huaweicloud-devkit 1.0.2-next.7 → 1.0.2-next.8

package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-ecs
-description: "Use when creating, configuring, managing, or troubleshooting ECS instances on Huawei Cloud. Covers instance creation (hcloud ECS CreateServers), flavor selection, image management, security groups, EIP binding, disk attachment, auto-scaling (AS), and troubleshooting. Triggers on: ECS, instance, flavor, image, security group, EIP, EVS, auto-scaling. NOT for: CCE container workloads (use huawei-cce), BMS bare metal servers."
+description: 'Use when creating, configuring, managing, or troubleshooting ECS instances on Huawei Cloud. Covers instance creation (hcloud ECS CreateServers), flavor selection, image management, security groups, EIP binding, disk attachment, auto-scaling (AS), and troubleshooting. Triggers on: ECS, instance, flavor, image, security group, EIP, EVS, auto-scaling. NOT for: CCE container workloads (use huawei-cce), BMS bare metal servers.'
 version: 1
 ---
 
@@ -17,6 +17,7 @@ Domain expertise for Huawei Cloud Elastic Cloud Server (ECS). Covers instance li
 ## Prerequisites
 
 Before creating an ECS instance from scratch, you MUST have:
+
 - A VPC (see `huawei-vpc`)
 - A subnet with DNS configured (see `huawei-vpc`)
 - A security group with application ports open (see `huawei-vpc`)
@@ -25,39 +26,39 @@ If these do not exist, load the `huawei-vpc` skill first and create them before
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Flavor not in region | Not all flavors available everywhere. Check with ECS ListFlavors first |
-| Security group denies all | New SGs deny ALL inbound. Must explicitly add rules |
-| EIP bills when idle | Unattached EIP still incurs charges |
-| Stopped instance still bills | Pay-per-use instances bill when stopped (unless shutdown-no-billing flavor) |
-| Disk survives instance delete | Deleting instance does NOT delete system disk by default |
+| Trap                          | Why                                                                         |
+| ----------------------------- | --------------------------------------------------------------------------- |
+| Flavor not in region          | Not all flavors available everywhere. Check with ECS ListFlavors first      |
+| Security group denies all     | New SGs deny ALL inbound. Must explicitly add rules                         |
+| EIP bills when idle           | Unattached EIP still incurs charges                                         |
+| Stopped instance still bills  | Pay-per-use instances bill when stopped (unless shutdown-no-billing flavor) |
+| Disk survives instance delete | Deleting instance does NOT delete system disk by default                    |
 
 ## Flavor Selection Guide
 
 Flavor families are **region-dependent**. Always run `hcloud ECS ListFlavors --cli-region=<r>` to discover available flavors before recommending.
 
-| Scenario | Family | What to look for |
-|----------|--------|-----------------|
-| Web app / microservices | General-purpose (ac, s, sn, c) | 2-4 vCPU, 4-8 GB RAM |
-| Database / big data | Memory-optimized (m, r) | 4-8 vCPU, 16-64 GB RAM |
-| AI inference | GPU (g, p) | 8+ vCPU, 64+ GB RAM + GPU |
-| HPC | High-IO (h, ir, i) | 8+ vCPU, local SSD |
+| Scenario                | Family                         | What to look for          |
+| ----------------------- | ------------------------------ | ------------------------- |
+| Web app / microservices | General-purpose (ac, s, sn, c) | 2-4 vCPU, 4-8 GB RAM      |
+| Database / big data     | Memory-optimized (m, r)        | 4-8 vCPU, 16-64 GB RAM    |
+| AI inference            | GPU (g, p)                     | 8+ vCPU, 64+ GB RAM + GPU |
+| HPC                     | High-IO (h, ir, i)             | 8+ vCPU, local SSD        |
 
 > See `references/flavors.md` for discovery workflow. **Do not hardcode flavor names** — availability changes by region and over time.
 
