloud_retrieve_skill to load a full SKILL.md after routing
+- Use huaweicloud_auth_init to switch credentials at runtime when different accounts co-exist in the same session
 - If no built-in skill matches, consult huaweicloud-capability-discovery for external marketplace options
 - Use huaweicloud_list_regions before creating regional resources
 - Use huaweicloud_get_regional_availability when unsure about service-region pairs

package/plugins/huaweicloud-core/src/auth/agent-registration.mjs

@@ -123,13 +123,16 @@ function officeaceRegistered() {
   let hasMcp = false;
   const dbPath = officeaceSqlitePath();
   if (existsSync(dbPath)) {
-    try {
-      const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
-      const db = new DatabaseSync(dbPath, { readonly: true });
-      const row = db.prepare("SELECT enabled FROM mcp_connectors WHERE name = 'huaweicloud-devkit'").get();
-      db.close();
-      hasMcp = Boolean(row?.enabled);
-    } catch {}
+    const nodeMajor = Number(process.versions.node.split('.')[0]);
+    if (nodeMajor >= 22) {
+      try {
+        const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
+        const db = new DatabaseSync(dbPath, { readonly: true });
+        const row = db.prepare("SELECT enabled FROM mcp_connectors WHERE name = 'huaweicloud-devkit'").get();
+        db.close();
+        hasMcp = Boolean(row?.enabled);
+      } catch {}
+    }
   }
 
   const capFile = join(officeaceCapabilitiesDir(), 'capabilities.json');

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -84,6 +84,13 @@ export function resolveCredentials(options = {}) {
   let securityToken = process.env.HW_SECURITY_TOKEN;
   let region = process.env.HW_REGION || process.env.HUAWEICLOUD_REGION || '';
 
+  const codeartsCreds = isCodeArtsContext() ? readCodeArtsCredentials() : null;
+  if (codeartsCreds) {
+    if (!ak && codeartsCreds.ak) ak = codeartsCreds.ak;
+    if (!sk && codeartsCreds.sk) sk = codeartsCreds.sk;
+    if (!region && codeartsCreds.region) region = codeartsCreds.region;
+  }
+
   const stored = readGlobalCredentials();
   if (stored) {
     if (!ak && stored.ak) ak = stored.ak;
@@ -101,3 +108,61 @@ export function resolveCredentials(options = {}) {
 
   return { ak, sk, securityToken, region };
 }
+
+function isCodeArtsContext() {
+  return existsSync(join(process.cwd(), '.codeartsdoer')) || existsSync(join(homedir(), '.codeartsdoer'));
+}
+
+function readCodeArtsCredentials() {
+  const searchPaths = [
+    join(process.cwd(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+    join(homedir(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+  ];
+
+  for (const path of searchPaths) {
+    try {
+      if (!existsSync(path)) continue;
+      const config = JSON.parse(readFileSync(path, 'utf8'));
+      const server = config?.mcpServers?.['huaweicloud-devkit'];
+      if (!server?.env) continue;
+
+      const ak = server.env.HW_ACCESS_KEY;
+      const sk = server.env.HW_SECRET_KEY;
+      if (ak && sk) {
+        return {
+          ak,
+          sk,
+          securityToken: server.env.HW_SECURITY_TOKEN || '',
+          region: server.env.HW_REGION || server.env.HUAWEICLOUD_REGION || '',
+        };
+      }
+    } catch {
+      // mcp_settings.json missing or invalid — skip
+    }
+  }
+
+  return null;
+}
+
+let runtimeCredentials = null;
+
+export function setRuntimeCredentials(ak, sk, securityToken, region) {
+  runtimeCredentials = { ak, sk, securityToken: securityToken || '', region: region || '' };
+}
+
+export function clearRuntimeCredentials() {
+  runtimeCredentials = null;
+}
+
+export function resolveCredentialsWithRuntime(options = {}) {
+  if (runtimeCredentials) {
+    return {
+      ak: runtimeCredentials.ak,
+      sk: runtimeCredentials.sk,
+      securityToken: runtimeCredentials.securityToken,
+      region: runtimeCredentials.region,
+    };
+  }
+
+  return resolveCredentials(options);
+}

package/plugins/huaweicloud-core/src/mcp-server.mjs

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
-process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
 import { stdin, stdout } from 'node:process';
-import { rmSync, existsSync } from 'node:fs';
-import { resolve, dirname } from 'node:path';
+import { rmSync, existsSync, readFileSync } from 'node:fs';
+import { resolve, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { TOOL_DEFINITIONS, callTool } from './tools.mjs';
 
