huaweicloud-devkit 1.0.2-next.7 → 1.0.2-next.8

package/plugins/huaweicloud-core/skills/huawei-cloud-find-skills/scripts/search-skills.mjs

@@ -1,17 +1,47 @@
-#!/usr/bin/env node
 import { Buffer } from 'node:buffer';
 
-const INDEX_URL = 'https://gitcode.com/api/v5/repos/2501_91318609/skills-for-index/contents/skills-index/index.json?ref=main';
-const CN_EN_MAP_URL = 'https://gitcode.com/api/v5/repos/2501_91318609/skills-for-index/contents/skills-index/cn-en-map.json?ref=main';
+const INDEX_URL =
+  'https://gitcode.com/api/v5/repos/2501_91318609/skills-for-index/contents/skills-index/index.json?ref=main';
+const CN_EN_MAP_URL =
+  'https://gitcode.com/api/v5/repos/2501_91318609/skills-for-index/contents/skills-index/cn-en-map.json?ref=main';
 
 const GENERIC_KEYWORDS = new Set([
-  '华为云', 'huawei', 'huawei cloud', '云', 'cloud', '技能', 'skill', 'skills',
-  '所有', 'all', '全部', '有什么', '有哪些', '相关', '列表', 'list',
-  '查找', '搜索', '发现', '浏览', 'find', 'search', 'discover', 'browse',
-  'show', 'explore', 'agent', '市场', 'market', '类目', 'category', '安装', 'install',
+  '华为云',
+  'huawei',
+  'huawei cloud',
+  '云',
+  'cloud',
+  '技能',
+  'skill',
+  'skills',
+  '所有',
+  'all',
+  '全部',
+  '有什么',
+  '有哪些',
+  '相关',
+  '列表',
+  'list',
+  '查找',
+  '搜索',
+  '发现',
+  '浏览',
+  'find',
+  'search',
+  'discover',
+  'browse',
+  'show',
+  'explore',
+  'agent',
+  '市场',
+  'market',
+  '类目',
+  'category',
+  '安装',
+  'install',
 ]);
 
-async function fetchJson(url, label) {
+async function fetchJson(url, _label) {
   const resp = await fetch(url, { headers: { 'User-Agent': 'huaweicloud-devkit/1.0' } });
   const data = await resp.json();
   if (data?.encoding === 'base64' && data.content) {
@@ -56,7 +86,10 @@ function scoreSkill(skill, specificKws, genericKws) {
     else if (tl.some((t) => t.includes(k))) s += 8;
     else if (dl.includes(k)) s += 5;
     else if (sl.includes(k)) s += 3;
-    if (s > 0) { total += s; matched.push(kw); }
+    if (s > 0) {
+      total += s;
+      matched.push(kw);
+    }
   }
   for (const kw of genericKws) {
     const k = kw.toLowerCase();
@@ -65,7 +98,10 @@ function scoreSkill(skill, specificKws, genericKws) {
     else if (tl.some((t) => t.includes(k))) s += 4;
     else if (dl.includes(k)) s += 2;
     else if (sl.includes(k)) s += 1;
-    if (s > 0) { total += s; matched.push(kw); }
+    if (s > 0) {
+      total += s;
+      matched.push(kw);
+    }
   }
   if (!specificKws.length && total === 0) {
     total = 1;
@@ -76,15 +112,16 @@ function scoreSkill(skill, specificKws, genericKws) {
 }
 
 async function main() {
-  const keyword = process.argv.slice(2).filter((a) => !a.startsWith('-')).join(' ') || '';
+  const keyword =
+    process.argv
+      .slice(2)
+      .filter((a) => !a.startsWith('-'))
+      .join(' ') || '';
   const catIdx = process.argv.indexOf('-c');
   const category = catIdx >= 0 ? process.argv[catIdx + 1] || '' : '';
 
   try {
-    const [idx, cnEnMap] = await Promise.all([
-      fetchJson(INDEX_URL, 'index'),
-      fetchJson(CN_EN_MAP_URL, 'cn-en-map'),
-    ]);
+    const [idx, cnEnMap] = await Promise.all([fetchJson(INDEX_URL, 'index'), fetchJson(CN_EN_MAP_URL, 'cn-en-map')]);
 
     if (!keyword && !category) {
       console.log(`Categories: ${(idx.categories || []).join(', ')}`);
@@ -101,7 +138,15 @@ async function main() {
       const [score, matched] = scoreSkill(skill, specificKws, genericKws);
       if (hasSpecific && score === 0) continue;
       const desc = (skill.description || '').slice(0, 150);
-      results.push({ score, name: skill.name, category: skill.category, service: skill.service, description: desc + (skill.description?.length > 150 ? '...' : ''), triggers: (skill.triggers || []).slice(0, 5), matched });
+      results.push({
+        score,
+        name: skill.name,
+        category: skill.category,
+        service: skill.service,
+        description: desc + (skill.description?.length > 150 ? '...' : ''),
+        triggers: (skill.triggers || []).slice(0, 5),
+        matched,
+      });
     }
     results.sort((a, b) => b.score - a.score);
 
@@ -112,7 +157,9 @@ async function main() {
 
     console.log(`Found ${results.length} skill(s):`);
     for (const r of results) {
-      console.log(`  [${r.score}pts] ${r.name} (${r.category}/${r.service})${r.matched.length ? ' matched: ' + r.matched.join(',') : ''}`);
+      console.log(
+        `  [${r.score}pts] ${r.name} (${r.category}/${r.service})${r.matched.length ? ' matched: ' + r.matched.join(',') : ''}`,
+      );
       console.log(`    ${r.description}`);
     }
   } catch (e) {

package/plugins/huaweicloud-core/skills/huawei-cts/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-cts
-description: "Use when managing Cloud Trace Service (CTS) audit logs, trackers, and traces on Huawei Cloud. Triggers: CTS, Cloud Trace, audit log, tracker, trace, operation record. NOT for: CES monitoring alarms (use huawei-cloud-eye), log analysis (use LTS)."
+description: 'Use when managing Cloud Trace Service (CTS) audit logs, trackers, and traces on Huawei Cloud. Triggers: CTS, Cloud Trace, audit log, tracker, trace, operation record. NOT for: CES monitoring alarms (use huawei-cloud-eye), log analysis (use LTS).'
 version: 1
 ---
 
@@ -16,34 +16,34 @@ Domain expertise for Cloud Trace Service. Covers trackers, traces, notifications
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Tracker required for traces | Must create a tracker before traces are recorded |
-| OBS bucket prerequisite | Tracker needs an OBS bucket for log delivery |
-| 7-day retention default | Trace data retained 7 days by default. Create LTS tracker for longer retention |
-| Organization tracker | Cross-account auditing requires organization tracker |
+| Trap                        | Why                                                                            |
+| --------------------------- | ------------------------------------------------------------------------------ |
+| Tracker required for traces | Must create a tracker before traces are recorded                               |
+| OBS bucket prerequisite     | Tracker needs an OBS bucket for log delivery                                   |
+| 7-day retention default     | Trace data retained 7 days by default. Create LTS tracker for longer retention |
+| Organization tracker        | Cross-account auditing requires organization tracker                           |
 
 ## Common Workflows
 
-| Task | Operation |
-|------|-----------|
-| List operations | `ListOperations --cli-region=<r> --project_id=<p>` |
-| List traces | `ListTraces --cli-region=<r> --project_id=<p>` |
-| Create tracker | `CreateTracker --cli-region=<r> --project_id=<p>` |
-| List trackers | `ListTrackers --cli-region=<r> --project_id=<p>` |
-| Delete tracker | `DeleteTracker --cli-region=<r> --project_id=<p>` |
-| Create notification | `CreateNotification --cli-region=<r> --project_id=<p>` |
-| List notifications | `ListNotifications --cli-region=<r> --project_id=<p>` |
+| Task                 | Operation                                              |
+| -------------------- | ------------------------------------------------------ |
+| List operations      | `ListOperations --cli-region=<r> --project_id=<p>`     |
+| List traces          | `ListTraces --cli-region=<r> --project_id=<p>`         |
+| Create tracker       | `CreateTracker --cli-region=<r> --project_id=<p>`      |
+| List trackers        | `ListTrackers --cli-region=<r> --project_id=<p>`       |
+| Delete tracker       | `DeleteTracker --cli-region=<r> --project_id=<p>`      |
+| Create notification  | `CreateNotification --cli-region=<r> --project_id=<p>` |
+| List notifications   | `ListNotifications --cli-region=<r> --project_id=<p>`  |
 | List trace resources | `ListTraceResources --cli-region=<r> --project_id=<p>` |
 
 Discover exact parameters with `--help` before executing any command.
 