 ## Common Workflows
 
-| Task | Command | Steps |
-|------|---------|-------|
-| List flavors | hcloud ECS ListFlavors --cli-region=<region> | references/flavors.md |
-| Create instance | hcloud ECS CreateServers --server.name=<n> --server.flavorRef=<id> --server.imageRef=<id> --server.nics.1.subnet_id=<id> --server.availability_zone=<az> | references/create-instance.md |
-| Find by name | See "How to search for instances" below | |
-| Bind EIP | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
-| Security group rule | hcloud VPC CreateSecurityGroupRule --security_group_id=<id> --direction=<direction> --protocol=<protocol> | references/sg.md |
-| Attach disk | hcloud EVS AttachVolume --volume_id=<id> --server_id=<id> | references/evs.md |
-| Delete instance | hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true | references/create-instance.md |
-| Reboot instance | hcloud ECS BatchRebootServers --reboot.servers.1.id=<id> --reboot.type=SOFT | NOT `RebootServer` — that operation does not exist |
+| Task                | Command                                                                                                                                                  | Steps                                                                                    |
+| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
+| List flavors        | hcloud ECS ListFlavors --cli-region=<region>                                                                                                             | references/flavors.md                                                                    |
+| Create instance     | hcloud ECS CreateServers --server.name=<n> --server.flavorRef=<id> --server.imageRef=<id> --server.nics.1.subnet_id=<id> --server.availability_zone=<az> | references/create-instance.md                                                            |
+| Find by name        | See "How to search for instances" below                                                                                                                  |                                                                                          |
+| Bind EIP            | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT                      | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
+| Security group rule | hcloud VPC CreateSecurityGroupRule --security_group_id=<id> --direction=<direction> --protocol=<protocol>                                                | references/sg.md                                                                         |
+| Attach disk         | hcloud EVS AttachVolume --volume_id=<id> --server_id=<id>                                                                                                | references/evs.md                                                                        |
+| Delete instance     | hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true                                                                 | references/create-instance.md                                                            |
+| Reboot instance     | hcloud ECS BatchRebootServers --reboot.servers.1.id=<id> --reboot.type=SOFT                                                                              | NOT `RebootServer` — that operation does not exist                                       |
 
