huaweicloud-devkit 1.0.2-next.2 → 1.0.2-next.21

package/plugins/huaweicloud-core/src/safety-policy.mjs

@@ -17,9 +17,13 @@ function regexFrom(pattern) {
 }
 
 function isSecretKeyName(key, policy = DEFAULT_POLICY) {
-  const normalized = String(key).toLowerCase().replace(/[^a-z0-9]/g, '');
+  const normalized = String(key)
+    .toLowerCase()
+    .replace(/[^a-z0-9]/g, '');
   if (
-    /access.*key|secret.*key|security.*token|xauth.*token|authorization|password|passwd|adminpass|credential|private.*key/.test(normalized)
+    /access.*key|secret.*key|security.*token|xauth.*token|authorization|password|passwd|adminpass|credential|private.*key/.test(
+      normalized,
+    )
   ) {
     return true;
   }
@@ -28,7 +32,10 @@ function isSecretKeyName(key, policy = DEFAULT_POLICY) {
 
 function redactString(text) {
   return String(text)
-    .replace(/((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|authorization|password|passwd|adminPass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi, '$1<redacted>')
+    .replace(
+      /((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|authorization|password|passwd|adminPass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
+      '$1<redacted>',
+    )
     .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>');
 }
 
@@ -78,15 +85,11 @@ function matchesAny(value, patterns) {
 
 function hasWritePrefix(operation, policy) {
   const normalized = String(operation);
-  return policy.writeOperationPrefixes.some((prefix) =>
-    new RegExp(`(^|[A-Za-z0-9])${prefix}`, 'i').test(normalized),
-  );
+  return policy.writeOperationPrefixes.some((prefix) => new RegExp(`(^|[A-Za-z0-9])${prefix}`, 'i').test(normalized));
 }
 
 function hasReadPrefix(operation, policy) {
-  return policy.readOperationPrefixes.some((prefix) =>
-    new RegExp(`^${prefix}`, 'i').test(operation),
-  );
+  return policy.readOperationPrefixes.some((prefix) => new RegExp(`^${prefix}`, 'i').test(operation));
 }
 
 function isLocalMetadataCommand(args) {
@@ -119,26 +122,31 @@ export function classifyHcloudArgs(args, options = {}) {
   }
 
   if (isLocalMetadataCommand(normalizedArgs)) {
-    return applyCommandRiskRules({
-      decision: 'allow',
-      risk: 'local_metadata',
-      reason: 'KooCLI local help and version commands are read-only and do not call Huawei Cloud resource APIs.',
-      service,
-      operation,
-      args: normalizedArgs,
-    }, normalizedArgs, options);
+    return applyCommandRiskRules(
+      {
+        decision: 'allow',
+        risk: 'local_metadata',
+        reason: 'KooCLI local help and version commands are read-only and do not call Huawei Cloud resource APIs.',
+        service,
+        operation,
+        args: normalizedArgs,
+      },
+      normalizedArgs,
+      options,
+    );
   }
 
   if (service.toLowerCase() === 'configure') {
     const subcommand = operation.toLowerCase();
     if (
-      policy.blockedConfigureSubcommands.map((cmd) => cmd.toLowerCase()).includes(subcommand)
-      && options.allowCredentialRead !== true
+      policy.blockedConfigureSubcommands.map((cmd) => cmd.toLowerCase()).includes(subcommand) &&
+      options.allowCredentialRead !== true
     ) {
       return {
         decision: 'deny',
         risk: 'credential',
-        reason: 'Direct hcloud configure inspection may expose profile credentials. Use the redacted toolkit tools instead.',
+        reason:
+          'Direct hcloud configure inspection may expose profile credentials. Use the redacted toolkit tools instead.',
       };
     }
   }
@@ -160,7 +168,8 @@ export function classifyHcloudArgs(args, options = {}) {
   }
 
   const readOnly = hasReadPrefix(operation, policy);
-  const executionOps = /(^|\.)(Invoke|SyncInvoke|AsyncInvoke|Send|Trigger|Execute|Start|Reboot|Restart|Stop|Publish|Deploy)/i;
+  const executionOps =
+    /(^|\.)(Invoke|SyncInvoke|AsyncInvoke|Send|Trigger|Execute|Start|Reboot|Restart|Stop|Publish|Deploy)/i;
   const isExecution = executionOps.test(operation) && !readOnly;
   const isWrite = !readOnly && hasWritePrefix(operation, policy);
 
@@ -176,11 +185,30 @@ export function classifyHcloudArgs(args, options = {}) {
     return {
       decision: 'deny',
       risk: 'write',
-      reason: 'Huawei Cloud write operation blocked until the agent presents a plan and receives explicit user approval.',
+      reason:
+        'Huawei Cloud write operation blocked until the agent presents a plan and receives explicit user approval.',
     };
   }
 
-  const obsutilWrites = ['mb', 'cp', 'mv', 'rm', 'delete', 'mkdir', 'sync', 'restore', 'chattri', 'bucketpolicy', 'lifecycle', 'cors', 'website', 'sign', 'share-add', 'share-update', 'share-rm'];
+  const obsutilWrites = [
+    'mb',
+    'cp',
+    'mv',
+    'rm',
+    'delete',
+    'mkdir',
+    'sync',
+    'restore',
+    'chattri',
+    'bucketpolicy',
+    'lifecycle',
+    'cors',
+    'website',
+    'sign',
+    'share-add',
+    'share-update',
+    'share-rm',
+  ];
   const obsutilReads = ['ls', 'stat', 'cat', 'help', 'version'];
   const isObs = service.toLowerCase() === 'obs' || service.toLowerCase() === 'hcloud obs';
   const isObsWrite = isObs && obsutilWrites.includes(operation);
@@ -193,64 +221,86 @@ export function classifyHcloudArgs(args, options = {}) {
     };
   }
   if (isObsRead) {
-    return applyCommandRiskRules({
-      decision: 'allow',
-      risk: 'read_only',
-      reason: 'OBS read-only operation.',
-      service,
-      operation,
-      args: normalizedArgs,
-    }, normalizedArgs, options);
+    return applyCommandRiskRules(
+      {
+        decision: 'allow',
+        risk: 'read_only',
+        reason: 'OBS read-only operation.',
+        service,
+        operation,
+        args: normalizedArgs,
+      },
+      normalizedArgs,
+      options,
+    );
   }
   if (isObsWrite && options.allowWrites) {
-    return applyCommandRiskRules({
-      decision: 'allow',
-      risk: 'write',
-      reason: 'OBS write operation approved by user.',
-      service,
-      operation,
-      args: normalizedArgs,
-    }, normalizedArgs, options);
+    return applyCommandRiskRules(
+      {
+        decision: 'allow',
+        risk: 'write',
+        reason: 'OBS write operation approved by user.',
+        service,
+        operation,
+        args: normalizedArgs,
+      },
+      normalizedArgs,
+      options,
+    );
   }
 
   if (isExecution && options.allowWrites) {
-    return applyCommandRiskRules({
-      decision: 'allow',
-      risk: 'execution',
-      reason: 'Huawei Cloud execution/trigger operation approved by user.',
-      service,
-      operation,
-      args: normalizedArgs,
-    }, normalizedArgs, options);
+    return applyCommandRiskRules(
+      {
+        decision: 'allow',
+        risk: 'execution',
+        reason: 'Huawei Cloud execution/trigger operation approved by user.',
+        service,
+        operation,
+        args: normalizedArgs,
+      },
+      normalizedArgs,
+      options,
+    );
   }
 
   if (isWrite && options.allowWrites) {
-    return applyCommandRiskRules({
+    return applyCommandRiskRules(
+      {
+        decision: 'allow',
+        risk: 'write',
+        reason: 'Huawei Cloud write operation approved by user.',
+        service,
+        operation,
+        args: normalizedArgs,
+      },
+      normalizedArgs,
+      options,
+    );
+  }
+
+  return applyCommandRiskRules(
+    {
       decision: 'allow',
-      risk: 'write',
-      reason: 'Huawei Cloud write operation approved by user.',
+      risk: readOnly ? 'read_only' : 'unknown_read',
+      reason: readOnly
+        ? 'Command appears to be a read-only Huawei Cloud operation.'
+        : 'Command does not match a known write or secret operation; treat output as untrusted and redact it.',
       service,
       operation,
       args: normalizedArgs,
-    }, normalizedArgs, options);
-  }
-
-  return applyCommandRiskRules({
-    decision: 'allow',
-    risk: readOnly ? 'read_only' : 'unknown_read',
-    reason: readOnly
-      ? 'Command appears to be a read-only Huawei Cloud operation.'
-      : 'Command does not match a known write or secret operation; treat output as untrusted and redact it.',
-    service,
-    operation,
-    args: normalizedArgs,
-  }, normalizedArgs, options);
+    },
+    normalizedArgs,
+    options,
+  );
 }
 
 function splitSimpleCommand(command) {
-  return String(command)
-    .match(/"[^"]*"|'[^']*'|\S+/g)
-    ?.map((part) => part.replace(/^['"]|['"]$/g, '')) || [];
+  return (
+    String(command)
+      .match(/"[^"]*"|'[^']*'|\S+/g)
+      ?.map((part) => part.replace(/^['"]|['"]$/g, '')) || []
+  );
 }
 
 export function classifyTextCommand(command, options = {}) {
@@ -261,11 +311,15 @@ export function classifyTextCommand(command, options = {}) {
     return {
       decision: 'deny',
       risk: 'credential',
-      reason: 'Reading Huawei Cloud credential or profile files is blocked. Use redacted profile inspection tools instead.',
+      reason:
+        'Reading Huawei Cloud credential or profile files is blocked. Use redacted profile inspection tools instead.',
     };
   }
 
-  if (/(^|\s)(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:)/i.test(text) && /HUAWEICLOUD|HWC_|HCLOUD|OS_/i.test(text)) {
+  if (
+    /(^|\s)(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:)/i.test(text) &&
+    /HUAWEICLOUD|HWC_|HCLOUD|OS_/i.test(text)
+  ) {
     return {
       decision: 'deny',
       risk: 'credential',

package/plugins/huaweicloud-core/src/sandbox/hdkitservice-api.mjs

@@ -2,8 +2,7 @@ import { getCredentials } from './hwlink-api.mjs';
 import { getProxyDispatcher } from '../proxy/proxy-agent.mjs';
 
 const HDKIT_BASE_URL =
-  process.env.HDKITSERVICE_ENDPOINT ||
-  'https://devkit.huaweicloud.com/rest/developer/server/hdkitservice/';
+  process.env.HDKITSERVICE_ENDPOINT || 'https://devkit.huaweicloud.com/rest/developer/server/hdkitservice/';
 
 async function hdkitRequest(method, path, body, timeoutMs = 300000) {
   const { ak, sk, securitytoken } = getCredentials();
@@ -30,8 +29,13 @@ async function hdkitRequest(method, path, body, timeoutMs = 300000) {
       body: body ? JSON.stringify(body) : undefined,
       signal: controller.signal,
     };
-    if (dispatcher) fetchOpts.dispatcher = dispatcher;
-    resp = await fetch(url, fetchOpts);
+    if (dispatcher) {
+      fetchOpts.dispatcher = dispatcher;
+      const { fetch: undiciFetch } = await import('undici');
+      resp = await undiciFetch(url, fetchOpts);
+    } else {
+      resp = await fetch(url, fetchOpts);
+    }
   } finally {
     clearTimeout(timer);
   }
@@ -45,9 +49,7 @@ async function hdkitRequest(method, path, body, timeoutMs = 300000) {
   }
 