 ## Troubleshooting
 
-| Error | Fix |
-|-------|-----|
-| No traces found | Check tracker is created and enabled. Filter by time range |
-| Tracker creation fails | Ensure OBS bucket exists and has correct permissions |
+| Error                  | Fix                                                        |
+| ---------------------- | ---------------------------------------------------------- |
+| No traces found        | Check tracker is created and enabled. Filter by time range |
+| Tracker creation fails | Ensure OBS bucket exists and has correct permissions       |
 
 ## Security
 

package/plugins/huaweicloud-core/skills/huawei-dds-dcs/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-dds-dcs
-description: "Use when creating or managing Document Database Service (DDS/MongoDB-compatible) or Distributed Cache Service (DCS/Redis/Memcached) on Huawei Cloud. Triggers: DDS, DCS, MongoDB, Redis, Memcached, document DB, cache, replica set, sharding. NOT for: RDS (use huawei-rds), GaussDB (use huawei-gaussdb)."
+description: 'Use when creating or managing Document Database Service (DDS/MongoDB-compatible) or Distributed Cache Service (DCS/Redis/Memcached) on Huawei Cloud. Triggers: DDS, DCS, MongoDB, Redis, Memcached, document DB, cache, replica set, sharding. NOT for: RDS (use huawei-rds), GaussDB (use huawei-gaussdb).'
 version: 1
 ---
 
@@ -14,22 +14,22 @@ Always run `hcloud DDS <Operation> --help` or `hcloud DCS <Operation> --help` be
 
 ## DDS Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Requires 3-node replica | Minimum production deployment needs 3 nodes |
-| Shard key permanent | Once selected, shard key cannot be changed |
-| Storage auto-scaling off | Enable before storage fills |
+| Trap                     | Why                                         |
+| ------------------------ | ------------------------------------------- |
+| Requires 3-node replica  | Minimum production deployment needs 3 nodes |
+| Shard key permanent      | Once selected, shard key cannot be changed  |
+| Storage auto-scaling off | Enable before storage fills                 |
 
 ### Common Workflows
 
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| Create instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
-| Delete instance | `DeleteInstance --cli-region=<r> --project_id=<p>` |
+| Task              | Operation                                           |
+| ----------------- | --------------------------------------------------- |
+| List instances    | `ListInstances --cli-region=<r> --project_id=<p>`   |
+| Create instance   | `CreateInstance --cli-region=<r> --project_id=<p>`  |
+| Delete instance   | `DeleteInstance --cli-region=<r> --project_id=<p>`  |
 | Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>` |
-| Add shard | `AddShardingNode --cli-region=<r> --project_id=<p>` |
-| Create backup | `CreateBackup --cli-region=<r> --project_id=<p>` |
+| Add shard         | `AddShardingNode --cli-region=<r> --project_id=<p>` |
+| Create backup     | `CreateBackup --cli-region=<r> --project_id=<p>`    |
 
 Discover exact parameters with `--help` before executing any command.
 
@@ -37,32 +37,32 @@ Discover exact parameters with `--help` before executing any command.
 
 ## DCS Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Redis password required | Cannot create Redis instance without password |
-| Memcached no password | Memcached has no auth — only accessible within VPC |
-| Cache persistence costs | AOF/RDB persistence uses additional storage |
+| Trap                    | Why                                                |
+| ----------------------- | -------------------------------------------------- |
+| Redis password required | Cannot create Redis instance without password      |
+| Memcached no password   | Memcached has no auth — only accessible within VPC |
+| Cache persistence costs | AOF/RDB persistence uses additional storage        |
 
 ### Common Workflows
 
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| Create Redis instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
-| Delete instance | `DeleteInstances --cli-region=<r> --project_id=<p>` |
-| Restart instance | `RestartInstance --cli-region=<r> --project_id=<p>` |
-| Show node information | `BatchShowNodesInformation --cli-region=<r> --project_id=<p>` |
-| Create custom template | `CreateCustomTemplate --cli-region=<r> --project_id=<p>` |
+| Task                   | Operation                                                     |
+| ---------------------- | ------------------------------------------------------------- |
+| List instances         | `ListInstances --cli-region=<r> --project_id=<p>`             |
+| Create Redis instance  | `CreateInstance --cli-region=<r> --project_id=<p>`            |
+| Delete instance        | `DeleteInstances --cli-region=<r> --project_id=<p>`           |
+| Restart instance       | `RestartInstance --cli-region=<r> --project_id=<p>`           |
+| Show node information  | `BatchShowNodesInformation --cli-region=<r> --project_id=<p>` |
+| Create custom template | `CreateCustomTemplate --cli-region=<r> --project_id=<p>`      |
 
 Discover exact parameters with `--help` before executing any command.
 