 ## How to Search for Instances
 
@@ -112,6 +113,7 @@ ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'command'
 ```
 
 Example — re-run failed cloud-init setup manually:
+
 ```bash
 ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'dnf install -y nginx && systemctl enable --now nginx'
 ```
@@ -127,14 +129,14 @@ ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'dnf install -y ngin
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Cannot SSH | SG missing port 22 or no EIP -> Add ingress rule / Bind EIP |
-| Flavor unavailable | Region limitation -> ListFlavors in target region |
-| Insufficient resources | Stock depleted -> Change flavor or AZ |
-| AuthFailure | Expired AK/SK -> re-run `npx huaweicloud-devkit auth init` |
-| APIGW.0802 / region permission | IAM user has no access to this region -> IAM console → User → Permissions → add region, or switch to another region |
-| Cannot SSH (port 22 open) | SCP policy may be blocking SSH. Check `SYS.0403` errors in command output -> Use cloud-init/user_data for initial setup instead. See `references/create-instance.md` §Bootstrap |
+| Error                          | Root Cause -> Fix                                                                                                                                                               |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Cannot SSH                     | SG missing port 22 or no EIP -> Add ingress rule / Bind EIP                                                                                                                     |
+| Flavor unavailable             | Region limitation -> ListFlavors in target region                                                                                                                               |
+| Insufficient resources         | Stock depleted -> Change flavor or AZ                                                                                                                                           |
+| AuthFailure                    | Expired AK/SK -> re-run `npx huaweicloud-devkit auth init`                                                                                                                      |
+| APIGW.0802 / region permission | IAM user has no access to this region -> IAM console → User → Permissions → add region, or switch to another region                                                             |
+| Cannot SSH (port 22 open)      | SCP policy may be blocking SSH. Check `SYS.0403` errors in command output -> Use cloud-init/user_data for initial setup instead. See `references/create-instance.md` §Bootstrap |
 
 ## Security Considerations
 
@@ -158,6 +160,7 @@ Prefer these tools over raw hcloud CLI — they enforce safety policies:
 ## Without MCP (Fallback)
 
 If MCP tools are NOT available (new install, session not restarted):
+
 - Raw hcloud commands WILL appear in shell history — passwords and secrets are at risk
 - Always use key_name instead of adminPass
 - Verify safety manually: no secret value reads, no credential file access
@@ -171,10 +174,10 @@ Fall back to hcloud CLI. State: "MCP unavailable, using local hcloud CLI."
 
 Flexus is the lightweight ECS family. Two variants:
 
-| Variant | API | CLI | Billing |
-|---------|-----|:---:|---------|
-| **Flexus L** | HCSS (hcss:lightInstances) | ❌ No hcloud — Python SDK only | Prepaid only |
-| **Flexus X** | Standard ECS API | ✅ `hcloud ECS` with `x1.*` flavors | On-demand & prepaid |
+| Variant      | API                        |                 CLI                 | Billing             |
+| ------------ | -------------------------- | :---------------------------------: | ------------------- |
+| **Flexus L** | HCSS (hcss:lightInstances) |   ❌ No hcloud — Python SDK only    | Prepaid only        |
+| **Flexus X** | Standard ECS API           | ✅ `hcloud ECS` with `x1.*` flavors | On-demand & prepaid |
 
 For Flexus X, use standard ECS CreateServers flow with `x1.*` flavors. For Flexus L, manual console provisioning is recommended — no KooCLI path exists.
 

package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md

@@ -3,10 +3,12 @@
 **Before executing any command: If MCP tools are not available** (new session after install), restart your session or use hcloud CLI directly with caution. Commands using adminPass/password WILL appear in shell history — prefer key_name.
 
 ## 1. Discover flavors
+
 hcloud ECS ListFlavors --cli-region=<region> --cli-output=json
 Filter for `os_extra_specs.cond:operation:status == normal` — most results are abandoned. See references/flavors.md.
 
 ## 2. Find availability zones
+
 hcloud ECS NovaListAvailabilityZones --cli-region=<region>
 
 ## 3. Find image
@@ -19,27 +21,32 @@ hcloud IMS ListImages --cli-region=<region> --__imagetype=gold --__isregistered=
 If searching by name (e.g. --name="Ubuntu") returns empty: use broad search without name filter, pick from results. Some regions only offer Huawei Cloud EulerOS (HCE).
 
 Common images (verify live per region):
-| Image | Region | ID |
-|-------|--------|----|
+
+| Image            | Region     | ID                                   |
+| ---------------- | ---------- | ------------------------------------ |
 | HCE 2.0 Standard | cn-north-4 | 7d940784-ac0a-425f-b3fa-8478f1a1df70 |
-| Ubuntu 22.04 | Query live | Query live |
-| CentOS 8.2 | Query live | Query live |
+| Ubuntu 22.04     | Query live | Query live                           |
+| CentOS 8.2       | Query live | Query live                           |
 
 ## 4. Verify or create VPC/subnet
+
 hcloud VPC ListVpcs --cli-region=<region>
 hcloud VPC ListSubnets --vpc_id=<vpc-id> --cli-region=<region>
 If no VPC/subnet exists: load `huawei-vpc` skill → create VPC → create subnet (with DNS) → create security group → return here.
 
 ## 5. Create keypair (recommended over adminPass)
+
 hcloud ECS NovaCreateKeypair --keypair.name=<name>
 Save the returned private key to a local file. The public key is auto-injected.
 
 Password alternative:
+
 - adminPass: 8-26 chars, must have uppercase + lowercase + digit + special char
 - Passwords appear ONCE in creation output and are not retrievable
 - Passwords are logged in shell history — this is a security risk
 
 ## 6. Create instance
+
 hcloud ECS CreateServers --cli-region=<region> --server.name=<name> --server.flavorRef=<flavor-id> --server.imageRef=<image-id> --server.nics.1.subnet_id=<subnet-id> --server.root_volume.volumetype=<type> --server.root_volume.size=<minsize> --server.vpcid=<vpc-id> --server.availability_zone=<az> --server.key_name=<keypair-name> --server.count=1
 
 ### Bootstrap with user_data (cloud-init)
@@ -63,6 +70,7 @@ hcloud ECS CreateServers ... --server.user_data=$user_data
 > **Debugging**: If the script didn't run, check `/var/log/cloud-init-output.log` on the instance.
 >
 > **Recovery after failure**: user_data only executes on **first boot**. Restarting the instance will NOT re-run user_data scripts. If cloud-init fails (e.g., DNS missing → `yum`/`apt` cannot resolve repos):
+>
 > 1. Fix the root cause (e.g., update subnet DNS via `VPC UpdateSubnet`)
 > 2. Either: SSH into the instance and run the setup commands manually (see `huawei-ecs` → SSH Connection Verification → Running Commands Inside the Instance)
 > 3. Or: Delete the instance and recreate with corrected user_data (fresh boot)
@@ -70,6 +78,7 @@ hcloud ECS CreateServers ... --server.user_data=$user_data
 ## 7. EIP (two methods)
 
 ### Method A: Inline with CreateServers (Recommended)
+
 Add EIP parameters to the `CreateServers` command in step 6:
 
 ```bash
@@ -84,6 +93,7 @@ hcloud ECS CreateServers \
 > **Trap**: Parameter names differ from `EIP CreatePublicip`. Use `iptype` (not `type`), `sharetype` (not `share_type`), and `chargemode` (not `charging_mode`). Always verify with `hcloud ECS CreateServers --help`.
 
 ### Method B: Create and bind separately
+
 hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
 
 ```bash
@@ -131,3 +141,4 @@ Warning: --delete_publicip and --delete_volume default to false. Set to true to
 - Flavor: must be available in target region — always ListFlavors first
 - Root volume: SSD 40GB min
 - Keypair is safer than adminPass (passwords leak into shell history)
+```

package/plugins/huaweicloud-core/skills/huawei-ecs/references/flavors.md

@@ -20,21 +20,23 @@ hcloud ECS ListFlavors --cli-region=<region> --cli-output=json \
 
 ## Step 2: Filter by scenario
 
-| Scenario | Look for | Preference |
-|----------|----------|------------|
-| Web app / microservices | General-purpose families (ac, s, sn) | 2-4 vCPU, 4-8 GB RAM |
-| Database / big data | Memory-optimized families (m, r) | 4-8 vCPU, 16-64 GB RAM |
-| AI inference / training | GPU families (g, p) | 8+ vCPU, 64+ GB RAM |
-| HPC / high throughput | High-IO families (h, ir, i) | 8+ vCPU, local SSD |
+| Scenario                | Look for                             | Preference             |
+| ----------------------- | ------------------------------------ | ---------------------- |
+| Web app / microservices | General-purpose families (ac, s, sn) | 2-4 vCPU, 4-8 GB RAM   |
+| Database / big data     | Memory-optimized families (m, r)     | 4-8 vCPU, 16-64 GB RAM |
+| AI inference / training | GPU families (g, p)                  | 8+ vCPU, 64+ GB RAM    |
+| HPC / high throughput   | High-IO families (h, ir, i)          | 8+ vCPU, local SSD     |
 
 ## Step 3: Match spec from ListFlavors output
 
 Common naming pattern: `<family><gen>.<type>x<ratio>`
+
 - `ac6.2xlarge.2` = ac6 family, 2xlarge (8 vCPU), ratio 2 (vCPU:RAM = 1:2 → 16 GB)
 
 ## Do Not Hardcode
 
 Flavor family names are region-dependent. Example discrepancies seen in testing:
+
 - cn-south-1: ac6/ac7/kc/r-c7e (s6/m6/g6 NOT available)
 - Other regions may have s6/m6/g6 families
 
@@ -44,10 +46,10 @@ Always run ListFlavors and pick from actual results.
 
 `ListFlavors` returns ALL specs including abandoned ones. Before selecting a spec, check the `os_extra_specs` field in the JSON response:
 
-| Field | Values | Meaning |
-|-------|--------|---------|
+| Field                                  | Values                         | Meaning                                                                              |
+| -------------------------------------- | ------------------------------ | ------------------------------------------------------------------------------------ |
 | `os_extra_specs.cond:operation:status` | `normal`, `abandon`, `sellout` | Only `normal` specs can be created. `abandon` = deprecated, `sellout` = out of stock |
-| `os_extra_specs.cond:operation:az` | e.g. `cn-north-4g(normal)` | Spec is available in this AZ. Multiple entries = multiple AZ support |
+| `os_extra_specs.cond:operation:az`     | e.g. `cn-north-4g(normal)`     | Spec is available in this AZ. Multiple entries = multiple AZ support                 |
 
 A flavor can be `normal` globally but `abandon` in specific AZs. Selecting an `abandon` or `sellout` spec will fail with **`Ecs.0019`** at creation time — there is no pre-flight validation in `ListFlavors`. If creation fails:
 

package/plugins/huaweicloud-core/skills/huawei-ecs/references/troubleshooting.md

@@ -4,16 +4,16 @@
 
 ## 错误码映射
 
-| 错误 | 根因 | 修复 |
-|------|------|------|
-| `Ecs.0005` flavor-image 不匹配 | 镜像虚拟化类型与规格不兼容 | 检查 image `__support_amd`/`__support_xen` 与 flavor `os_extra_specs`。BareMetal 镜像不兼容标准 ECS 规格 |
-| `[USE_ERROR]不正确的参数:imagetype` | 参数名错误 | KooCLI 使用双下划线前缀：`--__imagetype=gold`（不是 `--imagetype`） |
-| `[USE_ERROR]不正确的参数:chargingMode` | 参数路径错误 | 计费模式参数路径：`--server.extendparam.chargingMode=postPaid`。不传默认按需付费 |
-| `[USE_ERROR]不正确的参数:__support_amd` | 参数无效 | `IMS ListImages` 某些版本不支持此过滤。去掉该参数，使用 client-side 过滤 |
-| Cannot SSH | 安全组未开放22端口 或 未绑定EIP | 1) 添加入方向规则 tcp 22。2) `hcloud EIP BindPublicIp` |
-| Flavor unavailable | 区域不支持该规格 | `hcloud ECS ListFlavors --cli-region=<r>` 先查。不硬编码 s6/m6 等规格名 |
-| Insufficient resources | AZ 库存不足 | 换规格、换 AZ、或等待资源释放 |
-| AuthFailure | AK/SK 过期或无效 | `npx huaweicloud-devkit auth init` 重新配置统一凭据 |
+| 错误                                    | 根因                            | 修复                                                                                                     |
+| --------------------------------------- | ------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| `Ecs.0005` flavor-image 不匹配          | 镜像虚拟化类型与规格不兼容      | 检查 image `__support_amd`/`__support_xen` 与 flavor `os_extra_specs`。BareMetal 镜像不兼容标准 ECS 规格 |
+| `[USE_ERROR]不正确的参数:imagetype`     | 参数名错误                      | KooCLI 使用双下划线前缀：`--__imagetype=gold`（不是 `--imagetype`）                                      |
+| `[USE_ERROR]不正确的参数:chargingMode`  | 参数路径错误                    | 计费模式参数路径：`--server.extendparam.chargingMode=postPaid`。不传默认按需付费                         |
+| `[USE_ERROR]不正确的参数:__support_amd` | 参数无效                        | `IMS ListImages` 某些版本不支持此过滤。去掉该参数，使用 client-side 过滤                                 |
+| Cannot SSH                              | 安全组未开放22端口 或 未绑定EIP | 1) 添加入方向规则 tcp 22。2) `hcloud EIP BindPublicIp`                                                   |
+| Flavor unavailable                      | 区域不支持该规格                | `hcloud ECS ListFlavors --cli-region=<r>` 先查。不硬编码 s6/m6 等规格名                                  |
+| Insufficient resources                  | AZ 库存不足                     | 换规格、换 AZ、或等待资源释放                                                                            |
+| AuthFailure                             | AK/SK 过期或无效                | `npx huaweicloud-devkit auth init` 重新配置统一凭据                                                      |
 
 ## 创建失败诊断流程
 
@@ -38,10 +38,10 @@ hcloud IMS ListImages --cli-region=<r> --__imagetype=gold --__isregistered=true
 
