huaweicloud-devkit 1.0.2-next.3 → 1.0.3-dev.0

package/plugins/huaweicloud-core/skills/huawei-cts/SKILL.md

@@ -1,55 +1,55 @@
----
-name: huawei-cts
-description: "Use when managing Cloud Trace Service (CTS) audit logs, trackers, and traces on Huawei Cloud. Triggers: CTS, Cloud Trace, audit log, tracker, trace, operation record. NOT for: CES monitoring alarms (use huawei-cloud-eye), log analysis (use LTS)."
-version: 1
----
-
-# Huawei Cloud CTS
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud CTS <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for Cloud Trace Service. Covers trackers, traces, notifications, and resource tags.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Tracker required for traces | Must create a tracker before traces are recorded |
-| OBS bucket prerequisite | Tracker needs an OBS bucket for log delivery |
-| 7-day retention default | Trace data retained 7 days by default. Create LTS tracker for longer retention |
-| Organization tracker | Cross-account auditing requires organization tracker |
-
-## Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List operations | `ListOperations --cli-region=<r> --project_id=<p>` |
-| List traces | `ListTraces --cli-region=<r> --project_id=<p>` |
-| Create tracker | `CreateTracker --cli-region=<r> --project_id=<p>` |
-| List trackers | `ListTrackers --cli-region=<r> --project_id=<p>` |
-| Delete tracker | `DeleteTracker --cli-region=<r> --project_id=<p>` |
-| Create notification | `CreateNotification --cli-region=<r> --project_id=<p>` |
-| List notifications | `ListNotifications --cli-region=<r> --project_id=<p>` |
-| List trace resources | `ListTraceResources --cli-region=<r> --project_id=<p>` |
-
-Discover exact parameters with `--help` before executing any command.
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| No traces found | Check tracker is created and enabled. Filter by time range |
-| Tracker creation fails | Ensure OBS bucket exists and has correct permissions |
-
-## Security
-
-- SHOULD enable CTS for all production accounts
-- MUST use OBS server-side encryption for trace logs
-
-## Cross-Skill References
-
-- **OBS**: See `huawei-obs` for tracker log delivery bucket
+---
+name: huawei-cts
+description: "Use when managing Cloud Trace Service (CTS) audit logs, trackers, and traces on Huawei Cloud. Triggers: CTS, Cloud Trace, audit log, tracker, trace, operation record. NOT for: CES monitoring alarms (use huawei-cloud-eye), log analysis (use LTS)."
+version: 1
+---
+
+# Huawei Cloud CTS
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud CTS <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Cloud Trace Service. Covers trackers, traces, notifications, and resource tags.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Tracker required for traces | Must create a tracker before traces are recorded |
+| OBS bucket prerequisite | Tracker needs an OBS bucket for log delivery |
+| 7-day retention default | Trace data retained 7 days by default. Create LTS tracker for longer retention |
+| Organization tracker | Cross-account auditing requires organization tracker |
+
+## Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List operations | `ListOperations --cli-region=<r> --project_id=<p>` |
+| List traces | `ListTraces --cli-region=<r> --project_id=<p>` |
+| Create tracker | `CreateTracker --cli-region=<r> --project_id=<p>` |
+| List trackers | `ListTrackers --cli-region=<r> --project_id=<p>` |
+| Delete tracker | `DeleteTracker --cli-region=<r> --project_id=<p>` |
+| Create notification | `CreateNotification --cli-region=<r> --project_id=<p>` |
+| List notifications | `ListNotifications --cli-region=<r> --project_id=<p>` |
+| List trace resources | `ListTraceResources --cli-region=<r> --project_id=<p>` |
+
+Discover exact parameters with `--help` before executing any command.
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| No traces found | Check tracker is created and enabled. Filter by time range |
+| Tracker creation fails | Ensure OBS bucket exists and has correct permissions |
+
+## Security
+
+- SHOULD enable CTS for all production accounts
+- MUST use OBS server-side encryption for trace logs
+
+## Cross-Skill References
+
+- **OBS**: See `huawei-obs` for tracker log delivery bucket

package/plugins/huaweicloud-core/skills/huawei-dds-dcs/SKILL.md

@@ -1,70 +1,70 @@
----
-name: huawei-dds-dcs
-description: "Use when creating or managing Document Database Service (DDS/MongoDB-compatible) or Distributed Cache Service (DCS/Redis/Memcached) on Huawei Cloud. Triggers: DDS, DCS, MongoDB, Redis, Memcached, document DB, cache, replica set, sharding. NOT for: RDS (use huawei-rds), GaussDB (use huawei-gaussdb)."
-version: 1
----
-
-# Huawei Cloud DDS / DCS
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud DDS <Operation> --help` or `hcloud DCS <Operation> --help` before constructing commands.
-
-## DDS (Document Database Service — MongoDB Compatible)
-
-## DDS Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Requires 3-node replica | Minimum production deployment needs 3 nodes |
-| Shard key permanent | Once selected, shard key cannot be changed |
-| Storage auto-scaling off | Enable before storage fills |
-
-### Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| Create instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
-| Delete instance | `DeleteInstance --cli-region=<r> --project_id=<p>` |
-| Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>` |
-| Add shard | `AddShardingNode --cli-region=<r> --project_id=<p>` |
-| Create backup | `CreateBackup --cli-region=<r> --project_id=<p>` |
-
-Discover exact parameters with `--help` before executing any command.
-
-## DCS (Distributed Cache Service — Redis/Memcached)
-
-## DCS Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Redis password required | Cannot create Redis instance without password |
-| Memcached no password | Memcached has no auth — only accessible within VPC |
-| Cache persistence costs | AOF/RDB persistence uses additional storage |
-
-### Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| Create Redis instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
-| Delete instance | `DeleteInstances --cli-region=<r> --project_id=<p>` |
-| Restart instance | `RestartInstance --cli-region=<r> --project_id=<p>` |
-| Show node information | `BatchShowNodesInformation --cli-region=<r> --project_id=<p>` |
-| Create custom template | `CreateCustomTemplate --cli-region=<r> --project_id=<p>` |
-
-Discover exact parameters with `--help` before executing any command.
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| DDS instance creation fails | Check 3-node minimum, VPC/subnet availability |
-| DCS connection refused | Redis instances need password. Memcached only accessible within VPC |
-| DCS auto-expire not working | Enable auto-expire scan task for Redis |
-
-## Cross-Skill References
-
-- **VPC/Subnet**: See `huawei-vpc` for instance networking
-- **Backup/CBR**: See `huawei-cbr` for backup management
+---
+name: huawei-dds-dcs
+description: "Use when creating or managing Document Database Service (DDS/MongoDB-compatible) or Distributed Cache Service (DCS/Redis/Memcached) on Huawei Cloud. Triggers: DDS, DCS, MongoDB, Redis, Memcached, document DB, cache, replica set, sharding. NOT for: RDS (use huawei-rds), GaussDB (use huawei-gaussdb)."
+version: 1
+---
+
+# Huawei Cloud DDS / DCS
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud DDS <Operation> --help` or `hcloud DCS <Operation> --help` before constructing commands.
+
+## DDS (Document Database Service — MongoDB Compatible)
+
+## DDS Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Requires 3-node replica | Minimum production deployment needs 3 nodes |
+| Shard key permanent | Once selected, shard key cannot be changed |
+| Storage auto-scaling off | Enable before storage fills |
+
+### Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| Create instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
+| Delete instance | `DeleteInstance --cli-region=<r> --project_id=<p>` |
+| Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>` |
+| Add shard | `AddShardingNode --cli-region=<r> --project_id=<p>` |
+| Create backup | `CreateBackup --cli-region=<r> --project_id=<p>` |
+
+Discover exact parameters with `--help` before executing any command.
+
+## DCS (Distributed Cache Service — Redis/Memcached)
+
+## DCS Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Redis password required | Cannot create Redis instance without password |
+| Memcached no password | Memcached has no auth — only accessible within VPC |
+| Cache persistence costs | AOF/RDB persistence uses additional storage |
+
+### Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| Create Redis instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
+| Delete instance | `DeleteInstances --cli-region=<r> --project_id=<p>` |
+| Restart instance | `RestartInstance --cli-region=<r> --project_id=<p>` |
+| Show node information | `BatchShowNodesInformation --cli-region=<r> --project_id=<p>` |
+| Create custom template | `CreateCustomTemplate --cli-region=<r> --project_id=<p>` |
+
+Discover exact parameters with `--help` before executing any command.
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| DDS instance creation fails | Check 3-node minimum, VPC/subnet availability |
+| DCS connection refused | Redis instances need password. Memcached only accessible within VPC |
+| DCS auto-expire not working | Enable auto-expire scan task for Redis |
+
+## Cross-Skill References
+
+- **VPC/Subnet**: See `huawei-vpc` for instance networking
+- **Backup/CBR**: See `huawei-cbr` for backup management

package/plugins/huaweicloud-core/skills/huawei-deployment/SKILL.md

@@ -1,56 +1,56 @@
----
-name: huawei-deployment
-description: "Use when creating, managing, or running deployment tasks and pipelines on Huawei Cloud CloudDeploy. Triggers: CloudDeploy, deployment, CI/CD, pipeline, release, artifact deployment, deploy task. NOT for: CodeArts Build (build pipeline), SWR container registry."
-version: 1
----
-
-# Huawei Cloud CloudDeploy
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for Huawei Cloud CloudDeploy. Covers application creation, deployment task management, pipeline execution, and artifact configuration.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Service name may be `CodeArtsDeploy` | hcloud service name for deployment may be `CodeArtsDeploy` instead of `CloudDeploy`. Run `hcloud --help` to verify |
-| Deployment hosts need agent | Install CloudDeploy agent on target hosts first |
-| Task must reference application first | Create application before task |
-| Artifact source defaults to OBS | Most deployment tasks pull artifacts from OBS. Ensure bucket and object exist |
-| Parallel deployments may conflict | Lock resources or use deployment groups |
-
-## Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| Create application | `CreateApp --name=<n> --platform=<p> --cli-region=<r>` |
-| Create deployment task | `CreateTask --name=<n> --app_id=<id> --artifact_source_type=OBS` |
-| Start deployment | `StartTask --task_id=<id>` |
-| List tasks | `ListTasks --app_id=<id>` |
-| Delete task | `DeleteTask --task_id=<id>` |
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| Agent offline | Check agent service on target host, network connectivity, firewall rules |
-| Deployment timeout | Check artifact size, increase task timeout, verify target host resources |
-| Artifact not found | Verify OBS bucket and object path, check artifact permissions |
-| Permission denied | Verify IAM roles for deployment: `CodeArtsDeploy FullAccess` or custom policy |
-
-## Security
-
-- MUST use IAM roles for deployment permissions
-- MUST verify artifact integrity before deployment
-- MUST not store credentials in deployment scripts
-
-## Cross-Skill References
-
-- **OBS artifact storage**: See `huawei-obs`
-- **ECS deployment target**: See `huawei-ecs`
-- **IAM permissions**: See `huawei-iam`
+---
+name: huawei-deployment
+description: "Use when creating, managing, or running deployment tasks and pipelines on Huawei Cloud CloudDeploy. Triggers: CloudDeploy, deployment, CI/CD, pipeline, release, artifact deployment, deploy task. NOT for: CodeArts Build (build pipeline), SWR container registry."
+version: 1
+---
+
+# Huawei Cloud CloudDeploy
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Huawei Cloud CloudDeploy. Covers application creation, deployment task management, pipeline execution, and artifact configuration.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Service name may be `CodeArtsDeploy` | hcloud service name for deployment may be `CodeArtsDeploy` instead of `CloudDeploy`. Run `hcloud --help` to verify |
+| Deployment hosts need agent | Install CloudDeploy agent on target hosts first |
+| Task must reference application first | Create application before task |
+| Artifact source defaults to OBS | Most deployment tasks pull artifacts from OBS. Ensure bucket and object exist |
+| Parallel deployments may conflict | Lock resources or use deployment groups |
+
+## Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| Create application | `CreateApp --name=<n> --platform=<p> --cli-region=<r>` |
+| Create deployment task | `CreateTask --name=<n> --app_id=<id> --artifact_source_type=OBS` |
+| Start deployment | `StartTask --task_id=<id>` |
+| List tasks | `ListTasks --app_id=<id>` |
+| Delete task | `DeleteTask --task_id=<id>` |
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| Agent offline | Check agent service on target host, network connectivity, firewall rules |
+| Deployment timeout | Check artifact size, increase task timeout, verify target host resources |
+| Artifact not found | Verify OBS bucket and object path, check artifact permissions |
+| Permission denied | Verify IAM roles for deployment: `CodeArtsDeploy FullAccess` or custom policy |
+
+## Security
+
+- MUST use IAM roles for deployment permissions
+- MUST verify artifact integrity before deployment
+- MUST not store credentials in deployment scripts
+
+## Cross-Skill References
+
+- **OBS artifact storage**: See `huawei-obs`
+- **ECS deployment target**: See `huawei-ecs`
+- **IAM permissions**: See `huawei-iam`

package/plugins/huaweicloud-core/skills/huawei-dew/SKILL.md

@@ -1,97 +1,97 @@
----
-name: huawei-dew
-description: "Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secrets, KMS for encryption keys, and credential rotation. Triggers on: secret, credential, API key, token, password, encrypt, decrypt, KMS, CSMS, DEW, certificate, CSR, rotation. Activates for ANY task involving secrets or credentials — load this skill first before touching secrets."
-version: 1
----
-
-# Huawei Cloud DEW (Data Encryption Workshop)
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for Huawei Cloud Data Encryption Workshop (DEW). Covers CSMS for secret lifecycle management, KMS for encryption key management, credential rotation, and secure application integration patterns.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| NEVER fetch secret values into agent context | Use {{resolve:csms:secret-id:SecretString:key}} runtime injection |
-| NEVER echo credentials in conversation | AK/SK, passwords, tokens must never appear in chat |
-| KMS key deletion is irreversible | 7-30 day pending deletion window. Once gone, data is unrecoverable |
-| Secret rotation requires automation | Manual rotation risks stale credentials |
-| Cross-account KMS needs grants | KMS keys are regional. Cross-region data needs grant setup |
-
-## CSMS Operations
-
-### Read-only (safe — metadata only)
-| Operation | Description |
-|-----------|-------------|
-| ListSecrets | List all secrets (names only, no values) |
-| DescribeSecret | Get secret metadata (rotation config, KMS key, status) |
-| ListSecretVersions | List version IDs and stages (no values) |
-
-### Secret Value (blocked by policy — use runtime injection)
-| Operation | Safe Alternative |
-|-----------|-----------------|
-| DownloadSecret | Use {{resolve:csms:secret-id}} in IaC or SDK |
-| ShowSecretVersion | Use runtime injection, never in agent context |
-| GetSecretValue | Blocked. Use MCP proxy resolve pattern |
-
-## KMS Operations
-
-| Task | Command | Notes |
-|------|---------|-------|
-| List keys | hcloud KMS ListKeys | Read-only |
-| Create key | hcloud KMS CreateKey --key_alias=<name> | Requires write approval |
-| Encrypt | hcloud KMS EncryptData --key_id=<id> --plaintext=<b64> | Prefer SDK offline encrypt |
-| Decrypt | hcloud KMS DecryptData (**BLOCKED**) | Use runtime injection |
-
-## Runtime Injection Pattern
-
-`ash
-# Terraform / IaC
-resource "huaweicloud_csms_secret" "db_password" {
-  secret_string = var.db_password  # NEVER hardcode
-}
-
-# SDK
-secret_value = client.get_secret(secret_id="my-secret")
-# Use immediately, never print or store in context
-
-# hcloud (for approved automation only)
-hcloud CSMS DownloadSecret --secret_name=<name>
-# WARNING: Output goes to stdout. Pipe directly, never capture in agent.
