huaweicloud-devkit 1.0.2-next.2 → 1.0.2-next.20

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -5,10 +5,7 @@
     "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
     "developerName": "HuaweiCloud Mate",
     "category": "Cloud",
-    "capabilities": [
-      "Read",
-      "Interactive"
-    ],
+    "capabilities": ["Read", "Interactive"],
     "websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
     "brandColor": "#C7000B",
     "defaultPrompt": [
@@ -20,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.0.2-next.2",
+  "version": "1.0.2-next.20",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"
@@ -30,15 +27,5 @@
   "homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
   "repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
   "license": "Apache-2.0",
-  "keywords": [
-    "huaweicloud",
-    "huawei-cloud",
-    "koocli",
-    "hcloud",
-    "agent",
-    "mcp",
-    "api",
-    "sdk",
-    "skills"
-  ]
+  "keywords": ["huaweicloud", "huawei-cloud", "koocli", "hcloud", "agent", "mcp", "api", "sdk", "skills"]
 }

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -0,0 +1,30 @@
+{
+  "name": "huaweicloud-core",
+  "version": "1.0.2-next.20",
+  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
+  "author": {
+    "name": "HuaweiCloud Mate",
+    "url": "https://github.com/huaweicloud"
+  },
+  "homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+  "repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+  "license": "Apache-2.0",
+  "keywords": ["huaweicloud", "huawei-cloud", "koocli", "hcloud", "agent", "mcp", "api", "sdk", "skills"],
+  "skills": "./skills/",
+  "mcpServers": "./.mcp.json",
+  "interface": {
+    "displayName": "HuaweiCloud Devkit",
+    "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
+    "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
+    "developerName": "HuaweiCloud Mate",
+    "category": "Cloud",
+    "capabilities": ["Read", "Interactive"],
+    "websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+    "brandColor": "#C7000B",
+    "defaultPrompt": [
+      "Help me choose the right Huawei Cloud capability.",
+      "Check my Huawei Cloud CLI setup safely.",
+      "Plan this Huawei Cloud API or SDK task."
+    ]
+  }
+}

package/plugins/huaweicloud-core/.mcp.json

@@ -2,13 +2,10 @@
   "mcpServers": {
     "huaweicloud-devkit": {
       "command": "node",
-      "args": [
-        "./src/mcp-server.mjs"
-      ],
+      "args": ["./src/mcp-server.mjs"],
       "cwd": ".",
       "env": {
-        "HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local",
-        "HDKITSERVICE_ENDPOINT": ""
+        "HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local"
       }
     }
   }

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-core",
-  "version": "1.0.2-next.2",
+  "version": "1.0.2-next.20",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",
@@ -9,30 +9,16 @@
   "homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
   "repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
   "license": "Apache-2.0",
-  "keywords": [
-    "huaweicloud",
-    "huawei-cloud",
-    "koocli",
-    "hcloud",
-    "agent",
-    "mcp",
-    "api",
-    "sdk",
-    "skills"
-  ],
+  "keywords": ["huaweicloud", "huawei-cloud", "koocli", "hcloud", "agent", "mcp", "api", "sdk", "skills"],
   "skills": "./skills/",
   "mcpServers": "./.mcp.json",
-  "hooks": "./hooks/",
   "interface": {
     "displayName": "HuaweiCloud Devkit",
     "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
     "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
     "developerName": "HuaweiCloud Mate",
     "category": "Cloud",
-    "capabilities": [
-      "Read",
-      "Interactive"
-    ],
+    "capabilities": ["Read", "Interactive"],
     "websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
     "brandColor": "#C7000B",
     "defaultPrompt": [

package/plugins/huaweicloud-core/hooks/huaweicloud-safety.py

@@ -18,15 +18,38 @@ from pathlib import Path
 
 DENY_PREFIX = "Huawei Cloud safety hook blocked this action: "
 RULES_PATH = Path(__file__).resolve().parents[1] / "safety" / "rules" / "cloud-risk-rules.json"
+POLICY_PATH = Path(__file__).resolve().parents[1] / "safety" / "policy.json"
 