 ## 密钥对 vs 密码
 
-| 方式 | 安全 | 建议 |
-|------|------|------|
+| 方式                       | 安全  | 建议                                               |
+| -------------------------- | ----- | -------------------------------------------------- |
 | `--server.key_name=<name>` | ✅ 高 | **推荐**。先 `hcloud DEW CreateKeypair` 创建密钥对 |
-| `--server.adminPass=<pw>` | ❌ 低 | 密码明文进入 shell 历史。仅测试用 |
+| `--server.adminPass=<pw>`  | ❌ 低 | 密码明文进入 shell 历史。仅测试用                  |
 
 密码要求：8-26 字符，含大写 + 小写 + 数字 + 特殊字符。
 

package/plugins/huaweicloud-core/skills/huawei-functiongraph/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-functiongraph
-description: "Use when creating, deploying, or managing serverless functions on FunctionGraph. Covers triggers (APIG/OBS/timer/SMN), cold start, reserved concurrency. Triggers: FunctionGraph, serverless, function, Lambda, trigger. NOT for: CCE containers (use huawei-cce)."
+description: 'Use when creating, deploying, or managing serverless functions on FunctionGraph. Covers triggers (APIG/OBS/timer/SMN), cold start, reserved concurrency. Triggers: FunctionGraph, serverless, function, Lambda, trigger. NOT for: CCE containers (use huawei-cce).'
 version: 1
 ---
 
@@ -20,16 +20,16 @@ Domain expertise for Huawei Cloud FunctionGraph. Covers function lifecycle, code
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Service name is `FunctionGraph` | NOT `FGS`. KooCLI 7.x uses the full service name |
-| CLI requires `project_id` | Get it: `hcloud IAM KeystoneListProjects` or extract from URN `urn:fss:<region>:<project_id>:...` |
-| Cold start 100ms-2s | Reserve concurrency for latency-sensitive workloads |
-| Max execution 900s | Use ECS/CCE for long-running tasks |
-| Env vars plaintext | Use DEW for secrets |
-| **ZIP upload is unreliable** | `CreateFunction --code_type=zip --code_filename=xxx.zip` succeeds even with a nonexistent file — the function is created with empty code. Prefer `code_type=inline` for simple functions. If using zip, verify `code_size` > placeholder after creation and run `InvokeFunction` to confirm output. |
-| **DeleteFunction strip `:latest`** | Passing `urn:fss:...:function:xxx:latest` causes FSS.0400. Strip `:latest` suffix (DeleteFunction only — UpdateApiV2 needs the full URN). |
-| **DeleteFunctionTrigger does NOT cascade** | Deleting a DEDICATEDGATEWAY trigger leaves the API in APIG. Manually clean up: `hcloud APIG DeleteApiV2 --instance_id=<id> --api_id=<api-id>`. |
+| Trap                                       | Why                                                                                                                                                                                                                                                                                                 |
+| ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Service name is `FunctionGraph`            | NOT `FGS`. KooCLI 7.x uses the full service name                                                                                                                                                                                                                                                    |
+| CLI requires `project_id`                  | Get it: `hcloud IAM KeystoneListProjects` or extract from URN `urn:fss:<region>:<project_id>:...`                                                                                                                                                                                                   |
+| Cold start 100ms-2s                        | Reserve concurrency for latency-sensitive workloads                                                                                                                                                                                                                                                 |
+| Max execution 900s                         | Use ECS/CCE for long-running tasks                                                                                                                                                                                                                                                                  |
+| Env vars plaintext                         | Use DEW for secrets                                                                                                                                                                                                                                                                                 |
+| **ZIP upload is unreliable**               | `CreateFunction --code_type=zip --code_filename=xxx.zip` succeeds even with a nonexistent file — the function is created with empty code. Prefer `code_type=inline` for simple functions. If using zip, verify `code_size` > placeholder after creation and run `InvokeFunction` to confirm output. |
+| **DeleteFunction strip `:latest`**         | Passing `urn:fss:...:function:xxx:latest` causes FSS.0400. Strip `:latest` suffix (DeleteFunction only — UpdateApiV2 needs the full URN).                                                                                                                                                           |
+| **DeleteFunctionTrigger does NOT cascade** | Deleting a DEDICATEDGATEWAY trigger leaves the API in APIG. Manually clean up: `hcloud APIG DeleteApiV2 --instance_id=<id> --api_id=<api-id>`.                                                                                                                                                      |
 
 ## Prerequisites
 
@@ -42,13 +42,13 @@ hcloud FunctionGraph --help        # confirm service is available
 
 If you see `FSS.0403 Forbidden`, the user needs these permissions:
 
