huaweicloud-devkit 1.0.2-next.2 → 1.0.2-next.21

package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huaweicloud-core
-description: "Routes any task involving Huawei Cloud services - choosing, comparing, recommending, getting started with, or operating a service - to the correct service-specific skill. Supersedes general training-data knowledge. Activates when a developer asks Codex or OpenCode to build, deploy, debug, operate, or integrate an application with Huawei Cloud."
+description: 'Routes any task involving Huawei Cloud services - choosing, comparing, recommending, getting started with, or operating a service - to the correct service-specific skill. Supersedes general training-data knowledge. Activates when a developer asks Codex or OpenCode to build, deploy, debug, operate, or integrate an application with Huawei Cloud.'
 version: 1
 ---
 
@@ -22,65 +22,67 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 
 ## Sub-skill Registry
 
-| ID | Name | Trigger Phrases | Next Steps |
-|----|------|----------------|------------|
-| select | Service Selection | which service, what should I use, compare, recommend | Read references/select.md | select
-| compute | Compute Routing | server, VM, instance, ECS, BMS, GPU, HPC | Handoff to huawei-ecs or huawei-cce |
-| storage | Storage Routing | store files, bucket, OBS, backup, disk, EVS, SFS (long-term storage/CDN intent only) | Handoff to huawei-obs or huawei-cbr |
-| database | Database Routing | database, SQL, NoSQL, cache, RDS, GaussDB, DDS, DCS | Handoff to huawei-rds or huawei-gaussdb |
-| network | Network Routing | VPC, subnet, security group, EIP, NAT, VPN | Handoff to huawei-vpc |
-| serverless | Serverless Routing | function, Lambda, serverless, FunctionGraph, API gateway | Handoff to huawei-functiongraph or huawei-apig |
-| ai | AI/ML Routing | AI, model, LLM, Pangu, training, inference, RAG | Handoff to huawei-modelarts |
-| messaging | Messaging Routing | message queue, notification, Kafka, RabbitMQ, event, SMN | Handoff to huawei-smn-dms |
-| security | Security Routing | secret, credential, encrypt, KMS, WAF, firewall, DDoS | Handoff to huawei-dew or huawei-waf-aad |
-| observability | Observability Routing | monitor, alarm, log, audit, trace, Cloud Eye | Handoff to huawei-cloud-eye or huawei-cts |
-| billing | Billing Routing | cost, bill, budget, spending, invoice | Handoff to huawei-billing |
-| iam | IAM Routing | permission, policy, role, user, group, AK/SK | Handoff to huawei-iam |
-| deployment | Deployment Routing | deploy, host, publish, CI/CD, pipeline, release | CI/CD pipeline -> huawei-deployment; deploy/host/preview a web app or static website (no CI/CD target) -> present deployment-target options first, see "Deployment Target Options" below |
-| sandbox | Sandbox Routing | sandbox, DevStation, workspace, terminal, preview, temporary runtime | Handoff to huawei-sandbox |
-| cli | CLI and Auth Routing | install hcloud, configure KooCLI, AK/SK setup | Handoff to huaweicloud-cli-and-auth |
-| safety | Safety Routing | is this safe, approve command, risk review | Handoff to huaweicloud-safety |
-| troubleshoot | Troubleshooting Routing | error, bug, failed, AccessDenied, quota | Handoff to huaweicloud-troubleshooting |
-| api-sdk | API/SDK Routing | API call, SDK, REST, integration, code example | Handoff to huaweicloud-api-and-sdk |
-| report-issue | Issue Reporting | wrong service, you picked wrong, incorrect | Read references/report-issue.md |
+| ID            | Name                    | Trigger Phrases                                                                      | Next Steps                                                                                                                                                                               |
+| ------------- | ----------------------- | ------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| select        | Service Selection       | which service, what should I use, compare, recommend                                 | Read references/select.md                                                                                                                                                                | select |
+| compute       | Compute Routing         | server, VM, instance, ECS, BMS, GPU, HPC                                             | Handoff to huawei-ecs or huawei-cce                                                                                                                                                      |
+| storage       | Storage Routing         | store files, bucket, OBS, backup, disk, EVS, SFS (long-term storage/CDN intent only) | Handoff to huawei-obs or huawei-cbr                                                                                                                                                      |