@@ -27,6 +26,20 @@ try {
   if (existsSync(marker)) rmSync(marker, { force: true });
 } catch {}
 
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const pluginRoot = resolve(__dirname, '..');
+const packageRoot = resolve(pluginRoot, '..', '..');
+let pkgVersion = '0.0.0';
+for (const base of [pluginRoot, packageRoot]) {
+  try {
+    const version = JSON.parse(readFileSync(join(base, 'package.json'), 'utf8')).version;
+    if (version) {
+      pkgVersion = version;
+      break;
+    }
+  } catch {}
+}
+
 let buffer = Buffer.alloc(0);
 let useContentLengthFraming = true;
 
@@ -104,7 +117,7 @@ async function dispatch(method, params) {
       },
       serverInfo: {
         name: 'huaweicloud-devkit',
-        version: '0.1.0',
+        version: pkgVersion,
       },
     };
   }

package/plugins/huaweicloud-core/src/sandbox/hwlink-api.mjs

@@ -1,5 +1,5 @@
 import crypto from 'node:crypto';
-import { resolveCredentials } from '../auth/credentials.mjs';
+import { resolveCredentialsWithRuntime } from '../auth/credentials.mjs';
 import { getProxyDispatcher } from '../proxy/proxy-agent.mjs';
 
 const BASE_URL = process.env.HWLINK_ENDPOINT || 'https://devstation.myhuaweicloud.com';
@@ -77,7 +77,7 @@ function signRequest(method, path, query, body, ak, sk, securitytoken) {
 }
 
 export function getCredentials() {
-  const credentials = resolveCredentials();
+  const credentials = resolveCredentialsWithRuntime();
   return { ak: credentials.ak, sk: credentials.sk, securitytoken: credentials.securityToken };
 }
 

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -377,7 +377,7 @@ function printSandboxWarning(reason) {
   console.log(`\x1b[31m  请任选其一继续:\x1b[0m`);
   console.log(`\x1b[31m  A. 在码道外的终端安装并使用 KooCLI (推荐):`);
   console.log(`\x1b[31m     https://support.huaweicloud.com/qs-hcli/hcli_02_003.html`);
-  console.log(`\x1b[31m  B. 在码道设置中关闭沙箱模式后重试 (设置 → 权限 → Bash 模式)`);
+  console.log(`\x1b[31m  B. 在码道设置中关闭沙箱模式后重试 (设置 → 对话流 → 智能体 终端命令运行模式 → 自动运行)`);
   console.log(`\x1b[31m  关闭沙箱后重新运行: npx huaweicloud-devkit install-hcloud\x1b[0m`);
 }
 
@@ -405,7 +405,12 @@ function copyDir(src, dest) {
 }
 
 function installRuntimeDeps(pluginsDir) {
-  const pkgJson = { type: 'module', dependencies: { undici: '^8.10.0' } };
+  const pkgJson = {
+    name: 'huaweicloud-plugins',
+    version: pkgVersion,
+    type: 'module',
+    dependencies: { undici: '^8.10.0' },
+  };
   mkdirSync(pluginsDir, { recursive: true });
   writeFileSync(join(pluginsDir, 'package.json'), JSON.stringify(pkgJson, null, 2));
   const r = spawnSync('npm', ['install', '--omit=dev'], {
@@ -1427,6 +1432,7 @@ async function installOfficeAce() {
   copyDir(safetyDir, join(pluginDest, 'safety'));
   console.log(`  Safety Policy -> ${join(pluginDest, 'safety')}`);
 