 ## Troubleshooting
 
-| Error | Fix |
-|-------|-----|
-| DDS instance creation fails | Check 3-node minimum, VPC/subnet availability |
-| DCS connection refused | Redis instances need password. Memcached only accessible within VPC |
-| DCS auto-expire not working | Enable auto-expire scan task for Redis |
+| Error                       | Fix                                                                 |
+| --------------------------- | ------------------------------------------------------------------- |
+| DDS instance creation fails | Check 3-node minimum, VPC/subnet availability                       |
+| DCS connection refused      | Redis instances need password. Memcached only accessible within VPC |
+| DCS auto-expire not working | Enable auto-expire scan task for Redis                              |
 
 ## Cross-Skill References
 

package/plugins/huaweicloud-core/skills/huawei-deployment/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-deployment
-description: "Use when creating, managing, or running deployment tasks and pipelines on Huawei Cloud CloudDeploy. Triggers: CloudDeploy, deployment, CI/CD, pipeline, release, artifact deployment, deploy task. NOT for: CodeArts Build (build pipeline), SWR container registry."
+description: 'Use when creating, managing, or running deployment tasks and pipelines on Huawei Cloud CloudDeploy. Triggers: CloudDeploy, deployment, CI/CD, pipeline, release, artifact deployment, deploy task. NOT for: CodeArts Build (build pipeline), SWR container registry.'
 version: 1
 ---
 
@@ -16,33 +16,33 @@ Domain expertise for Huawei Cloud CloudDeploy. Covers application creation, depl
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
+| Trap                                                  | Why                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| ----------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Flyway SQL dialect mismatch (H2 dev → MySQL prod)** | Spring Boot apps commonly develop with H2 in-memory DB, then deploy to RDS MySQL. Flyway migrations using H2-specific syntax (e.g. `DATEADD`, `CHARACTER_LENGTH`, `BOOLEAN`) silently succeed on H2 but fail on MySQL. Before deploying, audit `V*__*.sql` migration files: replace `DATEADD` with `DATE_ADD`, `BOOLEAN` with `TINYINT(1)`, remove `characterEncoding=utf8mb4` from Spring Boot datasource URL (KooCLI RDS CreateInstance sets charset at the instance level). Use `Flyway.validate-on-migrate=true` in CI to catch dialect issues early. |
-| Service name may be `CodeArtsDeploy` | hcloud service name for deployment may be `CodeArtsDeploy` instead of `CloudDeploy`. Run `hcloud --help` to verify |
-| Deployment hosts need agent | Install CloudDeploy agent on target hosts first |
-| Task must reference application first | Create application before task |
-| Artifact source defaults to OBS | Most deployment tasks pull artifacts from OBS. Ensure bucket and object exist |
-| Parallel deployments may conflict | Lock resources or use deployment groups |
+| Service name may be `CodeArtsDeploy`                  | hcloud service name for deployment may be `CodeArtsDeploy` instead of `CloudDeploy`. Run `hcloud --help` to verify                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| Deployment hosts need agent                           | Install CloudDeploy agent on target hosts first                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| Task must reference application first                 | Create application before task                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| Artifact source defaults to OBS                       | Most deployment tasks pull artifacts from OBS. Ensure bucket and object exist                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Parallel deployments may conflict                     | Lock resources or use deployment groups                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 
 ## Common Workflows
 
-| Task | Operation |
-|------|-----------|
-| Create application | `CreateApp --name=<n> --platform=<p> --cli-region=<r>` |
+| Task                   | Operation                                                        |
+| ---------------------- | ---------------------------------------------------------------- |
+| Create application     | `CreateApp --name=<n> --platform=<p> --cli-region=<r>`           |
 | Create deployment task | `CreateTask --name=<n> --app_id=<id> --artifact_source_type=OBS` |
-| Start deployment | `StartTask --task_id=<id>` |
-| List tasks | `ListTasks --app_id=<id>` |
-| Delete task | `DeleteTask --task_id=<id>` |
+| Start deployment       | `StartTask --task_id=<id>`                                       |
+| List tasks             | `ListTasks --app_id=<id>`                                        |
+| Delete task            | `DeleteTask --task_id=<id>`                                      |
 