-| Operation | Required Permission |
-|-----------|---------------------|
+| Operation       | Required Permission                     |
+| --------------- | --------------------------------------- |
 | Create function | `functiongraph:function:createFunction` |
-| List functions | `functiongraph:function:list` |
+| List functions  | `functiongraph:function:list`           |
 | Delete function | `functiongraph:function:deleteFunction` |
-| Invoke function | `functiongraph:function:invoke` |
-| Create trigger | `functiongraph:trigger:*` |
+| Invoke function | `functiongraph:function:invoke`         |
+| Create trigger  | `functiongraph:trigger:*`               |
 
 Grant via IAM console (`FunctionGraph FullAccess` role) or ask project admin.
 
@@ -56,18 +56,19 @@ Grant via IAM console (`FunctionGraph FullAccess` role) or ask project admin.
 
 Always discover parameters with `--help` before executing. These are the correct operation names:
 
-| Task | Operation | Gotchas |
-|------|-----------|---------|
-| List functions | `ListFunctions` | |
-| Show function | `ShowFunctionConfig` | |
-| Create function | `CreateFunction` | references/create-function.md |
-| Delete function | `DeleteFunction` | Strip `:latest` from URN |
-| Invoke function | `InvokeFunction` | Requires body param (`--name=<value>` becomes event body). Use `--x_cff_request_version=v0` for raw output, `v1` for APIG-wrapped. |
-| Create trigger | `CreateFunctionTrigger` | references/triggers.md |
-| List triggers | `ListFunctionTriggers` | |
-| Delete trigger | `DeleteFunctionTrigger` | |
+| Task            | Operation               | Gotchas                                                                                                                            |
+| --------------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
+| List functions  | `ListFunctions`         |                                                                                                                                    |
+| Show function   | `ShowFunctionConfig`    |                                                                                                                                    |
+| Create function | `CreateFunction`        | references/create-function.md                                                                                                      |
+| Delete function | `DeleteFunction`        | Strip `:latest` from URN                                                                                                           |
+| Invoke function | `InvokeFunction`        | Requires body param (`--name=<value>` becomes event body). Use `--x_cff_request_version=v0` for raw output, `v1` for APIG-wrapped. |
+| Create trigger  | `CreateFunctionTrigger` | references/triggers.md                                                                                                             |
+| List triggers   | `ListFunctionTriggers`  |                                                                                                                                    |
+| Delete trigger  | `DeleteFunctionTrigger` |                                                                                                                                    |
 
 Discover exact parameters:
+
 ```bash
 hcloud FunctionGraph CreateFunction --help
 hcloud FunctionGraph CreateFunctionTrigger --help
@@ -83,19 +84,19 @@ See `references/deploy-workflow.md` for a step-by-step example with code templat
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| `不支持的服务名称:FGS` | Use `FunctionGraph`, not `FGS` |
-| `不支持的operation:CreateTrigger` | Use `CreateFunctionTrigger` |
-| `FSS.0403` / Forbidden | Missing IAM permissions — see IAM Permissions above |
-| `缺少必填参数:{*}` on Invoke | Add body param: `--name=<value>` |
-| APIG/EOM trigger error | `trigger_type_code=APIG` deprecated — use `DEDICATEDGATEWAY` |
-| `event_data` parse error | Use dotted format: `--event_data.key=value`, NOT JSON string |
-| FSS.1078 / code upload fails | `--code_filename` is filename-only, no path. `cd` to zip directory first |
-| DeleteFunction with `:latest` | Strip `:latest` version suffix from URN |
-| Code too large | Inline limit 10KB — use `zip`/`obs` code type |
-| Cold start slow | Set reserved instances for critical functions |
-| Auth failure | Run `npx huaweicloud-devkit auth init` |
+| Error                             | Root Cause -> Fix                                                        |
+| --------------------------------- | ------------------------------------------------------------------------ |
+| `不支持的服务名称:FGS`            | Use `FunctionGraph`, not `FGS`                                           |
+| `不支持的operation:CreateTrigger` | Use `CreateFunctionTrigger`                                              |
+| `FSS.0403` / Forbidden            | Missing IAM permissions — see IAM Permissions above                      |
+| `缺少必填参数:{*}` on Invoke      | Add body param: `--name=<value>`                                         |
+| APIG/EOM trigger error            | `trigger_type_code=APIG` deprecated — use `DEDICATEDGATEWAY`             |
+| `event_data` parse error          | Use dotted format: `--event_data.key=value`, NOT JSON string             |
+| FSS.1078 / code upload fails      | `--code_filename` is filename-only, no path. `cd` to zip directory first |
+| DeleteFunction with `:latest`     | Strip `:latest` version suffix from URN                                  |
+| Code too large                    | Inline limit 10KB — use `zip`/`obs` code type                            |
+| Cold start slow                   | Set reserved instances for critical functions                            |
+| Auth failure                      | Run `npx huaweicloud-devkit auth init`                                   |
 