-`
-
-## Troubleshooting
-
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Secret not found | Wrong region or project -> Verify secret ARN includes region/project |
-| AccessDenied on CSMS | Missing IAM CSMS policy -> Add csms:DescribeSecret + kms:Decrypt |
-| KMS key disabled | Key scheduled for deletion or manually disabled -> Enable or create new key |
-| Rotation stuck | Lambda/Python function error -> Check rotation function logs |
-
-## Security Considerations
-
-- MUST use runtime injection. NEVER fetch secrets into agent context
-- MUST rotate credentials every 90 days
-- MUST enable automatic rotation for CSMS secrets
-- MUST audit KMS key usage via CTS
-- SHOULD use customer-managed keys (CMK) for sensitive data
-- MUST NOT use default KMS keys for production workloads
-
-## MCP Tools
-
-- huaweicloud_list_operations service=DEW or CSMS or KMS
-- huaweicloud_run_readonly_command for ListSecrets/ListKeys (metadata only)
-- huaweicloud_safety policy blocks all secret value reads
-
-## References
-
-- DEW Docs: https://support.huaweicloud.com/dew/
-- CSMS usage: references/csms-usage.md
-- KMS usage: references/kms-usage.md
+---
+name: huawei-dew
+description: "Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secrets, KMS for encryption keys, and credential rotation. Triggers on: secret, credential, API key, token, password, encrypt, decrypt, KMS, CSMS, DEW, certificate, CSR, rotation. Activates for ANY task involving secrets or credentials — load this skill first before touching secrets."
+version: 1
+---
+
+# Huawei Cloud DEW (Data Encryption Workshop)
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Huawei Cloud Data Encryption Workshop (DEW). Covers CSMS for secret lifecycle management, KMS for encryption key management, credential rotation, and secure application integration patterns.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| NEVER fetch secret values into agent context | Use {{resolve:csms:secret-id:SecretString:key}} runtime injection |
+| NEVER echo credentials in conversation | AK/SK, passwords, tokens must never appear in chat |
+| KMS key deletion is irreversible | 7-30 day pending deletion window. Once gone, data is unrecoverable |
+| Secret rotation requires automation | Manual rotation risks stale credentials |
+| Cross-account KMS needs grants | KMS keys are regional. Cross-region data needs grant setup |
+
+## CSMS Operations
+
+### Read-only (safe — metadata only)
+| Operation | Description |
+|-----------|-------------|
+| ListSecrets | List all secrets (names only, no values) |
+| DescribeSecret | Get secret metadata (rotation config, KMS key, status) |
+| ListSecretVersions | List version IDs and stages (no values) |
+
+### Secret Value (blocked by policy — use runtime injection)
+| Operation | Safe Alternative |
+|-----------|-----------------|
+| DownloadSecret | Use {{resolve:csms:secret-id}} in IaC or SDK |
+| ShowSecretVersion | Use runtime injection, never in agent context |
+| GetSecretValue | Blocked. Use MCP proxy resolve pattern |
+
+## KMS Operations
+
+| Task | Command | Notes |
+|------|---------|-------|
+| List keys | hcloud KMS ListKeys | Read-only |
+| Create key | hcloud KMS CreateKey --key_alias=<name> | Requires write approval |
+| Encrypt | hcloud KMS EncryptData --key_id=<id> --plaintext=<b64> | Prefer SDK offline encrypt |
+| Decrypt | hcloud KMS DecryptData (**BLOCKED**) | Use runtime injection |
+
+## Runtime Injection Pattern
+
+`ash
+# Terraform / IaC
+resource "huaweicloud_csms_secret" "db_password" {
+  secret_string = var.db_password  # NEVER hardcode
+}
+
+# SDK
+secret_value = client.get_secret(secret_id="my-secret")
+# Use immediately, never print or store in context
+
+# hcloud (for approved automation only)
+hcloud CSMS DownloadSecret --secret_name=<name>
+# WARNING: Output goes to stdout. Pipe directly, never capture in agent.