+| database      | Database Routing        | database, SQL, NoSQL, cache, RDS, GaussDB, DDS, DCS                                  | Handoff to huawei-rds or huawei-gaussdb                                                                                                                                                  |
+| network       | Network Routing         | VPC, subnet, security group, EIP, NAT, VPN                                           | Handoff to huawei-vpc                                                                                                                                                                    |
+| serverless    | Serverless Routing      | function, Lambda, serverless, FunctionGraph, API gateway                             | Handoff to huawei-functiongraph or huawei-apig                                                                                                                                           |
+| ai            | AI/ML Routing           | AI, model, LLM, Pangu, training, inference, RAG                                      | Handoff to huawei-modelarts                                                                                                                                                              |
+| messaging     | Messaging Routing       | message queue, notification, Kafka, RabbitMQ, event, SMN                             | Handoff to huawei-smn-dms                                                                                                                                                                |
+| security      | Security Routing        | secret, credential, encrypt, KMS, WAF, firewall, DDoS                                | Handoff to huawei-dew or huawei-waf-aad                                                                                                                                                  |
+| observability | Observability Routing   | monitor, alarm, log, audit, trace, Cloud Eye                                         | Handoff to huawei-cloud-eye or huawei-cts                                                                                                                                                |
+| billing       | Billing Routing         | cost, bill, budget, spending, invoice                                                | Handoff to huawei-billing                                                                                                                                                                |
+| iam           | IAM Routing             | permission, policy, role, user, group, AK/SK                                         | Handoff to huawei-iam                                                                                                                                                                    |
+| deployment    | Deployment Routing      | deploy, host, publish, CI/CD, pipeline, release                                      | CI/CD pipeline -> huawei-deployment; deploy/host/preview a web app or static website (no CI/CD target) -> present deployment-target options first, see "Deployment Target Options" below |
+| sandbox       | Sandbox Routing         | sandbox, DevStation, workspace, terminal, preview, temporary runtime                 | Handoff to huawei-sandbox                                                                                                                                                                |
+| cli           | CLI and Auth Routing    | install hcloud, configure KooCLI, AK/SK setup                                        | Handoff to huaweicloud-cli-and-auth                                                                                                                                                      |
+| safety        | Safety Routing          | is this safe, approve command, risk review                                           | Handoff to huaweicloud-safety                                                                                                                                                            |
+| troubleshoot  | Troubleshooting Routing | error, bug, failed, AccessDenied, quota                                              | Handoff to huaweicloud-troubleshooting                                                                                                                                                   |
+| api-sdk       | API/SDK Routing         | API call, SDK, REST, integration, code example                                       | Handoff to huaweicloud-api-and-sdk                                                                                                                                                       |
+| report-issue  | Issue Reporting         | wrong service, you picked wrong, incorrect                                           | Read references/report-issue.md                                                                                                                                                          |
 