   if (!resp.ok) {
-    const err = new Error(
-      data.message || `hdkitservice error: ${data.code || resp.status}`
-    );
+    const err = new Error(data.message || `hdkitservice error: ${data.code || resp.status}`);
     err.code = data.code;
     err.status = resp.status;
     err.traceId = data.traceId; // 后端实际返回驼峰 traceId
@@ -87,5 +89,3 @@ export async function hdkitCredentials(sessionId, devStageId, enableSts = true)
 
   return await hdkitRequest('POST', 'credentials', body);
 }
-
-

package/plugins/huaweicloud-core/src/sandbox/hwlink-api.mjs

@@ -1,5 +1,5 @@
 import crypto from 'node:crypto';
-import { resolveCredentials } from '../auth/credentials.mjs';
+import { resolveCredentialsWithRuntime } from '../auth/credentials.mjs';
 import { getProxyDispatcher } from '../proxy/proxy-agent.mjs';
 
 const BASE_URL = process.env.HWLINK_ENDPOINT || 'https://devstation.myhuaweicloud.com';
@@ -14,9 +14,7 @@ function hmacSha256(key, data) {
 
 function urlEncode(str) {
   const hex = (c) => '%' + (c < 16 ? '0' : '') + c.toString(16).toUpperCase();
-  const noEscape = new Set(
-    'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~'.split('')
-  );
+  const noEscape = new Set('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~'.split(''));
   let out = '';
   for (const ch of str) {
     const c = ch.codePointAt(0);
@@ -54,9 +52,7 @@ function signRequest(method, path, query, body, ak, sk, securitytoken) {
       .join('/') +
     '/';
 
-  const signedHeaders = securitytoken
-    ? 'host;x-sdk-date;x-security-token'
-    : 'host;x-sdk-date';
+  const signedHeaders = securitytoken ? 'host;x-sdk-date;x-security-token' : 'host;x-sdk-date';
   const canonicalHeaders = securitytoken
     ? `host:${host}\nx-sdk-date:${ts}\nx-security-token:${securitytoken}\n`
     : `host:${host}\nx-sdk-date:${ts}\n`;
@@ -64,14 +60,7 @@ function signRequest(method, path, query, body, ak, sk, securitytoken) {
   const bodyStr = body ? JSON.stringify(body) : '';
   const payloadHash = sha256Hex(bodyStr);
 
-  const canonicalRequest = [
-    method,
-    curi,
-    cqs,
-    canonicalHeaders,
-    signedHeaders,
-    payloadHash,
-  ].join('\n');
+  const canonicalRequest = [method, curi, cqs, canonicalHeaders, signedHeaders, payloadHash].join('\n');
 
   const stringToSign = `SDK-HMAC-SHA256\n${ts}\n${sha256Hex(canonicalRequest)}`;
   const signature = hmacSha256(sk, stringToSign);
@@ -88,7 +77,7 @@ function signRequest(method, path, query, body, ak, sk, securitytoken) {
 }
 
 export function getCredentials() {
-  const credentials = resolveCredentials();
+  const credentials = resolveCredentialsWithRuntime();
   return { ak: credentials.ak, sk: credentials.sk, securitytoken: credentials.securityToken };
 }
 
@@ -100,7 +89,12 @@ async function apiGet(path, query, ak, sk, securitytoken) {
   const url = `${BASE_URL}${fullPath}`;
   const dispatcher = await getProxyDispatcher(url);
   const fetchOpts = { headers };
-  if (dispatcher) fetchOpts.dispatcher = dispatcher;
+  if (dispatcher) {
+    fetchOpts.dispatcher = dispatcher;
+    const { fetch: undiciFetch } = await import('undici');
+    const resp = await undiciFetch(url, fetchOpts);
+    return { status: resp.status, data: await resp.json() };
+  }
   const resp = await fetch(url, fetchOpts);
   return { status: resp.status, data: await resp.json() };
 }
@@ -114,7 +108,12 @@ async function apiPost(path, body, ak, sk, securitytoken) {
     headers: { ...headers, 'Content-Type': 'application/json' },
     body: JSON.stringify(body),
   };
-  if (dispatcher) fetchOpts.dispatcher = dispatcher;
+  if (dispatcher) {
+    fetchOpts.dispatcher = dispatcher;
+    const { fetch: undiciFetch } = await import('undici');
+    const resp = await undiciFetch(url, fetchOpts);
+    return { status: resp.status, data: await resp.json() };
+  }
   const resp = await fetch(url, fetchOpts);
   return { status: resp.status, data: await resp.json() };
 }
@@ -123,7 +122,9 @@ export async function createConnection(envId, ak, sk, securitytoken) {
   const { status, data } = await apiPost(
     `/open-api-public/v1/devenvs/${envId}/connections`,
     { source: 'CLI' },
-    ak, sk, securitytoken
+    ak,
+    sk,
+    securitytoken,
   );
 
   if (status !== 200 || data?.error_code !== '0000' || !data?.result?.connection_id) {
@@ -138,13 +139,12 @@ export async function createConnection(envId, ak, sk, securitytoken) {
     const { data: getData } = await apiGet(
       `/open-api-public/v1/devenvs/${envId}/connections/${connectionId}`,
       {},
-      ak, sk, securitytoken
+      ak,
+      sk,
+      securitytoken,
     );
 
-    if (
-      getData?.result?.connection_info?.url &&
-      getData.result.connection_info.extensions?.source != null
-    ) {
+    if (getData?.result?.connection_info?.url && getData.result.connection_info.extensions?.source != null) {
       const u = new URL(getData.result.connection_info.url);
       u.searchParams.set('source', String(getData.result.connection_info.extensions.source));
       process.stderr.write(`\rConnection ${connectionId} established (${i}s).\n`);
@@ -158,5 +158,3 @@ export async function createConnection(envId, ak, sk, securitytoken) {
 
   throw new Error(`Timed out waiting for connection ${connectionId}`);
 }
-
-

package/plugins/huaweicloud-core/src/sandbox/sandbox-file-server.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+import hashlib, http.server, json, os, sys
+class UploadHandler(http.server.BaseHTTPRequestHandler):
+    def do_POST(self):
+        if self.path != '/upload':
+            self.send_error(404)
+            return
+        target_path = self.headers.get('X-Target-Path', '/workspace/upload.tar.gz')
+        content_length = int(self.headers.get('Content-Length', 0))
+        os.makedirs(os.path.dirname(target_path), exist_ok=True)
+        md5 = hashlib.md5()
+        bytes_written = 0
+        with open(target_path, 'wb') as f:
+            remaining = content_length
+            while remaining > 0:
+                chunk = self.rfile.read(min(remaining, 65536))
+                if not chunk:
+                    break
+                f.write(chunk)
+                md5.update(chunk)
+                bytes_written += len(chunk)
+                remaining -= len(chunk)
+        result = json.dumps({'ok': True, 'path': target_path, 'bytes': bytes_written, 'md5': md5.hexdigest()})
+        self.send_response(200)
+        self.send_header('Content-Type', 'application/json')
+        self.send_header('Content-Length', str(len(result)))
+        self.end_headers()
+        self.wfile.write(result.encode())
+    def do_GET(self):
+        if self.path == '/health':
+            body = b'ok'
+            self.send_response(200)
+            self.send_header('Content-Length', str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+        else:
+            self.send_error(404)
+    def log_message(self, format, *args):
+        pass
+if __name__ == '__main__':
+    port = int(sys.argv[1]) if len(sys.argv) > 1 else 8888
+    token = sys.argv[2] if len(sys.argv) > 2 else ''
+    server = http.server.HTTPServer(('127.0.0.1', port), UploadHandler)
+    server.upload_token = token
+    server.serve_forever()