+`
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|------------------|
+| Secret not found | Wrong region or project -> Verify secret ARN includes region/project |
+| AccessDenied on CSMS | Missing IAM CSMS policy -> Add csms:DescribeSecret + kms:Decrypt |
+| KMS key disabled | Key scheduled for deletion or manually disabled -> Enable or create new key |
+| Rotation stuck | Lambda/Python function error -> Check rotation function logs |
+
+## Security Considerations
+
+- MUST use runtime injection. NEVER fetch secrets into agent context
+- MUST rotate credentials every 90 days
+- MUST enable automatic rotation for CSMS secrets
+- MUST audit KMS key usage via CTS
+- SHOULD use customer-managed keys (CMK) for sensitive data
+- MUST NOT use default KMS keys for production workloads
+
+## MCP Tools
+
+- huaweicloud_list_operations service=DEW or CSMS or KMS
+- huaweicloud_run_readonly_command for ListSecrets/ListKeys (metadata only)
+- huaweicloud_safety policy blocks all secret value reads
+
+## References
+
+- DEW Docs: https://support.huaweicloud.com/dew/
+- CSMS usage: references/csms-usage.md
+- KMS usage: references/kms-usage.md

package/plugins/huaweicloud-core/skills/huawei-dew/references/csms-usage.md

@@ -1,29 +1,29 @@
-# CSMS Usage Guide
-
-## Create Secret
-hcloud CSMS CreateSecret --secret_name=prod-db-password --secret_string='{"password":"CHANGE_ME"}'
-
-## List Secrets (metadata only)
-hcloud CSMS ListSecrets
-
-## Describe Secret
-hcloud CSMS DescribeSecret --secret_name=prod-db-password
-
-## List Versions
-hcloud CSMS ListSecretVersions --secret_name=prod-db-password
-
-## Runtime Injection (Terraform)
-data "huaweicloud_csms_secret" "db" {
-  secret_name = "prod-db-password"
-}
-Use: data.huaweicloud_csms_secret.db.secret_string
-
-## Rotation
-- Enable auto-rotation: hcloud CSMS EnableSecretRotation --secret_name=<name> --rotation_interval=30
-- Rotation function ARN: provide Lambda to generate new secret value
-
-## Policy Rules
-- hcloud CSMS DownloadSecret -> BLOCKED (use runtime injection)
-- hcloud CSMS ShowSecretVersion -> BLOCKED
-- hcloud CSMS ListSecrets -> ALLOWED (metadata only)
-- hcloud CSMS DescribeSecret -> ALLOWED (metadata only)
+# CSMS Usage Guide
+
+## Create Secret
+hcloud CSMS CreateSecret --secret_name=prod-db-password --secret_string='{"password":"CHANGE_ME"}'
+
+## List Secrets (metadata only)
+hcloud CSMS ListSecrets
+
+## Describe Secret
+hcloud CSMS DescribeSecret --secret_name=prod-db-password
+
+## List Versions
+hcloud CSMS ListSecretVersions --secret_name=prod-db-password
+
+## Runtime Injection (Terraform)
+data "huaweicloud_csms_secret" "db" {
+  secret_name = "prod-db-password"
+}
+Use: data.huaweicloud_csms_secret.db.secret_string
+
+## Rotation
+- Enable auto-rotation: hcloud CSMS EnableSecretRotation --secret_name=<name> --rotation_interval=30
+- Rotation function ARN: provide Lambda to generate new secret value
+
+## Policy Rules
+- hcloud CSMS DownloadSecret -> BLOCKED (use runtime injection)
+- hcloud CSMS ShowSecretVersion -> BLOCKED
+- hcloud CSMS ListSecrets -> ALLOWED (metadata only)
+- hcloud CSMS DescribeSecret -> ALLOWED (metadata only)