huaweicloud-devkit 1.0.2-next.7 → 1.0.2-next.8

package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-obs
-description: "Use when creating, configuring, or managing OBS buckets and objects on Huawei Cloud. Covers bucket creation, lifecycle policies, versioning, static website hosting, CORS, access control (IAM/bucket policy/ACL), cross-region replication, event notifications, and presigned URLs. Triggers on: OBS, bucket, object storage, lifecycle, versioning, static website, CORS, presigned, replication. NOT for: EVS block storage (use huawei-ecs), SFS file storage, CBR backup (use huawei-cbr)."
+description: 'Use when creating, configuring, or managing OBS buckets and objects on Huawei Cloud. Covers bucket creation, lifecycle policies, versioning, static website hosting, CORS, access control (IAM/bucket policy/ACL), cross-region replication, event notifications, and presigned URLs. Triggers on: OBS, bucket, object storage, lifecycle, versioning, static website, CORS, presigned, replication. NOT for: EVS block storage (use huawei-ecs), SFS file storage, CBR backup (use huawei-cbr).'
 version: 1
 ---
 
@@ -23,11 +23,11 @@ hcloud OBS help           # NOT --help
 hcloud OBS help <command> # e.g. hcloud OBS help mb
 ```
 
-| Wrong (API-style) | Correct (obsutil-style) |
-|-------------------|-------------------------|
-| `OBS CreateBucket` | `OBS mb obs://<bucket>` |
-| `OBS PutObject` | `OBS cp <file> obs://<bucket>/` |
-| `OBS DeleteBucket` | `OBS rm obs://<bucket> -r` |
+| Wrong (API-style)  | Correct (obsutil-style)         |
+| ------------------ | ------------------------------- |
+| `OBS CreateBucket` | `OBS mb obs://<bucket>`         |
+| `OBS PutObject`    | `OBS cp <file> obs://<bucket>/` |
+| `OBS DeleteBucket` | `OBS rm obs://<bucket> -r`      |
 
 ## Overview
 
@@ -35,16 +35,16 @@ Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/ob
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Bucket name is global | All users share bucket namespace. Always use a unique name: `{prefix}-{timestamp}` (e.g. `mybucket-20260810155048`) |
-| Three-layer permissions | IAM > Bucket Policy > ACL. Most restrictive wins |
-| Versioning is irreversible | Once enabled, cannot be disabled, only suspended |
-| OBS uses AK/SK directly | NOT IAM tokens. Auth errors mean check AK/SK validity |
-| Static website via CLI missing | KooCLI OBS lacks website config. Use REST API or console |
-| **OBS needs separate cred config** | `hcloud configure` is NOT enough for OBS. Before any OBS operation, call `huaweicloud_setup_obs_config` to sync credentials from hcloud profile. |
-| **obsutil interactive prompts** | `cp`/`rm` without `-f` causes "Please input (y/n)" → Agent hangs (TIMEOUT). Always use `-f` for non-interactive. |
-| **Directory upload adds prefix** | `cp <dir>/ obs://<bucket>/ -r` puts files under `bucket/<dir>/...`. Use `-flat` for root-level files (static sites). Preview with `-dryRun` first. |
+| Trap                               | Why                                                                                                                                                |
+| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Bucket name is global              | All users share bucket namespace. Always use a unique name: `{prefix}-{timestamp}` (e.g. `mybucket-20260810155048`)                                |
+| Three-layer permissions            | IAM > Bucket Policy > ACL. Most restrictive wins                                                                                                   |
+| Versioning is irreversible         | Once enabled, cannot be disabled, only suspended                                                                                                   |
+| OBS uses AK/SK directly            | NOT IAM tokens. Auth errors mean check AK/SK validity                                                                                              |
+| Static website via CLI missing     | KooCLI OBS lacks website config. Use REST API or console                                                                                           |
+| **OBS needs separate cred config** | `hcloud configure` is NOT enough for OBS. Before any OBS operation, call `huaweicloud_setup_obs_config` to sync credentials from hcloud profile.   |
+| **obsutil interactive prompts**    | `cp`/`rm` without `-f` causes "Please input (y/n)" → Agent hangs (TIMEOUT). Always use `-f` for non-interactive.                                   |
+| **Directory upload adds prefix**   | `cp <dir>/ obs://<bucket>/ -r` puts files under `bucket/<dir>/...`. Use `-flat` for root-level files (static sites). Preview with `-dryRun` first. |
 
 ## OBS Credential Setup (Required Before First Use)
 
@@ -62,21 +62,21 @@ hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK> -t=token
 
 ## Common Workflows
 
-| Task | Command |
-|------|---------|
-| Create bucket | `hcloud OBS mb obs://<bucket> -location=<region>` |
-| List buckets/objects | `hcloud OBS ls [obs://<bucket>]` |
-| Upload file | `hcloud OBS cp <file> obs://<bucket>/<key>` |
-| Upload directory (recursive) | `hcloud OBS cp <dir>/ obs://<bucket>/ -r -f -flat` |
-| Download object | `hcloud OBS cp obs://<bucket>/<key> <local-path>` |
-| Set bucket ACL | `hcloud OBS chattri obs://<bucket> -acl=public-read` |
-| Set object ACL | `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read` | Bucket ACL does NOT cascade — anonymous reads need both |
-| Set lifecycle | `hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<json>` |
-| Set bucket policy | `hcloud OBS bucketpolicy obs://<bucket> -method=put -localfile=<json>` |
-| Set CORS | `hcloud OBS cors obs://<bucket> -method=put -localfile=<json>` |
-| Delete bucket | `hcloud OBS rm obs://<bucket> -r` (must be empty) |
-| Presigned URL | `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>` |
-| Object metadata | `hcloud OBS stat obs://<bucket>/<key>` |
+| Task                         | Command                                                                |
+| ---------------------------- | ---------------------------------------------------------------------- |
+| Create bucket                | `hcloud OBS mb obs://<bucket> -location=<region>`                      |
+| List buckets/objects         | `hcloud OBS ls [obs://<bucket>]`                                       |
+| Upload file                  | `hcloud OBS cp <file> obs://<bucket>/<key>`                            |
+| Upload directory (recursive) | `hcloud OBS cp <dir>/ obs://<bucket>/ -r -f -flat`                     |
+| Download object              | `hcloud OBS cp obs://<bucket>/<key> <local-path>`                      |
+| Set bucket ACL               | `hcloud OBS chattri obs://<bucket> -acl=public-read`                   |
+| Set object ACL               | `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read`             | Bucket ACL does NOT cascade — anonymous reads need both |
+| Set lifecycle                | `hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<json>`    |
+| Set bucket policy            | `hcloud OBS bucketpolicy obs://<bucket> -method=put -localfile=<json>` |
+| Set CORS                     | `hcloud OBS cors obs://<bucket> -method=put -localfile=<json>`         |
+| Delete bucket                | `hcloud OBS rm obs://<bucket> -r` (must be empty)                      |
+| Presigned URL                | `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>`                    |
+| Object metadata              | `hcloud OBS stat obs://<bucket>/<key>`                                 |
 
 ## Static Website Deployment Workflow
 
@@ -94,22 +94,22 @@ See `references/single-file-share.md` for the full workflow to host one file and
 
 ## Storage Classes
 
-| Class | Use Case | Min Storage | Retrieval Fee |
-|-------|----------|-------------|---------------|
-| STANDARD | Frequently accessed | None | No |
-| STANDARD_IA | Infrequent access | 30 days | Yes |
-| ARCHIVE | Long-term archive | 90 days | Yes (hours) |
+| Class       | Use Case            | Min Storage | Retrieval Fee |
+| ----------- | ------------------- | ----------- | ------------- |
+| STANDARD    | Frequently accessed | None        | No            |
+| STANDARD_IA | Infrequent access   | 30 days     | Yes           |
+| ARCHIVE     | Long-term archive   | 90 days     | Yes (hours)   |
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| AccessDenied on bucket | IAM/bucket policy/ACL conflict -> Check all three layers |
-| BucketAlreadyExists | Name taken globally -> Generate unique name with timestamp suffix: `{prefix}-{yyyymmddHHMMSS}` |
-| NoSuchKey | Object doesn't exist or wrong region -> Verify key and region |
-| InvalidAccessKeyId | OBS uses AK/SK directly -> Verify AK/SK validity, OBS endpoint, OBS permissions |
-| EntityTooLarge | Single PUT limit 5GB -> Use multipart upload |
-| OBS --help fails | KooCLI OBS uses `help` not `--help` -> Run `hcloud OBS help` |
+| