npm - huaweicloud-devkit - Versions diffs - 1.0.2-next.2 → 1.0.2-next.21 - Mend

huaweicloud-devkit 1.0.2-next.2 → 1.0.2-next.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (96) hide show

package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md CHANGED Viewed

@@ -1,6 +1,6 @@
 ---
 name: huawei-vpc
-description: "Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration."
+description: 'Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration.'
 version: 1
 ---
@@ -18,50 +18,50 @@ Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet
 ## Critical Warnings
-| Trap | Why |
-|------|-----|
-| VPC CIDR cannot change | Once set, VPC CIDR block is immutable |
-| Security group stateful | SG rules are stateful. Return traffic auto-allowed |
-| Network ACL stateless | ACL rules must allow both inbound AND outbound |
-| EIP bills when idle | Unbound EIP still charges. Release when unused |
-| Subnet AZ binding | Subnet tied to single AZ. Cross-AZ needs multiple subnets |
-| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required |
-| **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |
-| **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |
-| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS IPs: cn-north-4 (100.125.1.250 / 100.125.1.251), cn-north-1 (100.125.1.250 / 100.125.129.250), cn-east-3 (100.125.1.250 / 100.125.129.250), ap-southeast-3 (100.125.1.250 / 100.125.128.250) |
-| SCP blocks 0.0.0.0/0 SG rules | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead |
-| **VPC tags use `*` separator** | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value` |
+| Trap                                  | Why                                                                                                                                                                                                                                                                                                                                                                                                |
+| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| VPC CIDR cannot change                | Once set, VPC CIDR block is immutable                                                                                                                                                                                                                                                                                                                                                              |
+| Security group stateful               | SG rules are stateful. Return traffic auto-allowed                                                                                                                                                                                                                                                                                                                                                 |
+| Network ACL stateless                 | ACL rules must allow both inbound AND outbound                                                                                                                                                                                                                                                                                                                                                     |
+| EIP bills when idle                   | Unbound EIP still charges. Release when unused                                                                                                                                                                                                                                                                                                                                                     |
+| Subnet AZ binding                     | Subnet tied to single AZ. Cross-AZ needs multiple subnets                                                                                                                                                                                                                                                                                                                                          |
+| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required                                                                                                                                                                                                                                                                                                                 |
+| **VPC params need nested prefix**     | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx`                                                                                                                                                                                                                                                                |
+| **Security group needs no vpc_id**    | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound                                                                                                                                                                                                                                                                                         |
+| Subnet DNS empty → ECS no DNS         | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS IPs: cn-north-4 (100.125.1.250 / 100.125.1.251), cn-north-1 (100.125.1.250 / 100.125.129.250), cn-east-3 (100.125.1.250 / 100.125.129.250), ap-southeast-3 (100.125.1.250 / 100.125.128.250) |
+| SCP blocks 0.0.0.0/0 SG rules         | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead                                                                                                                                                                                         |
+| **VPC tags use `*` separator**        | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value`                                                                                                                                                                                                                         |
 ## Common Workflows
-| Task | Command | Steps |
-|------|---------|-------|
-| Create VPC | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr> | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first |
-| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
-| Update subnet | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2> | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes |
-| Security group | hcloud VPC CreateSecurityGroup --security_group.name=<name> | references/security-group.md |
-| SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |
-| Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |
-| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
-| Unbind EIP | hcloud EIP DisassociatePublicip --publicip_id=<id> | references/eip.md |
-| Delete EIP | hcloud EIP DeletePublicip --publicip_id=<id> | references/eip.md |
-| List EIPs | hcloud EIP ListPublicips | |
-| NAT gateway | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id> | Run `hcloud NAT CreateNatGateway --help` for available spec values |
+| Task            | Command                                                                                                                                                                                                                                                    | Steps                                                                                                                |
+| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
+| Create VPC      | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr>                                                                                                                                                                                                   | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first                                           |
+| Create subnet   | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az>                                                  | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
+| Update subnet   | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2>                                                                                                                                                               | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes                             |
+| Security group  | hcloud VPC CreateSecurityGroup --security_group.name=<name>                                                                                                                                                                                                | references/security-group.md                                                                                         |
+| SG rule         | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md                                                                                         |
+| Create EIP      | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>                                                                                                                       | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region                                       |
+| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT                                                                                                                        | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id`                             |
+| Unbind EIP      | hcloud EIP DisassociatePublicip --publicip_id=<id>                                                                                                                                                                                                         | references/eip.md                                                                                                    |
+| Delete EIP      | hcloud EIP DeletePublicip --publicip_id=<id>                                                                                                                                                                                                               | references/eip.md                                                                                                    |
+| List EIPs       | hcloud EIP ListPublicips                                                                                                                                                                                                                                   |                                                                                                                      |
+| NAT gateway     | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id>                                                                                                                                     | Run `hcloud NAT CreateNatGateway --help` for available spec values                                                   |
 ## Troubleshooting
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Cannot reach instance | SG missing rule or no EIP -> Add SG rule / Bind EIP |
-| Subnet CIDR conflict | Overlapping with existing subnets -> Choose non-overlapping CIDR |
-| NAT gateway no internet | Route table missing default route -> Add 0.0.0.0/0 via NAT |
-| EIP quota exceeded | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10) |
-| EIP.7905 | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage |
-| VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |
-| EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
-| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help` |
-| VPC.0209: Subnet still used | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet |
-| SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |
+| Error                                              | Root Cause -> Fix                                                                                                                                                                                                                            |
+| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Cannot reach instance                              | SG missing rule or no EIP -> Add SG rule / Bind EIP                                                                                                                                                                                          |
+| Subnet CIDR conflict                               | Overlapping with existing subnets -> Choose non-overlapping CIDR                                                                                                                                                                             |
+| NAT gateway no internet                            | Route table missing default route -> Add 0.0.0.0/0 via NAT                                                                                                                                                                                   |
+| EIP quota exceeded                                 | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10)                                                                                                             |
+| EIP.7905                                           | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage                                                                                                                                                                 |
+| VPC.0301: Bandwidth name invalid                   | PER type requires `--bandwidth.name`, even though `--help` marks it optional                                                                                                                                                                 |
+| EIP has no public IP after binding                 | May need AddIngressEipV2 for ELB-type resources (see huawei-apig)                                                                                                                                                                            |
+| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help`      |
+| VPC.0209: Subnet still used                        | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet                                                                                                                                                               |
+| SYS.0403 / SCP deny                                | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |
 ## Security Considerations

package/plugins/huaweicloud-core/skills/huawei-vpc/references/network.md CHANGED Viewed

@@ -4,15 +4,16 @@
 Subnets without DNS configuration will fail cloud-init. Use these DNS addresses:
-| Region | Primary DNS | Secondary DNS |
-|--------|------------|---------------|
-| cn-north-1 | 100.125.1.250 | 100.125.129.250 |
-| cn-north-4 | 100.125.1.250 | 100.125.129.250 |
-| cn-east-3 | 100.125.1.250 | 100.125.129.250 |
-| cn-south-1 | 100.125.1.250 | 100.125.129.250 |
+| Region         | Primary DNS   | Secondary DNS   |
+| -------------- | ------------- | --------------- |
+| cn-north-1     | 100.125.1.250 | 100.125.129.250 |
+| cn-north-4     | 100.125.1.250 | 100.125.129.250 |
+| cn-east-3      | 100.125.1.250 | 100.125.129.250 |
+| cn-south-1     | 100.125.1.250 | 100.125.129.250 |
 | ap-southeast-3 | 100.125.1.250 | 100.125.129.250 |
 **Subnet create with DNS**:
 ```bash
 hcloud VPC CreateSubnet \
   --subnet.name=<name> \
@@ -28,12 +29,12 @@ hcloud VPC CreateSubnet \
 KooCLI 7.x VPC API requires nested prefixes:
-| Resource | Create Param Prefix | Example |
-|----------|---------------------|---------|
-| VPC | `--vpc.` | `--vpc.name=my-vpc --vpc.cidr=192.168.0.0/16` |
-| Subnet | `--subnet.` | `--subnet.name=web --subnet.vpc_id=<id> --subnet.cidr=192.168.1.0/24` |
-| Security Group | `--security_group.` | `--security_group.name=sg-web` |
-| SG Rule | `--security_group_rule.` | `--security_group_rule.direction=ingress` |
+| Resource       | Create Param Prefix      | Example                                                               |
+| -------------- | ------------------------ | --------------------------------------------------------------------- |
+| VPC            | `--vpc.`                 | `--vpc.name=my-vpc --vpc.cidr=192.168.0.0/16`                         |
+| Subnet         | `--subnet.`              | `--subnet.name=web --subnet.vpc_id=<id> --subnet.cidr=192.168.1.0/24` |
+| Security Group | `--security_group.`      | `--security_group.name=sg-web`                                        |
+| SG Rule        | `--security_group_rule.` | `--security_group_rule.direction=ingress`                             |
 ## EIP Management

package/plugins/huaweicloud-core/skills/huawei-vpc/references/security-group.md CHANGED Viewed

@@ -19,6 +19,7 @@ Security group params use `--security_group.` prefix. Rules use `--security_grou
 ## Create Security Group Rule
 Complete example with nested prefix:
 ```bash
 hcloud VPC CreateSecurityGroupRule \
   --security_group_rule.security_group_id=<sg-id> \
@@ -32,28 +33,28 @@ hcloud VPC CreateSecurityGroupRule \
 ## Stateful vs Stateless
-| Feature | Security Group | Network ACL |
-|---------|---------------|-------------|
-| Stateful? | Yes — return traffic auto-allowed | No — must allow both directions |
-| Applied to | ECS instance NIC | Subnet |
-| Rules | Allow only | Allow and Deny |
-| Default | Deny all inbound, allow all outbound | Allow all |
+| Feature    | Security Group                       | Network ACL                     |
+| ---------- | ------------------------------------ | ------------------------------- |
+| Stateful?  | Yes — return traffic auto-allowed    | No — must allow both directions |
+| Applied to | ECS instance NIC                     | Subnet                          |
+| Rules      | Allow only                           | Allow and Deny                  |
+| Default    | Deny all inbound, allow all outbound | Allow all                       |
 ## Common Rules Reference
-| Direction | Protocol | Port | Source | Purpose |
-|-----------|----------|------|--------|---------|
-| Ingress | TCP | 22 | <office-ip>/32 | SSH |
-| Ingress | TCP | 80 | 0.0.0.0/0 | HTTP |
-| Ingress | TCP | 443 | 0.0.0.0/0 | HTTPS |
-| Ingress | TCP | 3306 | <sg-app-id> | MySQL from app |
-| Ingress | TCP | 6379 | <sg-app-id> | Redis from app |
-| Egress | ALL | ALL | 0.0.0.0/0 | Outbound default |
+| Direction | Protocol | Port | Source         | Purpose          |
+| --------- | -------- | ---- | -------------- | ---------------- |
+| Ingress   | TCP      | 22   | <office-ip>/32 | SSH              |
+| Ingress   | TCP      | 80   | 0.0.0.0/0      | HTTP             |
+| Ingress   | TCP      | 443  | 0.0.0.0/0      | HTTPS            |
+| Ingress   | TCP      | 3306 | <sg-app-id>    | MySQL from app   |
+| Ingress   | TCP      | 6379 | <sg-app-id>    | Redis from app   |
+| Egress    | ALL      | ALL  | 0.0.0.0/0      | Outbound default |
 ## Common Errors
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| Cannot SSH | Default SG denies all inbound. Add port 22 rule |
-| Rule not effective | SG assigned to wrong instance. Verify NIC attachment |
-| `[USE_ERROR]不正确的参数:vpc_id` | Security groups don't need vpc_id. Remove it |
+| Error                            | Root Cause -> Fix                                    |
+| -------------------------------- | ---------------------------------------------------- |
+| Cannot SSH                       | Default SG denies all inbound. Add port 22 rule      |
+| Rule not effective               | SG assigned to wrong instance. Verify NIC attachment |
+| `[USE_ERROR]不正确的参数:vpc_id` | Security groups don't need vpc_id. Remove it         |

package/plugins/huaweicloud-core/skills/huawei-vpc/references/subnet.md CHANGED Viewed

@@ -26,25 +26,25 @@ hcloud VPC CreateSubnet --vpc_id=xxx
 ## Key Constraints
-| Constraint | Detail |
-|-----------|--------|
+| Constraint                | Detail                                                         |
+| ------------------------- | -------------------------------------------------------------- |
 | Subnet bound to single AZ | Cross-AZ needs multiple subnets. AZ code format: `cn-south-1a` |
-| CIDR must not overlap | Cannot overlap with other subnets in same VPC |
-| Gateway IP auto-assigned | Default is first IP in CIDR range (e.g., 192.168.1.1 for /24) |
-| 5 IPs reserved per subnet | First 4 + broadcast reserved by platform |
+| CIDR must not overlap     | Cannot overlap with other subnets in same VPC                  |
+| Gateway IP auto-assigned  | Default is first IP in CIDR range (e.g., 192.168.1.1 for /24)  |
+| 5 IPs reserved per subnet | First 4 + broadcast reserved by platform                       |
 ## Common Errors
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| `[USE_ERROR]不正确的参数:name` | Missing nested prefix. Use `--vpc.name=` or `--subnet.name=` |
-| CIDR overlap | Subnet CIDR must be within VPC CIDR and not overlap others |
-| AZ not found | Use `hcloud ECS NovaListAvailabilityZones --cli-region=<r>` to list valid AZ codes |
+| Error                          | Root Cause -> Fix                                                                  |
+| ------------------------------ | ---------------------------------------------------------------------------------- |
+| `[USE_ERROR]不正确的参数:name` | Missing nested prefix. Use `--vpc.name=` or `--subnet.name=`                       |
+| CIDR overlap                   | Subnet CIDR must be within VPC CIDR and not overlap others                         |
+| AZ not found                   | Use `hcloud ECS NovaListAvailabilityZones --cli-region=<r>` to list valid AZ codes |
 ## CIDR Planning Reference
-| Environment | VPC CIDR | Subnet CIDR |
-|------------|----------|-------------|
-| Dev | 192.168.0.0/16 | 192.168.1.0/24 |
-| Staging | 10.0.0.0/16 | 10.0.1.0/24 |
-| Production | 172.16.0.0/16 | 172.16.1.0/24 (public) + 172.16.2.0/24 (private) |
+| Environment | VPC CIDR       | Subnet CIDR                                      |
+| ----------- | -------------- | ------------------------------------------------ |
+| Dev         | 192.168.0.0/16 | 192.168.1.0/24                                   |
+| Staging     | 10.0.0.0/16    | 10.0.1.0/24                                      |
+| Production  | 172.16.0.0/16  | 172.16.1.0/24 (public) + 172.16.2.0/24 (private) |

package/plugins/huaweicloud-core/skills/huawei-waf-aad/SKILL.md CHANGED Viewed

@@ -1,6 +1,6 @@
 ---
 name: huawei-waf-aad
-description: "Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts)."
+description: 'Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts).'
 version: 1
 ---
@@ -16,25 +16,25 @@ Domain expertise for WAF and Anti-DDoS. Covers WAF policy/rules, AAD protection,
 ## Critical Warnings
-| Trap | Why |
-|------|-----|
-| WAF needs CNAME redirect | DNS must point to WAF endpoint, not server IP |
-| Premium instance required | Cloud WAF needs a dedicated/premium WAF instance |
+| Trap                       | Why                                                               |
+| -------------------------- | ----------------------------------------------------------------- |
+| WAF needs CNAME redirect   | DNS must point to WAF endpoint, not server IP                     |
+| Premium instance required  | Cloud WAF needs a dedicated/premium WAF instance                  |
 | AAD Standard vs Enterprise | Standard protects single IP. Enterprise protects entire IP ranges |
-| Rule order matters | WAF rules evaluated top-to-bottom within a policy |
+| Rule order matters         | WAF rules evaluated top-to-bottom within a policy                 |
 ## Common Workflows
 ### WAF
-| Task | Operation |
-|------|-----------|
-| List WAF instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| List policies | `ListPolicies --cli-region=<r> --project_id=<p>` |
-| Create custom rule | `BatchCreateCustomRule --cli-region=<r> --project_id=<p>` |
+| Task                | Operation                                                       |
+| ------------------- | --------------------------------------------------------------- |
+| List WAF instances  | `ListInstances --cli-region=<r> --project_id=<p>`               |
+| List policies       | `ListPolicies --cli-region=<r> --project_id=<p>`                |
+| Create custom rule  | `BatchCreateCustomRule --cli-region=<r> --project_id=<p>`       |
 | Create IP blacklist | `BatchCreateWhiteblackipRule --cli-region=<r> --project_id=<p>` |
-| Create CC rule | `BatchCreateCcRule --cli-region=<r> --project_id=<p>` |
-| Create geo rule | `BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>` |
+| Create CC rule      | `BatchCreateCcRule --cli-region=<r> --project_id=<p>`           |
+| Create geo rule     | `BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>`        |
 ### AAD
@@ -45,11 +45,11 @@ hcloud AAD CreateInstance --cli-region=<r> --project_id=<p>
 ## Troubleshooting
-| Error | Fix |
-|-------|-----|
-| Website unreachable after WAF | Check CNAME record points to WAF endpoint |
-| WAF blocking legitimate traffic | Check rules order, adjust false positive settings |
-| AAD not responding | Standard AAD only protects single EIP. Check EIP binding |
+| Error                           | Fix                                                      |
+| ------------------------------- | -------------------------------------------------------- |
+| Website unreachable after WAF   | Check CNAME record points to WAF endpoint                |
+| WAF blocking legitimate traffic | Check rules order, adjust false positive settings        |
+| AAD not responding              | Standard AAD only protects single EIP. Check EIP binding |
 ## Security

package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/SKILL.md CHANGED Viewed

@@ -11,12 +11,12 @@ Use this skill when the deliverable is application code, API integration, or pre
 ## Critical Warnings
-| Trap | Why |
-|------|-----|
-| `project_id` in path for most services | Many Huawei Cloud APIs require `project_id` in the URL path. Get it from IAM or KooCLI profile |
-| Pagination is not automatic | APIs return paginated results. Always check for `next_marker` or `page_info` to avoid partial data |
-| AK/SK signing algorithm | Huawei Cloud uses HMAC-SHA256 signing with specific header ordering. Use SDK, don't implement manually |
-| Endpoint varies by service and region | Always verify at https://developer.huaweicloud.com/endpoint |
+| Trap                                     | Why                                                                                                       |
+| ---------------------------------------- | --------------------------------------------------------------------------------------------------------- |
+| `project_id` in path for most services   | Many Huawei Cloud APIs require `project_id` in the URL path. Get it from IAM or KooCLI profile            |
+| Pagination is not automatic              | APIs return paginated results. Always check for `next_marker` or `page_info` to avoid partial data        |
+| AK/SK signing algorithm                  | Huawei Cloud uses HMAC-SHA256 signing with specific header ordering. Use SDK, don't implement manually    |
+| Endpoint varies by service and region    | Always verify at https://developer.huaweicloud.com/endpoint                                               |
 | Error response in `body` not HTTP status | Many errors return HTTP 200 with error details in the JSON body. Check `error_code` or `error_msg` fields |
 ## API Workflow
@@ -38,13 +38,13 @@ Use this skill when the deliverable is application code, API integration, or pre
 ## Troubleshooting
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| Invalid project_id | Wrong or missing project_id in URL path. Use `hcloud IAM KeystoneListProjects` or KooCLI profile |
-| 401/AuthFailure | Expired AK/SK or wrong signing algorithm. Regenerate AK/SK or check SDK version |
-| 403/Forbidden | IAM permission missing. Check user/role has required action permissions |
-| Empty results | Pagination missing — add `limit` and check `marker` |
-| Endpoint not reachable | Wrong region/service endpoint. Verify at developer.huaweicloud.com/endpoint |
+| Error                  | Root Cause -> Fix                                                                                |
+| ---------------------- | ------------------------------------------------------------------------------------------------ |
+| Invalid project_id     | Wrong or missing project_id in URL path. Use `hcloud IAM KeystoneListProjects` or KooCLI profile |
+| 401/AuthFailure        | Expired AK/SK or wrong signing algorithm. Regenerate AK/SK or check SDK version                  |
+| 403/Forbidden          | IAM permission missing. Check user/role has required action permissions                          |
+| Empty results          | Pagination missing — add `limit` and check `marker`                                              |
+| Endpoint not reachable | Wrong region/service endpoint. Verify at developer.huaweicloud.com/endpoint                      |
 ## Terraform Priority

package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/agents/openai.yaml CHANGED Viewed

@@ -1,4 +1,4 @@
 interface:
-  display_name: "Huawei Cloud API And SDK"
-  short_description: "Build correct Huawei Cloud API requests and SDK integrations."
-  default_prompt: "Use $huaweicloud-api-and-sdk to plan this Huawei Cloud API or SDK integration."
+  display_name: 'Huawei Cloud API And SDK'
+  short_description: 'Build correct Huawei Cloud API requests and SDK integrations.'
+  default_prompt: 'Use $huaweicloud-api-and-sdk to plan this Huawei Cloud API or SDK integration.'

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md CHANGED Viewed

@@ -5,7 +5,6 @@ description: Discover Huawei Cloud capabilities for an agent task. Use when the
 # Huawei Cloud Capability Discovery
 **STOP - Do not answer from general knowledge.** Follow the procedure below.
 Use this skill to turn vague developer intent into a precise Huawei Cloud capability path.
@@ -21,6 +20,23 @@ Use this skill to turn vague developer intent into a precise Huawei Cloud capabi
 7. Prefer MCP only when an approved Huawei Cloud MCP tool exists for the needed operation.
 8. Treat Terraform as a secondary V1 path for reviewed IaC, not the default.
 9. When no built-in devkit skill matches, browse the community skill marketplace at https://github.com/huaweicloud/huaweicloud-skills. Fetch the index from https://raw.githubusercontent.com/huaweicloud/huaweicloud-skills/master/skills-index/index.json.
+10. When the deliverable is a PPT, architecture diagram (draw.io), or frontend page that needs official Huawei Cloud service logos, use the `huaweicloud_get_service_icon` MCP tool to get logo URLs from the official Icons library instead of guessing or hotlinking unofficial images.
+## Scenario Routing
+Match the scenario before picking a service. For "deploy a web app" requests, layer the recommendation instead of defaulting to a production service:
+| Scenario                                                             | Recommended path                                                                             |
+| -------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
+| hello world / prototype / demo / temporary preview (free, quick try) | `huawei-sandbox` first — temporary runtime + public URL, ~8h validity, zero billed resources |
+| production / long-term / custom domain / high availability           | `huawei-functiongraph` / `huawei-ecs` (or `huawei-cce` for containers)                       |
+Route to the sandbox when the developer signals free/quick preview intent ("免费", "快速", "预览", "hello world", "原型", "演示"); route to production services only when production-grade hosting is explicitly required.
+## Official Service Logos
+- Use `huaweicloud_get_service_icon` with the service name, alias, or Chinese name (e.g. `ecs`, `obs`, `modelarts`, `对象存储`). It returns the official CDN logo URL (`logo.source_url`), category, and product page link from https://open.huaweicloud.com/openplatform/icons.html.
+- Prefer `logo.source_url` for web deliverables and the Icons library search page for browsing; do not scrape logos from third-party sites.
 ## Deployment Target Options

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/agents/openai.yaml CHANGED Viewed

@@ -1,4 +1,4 @@
 interface:
-  display_name: "Huawei Cloud Capability Discovery"
-  short_description: "Find the right Huawei Cloud capability path for a developer task."
-  default_prompt: "Use $huaweicloud-capability-discovery to route this scenario to Huawei Cloud capabilities."
+  display_name: 'Huawei Cloud Capability Discovery'
+  short_description: 'Find the right Huawei Cloud capability path for a developer task.'
+  default_prompt: 'Use $huaweicloud-capability-discovery to route this scenario to Huawei Cloud capabilities.'

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md CHANGED Viewed

@@ -5,7 +5,6 @@ description: Safe Huawei Cloud KooCLI usage and authentication guidance. Use whe
 # Huawei Cloud CLI And Auth
 **STOP - Do not answer from general knowledge.** Follow the procedure below.
 Use KooCLI `hcloud` for local inspection and reviewed operations. Never ask the user to paste AK/SK, SK, tokens, passwords, or credential files into chat.
@@ -15,16 +14,21 @@ Use KooCLI `hcloud` for local inspection and reviewed operations. Never ask the
 Official guide: `https://support.huaweicloud.com/qs-hcli/hcli_02_003.html`.
 ### Windows
 1. Download and unzip: `https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-windows-amd64.zip`
 2. Extract to `%USERPROFILE%\hcloud`, add to user `PATH`
 3. Verify: `hcloud version`
 ### Linux (amd64 / arm64)
 One-liner (recommended):
 ```bash
 curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
 ```
 Or manual download:
 ```bash
 # amd64
 curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-amd64.tar.gz"
@@ -33,15 +37,20 @@ tar -zxvf huaweicloud-cli-linux-amd64.tar.gz
 curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-arm64.tar.gz"
 tar -zxvf huaweicloud-cli-linux-arm64.tar.gz
 ```
 Move to PATH: `mv $(pwd)/hcloud ~/.local/bin/`
 Verify: `hcloud version`
 ### macOS (amd64 / arm64)
 One-liner (recommended):
 ```bash
 curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
 ```
 Or manual download:
 ```bash
 # amd64
 curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-amd64.tar.gz"
@@ -50,6 +59,7 @@ tar -zxvf huaweicloud-cli-mac-amd64.tar.gz
 curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-arm64.tar.gz"
 tar -zxvf huaweicloud-cli-mac-arm64.tar.gz
 ```
 Move to PATH: `mv $(pwd)/hcloud /usr/local/bin/`
 Verify: `hcloud version`
@@ -111,8 +121,24 @@ hcloud <Service> <ListOp> --cli-output=json --cli-query "items[?status=='ACTIVE'
 hcloud <Service> <Op> --cli-debug=true
 ```
+## Credential Resolution Priority
+Credentials are resolved in this order (highest priority first):
+| Priority | Source                  | Mechanism                                                  | Persistence                     |
+| -------- | ----------------------- | ---------------------------------------------------------- | ------------------------------- |
+| 1        | Runtime credentials     | `huaweicloud_auth_init` tool                               | Memory (cleared on MCP restart) |
+| 2        | Environment variables   | `HW_ACCESS_KEY` / `HW_SECRET_KEY`                          | MCP process lifetime            |
+| 3        | CodeArts project config | `.codeartsdoer/mcp/mcp_settings.json` (project, then user) | File                            |
+| 4        | Global config file      | `~/.config/huaweicloud/credentials.json`                   | Permanent                       |
+| 5        | KooCLI profile          | `~/.hcloud/config.json` (KooCLI only)                      | Permanent                       |
+When switching accounts within the same Agent session, use `huaweicloud_auth_init` to set runtime credentials. This overrides all other sources for the current MCP process.
 ## Preferred Toolkit Tools
+- `huaweicloud_auth_init`
+- `huaweicloud_auth_status`
 - `huaweicloud_check_cli`
 - `huaweicloud_show_profile_redacted`
 - `huaweicloud_plan_cli_command`

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/agents/openai.yaml CHANGED Viewed

@@ -1,4 +1,4 @@
 interface:
-  display_name: "Huawei Cloud CLI And Auth"
-  short_description: "Use KooCLI safely without exposing credentials."
-  default_prompt: "Use $huaweicloud-cli-and-auth to check KooCLI setup safely."
+  display_name: 'Huawei Cloud CLI And Auth'
+  short_description: 'Use KooCLI safely without exposing credentials.'
+  default_prompt: 'Use $huaweicloud-cli-and-auth to check KooCLI setup safely.'