-CONFIG_FILE_RE = re.compile(r"(\.hcloud|\.huaweicloud|hcloud[/\\](config|credentials)|huaweicloud[/\\](config|credentials))", re.I)
-ENV_DUMP_RE = re.compile(r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I)
-SECRET_READ_RE = re.compile(r"(ShowSecretVersion|GetSecretValue|secret_string|secret_binary)", re.I)
-HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
-WRITE_OPERATION_RE = re.compile(
-    r"\b(BatchCreate|BatchDelete|Create|Delete|Update|Modify|Resize|Reboot|Stop|Start|Restart|Authorize|Revoke|Add|Remove|Associate|Disassociate|Attach|Detach|Enable|Disable)\w*",
-    re.I,
+CONFIG_FILE_RE = None
+SECRET_READ_RE = None
+WRITE_OPERATION_RE = None
+
+
+def load_policy():
+    global CONFIG_FILE_RE, SECRET_READ_RE, WRITE_OPERATION_RE
+    try:
+        with POLICY_PATH.open("r", encoding="utf-8") as file_obj:
+            policy = json.load(file_obj)
+        cred_patterns = policy.get("credentialFilePatterns", [])
+        if cred_patterns:
+            CONFIG_FILE_RE = re.compile("|".join(cred_patterns), re.I)
+        blocked_secrets = policy.get("blockedSecretOperations", [])
+        if blocked_secrets:
+            SECRET_READ_RE = re.compile("|".join(re.escape(op) for op in blocked_secrets), re.I)
+        write_prefixes = policy.get("writeOperationPrefixes", [])
+        if write_prefixes:
+            WRITE_OPERATION_RE = re.compile(r"\b(" + "|".join(write_prefixes) + r")\w*", re.I)
+    except Exception:
+        pass
+
+
+load_policy()
+
+ENV_DUMP_RE = re.compile(
+    r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I,
 )
+HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
+READ_OPERATION_RE = re.compile(r"\b(List|Show|Get|Describe|NovaList|NovaShow)\w*", re.I)
 READ_OPERATION_RE = re.compile(r"\b(List|Show|Get|Describe|NovaList|NovaShow)\w*", re.I)
 
 
@@ -117,11 +140,11 @@ def main():
     tool_name = data.get("tool_name", "")
     text = command_text(data.get("tool_input", {}))
 
-    if CONFIG_FILE_RE.search(text):
+    if CONFIG_FILE_RE and CONFIG_FILE_RE.search(text):
         deny("reading Huawei Cloud credential/profile files can expose AK/SK or tokens. Use redacted toolkit tools.")
     if ENV_DUMP_RE.search(text):
         deny("dumping cloud credential environment variables is not allowed.")
-    if SECRET_READ_RE.search(text):
+    if SECRET_READ_RE and SECRET_READ_RE.search(text):
         deny("direct secret value retrieval would put plaintext secrets into the agent context.")
     denied_rule = first_denied_command_rule(text)
     if denied_rule:

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -0,0 +1,20 @@
+{
+  "name": "huaweicloud-devkit",
+  "id": "huaweicloud-devkit",
+  "displayName": "HuaweiCloud DevKit",
+  "version": "1.0.2-next.18",
+  "family": "bundle-plugin",
+  "bundleFormat": "codex",
+  "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",
+  "author": {
+    "name": "HuaweiCloud Mate",
+    "url": "https://github.com/huaweicloud"
+  },
+  "homepage": "https://github.com/huaweicloud/huaweicloud-devkit",
+  "repository": "https://github.com/huaweicloud/huaweicloud-devkit",
+  "license": "Apache-2.0",
+  "keywords": ["huaweicloud", "huawei-cloud", "koocli", "hcloud", "agent", "mcp", "api", "sdk", "skills", "cloud"],
+  "category": "Cloud",
+  "capabilities": ["Read", "Interactive"],
+  "brandColor": "#C7000B"
+}

package/plugins/huaweicloud-core/safety/policy.json

@@ -1,100 +1,76 @@
 {
-    "version":  "0.1.0",
-    "secretKeyNamePatterns":  [
-                                  "access[_-]?key",
-                                  "secret[_-]?key",
-                                  "security[_-]?token",
-                                  "x[_-]?auth[_-]?token",
-                                  "authorization",
-                                  "password",
-                                  "passwd",
-                                  "token",
-                                  "credential",
-                                  "private[_-]?key",
-                                  "ak",
-                                  "sk"
-                              ],
-    "credentialFilePatterns":  [
-                                   "\\.hcloud",
-                                   "\\.huaweicloud",
-                                   "hcloud[/\\\\](config|credentials)",
-                                   "huaweicloud[/\\\\](config|credentials)"
-                               ],
-    "blockedConfigureSubcommands":  [
-                                        "show",
-                                        "get",
-                                        "list",
-                                        "export",
-                                        "init"
-                                    ],
-    "blockedSecretOperations":  [
-                                    "ShowSecretVersion",
-                                    "DownloadSecret",
-                                    "GetSecretValue"
-                                ],
-    "writeOperationPrefixes":  [
-                                   "Create",
-                                   "BatchCreate",
-                                   "Delete",
-                                   "BatchDelete",
-                                   "Update",
-                                   "Modify",
-                                   "Resize",
-                                   "Reboot",
-                                   "Stop",
-                                   "Start",
-                                   "Restart",
-                                   "Authorize",
-                                   "Revoke",
-                                   "Add",
-                                   "Remove",
-                                   "Associate",
-                                   "Disassociate",
-                                   "Attach",
-                                   "Detach",
-                                    "Enable",
-                                    "Disable",
-                                    "Set",
-                                    "Put",
-                                    "Upload",
-                                    "Install",
-                                    "Publish",
-                                    "Bind",
-                                    "Unbind",
-                                    "Invoke",
-                                    "Execute",
-                                    "Trigger",
-                                    "Deploy"
-                               ],
-    "readOperationPrefixes":  [
-                                  "List",
-                                  "Show",
-                                  "Get",
-                                  "Describe",
-                                  "NovaList",
-                                  "NovaShow"
-                              ],
-    "safeTextReadCommands":  [
-                                 "rg",
-                                 "grep",
-                                 "findstr",
-                                 "git",
-                                 "ls",
-                                 "dir",
-                                 "Get-ChildItem"
-                             ],
-    "blockedSandboxCommands":  [
-                                  "rm\\s+-rf\\s+/",
-                                  "mkfs",
-                                  "dd\\s+if=",
-                                  ":\\(\\)\\{:\\|:&\\};:",
-                                  "shutdown",
-                                  "reboot",
-                                  "init\\s+[06]",
-                                  "fdisk"
-                              ],
-    "sandboxWriteTools":  [
-                               "huaweicloud_sandbox_connect",
-                               "huaweicloud_sandbox_credentials"
-                           ]
-}
+  "version": "0.1.0",
+  "secretKeyNamePatterns": [
+    "access[_-]?key",
+    "secret[_-]?key",
+    "security[_-]?token",
+    "x[_-]?auth[_-]?token",
+    "authorization",
+    "password",
+    "passwd",
+    "token",
+    "credential",
+    "private[_-]?key",
+    "ak",
+    "sk"
+  ],
+  "credentialFilePatterns": [
+    "\\.hcloud",
+    "\\.huaweicloud",
+    "hcloud[/\\\\](config|credentials)",
+    "huaweicloud[/\\\\](config|credentials)"
+  ],
+  "blockedConfigureSubcommands": ["show", "get", "list", "export", "init"],
+  "blockedSecretOperations": ["ShowSecretVersion", "DownloadSecret", "GetSecretValue"],
+  "writeOperationPrefixes": [
+    "Create",
+    "BatchCreate",
+    "Delete",
+    "BatchDelete",
+    "Update",
+    "Modify",
+    "Resize",
+    "Reboot",
+    "Stop",
+    "Start",
+    "Restart",
+    "Authorize",
+    "Revoke",
+    "Add",
+    "Remove",
+    "Associate",
+    "Disassociate",
+    "Attach",
+    "Detach",
+    "Enable",
+    "Disable",
+    "Set",
+    "Put",
+    "Upload",
+    "Install",
+    "Publish",
+    "Bind",
+    "Unbind",
+    "Invoke",
+    "Execute",
+    "Trigger",
+    "Deploy"
+  ],
+  "readOperationPrefixes": ["List", "Show", "Get", "Describe", "NovaList", "NovaShow"],
+  "safeTextReadCommands": ["rg", "grep", "findstr", "git", "ls", "dir", "Get-ChildItem"],
+  "blockedSandboxCommands": [
+    "rm\\s+-rf\\s+/",
+    "mkfs",
+    "dd\\s+if=",
+    ":\\(\\)\\{:\\|:&\\};:",
+    "shutdown",
+    "reboot",
+    "init\\s+[06]",
+    "fdisk"
+  ],
+  "sandboxWriteTools": [
+    "huaweicloud_sandbox_connect",
+    "huaweicloud_sandbox_credentials",
+    "huaweicloud_sandbox_upload_file"
+  ]
+}

package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json

@@ -9,7 +9,10 @@
       "stages": ["command"],
       "match": {
         "any": [
-          { "field": "text", "regex": "(^|\\s)(cat|type|Get-Content|gc|less|more)\\s+[^\\n]*(\\.hcloud|\\.huaweicloud)" },
+          {
+            "field": "text",
+            "regex": "(^|\\s)(cat|type|Get-Content|gc|less|more)\\s+[^\\n]*(\\.hcloud|\\.huaweicloud)"
+          },
           { "field": "text", "regex": "(hcloud|huaweicloud)[/\\\\](config|credentials)" }
         ]
       },
@@ -54,7 +57,10 @@
       "stages": ["command"],
       "match": {
         "all": [
-          { "field": "text", "regex": "(base64\\s+(-d|--decode)|xxd\\s+-r|certutil\\s+-decode|FromBase64String|hex\\s*decode)" },
+          {
+            "field": "text",
+            "regex": "(base64\\s+(-d|--decode)|xxd\\s+-r|certutil\\s+-decode|FromBase64String|hex\\s*decode)"
+          },
           { "field": "text", "regex": "(\\||;|&&)" },
           { "field": "text", "regex": "\\b(bash|sh|zsh|powershell|pwsh|cmd|python|node)\\b" }
         ]
@@ -70,8 +76,14 @@
       "stages": ["command", "artifact", "deploy_plan"],
       "match": {
         "all": [
-          { "field": "text", "regex": "(0\\.0\\.0\\.0\\s*/\\s*0|::\\s*/\\s*0|remote_ip_prefix\\s*[=:]\\s*0\\.0\\.0\\.0\\s*/\\s*0|cidr\\s*[=:]\\s*0\\.0\\.0\\.0\\s*/\\s*0)" },
-          { "field": "text", "regex": "(port_range_min|port_range_max|from_port|to_port|port|\\b22\\b|\\b3389\\b|\\b3306\\b|\\b5432\\b|\\b6379\\b|\\b9200\\b)" }
+          {
+            "field": "text",
+            "regex": "(0\\.0\\.0\\.0\\s*/\\s*0|::\\s*/\\s*0|remote_ip_prefix\\s*[=:]\\s*0\\.0\\.0\\.0\\s*/\\s*0|cidr\\s*[=:]\\s*0\\.0\\.0\\.0\\s*/\\s*0)"
+          },
+          {
+            "field": "text",
+            "regex": "(port_range_min|port_range_max|from_port|to_port|port|\\b22\\b|\\b3389\\b|\\b3306\\b|\\b5432\\b|\\b6379\\b|\\b9200\\b)"
+          }
         ]
       },
       "message": "The change appears to expose an administrative or database port to the public internet.",
@@ -84,12 +96,16 @@
       "severity": "deny",
       "stages": ["command", "artifact", "deploy_plan"],
       "match": {
-        "all": [
-          { "field": "text", "regex": "(OBS|obs://|bucket|object|Statement|Principal)" }
-        ],
+        "all": [{ "field": "text", "regex": "(OBS|obs://|bucket|object|Statement|Principal)" }],
         "any": [
-          { "field": "text", "regex": "((Anonymous|Everyone|\\\"Principal\\\"\\s*:\\s*\\\"\\*\\\"|AllUsers).*(PutObject|DeleteObject|PutBucketPolicy|FULL_CONTROL|WRITE|obs:object:PutObject|obs:bucket:PutBucketPolicy)|(PutObject|DeleteObject|PutBucketPolicy|FULL_CONTROL|WRITE|obs:object:PutObject|obs:bucket:PutBucketPolicy).*(Anonymous|Everyone|\\\"Principal\\\"\\s*:\\s*\\\"\\*\\\"|AllUsers))" },
-          { "field": "text", "regex": "(-acl\\s*=?\\s*public-read-write|acl\\s*[=:]\\s*[\\\"']?public-read-write|public-write)" }
+          {
+            "field": "text",
+            "regex": "((Anonymous|Everyone|\\\"Principal\\\"\\s*:\\s*\\\"\\*\\\"|AllUsers).*(PutObject|DeleteObject|PutBucketPolicy|FULL_CONTROL|WRITE|obs:object:PutObject|obs:bucket:PutBucketPolicy)|(PutObject|DeleteObject|PutBucketPolicy|FULL_CONTROL|WRITE|obs:object:PutObject|obs:bucket:PutBucketPolicy).*(Anonymous|Everyone|\\\"Principal\\\"\\s*:\\s*\\\"\\*\\\"|AllUsers))"
+          },
+          {
+            "field": "text",
+            "regex": "(-acl\\s*=?\\s*public-read-write|acl\\s*[=:]\\s*[\\\"']?public-read-write|public-write)"
+          }
         ]
       },
       "message": "The change may grant anonymous write or full-control access to OBS data.",
@@ -104,7 +120,10 @@
       "match": {
         "all": [
           { "field": "text", "regex": "(FunctionGraph|APIG|CreateTrigger|CreateApi|DEDICATEDGATEWAY|API Gateway)" },
-          { "field": "text", "regex": "(public|PUBLIC|0\\.0\\.0\\.0\\s*/\\s*0|auth[\\\"']?\\s*[=:]\\s*[\\\"']?(NONE|none|false)|security_authentication[\\\"']?\\s*[=:]\\s*[\\\"']?(NONE|none))" }
+          {
+            "field": "text",
+            "regex": "(public|PUBLIC|0\\.0\\.0\\.0\\s*/\\s*0|auth[\\\"']?\\s*[=:]\\s*[\\\"']?(NONE|none|false)|security_authentication[\\\"']?\\s*[=:]\\s*[\\\"']?(NONE|none))"
+          }
         ]
       },
       "message": "The generated FunctionGraph or API Gateway path may be publicly reachable without authentication.",
@@ -119,7 +138,10 @@
       "match": {
         "all": [
           { "field": "text", "regex": "(IAM|policy|role|agency|Statement|Action)" },
-          { "field": "text", "regex": "(\\\"Action\\\"\\s*:\\s*(\\\"(\\*|\\*:\\*)\\\"|\\[\\s*\\\"(\\*|\\*:\\*)\\\")|Action\\s*[=:]\\s*(\\*|\\*:\\*)|AdministratorAccess|FullAccess)" },
+          {
+            "field": "text",
+            "regex": "(\\\"Action\\\"\\s*:\\s*(\\\"(\\*|\\*:\\*)\\\"|\\[\\s*\\\"(\\*|\\*:\\*)\\\")|Action\\s*[=:]\\s*(\\*|\\*:\\*)|AdministratorAccess|FullAccess)"
+          },
           { "field": "text", "regex": "(\\\"Effect\\\"\\s*:\\s*\\\"Allow\\\"|Effect\\s*[=:]\\s*Allow)" }
         ]
       },
@@ -149,7 +171,10 @@
       "stages": ["artifact", "deploy_plan"],
       "match": {
         "all": [
-          { "field": "text", "regex": "(sandbox|preview|temporary|ephemeral|dev environment|FunctionGraph|ECS|CCE|APIG)" },
+          {
+            "field": "text",
+            "regex": "(sandbox|preview|temporary|ephemeral|dev environment|FunctionGraph|ECS|CCE|APIG)"
+          },
           { "field": "text", "regex": "(Create|Deploy|Provision|resource|stack|environment)" }
         ],
         "none": [
@@ -167,7 +192,10 @@
       "stages": ["command", "artifact", "deploy_plan"],
       "match": {
         "any": [
-          { "field": "text", "regex": "(max_instances|max_node_count|max_replica|desired\\s*[=:]\\s*[5-9][0-9]|replicas\\s*[=:]\\s*[5-9][0-9])" },
+          {
+            "field": "text",
+            "regex": "(max_instances|max_node_count|max_replica|desired\\s*[=:]\\s*[5-9][0-9]|replicas\\s*[=:]\\s*[5-9][0-9])"
+          },
           { "field": "text", "regex": "(GPU|gpu|large|xlarge|charging_mode\\s*[=:]\\s*prePaid|period_type|period_num)" }
         ]
       },

package/plugins/huaweicloud-core/skills/huawei-apig/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-apig
-description: "Use when creating or managing API Gateway (APIG). Covers API creation, throttling, auth (IAM/APP/basic), CORS, publishing, instance management. Triggers: APIG, API gateway, throttling, publish API. NOT for: FunctionGraph triggers (use huawei-functiongraph)."
+description: 'Use when creating or managing API Gateway (APIG). Covers API creation, throttling, auth (IAM/APP/basic), CORS, publishing, instance management. Triggers: APIG, API gateway, throttling, publish API. NOT for: FunctionGraph triggers (use huawei-functiongraph).'
 version: 1
 ---
 
@@ -16,16 +16,16 @@ Always discover parameters with `hcloud APIG <Operation> --help` before executin
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| API group region-locked | Cannot move across regions |
-| Throttling per-API default | Use app-level quotas for per-user limits |
-| CORS must be explicit | OPTIONS preflight fails until configured |
-| `BASIC` spec has no public IP | Use `PROFESSIONAL` + `elb` provider for public access |
-| Instance creation takes 5-15min | Long-running async operation. State is **Running** (NOT "SUCCESS"). Poll with `ListInstancesV2`, wait for `status == "Running"` |
-| `sl_domain` is from API **Group** | NOT from Instance. Get it from `CreateApiGroupV2` or `ListApiGroupsV2` response |
-| API name must NOT have hyphens | `[a-zA-Z0-9_]+` only. Hyphens cause regex validation failure |
-| VPC params need prefix | `--vpc.name=<n>` / `--subnet.vpc_id=<id>` / `--security_group.name=<n>` with KooCLI 7.x |
+| Trap                              | Why                                                                                                                             |
+| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| API group region-locked           | Cannot move across regions                                                                                                      |
+| Throttling per-API default        | Use app-level quotas for per-user limits                                                                                        |
+| CORS must be explicit             | OPTIONS preflight fails until configured                                                                                        |
+| `BASIC` spec has no public IP     | Use `PROFESSIONAL` + `elb` provider for public access                                                                           |
+| Instance creation takes 5-15min   | Long-running async operation. State is **Running** (NOT "SUCCESS"). Poll with `ListInstancesV2`, wait for `status == "Running"` |
+| `sl_domain` is from API **Group** | NOT from Instance. Get it from `CreateApiGroupV2` or `ListApiGroupsV2` response                                                 |
+| API name must NOT have hyphens    | `[a-zA-Z0-9_]+` only. Hyphens cause regex validation failure                                                                    |
+| VPC params need prefix            | `--vpc.name=<n>` / `--subnet.vpc_id=<id>` / `--security_group.name=<n>` with KooCLI 7.x                                         |
 