 ## Security Considerations
 

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/apig-event-format.md

@@ -22,6 +22,7 @@ When APIG calls FunctionGraph via DEDICATEDGATEWAY trigger, the event structure
 `event["body"]` is Base64 encoded. You MUST decode it:
 
 **Python handler template:**
+
 ```python
 import json, base64
 
@@ -38,18 +39,19 @@ def handler(event, context):
 ```
 
 **Node.js handler template:**
+
 ```js
 exports.handler = async (event, context) => {
-    let body = event.body || "";
-    if (event.isBase64Encoded) {
-        body = Buffer.from(body, "base64").toString("utf8");
-    }
-    const data = body ? JSON.parse(body) : {};
-    return {
-        statusCode: 200,
-        body: JSON.stringify({ message: "ok", received: data }),
-        headers: { "Content-Type": "application/json" }
-    };
+  let body = event.body || '';
+  if (event.isBase64Encoded) {
+    body = Buffer.from(body, 'base64').toString('utf8');
+  }
+  const data = body ? JSON.parse(body) : {};
+  return {
+    statusCode: 200,
+    body: JSON.stringify({ message: 'ok', received: data }),
+    headers: { 'Content-Type': 'application/json' },
+  };
 };
 ```
 

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md

@@ -2,14 +2,14 @@
 
 ## Runtime Options
 
-| Runtime | Handler Format | Example |
-|---------|---------------|---------|
-| Python3.9 | `index.handler` | `def handler(event, context): return {"statusCode": 200}` |
-| Python3.10 | `index.handler` | Same as 3.9 |
-| Node.js 18 | `index.handler` | `exports.handler = async (event, context) => ({statusCode: 200})` |
-| Java 8/11/17 | `com.example.Handler::handleRequest` | Java class method |
-| Go 1.x | `handler` | Go function name |
-| C# (.NET Core) | `CsharpDemo::CsharpDemo.Function::Handler` | Namespace.Class::Method |
+| Runtime        | Handler Format                             | Example                                                           |
+| -------------- | ------------------------------------------ | ----------------------------------------------------------------- |
+| Python3.9      | `index.handler`                            | `def handler(event, context): return {"statusCode": 200}`         |
+| Python3.10     | `index.handler`                            | Same as 3.9                                                       |
+| Node.js 18     | `index.handler`                            | `exports.handler = async (event, context) => ({statusCode: 200})` |
+| Java 8/11/17   | `com.example.Handler::handleRequest`       | Java class method                                                 |
+| Go 1.x         | `handler`                                  | Go function name                                                  |
+| C# (.NET Core) | `CsharpDemo::CsharpDemo.Function::Handler` | Namespace.Class::Method                                           |
 
