huaweicloud-devkit 1.0.2-next.3 → 1.0.3-dev.0

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -1,139 +1,134 @@
----
-name: huawei-sandbox
-description: "Use when creating, connecting, or managing Huawei Cloud Sandbox instances and workspace terminals, or when a task needs a temporary runtime to deploy, run, or preview a web application. Covers sandbox lifecycle (check-user, sign-agreement, connect, release), session-based terminal execution, and credential injection. Triggers on: sandbox, workspace, terminal, web app deployment, deploy web app, preview app, deploy github, github repo, deploy repo, website, static site, web application, hwlink, devstation, hdkitservice, remote exec. NOT for: ECS instances (use huawei-ecs), CCE clusters (use huawei-cce)."
-version: 1
----
-
-# Huawei Cloud Sandbox
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-## Overview
-
-Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace terminal execution. Covers sandbox lifecycle via hdkitservice API and remote terminal command execution via hwlink protocol.
-
-## Activation
-
-- **Proactive offering**: when the developer's task needs a temporary runtime (e.g. "deploy this web app", "run this app and preview it"), offer the sandbox proactively — the developer never has to say "use sandbox". Prompt: "This task can be satisfied by a sandbox — use it?"
-- **Static website hosting — present options, sandbox first**: when the developer asks to deploy/host/publish a static website or web app without naming a target, do NOT silently pick a service. Present the target options in this order: ① 沙箱 (recommended — temporary runtime, instant preview URL) ② OBS 静态托管 (long-term static hosting/CDN) ③ ECS ④ CCE, then follow the developer's choice. Recommended prompt: "建议优先部署到沙箱（临时运行环境，可预览访问），也可选择 OBS 静态托管、ECS 或 CCE，你想部署到哪里？" If the developer has no preference, proceed with the sandbox.
-- **Detect web apps in deploy-a-repo prompts**: prompts like "部署 GitHub - <owner>/<repo>" or "deploy <github repo>" do not say "web app". Clone or inspect the repository first (package.json with dev/serve/build scripts, index.html, frontend framework dependencies such as vue/react/angular/vite, static sites, Dockerfile running a web server). If it is a web application, offer the sandbox first: "检测到该项目是 Web 应用，建议优先使用沙箱部署（临时运行环境，可预览访问），是否使用？"
-- **Clone into the sandbox workspace directory**: always put project code under `/workspace/<repo-name>` (create the directory if missing) — `/workspace` is the sandbox's dedicated workspace mount at the filesystem root, not `$HOME/workspace`. Never use `/tmp` or other ephemeral locations. This keeps the project with the sandbox session, is easy to reference for serving/exposing, and survives session-level restarts of the shell.
-- **Deployment must end with a public URL**: after deploying and exposing the app with DevBridge, always return the tunnel URL to the developer as the final result — a deployment without an accessible link is incomplete.
-- **Do not intercept a specified target**: if the task already names a deployment target (ECS, CCE, an existing server), follow that target instead of offering the sandbox. Offer the sandbox only when the task needs a temporary runtime or no target is specified.
-- The developer never needs to name or understand the sandbox as a separate service. Detect the "web application deployment / needs a runtime environment" intent and propose the sandbox.
-
-## MCP Tools
-
-### User Verification (Prerequisites)
-
-| Tool | Purpose |
-|------|---------|
-| `huaweicloud_sandbox_check_user` | Check real-name verification and agreement signing status |
-| `huaweicloud_sandbox_sign_agreement` | Sign unsigned/outdated agreements (required before connect) |
-
-### Sandbox Lifecycle
-
-| Tool | Purpose |
-|------|---------|
-| `huaweicloud_sandbox_connect` | Connect to sandbox (one user one instance, reuses existing if available) |
-| `huaweicloud_sandbox_credentials` | Inject temporary AK/SK into a running sandbox |
-
-### Terminal Execution
-
-| Tool | Purpose |
-|------|---------|
-| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists) |
-| `huaweicloud_sandbox_close_session` | Close a persistent terminal session |
-
-## Workflow
-
-Setup is a **plugin-side preflight** — the developer should be asked a question only once, when the agreement actually needs signing:
-
-1. **Check user** (transparent): `huaweicloud_sandbox_check_user` — returns `realnameVerified`/`agreementSigned` (200) when all good, OR throws a 403 error with one of these codes:
-   - `HDKIT_NOT_REALNAME` — real-name missing only → go to step 2
-   - `HDKIT_NOT_AGREEMENT` — latest agreement not signed only → go to step 3
-   - `HDKIT_NOT_REALNAME_AND_AGREEMENT` — both missing → go to step 4
-2. **Real-name verification only** (`HDKIT_NOT_REALNAME`): tell the developer once, "Huawei Cloud requires real-name verification before using the sandbox — please complete it in the Huawei Cloud console (实名认证)." and stop — do not retry `connect` in a loop
-3. **Sign agreement only** (`HDKIT_NOT_AGREEMENT`): **STOP and do NOT sign on your own.** Ask the developer: "Huawei Cloud sandbox requires signing the latest developer service agreement. May I sign it for you?" Then **wait for the developer to explicitly agree** (e.g. "签署" / "确认" / "sign it"). Only after explicit consent call `huaweicloud_sandbox_sign_agreement` and return its result (`signed`/`signedCount`) to the developer. **Never sign a legal agreement on the developer's behalf without their explicit, unambiguous consent.** Do not expose the underlying sandbox/DevBridge service as a separate entity the developer must understand or sign up for
-4. **Both missing** (`HDKIT_NOT_REALNAME_AND_AGREEMENT`): present **both** requirements together in one message — the real-name verification steps (console, step 2) **and** the agreement-signing request (step 3, wait for explicit consent) — so the developer can complete both at once
-5. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`
-6. **Inject credentials** (optional): `huaweicloud_sandbox_credentials` — enables cloud API access from sandbox
-7. **Execute commands**: `huaweicloud_sandbox_exec_with_session` for interactive work
-8. **Expose the deployed app and return the public URL**: set up a public access link for the app port and give the URL to the developer as the final result (see "Expose the deployed app (public URL)") — this step uses an internal tunnel mechanism that must never be mentioned to the developer
-
-## Expose the deployed app (public URL)
-
-Expose a deployed web app to a public URL and return that URL to the developer.
-
-**User-facing language rule**: the tunnel mechanism below is an internal implementation detail. Never mention "DevBridge", "tunnel", or the tunnel CLI to the developer. Tell the developer only: "正在生成访问地址..." while exposing, then hand over the final URL.
-
-**Install** (internal tooling; skip if `devbridge version` already works):
-
-```bash
-curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash
-export PATH=$PATH:$HOME/.huawei/bin   # installer only writes ~/.bashrc; session shells do not re-source it
-```
-
-**Login** (non-interactive, credentials come from the developer's local agent — the vault or HW_ACCESS_KEY/HW_SECRET_KEY; never echo them):
-
-```bash
-devbridge auth login --huaweicloud --access-key "$AK" --secret-key "$SK"
-```
-
-- The `--huaweicloud` flag is required for AK/SK login; without it the CLI tries an interactive browser login, which fails in the sandbox.
-- Write the AK/SK to temp files with `umask 077` (or shell vars) and delete them right after login. Verify with `devbridge auth status`.
-
-**Expose** (run the web server and the tunnel in the background, then read the URL from the log; the app lives in the workspace mount, e.g. `/workspace/<repo-name>`):
-
-```bash
-cd /workspace/<repo-name> && nohup python3 -m http.server 8080 > /tmp/http.log 2>&1 &
-nohup devbridge host -p 8080 -e 8 > /tmp/host.log 2>&1 &
-sleep 10 && cat /tmp/host.log
-```
-
-- The public URL has the form `https://<id>-<port>.cn-north-4-bridge.myhuaweicloud.com` (from the `Tunnel URL:` line).
-- **Return this URL to the developer as the deployment result link.** Keep the host process running (do not close the session before handing over the URL).
-- Internal docs: https://huaweicloud.github.io/devspace-devbridge/
-
-**No local downgrade**: if the tunnel tooling cannot be installed in the sandbox, STOP and report a generic error ("无法生成访问地址") without technical detail. Never install it on the developer's local machine — a local install would defeat the purpose of sandbox deployment.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Agreement required first | `sandbox_connect` fails if the agreement isn't signed; the `sandbox_check_user` preflight detects this, so surface it to the developer only when signing is needed |
-| Real-name required | `sandbox_connect` fails if `realnameVerified=false`; tell the developer once and stop, don't loop on connect |
-| Never expose tunnel details | Do not mention "DevBridge"/"tunnel"/"devbridge" to the developer — say "正在生成访问地址..." and hand over only the URL |
-| Login needs `--huaweicloud` | `devbridge auth login --access-key/--secret-key` without `--huaweicloud` falls back to interactive browser login, which fails in the sandbox |
-| CLI PATH | The installer only writes `~/.bashrc`; run `export PATH=$PATH:$HOME/.huawei/bin` in the session before using `devbridge` |
-| Never install tunnel tooling locally | If the sandbox cannot install it, report a generic error and stop — installing on the developer's machine defeats sandbox deployment |
-| Return the deployment URL | Always hand the public URL from the host log to the developer as the final result |
-| Session state persists | `exec_with_session` preserves `cd`, env vars, aliases between calls |
-| Destructive commands blocked | `rm -rf /`, `mkfs`, `dd if=`, fork bombs are denied by safety policy |
-| Workspace ID = dev_stage_id | Use `dev_stage_id` from `sandbox_connect` as `workspace_id` for terminal exec |
-| Projects live in `/workspace` | Clone/install project code under `/workspace/<repo-name>` (filesystem-root workspace mount, not `$HOME/workspace`), never in `/tmp` — ephemeral locations lose the project when the sandbox session restarts |
-| Node.js >= 22 required | Sandbox terminal uses built-in WebSocket (globalThis.WebSocket); if Node.js is missing, install it from the Huawei Cloud mirror (see "Node.js in the sandbox") |
-
-## Node.js in the sandbox
-
-If the sandbox has no Node.js, download it from the Huawei Cloud mirror. Pick the tarball matching the sandbox arch (`uname -m`: `aarch64` -> arm64, `x86_64` -> x64):
-
-```bash
-# aarch64 sandbox:
-curl -fsSL https://mirrors.huaweicloud.com/nodejs/v24.19.0/node-v24.19.0-linux-arm64.tar.gz -o node.tar.gz
-# x86_64 sandbox:
-curl -fsSL https://mirrors.huaweicloud.com/nodejs/v24.19.0/node-v24.19.0-linux-x64.tar.gz -o node.tar.gz
-sudo tar -xzf node.tar.gz -C /usr/local --strip-components=1
-node --version
-```
-
-## Environment Variables
-
-| Variable | Required | Description |
-|----------|----------|-------------|
-| `HW_ACCESS_KEY` | Yes | Huawei Cloud AK |
-| `HW_SECRET_KEY` | Yes | Huawei Cloud SK |
-| `HW_SECURITY_TOKEN` | No | STS security token |
-| `HW_WORKSPACE_ID` | No | Default workspace ID |
-| `HDKITSERVICE_ENDPOINT` | No | hdkitservice API endpoint |
-| `HWLINK_ENDPOINT` | No | DevStation API endpoint |
+---
+name: huawei-sandbox
+description: "Use when creating, connecting, or managing Huawei Cloud Sandbox instances and workspace terminals, or when a task needs a temporary runtime to deploy, run, or preview a web application. Covers sandbox lifecycle (check-user, sign-agreement, connect, release), session-based terminal execution, and credential injection. Triggers on: sandbox, workspace, terminal, web app deployment, deploy web app, preview app, deploy github, github repo, deploy repo, website, static site, web application, hwlink, devstation, hdkitservice, remote exec. NOT for: ECS instances (use huawei-ecs), CCE clusters (use huawei-cce)."
+version: 1
+---
+
+# Huawei Cloud Sandbox
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+## Overview
+
+Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace terminal execution. Covers sandbox lifecycle via hdkitservice API and remote terminal command execution via hwlink protocol.
+
+## Activation
+
+- **Proactive offering**: when the developer's task needs a temporary runtime (e.g. "deploy this web app", "run this app and preview it"), offer the sandbox proactively — the developer never has to say "use sandbox". Prompt: "This task can be satisfied by a sandbox — use it?"
+- **Detect web apps in deploy-a-repo prompts**: prompts like "部署 GitHub - <owner>/<repo>" or "deploy <github repo>" do not say "web app". Clone or inspect the repository first (package.json with dev/serve/build scripts, index.html, frontend framework dependencies such as vue/react/angular/vite, static sites, Dockerfile running a web server). If it is a web application, offer the sandbox first: "检测到该项目是 Web 应用，建议优先使用沙箱部署（临时运行环境，可预览访问），是否使用？"
+- **Clone into the sandbox workspace directory**: always put project code under `/workspace/<repo-name>` (create the directory if missing) — `/workspace` is the sandbox's dedicated workspace mount at the filesystem root, not `$HOME/workspace`. Never use `/tmp` or other ephemeral locations. This keeps the project with the sandbox session, is easy to reference for serving/exposing, and survives session-level restarts of the shell.
+- **Deployment must end with a public URL**: after deploying and exposing the app with DevBridge, always return the tunnel URL to the developer as the final result — a deployment without an accessible link is incomplete.
+- **Do not intercept a specified target**: if the task already names a deployment target (ECS, CCE, an existing server), follow that target instead of offering the sandbox. Offer the sandbox only when the task needs a temporary runtime or no target is specified.
+- The developer never needs to name or understand the sandbox as a separate service. Detect the "web application deployment / needs a runtime environment" intent and propose the sandbox.
+
+## MCP Tools
+
+### User Verification (Prerequisites)
+
+| Tool | Purpose |
+|------|---------|
+| `huaweicloud_sandbox_check_user` | Check real-name verification and agreement signing status |
+| `huaweicloud_sandbox_sign_agreement` | Sign unsigned/outdated agreements (required before connect) |
+
+### Sandbox Lifecycle
+
+| Tool | Purpose |
+|------|---------|
+| `huaweicloud_sandbox_connect` | Connect to sandbox (one user one instance, reuses existing if available) |
+| `huaweicloud_sandbox_credentials` | Inject temporary AK/SK into a running sandbox |
+
+### Terminal Execution
+
+| Tool | Purpose |
+|------|---------|
+| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists) |
+| `huaweicloud_sandbox_close_session` | Close a persistent terminal session |
+
+## Workflow
+
+Setup is a **plugin-side preflight** — the developer should be asked a question only once, when the agreement actually needs signing:
+
+1. **Check user** (transparent): `huaweicloud_sandbox_check_user` — verify `realname_verified` and `agreement_signed`
+2. **Real-name verification** (only if `realname_verified=false`): tell the developer once, "Huawei Cloud requires real-name verification before using the sandbox." and stop — do not retry `connect` in a loop
+3. **Sign agreement** (only if `agreement_signed=false`): ask the developer once as the plugin — "Huawei Cloud sandbox requires signing its service agreement. May I sign it on your behalf?" — then call `huaweicloud_sandbox_sign_agreement`. Do not expose the underlying sandbox/DevBridge service as a separate entity the developer must understand or sign up for
+4. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`
+5. **Inject credentials** (optional): `huaweicloud_sandbox_credentials` — enables cloud API access from sandbox
+6. **Execute commands**: `huaweicloud_sandbox_exec_with_session` for interactive work
+7. **Expose the deployed app and return the public URL**: set up a public access link for the app port and give the URL to the developer as the final result (see "Expose the deployed app (public URL)") — this step uses an internal tunnel mechanism that must never be mentioned to the developer
+
+## Expose the deployed app (public URL)
+
+Expose a deployed web app to a public URL and return that URL to the developer.
+
+**User-facing language rule**: the tunnel mechanism below is an internal implementation detail. Never mention "DevBridge", "tunnel", or the tunnel CLI to the developer. Tell the developer only: "正在生成访问地址..." while exposing, then hand over the final URL.
+
+**Install** (internal tooling; skip if `devbridge version` already works):
+
+```bash
+curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash
+export PATH=$PATH:$HOME/.huawei/bin   # installer only writes ~/.bashrc; session shells do not re-source it
+```
+
+**Login** (non-interactive, credentials come from the developer's local agent — the vault or HW_ACCESS_KEY/HW_SECRET_KEY; never echo them):
+
+```bash
+devbridge auth login --huaweicloud --access-key "$AK" --secret-key "$SK"
+```
+
+- The `--huaweicloud` flag is required for AK/SK login; without it the CLI tries an interactive browser login, which fails in the sandbox.
+- Write the AK/SK to temp files with `umask 077` (or shell vars) and delete them right after login. Verify with `devbridge auth status`.
+
+**Expose** (run the web server and the tunnel in the background, then read the URL from the log; the app lives in the workspace mount, e.g. `/workspace/<repo-name>`):
+
+```bash
+cd /workspace/<repo-name> && nohup python3 -m http.server 8080 > /tmp/http.log 2>&1 &
+nohup devbridge host -p 8080 -e 8 > /tmp/host.log 2>&1 &
+sleep 10 && cat /tmp/host.log
+```
+
+- The public URL has the form `https://<id>-<port>.cn-north-4-bridge.myhuaweicloud.com` (from the `Tunnel URL:` line).
+- **Return this URL to the developer as the deployment result link.** Keep the host process running (do not close the session before handing over the URL).
+- Internal docs: https://huaweicloud.github.io/devspace-devbridge/
+
+**No local downgrade**: if the tunnel tooling cannot be installed in the sandbox, STOP and report a generic error ("无法生成访问地址") without technical detail. Never install it on the developer's local machine — a local install would defeat the purpose of sandbox deployment.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Agreement required first | `sandbox_connect` fails if the agreement isn't signed; the `sandbox_check_user` preflight detects this, so surface it to the developer only when signing is needed |
+| Real-name required | `sandbox_connect` fails if `realname_verified=false`; tell the developer once and stop, don't loop on connect |
+| Never expose tunnel details | Do not mention "DevBridge"/"tunnel"/"devbridge" to the developer — say "正在生成访问地址..." and hand over only the URL |
+| Login needs `--huaweicloud` | `devbridge auth login --access-key/--secret-key` without `--huaweicloud` falls back to interactive browser login, which fails in the sandbox |
+| CLI PATH | The installer only writes `~/.bashrc`; run `export PATH=$PATH:$HOME/.huawei/bin` in the session before using `devbridge` |
+| Never install tunnel tooling locally | If the sandbox cannot install it, report a generic error and stop — installing on the developer's machine defeats sandbox deployment |
+| Return the deployment URL | Always hand the public URL from the host log to the developer as the final result |
+| Session state persists | `exec_with_session` preserves `cd`, env vars, aliases between calls |
+| Destructive commands blocked | `rm -rf /`, `mkfs`, `dd if=`, fork bombs are denied by safety policy |
+| Workspace ID = dev_stage_id | Use `dev_stage_id` from `sandbox_connect` as `workspace_id` for terminal exec |
+| Projects live in `/workspace` | Clone/install project code under `/workspace/<repo-name>` (filesystem-root workspace mount, not `$HOME/workspace`), never in `/tmp` — ephemeral locations lose the project when the sandbox session restarts |
+| Node.js >= 22 required | Sandbox terminal uses built-in WebSocket (globalThis.WebSocket); if Node.js is missing, install it from the Huawei Cloud mirror (see "Node.js in the sandbox") |
+
+## Node.js in the sandbox
+
+If the sandbox has no Node.js, download it from the Huawei Cloud mirror. Pick the tarball matching the sandbox arch (`uname -m`: `aarch64` -> arm64, `x86_64` -> x64):
+
+```bash
+# aarch64 sandbox:
+curl -fsSL https://mirrors.huaweicloud.com/nodejs/v24.19.0/node-v24.19.0-linux-arm64.tar.gz -o node.tar.gz
+# x86_64 sandbox:
+curl -fsSL https://mirrors.huaweicloud.com/nodejs/v24.19.0/node-v24.19.0-linux-x64.tar.gz -o node.tar.gz
+sudo tar -xzf node.tar.gz -C /usr/local --strip-components=1
+node --version
+```
+
+## Environment Variables
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `HW_ACCESS_KEY` | Yes | Huawei Cloud AK |
+| `HW_SECRET_KEY` | Yes | Huawei Cloud SK |
+| `HW_SECURITY_TOKEN` | No | STS security token |
+| `HW_WORKSPACE_ID` | No | Default workspace ID |
+| `HDKITSERVICE_ENDPOINT` | No | hdkitservice API endpoint |
+| `HWLINK_ENDPOINT` | No | DevStation API endpoint |

package/plugins/huaweicloud-core/skills/huawei-smn-dms/SKILL.md

@@ -1,69 +1,69 @@
----
-name: huawei-smn-dms
-description: "Use when creating or managing SMN topics/subscriptions/messages or DMS Kafka/RabbitMQ/RocketMQ queues on Huawei Cloud. Triggers: SMN, DMS, notification, message queue, Kafka, RabbitMQ, RocketMQ, topic, subscription. NOT for: APIG (use huawei-apig), FunctionGraph triggers (use huawei-functiongraph)."
-version: 1
----
-
-# Huawei Cloud SMN / DMS
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud SMN <Operation> --help` or `hcloud DMS <Operation> --help` before constructing commands.
-
-## Overview
-
-Domain expertise for SMN (Simple Message Notification) and DMS (Distributed Message Service). SMN is used for notifications and alerts. DMS covers Kafka, RabbitMQ, and RocketMQ instances.
-
-## SMN
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Subscription confirmation | HTTP/HTTPS subscriptions need endpoint ping-back confirmation |
-| Email subscription delay | Email subscriptions require user to click confirmation link |
-| SMS charge per message | Template SMS incurs per-delivery charges |
-
-### Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List topics | `ListTopics --cli-region=<r> --project_id=<p>` |
-| Create topic | `CreateTopic --cli-region=<r> --project_id=<p>` |
-| Add subscription | `AddSubscription --cli-region=<r> --project_id=<p>` |
-| List subscriptions | `ListSubscriptions --cli-region=<r> --project_id=<p>` |
-| Create message template | `CreateMessageTemplate --cli-region=<r> --project_id=<p>` |
-| Publish message | `PublishMessage --cli-region=<r> --project_id=<p>` |
-| Delete topic | `DeleteTopic --cli-region=<r> --project_id=<p>` |
-
-## DMS
-
-### Service Types
-
-| Type | KooCLI Service |
-|------|---------------|
-| Kafka | `hcloud DMS` |
-| RabbitMQ | `hcloud DMS` |
-| RocketMQ | `hcloud DMS` |
-
-### Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| Create Kafka instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
-| List Kafka topics | `ListTopics --cli-region=<r> --project_id=<p>` |
-
-Discover exact parameters with `--help` before executing any command.
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| Subscription not confirmed | SMN subscriptions need endpoint/user confirmation |
-| DMS instance creation fails | Check VPC/subnet availability and engine version |
-
-## Cross-Skill References
-
-- **CES alarms**: See `huawei-cloud-eye` for SMN-based alarm notifications
-- **VPC**: See `huawei-vpc` for DMS instance networking
+---
+name: huawei-smn-dms
+description: "Use when creating or managing SMN topics/subscriptions/messages or DMS Kafka/RabbitMQ/RocketMQ queues on Huawei Cloud. Triggers: SMN, DMS, notification, message queue, Kafka, RabbitMQ, RocketMQ, topic, subscription. NOT for: APIG (use huawei-apig), FunctionGraph triggers (use huawei-functiongraph)."
+version: 1
+---
+
+# Huawei Cloud SMN / DMS
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud SMN <Operation> --help` or `hcloud DMS <Operation> --help` before constructing commands.
+
+## Overview
+
+Domain expertise for SMN (Simple Message Notification) and DMS (Distributed Message Service). SMN is used for notifications and alerts. DMS covers Kafka, RabbitMQ, and RocketMQ instances.
+
+## SMN
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Subscription confirmation | HTTP/HTTPS subscriptions need endpoint ping-back confirmation |
+| Email subscription delay | Email subscriptions require user to click confirmation link |
+| SMS charge per message | Template SMS incurs per-delivery charges |
+
+### Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List topics | `ListTopics --cli-region=<r> --project_id=<p>` |
+| Create topic | `CreateTopic --cli-region=<r> --project_id=<p>` |
+| Add subscription | `AddSubscription --cli-region=<r> --project_id=<p>` |
+| List subscriptions | `ListSubscriptions --cli-region=<r> --project_id=<p>` |
+| Create message template | `CreateMessageTemplate --cli-region=<r> --project_id=<p>` |
+| Publish message | `PublishMessage --cli-region=<r> --project_id=<p>` |
+| Delete topic | `DeleteTopic --cli-region=<r> --project_id=<p>` |
+
+## DMS
+
+### Service Types
+
+| Type | KooCLI Service |
+|------|---------------|
+| Kafka | `hcloud DMS` |
+| RabbitMQ | `hcloud DMS` |
+| RocketMQ | `hcloud DMS` |
+
+### Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| Create Kafka instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
+| List Kafka topics | `ListTopics --cli-region=<r> --project_id=<p>` |
+
+Discover exact parameters with `--help` before executing any command.
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| Subscription not confirmed | SMN subscriptions need endpoint/user confirmation |
+| DMS instance creation fails | Check VPC/subnet availability and engine version |
+
+## Cross-Skill References
+
+- **CES alarms**: See `huawei-cloud-eye` for SMN-based alarm notifications
+- **VPC**: See `huawei-vpc` for DMS instance networking