 ## Troubleshooting
 
-| Error | Fix |
-|-------|-----|
-| Agent offline | Check agent service on target host, network connectivity, firewall rules |
-| Deployment timeout | Check artifact size, increase task timeout, verify target host resources |
-| Artifact not found | Verify OBS bucket and object path, check artifact permissions |
-| Permission denied | Verify IAM roles for deployment: `CodeArtsDeploy FullAccess` or custom policy |
+| Error              | Fix                                                                           |
+| ------------------ | ----------------------------------------------------------------------------- |
+| Agent offline      | Check agent service on target host, network connectivity, firewall rules      |
+| Deployment timeout | Check artifact size, increase task timeout, verify target host resources      |
+| Artifact not found | Verify OBS bucket and object path, check artifact permissions                 |
+| Permission denied  | Verify IAM roles for deployment: `CodeArtsDeploy FullAccess` or custom policy |
 
 ## Security
 

package/plugins/huaweicloud-core/skills/huawei-dew/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-dew
-description: "Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secrets, KMS for encryption keys, and credential rotation. Triggers on: secret, credential, API key, token, password, encrypt, decrypt, KMS, CSMS, DEW, certificate, CSR, rotation. Activates for ANY task involving secrets or credentials — load this skill first before touching secrets."
+description: 'Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secrets, KMS for encryption keys, and credential rotation. Triggers on: secret, credential, API key, token, password, encrypt, decrypt, KMS, CSMS, DEW, certificate, CSR, rotation. Activates for ANY task involving secrets or credentials — load this skill first before touching secrets.'
 version: 1
 ---
 
@@ -16,64 +16,73 @@ Domain expertise for Huawei Cloud Data Encryption Workshop (DEW). Covers CSMS fo
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| NEVER fetch secret values into agent context | Use {{resolve:csms:secret-id:SecretString:key}} runtime injection |
-| NEVER echo credentials in conversation | AK/SK, passwords, tokens must never appear in chat |
-| KMS key deletion is irreversible | 7-30 day pending deletion window. Once gone, data is unrecoverable |
-| Secret rotation requires automation | Manual rotation risks stale credentials |
-| Cross-account KMS needs grants | KMS keys are regional. Cross-region data needs grant setup |
+| Trap                                         | Why                                                                |
+| -------------------------------------------- | ------------------------------------------------------------------ |
+| NEVER fetch secret values into agent context | Use {{resolve:csms:secret-id:SecretString:key}} runtime injection  |
+| NEVER echo credentials in conversation       | AK/SK, passwords, tokens must never appear in chat                 |
+| KMS key deletion is irreversible             | 7-30 day pending deletion window. Once gone, data is unrecoverable |
+| Secret rotation requires automation          | Manual rotation risks stale credentials                            |
+| Cross-account KMS needs grants               | KMS keys are regional. Cross-region data needs grant setup         |
 
 ## CSMS Operations
 
 ### Read-only (safe — metadata only)
-| Operation | Description |
-|-----------|-------------|
-| ListSecrets | List all secrets (names only, no values) |
-| DescribeSecret | Get secret metadata (rotation config, KMS key, status) |
-| ListSecretVersions | List version IDs and stages (no values) |
+
+| Operation          | Description                                            |
+| ------------------ | ------------------------------------------------------ |
+| ListSecrets        | List all secrets (names only, no values)               |
+| DescribeSecret     | Get secret metadata (rotation config, KMS key, status) |
+| ListSecretVersions | List version IDs and stages (no values)                |
 
 ### Secret Value (blocked by policy — use runtime injection)
-| Operation | Safe Alternative |
-|-----------|-----------------|
-| DownloadSecret | Use {{resolve:csms:secret-id}} in IaC or SDK |
+
+| Operation         | Safe Alternative                              |
+| ----------------- | --------------------------------------------- |
+| DownloadSecret    | Use {{resolve:csms:secret-id}} in IaC or SDK  |
 | ShowSecretVersion | Use runtime injection, never in agent context |
-| GetSecretValue | Blocked. Use MCP proxy resolve pattern |
+| GetSecretValue    | Blocked. Use MCP proxy resolve pattern        |
 
 ## KMS Operations
 
-| Task | Command | Notes |
-|------|---------|-------|
-| List keys | hcloud KMS ListKeys | Read-only |
-| Create key | hcloud KMS CreateKey --key_alias=<name> | Requires write approval |
-| Encrypt | hcloud KMS EncryptData --key_id=<id> --plaintext=<b64> | Prefer SDK offline encrypt |
-| Decrypt | hcloud KMS DecryptData (**BLOCKED**) | Use runtime injection |
+| Task       | Command                                                | Notes                      |
+| ---------- | ------------------------------------------------------ | -------------------------- |
+| List keys  | hcloud KMS ListKeys                                    | Read-only                  |
+| Create key | hcloud KMS CreateKey --key_alias=<name>                | Requires write approval    |
+| Encrypt    | hcloud KMS EncryptData --key_id=<id> --plaintext=<b64> | Prefer SDK offline encrypt |
+| Decrypt    | hcloud KMS DecryptData (**BLOCKED**)                   | Use runtime injection      |
 