 ## Instance Management
 
@@ -43,14 +43,14 @@ hcloud APIG CreateInstanceV2 --help
 
 Key gotchas when creating:
 
-| Param | Note |
-|-------|------|
-| `--spec_id` | `BASIC` (no public access), `PROFESSIONAL` (requires `--loadbalancer_provider`) |
-| `--loadbalancer_provider` | `elb` for public access (supports `AddIngressEipV2`), `lvs` for internal only (supports `AddEipV2`) |
-| `--enterprise_project_id` | **Required** for enterprise accounts. Use `"0"` for default project |
-| `--available_zone_ids` | Use AZ code like `ap-southeast-3a`, NOT UUID from `ListAvailableZonesV2` |
-| `--vpc_id`, `--subnet_id` | Must exist in the target region |
-| `--security_group_id` | **Required**. Create a security group first via `VPC CreateSecurityGroup` (VPC v3 API — no `vpc_id` param needed) |
+| Param                     | Note                                                                                                              |
+| ------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| `--spec_id`               | `BASIC` (no public access), `PROFESSIONAL` (requires `--loadbalancer_provider`)                                   |
+| `--loadbalancer_provider` | `elb` for public access (supports `AddIngressEipV2`), `lvs` for internal only (supports `AddEipV2`)               |
+| `--enterprise_project_id` | **Required** for enterprise accounts. Use `"0"` for default project                                               |
+| `--available_zone_ids`    | Use AZ code like `ap-southeast-3a`, NOT UUID from `ListAvailableZonesV2`                                          |
+| `--vpc_id`, `--subnet_id` | Must exist in the target region                                                                                   |
+| `--security_group_id`     | **Required**. Create a security group first via `VPC CreateSecurityGroup` (VPC v3 API — no `vpc_id` param needed) |
 
 ### Add Public Access (ELB Provider Only)
 
@@ -89,9 +89,9 @@ Wait for `eip_address` to show a valid IP (may take up to 2 minutes). If `eip_ad
 hcloud APIG CreateApiGroupV2 --instance_id=<id> --name=<n>
 ```
 
-| Param | Note |
-|-------|------|
-| `--name` | Group name (required) |
+| Param      | Note                   |
+| ---------- | ---------------------- |
+| `--name`   | Group name (required)  |
 | `--remark` | Description (optional) |
 
 ## API Management
@@ -120,18 +120,18 @@ hcloud APIG CreateThrottlingPolicyV2 --name=<n> --api_call_limits=1000
 
 ## Common Workflows
 
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstancesV2` |
-| Create instance | `CreateInstanceV2` |
-| Delete instance | `DeleteInstancesV2` |
-| Add public EIP | `AddIngressEipV2` |
-| Create API group | `CreateApiGroupV2` |
-| Create API | `CreateApiV2` |
-| Update API | `UpdateApiV2` — change auth mode, path, etc. |
-| List APIs | `ListApisV2` |
-| Publish | `BatchPublishOrOfflineApiV2` |
-| List APIs | `ListApisV2` |
+| Task             | Operation                                    |
+| ---------------- | -------------------------------------------- |
+| List instances   | `ListInstancesV2`                            |
+| Create instance  | `CreateInstanceV2`                           |
+| Delete instance  | `DeleteInstancesV2`                          |
+| Add public EIP   | `AddIngressEipV2`                            |
+| Create API group | `CreateApiGroupV2`                           |
+| Create API       | `CreateApiV2`                                |
+| Update API       | `UpdateApiV2` — change auth mode, path, etc. |
+| List APIs        | `ListApisV2`                                 |
+| Publish          | `BatchPublishOrOfflineApiV2`                 |
+| List APIs        | `ListApisV2`                                 |
 
 ## FunctionGraph Integration