 ## Service Map
 
-| Workload | Primary Service | Skill |
-|----------|----------------|-------|
-| Web application hosting | ECS | huawei-ecs |
-| Containerized microservices | CCE | huawei-cce |
-| Static file storage / CDN (long-term) | OBS | huawei-obs |
-| Relational database (MySQL/PG) | RDS | huawei-rds |
-| Distributed SQL database | GaussDB | huawei-gaussdb |
-| Document database (MongoDB API) | DDS | huawei-dds-dcs |
-| In-memory cache | DCS (Redis) | huawei-dds-dcs |
-| Serverless functions | FunctionGraph | huawei-functiongraph |
-| API management | APIG | huawei-apig |
-| AI model training/inference | ModelArts | huawei-modelarts |
-| Message queuing | DMS (Kafka/RabbitMQ) | huawei-smn-dms |
-| Push notifications | SMN | huawei-smn-dms |
-| Secret management | DEW (CSMS) | huawei-dew |
-| Key management | DEW (KMS) | huawei-dew |
-| DDoS protection | AAD | huawei-waf-aad |
-| Web firewall | WAF | huawei-waf-aad |
-| Monitoring dashboards | Cloud Eye (CES) | huawei-cloud-eye |
-| Audit trails | CTS | huawei-cts |
-| Backup / disaster recovery | CBR | huawei-cbr |
-| CI/CD pipeline | CloudDeploy | huawei-deployment |
-| Temporary runtime / web app preview | Sandbox (DevStation) | huawei-sandbox |
-| Getting started | Account setup | huaweicloud-cli-and-auth |
+| Workload                                         | Primary Service      | Skill                    |
+| ------------------------------------------------ | -------------------- | ------------------------ |
+| Web application hosting (production / long-term) | ECS                  | huawei-ecs               |
+| Containerized microservices                      | CCE                  | huawei-cce               |
+| Static file storage / CDN (long-term)            | OBS                  | huawei-obs               |
+| Relational database (MySQL/PG)                   | RDS                  | huawei-rds               |
+| Distributed SQL database                         | GaussDB              | huawei-gaussdb           |
+| Document database (MongoDB API)                  | DDS                  | huawei-dds-dcs           |
+| In-memory cache                                  | DCS (Redis)          | huawei-dds-dcs           |
+| Serverless functions                             | FunctionGraph        | huawei-functiongraph     |
+| API management                                   | APIG                 | huawei-apig              |
+| AI model training/inference                      | ModelArts            | huawei-modelarts         |
+| Message queuing                                  | DMS (Kafka/RabbitMQ) | huawei-smn-dms           |
+| Push notifications                               | SMN                  | huawei-smn-dms           |
+| Secret management                                | DEW (CSMS)           | huawei-dew               |
+| Key management                                   | DEW (KMS)            | huawei-dew               |
+| DDoS protection                                  | AAD                  | huawei-waf-aad           |
+| Web firewall                                     | WAF                  | huawei-waf-aad           |
+| Monitoring dashboards                            | Cloud Eye (CES)      | huawei-cloud-eye         |
+| Audit trails                                     | CTS                  | huawei-cts               |
+| Backup / disaster recovery                       | CBR                  | huawei-cbr               |
+| CI/CD pipeline                                   | CloudDeploy          | huawei-deployment        |
+| Temporary runtime / web app preview              | Sandbox (DevStation) | huawei-sandbox           |
+| Getting started                                  | Account setup        | huaweicloud-cli-and-auth |
+
+**Web app scenario layering**: for "deploy a web app", prefer `huawei-sandbox` for free/quick try (hello world, prototype, demo, temporary preview — temporary runtime + public URL, ~8h validity, zero billed resources); route to `huawei-functiongraph` / `huawei-ecs` (or `huawei-cce`) for production / long-term / custom-domain / high-availability hosting.
 
 ## Deployment Target Options
 
 When the intent is to **deploy, host, or preview a web app or static website** (no explicit target named), NEVER default to a single service such as OBS. Ask the developer to choose a target and present the options in this order:
 
-| # | Option | When to choose | Skill |
-|---|--------|----------------|-------|
-| 1 | **Sandbox (DevStation) — recommended** | Temporary runtime, quick preview, demo; instant public URL | huawei-sandbox |
-| 2 | OBS static website hosting | Long-term static hosting / CDN, no backend | huawei-obs |
-| 3 | ECS | Needs a server runtime (backend, custom server) | huawei-ecs |
-| 4 | CCE | Containerized workloads, scaling | huawei-cce |
+| #   | Option                                 | When to choose                                             | Skill          |
+| --- | -------------------------------------- | ---------------------------------------------------------- | -------------- |
+| 1   | **Sandbox (DevStation) — recommended** | Temporary runtime, quick preview, demo; instant public URL | huawei-sandbox |
+| 2   | OBS static website hosting             | Long-term static hosting / CDN, no backend                 | huawei-obs     |
+| 3   | ECS                                    | Needs a server runtime (backend, custom server)            | huawei-ecs     |
+| 4   | CCE                                    | Containerized workloads, scaling                           | huawei-cce     |
 
 - Recommended prompt: "这个项目是 Web 应用/静态网站，建议优先部署到沙箱（临时运行环境，立即可预览）。也可选择 OBS 静态托管、ECS 或 CCE，你想部署到哪里？"
 - If the developer explicitly names a target (e.g. "deploy to OBS"), follow that target and hand off to the corresponding service skill.
@@ -100,6 +102,7 @@ When the intent is to **deploy, host, or preview a web app or static website** (
 
 - Use huaweicloud_search_docs to discover skills covering a topic
 - Use huaweicloud_retrieve_skill to load a full SKILL.md after routing
+- Use huaweicloud_auth_init to switch credentials at runtime when different accounts co-exist in the same session
 - If no built-in skill matches, consult huaweicloud-capability-discovery for external marketplace options
 - Use huaweicloud_list_regions before creating regional resources
 - Use huaweicloud_get_regional_availability when unsure about service-region pairs
@@ -108,4 +111,4 @@ When the intent is to **deploy, host, or preview a web app or static website** (
 
 ## Quality Bar
 
-Prefer short, precise instructions with commands the developer can run. Give source names and exact fields to verify. Avoid inventing service behavior. When uncertain, route to Huawei Cloud Skills or official API/SDK documentation.
+Prefer short, precise instructions with commands the developer can run. Give source names and exact fields to verify. Avoid inventing service behavior. When uncertain, route to Huawei Cloud Skills or official API/SDK documentation.

package/plugins/huaweicloud-core/skills/huaweicloud-core/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
-  display_name: "Huawei Cloud Core"
-  short_description: "Route Huawei Cloud tasks to Skills, CLI, API, SDK, MCP, or Terraform."
-  default_prompt: "Use $huaweicloud-core to choose the right Huawei Cloud capability path."
+  display_name: 'Huawei Cloud Core'
+  short_description: 'Route Huawei Cloud tasks to Skills, CLI, API, SDK, MCP, or Terraform.'
+  default_prompt: 'Use $huaweicloud-core to choose the right Huawei Cloud capability path.'

package/plugins/huaweicloud-core/skills/huaweicloud-core/references/report-issue.md

@@ -12,9 +12,9 @@ Use when the user reports an issue with a previous routing decision.
 
 ## Common Corrections
 
-| Wrong Routing | Likely Correct |
-|---------------|---------------|
-| ECS for containers | CCE |
-| OBS for block storage | EVS (via huawei-ecs) |
-| RDS for cache | DCS (via huawei-dds-dcs) |
-| FunctionGraph for long-running tasks | ECS or CCE |
+| Wrong Routing                        | Likely Correct           |
+| ------------------------------------ | ------------------------ |
+| ECS for containers                   | CCE                      |
+| OBS for block storage                | EVS (via huawei-ecs)     |
+| RDS for cache                        | DCS (via huawei-dds-dcs) |
+| FunctionGraph for long-running tasks | ECS or CCE               |

package/plugins/huaweicloud-core/skills/huaweicloud-core/references/select.md

@@ -17,12 +17,26 @@ Use when the user asks which service to use or compares services.
 ## Example: I need a database
 
 Ask:
+
 - What type of data? Structured (tables) or flexible (documents)?
 - What scale? Small app or enterprise?
 - Do you need SQL queries?
 
 Route based on answers:
+
 - SQL + standard scale -> huawei-rds
 - SQL + massive scale / distributed -> huawei-gaussdb
 - Document model (MongoDB-compatible) -> huawei-dds-dcs
-- Cache / key-value -> huawei-dds-dcs (DCS)
+- Cache / key-value -> huawei-dds-dcs (DCS)
+
+## Example: I need to deploy a web app
+
+Ask:
+
+- Is this a quick try / prototype / demo / temporary preview (free)?
+- Or production (long-term, custom domain, high availability)?
+
+Route by scenario:
+
+- Free / quick try / prototype / demo / temporary preview -> huawei-sandbox (temporary runtime + public URL, ~8h validity, zero billed resources)
+- Production / long-term / custom domain / high availability -> huawei-functiongraph / huawei-ecs (or huawei-cce for containers)

package/plugins/huaweicloud-core/skills/huaweicloud-safety/SKILL.md

@@ -5,7 +5,6 @@ description: Huawei Cloud safety policy for agents. Use when handling credential
 
 # Huawei Cloud Safety
 
-
 **STOP - Do not answer from general knowledge.** Follow the procedure below.
 
 Use this skill before any Huawei Cloud action that may expose secrets, change resources, affect cost, change IAM, or expose a network endpoint.

package/plugins/huaweicloud-core/skills/huaweicloud-safety/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
-  display_name: "Huawei Cloud Safety"
-  short_description: "Keep Huawei Cloud agent operations safe and redacted."
-  default_prompt: "Use $huaweicloud-safety to review this Huawei Cloud operation."
+  display_name: 'Huawei Cloud Safety'
+  short_description: 'Keep Huawei Cloud agent operations safe and redacted.'
+  default_prompt: 'Use $huaweicloud-safety to review this Huawei Cloud operation.'

package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/SKILL.md

@@ -11,12 +11,12 @@ Use evidence before fixes. Do not guess service behavior when request IDs, regio
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Error in response body, not HTTP status | Many APIs return HTTP 200 with error in JSON body. Always check `error_code` and `error_msg` |
-| Missing `project_id` is common | New users often omit project_id from API path or CLI. Get it from `IAM KeystoneListProjects` |
-| Sandbox may block hcloud | OpenCode/Codex sandbox can block hcloud metadata files in `~/.hcloud/`. Use `dangerouslyDisableSandbox` or Bash tool |
-| KooCLI param prefix varies | VPC params need `--vpc.x`, ECS params need `--server.x`, ALWAYS check `--help` first |
+| Trap                                    | Why                                                                                                                  |
+| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
+| Error in response body, not HTTP status | Many APIs return HTTP 200 with error in JSON body. Always check `error_code` and `error_msg`                         |
+| Missing `project_id` is common          | New users often omit project_id from API path or CLI. Get it from `IAM KeystoneListProjects`                         |
+| Sandbox may block hcloud                | OpenCode/Codex sandbox can block hcloud metadata files in `~/.hcloud/`. Use `dangerouslyDisableSandbox` or Bash tool |
+| KooCLI param prefix varies              | VPC params need `--vpc.x`, ECS params need `--server.x`, ALWAYS check `--help` first                                 |
 
 ## Workflow
 
@@ -36,42 +36,42 @@ Use evidence before fixes. Do not guess service behavior when request IDs, regio
 
 ## Common Checks
 
-| Check | Command |
-|-------|---------|
-| Authentication | `hcloud configure list` (redacted) |
-| Region | Match CLI region, endpoint, and resource region |
-| Project ID | `hcloud IAM KeystoneListProjects` |
-| Pagination | Add `--limit=100` and check `marker` |
-| Quota | Check service quotas in console or API |
+| Check          | Command                                                       |
+| -------------- | ------------------------------------------------------------- |
+| Authentication | `hcloud configure list` (redacted)                            |
+| Region         | Match CLI region, endpoint, and resource region               |
+| Project ID     | `hcloud IAM KeystoneListProjects`                             |
+| Pagination     | Add `--limit=100` and check `marker`                          |
+| Quota          | Check service quotas in console or API                        |
 | IAM Permission | Verify user/role has required action — see `huawei-iam` skill |
-| KooCLI version | `hcloud version` |
+| KooCLI version | `hcloud version`                                              |
 
 ## Common Error Codes
 
-| Error | Likely Cause | Fix |
-|-------|-------------|-----|
-| AuthFailure / 401 | AK/SK invalid or expired | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init` |
-| AccessDenied / 403 | IAM permission missing | Check `huawei-iam` skill, add required policy action |
-| NoSuchKey / 404 | Resource not found | Verify resource ID, region, and project_id |
-| QuotaExceeded | Account limit reached | Request quota increase in console |
-| [USE_ERROR] 不正确的参数 | Wrong param name | Run `--help`, check `--param=value` format and nested prefix |
-| Ecs.0005 | Flavor-image mismatch | Check image `__support_*` against flavor virtualization type |
-| FSS.0400 | FunctionGraph latest version error | Strip `:latest` from function URN |
-| FSS.1417 | DEDICATEDGATEWAY missing params | Add instance_id, group_id, protocol, env_name, env_id |
-| APIC.7201 | Missing security_group_id | Add `--security_group_id` param for APIG CreateInstanceV2 |
-| [NETWORK_ERROR] | Transient network failure | Retry with `maxRetries` param or wait and retry |
+| Error                    | Likely Cause                       | Fix                                                          |
+| ------------------------ | ---------------------------------- | ------------------------------------------------------------ |
+| AuthFailure / 401        | AK/SK invalid or expired           | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init`  |
+| AccessDenied / 403       | IAM permission missing             | Check `huawei-iam` skill, add required policy action         |
+| NoSuchKey / 404          | Resource not found                 | Verify resource ID, region, and project_id                   |
+| QuotaExceeded            | Account limit reached              | Request quota increase in console                            |
+| [USE_ERROR] 不正确的参数 | Wrong param name                   | Run `--help`, check `--param=value` format and nested prefix |
+| Ecs.0005                 | Flavor-image mismatch              | Check image `__support_*` against flavor virtualization type |
+| FSS.0400                 | FunctionGraph latest version error | Strip `:latest` from function URN                            |
+| FSS.1417                 | DEDICATEDGATEWAY missing params    | Add instance_id, group_id, protocol, env_name, env_id        |
+| APIC.7201                | Missing security_group_id          | Add `--security_group_id` param for APIG CreateInstanceV2    |
+| [NETWORK_ERROR]          | Transient network failure          | Retry with `maxRetries` param or wait and retry              |
 