 ## Runtime Injection Pattern
 
 `ash
+
 # Terraform / IaC
+
 resource "huaweicloud_csms_secret" "db_password" {
-  secret_string = var.db_password  # NEVER hardcode
+secret_string = var.db_password # NEVER hardcode
 }
 
 # SDK
+
 secret_value = client.get_secret(secret_id="my-secret")
+
 # Use immediately, never print or store in context
 
 # hcloud (for approved automation only)
+
 hcloud CSMS DownloadSecret --secret_name=<name>
+
 # WARNING: Output goes to stdout. Pipe directly, never capture in agent.
+
 `
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Secret not found | Wrong region or project -> Verify secret ARN includes region/project |
-| AccessDenied on CSMS | Missing IAM CSMS policy -> Add csms:DescribeSecret + kms:Decrypt |
-| KMS key disabled | Key scheduled for deletion or manually disabled -> Enable or create new key |
-| Rotation stuck | Lambda/Python function error -> Check rotation function logs |
+| Error                | Root Cause -> Fix                                                           |
+| -------------------- | --------------------------------------------------------------------------- |
+| Secret not found     | Wrong region or project -> Verify secret ARN includes region/project        |
+| AccessDenied on CSMS | Missing IAM CSMS policy -> Add csms:DescribeSecret + kms:Decrypt            |
+| KMS key disabled     | Key scheduled for deletion or manually disabled -> Enable or create new key |
+| Rotation stuck       | Lambda/Python function error -> Check rotation function logs                |
 
 ## Security Considerations
 

package/plugins/huaweicloud-core/skills/huawei-dew/references/csms-usage.md

@@ -1,28 +1,35 @@
 # CSMS Usage Guide
 
 ## Create Secret
+
 hcloud CSMS CreateSecret --secret_name=prod-db-password --secret_string='{"password":"CHANGE_ME"}'
 
 ## List Secrets (metadata only)
+
 hcloud CSMS ListSecrets
 
 ## Describe Secret
+
 hcloud CSMS DescribeSecret --secret_name=prod-db-password
 
 ## List Versions
+
 hcloud CSMS ListSecretVersions --secret_name=prod-db-password
 
 ## Runtime Injection (Terraform)
+
 data "huaweicloud_csms_secret" "db" {
-  secret_name = "prod-db-password"
+secret_name = "prod-db-password"
 }
 Use: data.huaweicloud_csms_secret.db.secret_string
 
 ## Rotation
+
 - Enable auto-rotation: hcloud CSMS EnableSecretRotation --secret_name=<name> --rotation_interval=30
 - Rotation function ARN: provide Lambda to generate new secret value
 
 ## Policy Rules
+
 - hcloud CSMS DownloadSecret -> BLOCKED (use runtime injection)
 - hcloud CSMS ShowSecretVersion -> BLOCKED
 - hcloud CSMS ListSecrets -> ALLOWED (metadata only)

package/plugins/huaweicloud-core/skills/huawei-dew/references/kms-usage.md

@@ -1,23 +1,29 @@
 # KMS Usage Guide
 
 ## Create Key
+
 hcloud KMS CreateKey --key_alias=app-encryption-key --key_description="Application data encryption"
 
 ## List Keys (metadata only)
+
 hcloud KMS ListKeys
 
 ## Encrypt (offline preferred)
+
 hcloud KMS EncryptData --key_id=<key-id> --plaintext=<base64-data>
 
 ## Decrypt (BLOCKED - use runtime)
+
 DO NOT use hcloud KMS DecryptData directly.
 Use SDK with KMS client in application runtime.
 
 ## Key Rotation
+
 - Enable: hcloud KMS EnableKeyRotation --key_id=<key-id>
 - Rotation period: 365 days (default)
 
 ## Key Deletion
+
 - Schedule: hcloud KMS ScheduleKeyDeletion --key_id=<key-id> --pending_days=7
 - Cancel during pending window: hcloud KMS CancelKeyDeletion --key_id=<key-id>
 - WARNING: After deletion window passes, data encrypted with this key is UNRECOVERABLE