 ## Create Function (inline)
 
@@ -26,13 +26,13 @@ hcloud FunctionGraph CreateFunction \
   --cli-region=<region>
 ```
 
-| Param | Required | Range/Default |
-|-------|----------|---------------|
-| `--func_name` | Yes | 1-60 chars |
-| `--runtime` | Yes | See runtime options above |
-| `--handler` | Yes | Per runtime |
-| `--memory_size` | No | 128-4096 MB, default 128 |
-| `--timeout` | No | 1-900s, default 3 |
+| Param           | Required | Range/Default             |
+| --------------- | -------- | ------------------------- |
+| `--func_name`   | Yes      | 1-60 chars                |
+| `--runtime`     | Yes      | See runtime options above |
+| `--handler`     | Yes      | Per runtime               |
+| `--memory_size` | No       | 128-4096 MB, default 128  |
+| `--timeout`     | No       | 1-900s, default 3         |
 
 ## ZIP Upload Warning
 
@@ -49,11 +49,11 @@ Grant `FunctionGraph FullAccess` role or custom policy.
 
 ## Error Codes
 
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| FSS.0400 | `:latest` suffix on URN. Strip it |
-| FSS.1417 | Missing DEDICATEDGATEWAY params |
-| FSS.0403 | Insufficient IAM permission |
+| Error    | Root Cause -> Fix                                                                                                                           |
+| -------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| FSS.0400 | `:latest` suffix on URN. Strip it                                                                                                           |
+| FSS.1417 | Missing DEDICATEDGATEWAY params                                                                                                             |
+| FSS.0403 | Insufficient IAM permission                                                                                                                 |
 | FSS.1020 | Missing `--app_xrole` when binding VPC. Create IAM agency with `trust_domain_name=functiongraph`. See `huawei-iam` skill → Agencies section |
 
 ## VPC + Agency Configuration
@@ -68,4 +68,5 @@ hcloud IAM GrantRoleToAgency --agency_name=<name> --role_id=<role-id>
 # 3. Use in CreateFunction
 hcloud FunctionGraph CreateFunction --func_vpc.vpc_id=<vpc> --func_vpc.subnet_id=<subnet> --app_xrole=<name> ...
 ```
+
 | QuotaExceeded | Max 10 functions per project per region |

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/triggers.md

@@ -16,12 +16,12 @@ KooCLI uses **dotted key-value format**, NOT JSON strings:
 
 ## Trigger Types
 
-| Type | `--trigger_type_code` | Notes |
-|------|----------------------|-------|
-| APIG Dedicated | `DEDICATEDGATEWAY` | Use this, not `APIG` (deprecated). Requires APIG instance. |
-| Timer / Cron | `TIMER` | Simplest trigger for testing. No APIG dependency. |
-| OBS | `OBS` | Event when objects created/deleted in bucket |
-| SMN | `SMN` | Message notification trigger |
+| Type           | `--trigger_type_code` | Notes                                                      |
+| -------------- | --------------------- | ---------------------------------------------------------- |
+| APIG Dedicated | `DEDICATEDGATEWAY`    | Use this, not `APIG` (deprecated). Requires APIG instance. |
+| Timer / Cron   | `TIMER`               | Simplest trigger for testing. No APIG dependency.          |
+| OBS            | `OBS`                 | Event when objects created/deleted in bucket               |
+| SMN            | `SMN`                 | Message notification trigger                               |
 
 ## TIMER Trigger (Simple Testing)
 
@@ -46,22 +46,22 @@ hcloud FunctionGraph CreateFunctionTrigger \
 
 These are labeled optional by `--help` but are **required** for DEDICATEDGATEWAY:
 
-| Param | Note |
-|-------|------|
-| `--event_data.protocol` | `HTTPS` or `HTTP` or `BOTH` |
-| `--event_data.sl_domain` | Subdomain from APIG instance (e.g. `xxxx.apic.<region>.huaweicloudapis.com`) |
-| `--event_data.env_name` | API environment name (`RELEASE`) |
-| `--event_data.env_id` | API environment ID |
-| `--event_data.instance_id` | APIG dedicated instance ID |
-| `--event_data.group_id` | API group ID |
-| `--event_data.name` | API name — **hyphens (`-`) are DISALLOWED**. Use underscores (`_`) instead. |
+| Param                      | Note                                                                         |
+| -------------------------- | ---------------------------------------------------------------------------- |
+| `--event_data.protocol`    | `HTTPS` or `HTTP` or `BOTH`                                                  |
+| `--event_data.sl_domain`   | Subdomain from APIG instance (e.g. `xxxx.apic.<region>.huaweicloudapis.com`) |
+| `--event_data.env_name`    | API environment name (`RELEASE`)                                             |
+| `--event_data.env_id`      | API environment ID                                                           |
+| `--event_data.instance_id` | APIG dedicated instance ID                                                   |
+| `--event_data.group_id`    | API group ID                                                                 |
+| `--event_data.name`        | API name — **hyphens (`-`) are DISALLOWED**. Use underscores (`_`) instead.  |
 
 ### Error Mapping
 
-| Error | Root Cause → Fix |
-|-------|-----------------|
-| FSS.1417 | Missing `instance_id`, `group_id`, `protocol`, `env_name`, or `env_id`. These are labeled optional but REQUIRED. |
-| API name regex fail | Rename API — remove hyphens (`-`), use `[a-zA-Z0-9_]+` only. |
+| Error               | Root Cause → Fix                                                                                                 |
+| ------------------- | ---------------------------------------------------------------------------------------------------------------- |
+| FSS.1417            | Missing `instance_id`, `group_id`, `protocol`, `env_name`, or `env_id`. These are labeled optional but REQUIRED. |
+| API name regex fail | Rename API — remove hyphens (`-`), use `[a-zA-Z0-9_]+` only.                                                     |
 
 ### Example