 ## KooCLI Error Types
 
 KooCLI classifies errors into 5 types. The error type prefix in the message guides initial diagnosis:
 
-| Type | Meaning | First Check |
-|------|---------|-------------|
-| `[NETWORK_ERROR]` | HTTP request exception | Network connectivity, firewall, endpoint reachability |
-| `[CLI_ERROR]` | KooCLI internal error | Contact KooCLI support |
-| `[USE_ERROR]` | Incorrect command parameters | Run `--help`, check param names and format |
-| `[OPENAPI_ERROR]` | Cloud service API error | Check service docs, contact service support |
-| `[APIE_ERROR]` | API Explorer metadata error | Contact API Explorer support |
+| Type              | Meaning                      | First Check                                           |
+| ----------------- | ---------------------------- | ----------------------------------------------------- |
+| `[NETWORK_ERROR]` | HTTP request exception       | Network connectivity, firewall, endpoint reachability |
+| `[CLI_ERROR]`     | KooCLI internal error        | Contact KooCLI support                                |
+| `[USE_ERROR]`     | Incorrect command parameters | Run `--help`, check param names and format            |
+| `[OPENAPI_ERROR]` | Cloud service API error      | Check service docs, contact service support           |
+| `[APIE_ERROR]`    | API Explorer metadata error  | Contact API Explorer support                          |
 
 Enable debug with `--cli-debug=true` to see the underlying HTTP request/response and pinpoint network or endpoint issues.
 

package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
-  display_name: "Huawei Cloud Troubleshooting"
-  short_description: "Diagnose Huawei Cloud errors using evidence and read-only checks."
-  default_prompt: "Use $huaweicloud-troubleshooting to diagnose this Huawei Cloud error."
+  display_name: 'Huawei Cloud Troubleshooting'
+  short_description: 'Diagnose Huawei Cloud errors using evidence and read-only checks.'
+  default_prompt: 'Use $huaweicloud-troubleshooting to diagnose this Huawei Cloud error.'

package/plugins/huaweicloud-core/src/auth/agent-registration.mjs

@@ -1,9 +1,20 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
 
-export const SUPPORTED_AGENT_TARGETS = ['opencode', 'codex', 'codex-desktop', 'codearts', 'workbuddy', 'dsh'];
+export const SUPPORTED_AGENT_TARGETS = [
+  'opencode',
+  'codex',
+  'codex-desktop',
+  'codearts',
+  'workbuddy',
+  'dsh',
+  'officeace',
+  'hermes',
+  'openclaw',
+];
 