+  installRuntimeDeps(pluginDest);
   ensureOfficeaceMcpInSqlite();
   registerOfficeaceSkillEntries();
 }
@@ -1444,6 +1450,7 @@ async function updateOfficeAce() {
   console.log(`  MCP Server updated -> ${join(pluginDest, 'src')}`);
   copyDir(safetyDir, join(pluginDest, 'safety'));
   console.log(`  Safety Policy updated -> ${join(pluginDest, 'safety')}`);
+  installRuntimeDeps(pluginDest);
   ensureOfficeaceMcpInSqlite();
   registerOfficeaceSkillEntries();
   mkdirSync(pluginDest, { recursive: true });

package/plugins/huaweicloud-core/src/tools.mjs

@@ -16,7 +16,12 @@ import {
 } from './sandbox/session-manager.mjs';
 import { hdkitCheckUser, hdkitSignAgreement, hdkitConnect, hdkitCredentials } from './sandbox/hdkitservice-api.mjs';
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
-import { readGlobalCredentials, writeObsConfig as writeObsConfigFile } from './auth/credentials.mjs';
+import {
+  readGlobalCredentials,
+  writeObsConfig as writeObsConfigFile,
+  setRuntimeCredentials,
+  clearRuntimeCredentials,
+} from './auth/credentials.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const SKILLS_ROOT_DEV = join(__dirname, '..', 'skills');
@@ -404,6 +409,20 @@ export const TOOL_DEFINITIONS = [
       },
     },
   },
+  {
+    name: 'huaweicloud_auth_init',
+    description:
+      'Set or clear runtime Huawei Cloud credentials (AK/SK) for this MCP session. Runtime credentials take highest priority over environment variables and config files for all subsequent API calls. Use when switching accounts within the same Agent session — call with AK/SK to switch, or with clear=true to fall back to env/file credentials.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ak: { type: 'string', description: 'Huawei Cloud Access Key (required unless clear=true)' },
+        sk: { type: 'string', description: 'Huawei Cloud Secret Key (required unless clear=true)' },
+        region: { type: 'string', description: 'Default region (optional)' },
+        clear: { type: 'boolean', description: 'Set to true to clear runtime credentials and revert to env/file' },
+      },
+    },
+  },
   {
     name: 'huaweicloud_sandbox_exec_with_session',
     description:
@@ -570,6 +589,16 @@ export async function callTool(name, args = {}) {
       return getAuthStatus(args.target || 'all');
     case 'huaweicloud_auth_sync':
       return syncAuth(args.target || 'all');
+    case 'huaweicloud_auth_init':
+      if (args.clear) {
+        clearRuntimeCredentials();
+        return { status: 'cleared', message: 'Runtime credentials cleared. Fallback to env/file.' };
+      }
+      if (!args.ak || !args.sk) {
+        throw new Error('ak and sk are required. Set clear=true to clear runtime credentials.');
+      }
+      setRuntimeCredentials(args.ak, args.sk, undefined, args.region);
+      return { status: 'ok', message: 'Runtime credentials set for this MCP session.' };
     case 'huaweicloud_sandbox_exec_with_session': {
       const sandboxWsId2 = args.workspace_id || DEFAULT_WORKSPACE_ID;
       const sandboxUser2 = args.username || 'root';
@@ -796,7 +825,7 @@ async function setupObsConfigFromHcloud(profile) {
 const SERVICE_EXAMPLES = {
   ECS: { list: 'ECS ListServersDetails', create: 'ECS CreateServers', show: 'IMS GlanceShowImage' },
   VPC: { list: 'VPC ListVpcs', create: 'VPC CreateVpc', show: 'VPC ShowVpc' },
-  FunctionGraph: {
+  FUNCTIONGRAPH: {
     list: 'FunctionGraph ListFunctions',
     create: 'FunctionGraph CreateFunction',
     show: 'FunctionGraph ShowFunctionConfig',
@@ -805,7 +834,7 @@ const SERVICE_EXAMPLES = {
   OBS: { list: 'OBS ls', create: 'OBS mb obs://<bucket>', show: 'OBS stat obs://<bucket>/<key>' },
   RDS: { list: 'RDS ListInstances', create: 'RDS CreateInstance', show: 'RDS ShowInstance' },
   CES: { list: 'CES ListAlarms', create: 'CES CreateAlarm', show: 'CES ListMetrics' },
-  GaussDB: { list: 'GaussDB ListInstances', create: 'GaussDB CreateInstance', show: 'GaussDB ShowInstance' },
+  GAUSSDB: { list: 'GaussDB ListInstances', create: 'GaussDB CreateInstance', show: 'GaussDB ShowInstance' },
   DDS: { list: 'DDS ListInstances', create: 'DDS CreateInstance', show: 'DDS ShowInstance' },
   DCS: { list: 'DCS ListInstances', create: 'DCS CreateInstance', show: 'DCS ShowInstance' },
 };