 function baseHome() {
   return process.env.HUAWEICLOUD_HOME || homedir();
@@ -80,9 +91,99 @@ function dshRegistered() {
   if (!existsSync(patchPath)) return false;
   try {
     const patch = readFileSync(patchPath, 'utf8');
-    return patch.includes('id: mcp-huaweicloud')
-      && patch.includes("@deepseek-ai/dsh-mcp-client")
-      && patch.includes('serverName: huaweicloud');
+    return (
+      patch.includes('id: mcp-huaweicloud') &&
+      patch.includes('@deepseek-ai/dsh-mcp-client') &&
+      patch.includes('serverName: huaweicloud')
+    );
+  } catch {
+    return false;
+  }
+}
+
+function readOfficeaceRegistryInstallDir() {
+  if (process.platform !== 'win32') return null;
+  try {
+    const r = spawnSync('reg', ['query', 'HKCU\\SOFTWARE\\OfficeAce\\OfficeAce', '/v', 'InstallDir'], {
+      encoding: 'utf8',
+      windowsHide: true,
+      timeout: 5000,
+    });
+    if (r.status === 0) {
+      const m = r.stdout.match(/InstallDir\s+REG_SZ\s+(.+)/);
+      if (m) return m[1].trim();
+    }
+  } catch {}
+  return null;
+}
+
+function officeaceCapabilitiesDir() {
+  const configRoot = process.env.OFFICE_CLAW_CONFIG_ROOT;
+  if (configRoot && existsSync(join(configRoot, 'capabilities.json'))) return configRoot;
+  const regDir = readOfficeaceRegistryInstallDir();
+  if (regDir) {
+    const dir = join(regDir, '.office-claw');
+    if (existsSync(join(dir, 'capabilities.json'))) return dir;
+  }
+  if (process.platform === 'win32') {
+    const bases = [process.env.ProgramFiles, 'C:\\Program Files', 'D:\\Program Files'];
+    if (process.env.LOCALAPPDATA) bases.push(join(process.env.LOCALAPPDATA, 'Programs'));
+    for (const base of bases) {
+      if (!base) continue;
+      const dir = join(base, 'OfficeAce', '.office-claw');
+      if (existsSync(join(dir, 'capabilities.json'))) return dir;
+    }
+  }
+  return null;
+}
+
+function officeaceCapabilitiesDirSafe() {
+  return officeaceCapabilitiesDir() || join(baseHome(), '.office-claw');
+}
+
+function officeaceSqlitePath() {
+  const capDir = officeaceCapabilitiesDirSafe();
+  return join(resolve(capDir, '..'), 'data', 'mcp-connectors.sqlite');
+}
+
+function officeaceRegistered() {
+  let hasMcp = false;
+  const dbPath = officeaceSqlitePath();
+  if (existsSync(dbPath)) {
+    const nodeMajor = Number(process.versions.node.split('.')[0]);
+    if (nodeMajor >= 22) {
+      try {
+        const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
+        const db = new DatabaseSync(dbPath, { readonly: true });
+        const row = db.prepare("SELECT enabled FROM mcp_connectors WHERE name = 'huaweicloud-devkit'").get();
+        db.close();
+        hasMcp = Boolean(row?.enabled);
+      } catch {}
+    }
+  }
+
+  const capFile = join(officeaceCapabilitiesDirSafe(), 'capabilities.json');
+  const cfg = readJsonSafe(capFile);
+  const hasSkills = cfg?.capabilities?.some((c) => c.id === 'huaweicloud-core' && c.type === 'skill') ?? false;
+
+  return hasMcp || hasSkills;
+}
+
+function hermesHome() {
+  if (process.env.HERMES_HOME) return process.env.HERMES_HOME;
+  // Hermes on Windows stores under LOCALAPPDATA, not ~/.hermes
+  if (process.platform === 'win32' && process.env.LOCALAPPDATA) {
+    return join(process.env.LOCALAPPDATA, 'hermes');
+  }
+  return join(baseHome(), '.hermes');
+}
+
+function hermesRegistered() {
+  const configPath = join(hermesHome(), 'config.yaml');
+  if (!existsSync(configPath)) return false;
+  try {
+    const content = readFileSync(configPath, 'utf8');
+    return content.includes('mcp_servers:') && content.includes('huaweicloud-devkit');
   } catch {
     return false;
   }
@@ -99,6 +200,8 @@ export function getAgentRegistrationStatuses(target = 'all') {
     if (agent === 'codearts') configured = codeartsRegistered();
     if (agent === 'workbuddy') configured = workbuddyRegistered();
     if (agent === 'dsh') configured = dshRegistered();
+    if (agent === 'officeace') configured = officeaceRegistered();
+    if (agent === 'hermes') configured = hermesRegistered();
     result.agents[agent] = { configured };
   }
   return result;

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -7,14 +7,20 @@ import { homedir } from 'node:os';
 // Native Windows has no POSIX modes (statSync always reports 0666), so skip the check there.
 function ensurePrivateMode(path) {
   if (process.platform === 'win32') return;
-  try { chmodSync(path, 0o600); } catch {}
+  try {
+    chmodSync(path, 0o600);
+  } catch {}
   try {
     const mode = statSync(path).mode & 0o777;
     if (mode !== 0o600) {
-      console.warn(`\x1b[33m[WARN]\x1b[0m Could not set 0600 on ${path} (current mode ${mode.toString(8)}). Credentials may be readable by other users.`);
+      console.warn(
+        `\x1b[33m[WARN]\x1b[0m Could not set 0600 on ${path} (current mode ${mode.toString(8)}). Credentials may be readable by other users.`,
+      );
       console.warn(`\x1b[33m       If running under WSL, move the credential home to the Linux filesystem:\x1b[0m`);
       console.warn(`\x1b[33m         export HUAWEICLOUD_HOME=$HOME  (then re-run auth init)\x1b[0m`);
-      console.warn(`\x1b[33m       Or skip file storage entirely with HW_ACCESS_KEY/HW_SECRET_KEY environment variables.\x1b[0m`);
+      console.warn(
+        `\x1b[33m       Or skip file storage entirely with HW_ACCESS_KEY/HW_SECRET_KEY environment variables.\x1b[0m`,
+      );
     }
   } catch {}
 }
@@ -78,6 +84,13 @@ export function resolveCredentials(options = {}) {
   let securityToken = process.env.HW_SECURITY_TOKEN;
   let region = process.env.HW_REGION || process.env.HUAWEICLOUD_REGION || '';
 
+  const codeartsCreds = isCodeArtsContext() ? readCodeArtsCredentials() : null;
+  if (codeartsCreds) {
+    if (!ak && codeartsCreds.ak) ak = codeartsCreds.ak;
+    if (!sk && codeartsCreds.sk) sk = codeartsCreds.sk;
+    if (!region && codeartsCreds.region) region = codeartsCreds.region;
+  }
+
   const stored = readGlobalCredentials();
   if (stored) {
     if (!ak && stored.ak) ak = stored.ak;
@@ -88,8 +101,68 @@ export function resolveCredentials(options = {}) {
 
   if (!ak || !sk) {
     if (options.allowMissing) return null;
-    throw new Error('Huawei Cloud credentials are not configured. Run "npx huaweicloud-devkit auth init" or set HW_ACCESS_KEY/HW_SECRET_KEY.');
+    throw new Error(
+      'Huawei Cloud credentials are not configured. Run "npx huaweicloud-devkit auth init" or set HW_ACCESS_KEY/HW_SECRET_KEY.',
+    );
   }
 
   return { ak, sk, securityToken, region };
 }
+
+function isCodeArtsContext() {
+  return existsSync(join(process.cwd(), '.codeartsdoer')) || existsSync(join(homedir(), '.codeartsdoer'));
+}
+
+function readCodeArtsCredentials() {
+  const searchPaths = [
+    join(process.cwd(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+    join(homedir(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+  ];
+
+  for (const path of searchPaths) {
+    try {
+      if (!existsSync(path)) continue;
+      const config = JSON.parse(readFileSync(path, 'utf8'));
+      const server = config?.mcpServers?.['huaweicloud-devkit'];
+      if (!server?.env) continue;
+
+      const ak = server.env.HW_ACCESS_KEY;
+      const sk = server.env.HW_SECRET_KEY;
+      if (ak && sk) {
+        return {
+          ak,
+          sk,
+          securityToken: server.env.HW_SECURITY_TOKEN || '',
+          region: server.env.HW_REGION || server.env.HUAWEICLOUD_REGION || '',
+        };
+      }
+    } catch {
+      // mcp_settings.json missing or invalid — skip
+    }
+  }
+
+  return null;
+}
+
+let runtimeCredentials = null;
+
+export function setRuntimeCredentials(ak, sk, securityToken, region) {
+  runtimeCredentials = { ak, sk, securityToken: securityToken || '', region: region || '' };
+}
+
+export function clearRuntimeCredentials() {
+  runtimeCredentials = null;
+}
+
+export function resolveCredentialsWithRuntime(options = {}) {
+  if (runtimeCredentials) {
+    return {
+      ak: runtimeCredentials.ak,
+      sk: runtimeCredentials.sk,
+      securityToken: runtimeCredentials.securityToken,
+      region: runtimeCredentials.region,
+    };
+  }
+
+  return resolveCredentials(options);
+}

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -42,7 +42,7 @@ export function syncAuth(target = 'all') {
     };
   }
 
-  let obs = null;
+  let obs;
   try {
     obs = writeObsConfig(credentials);
   } catch (error) {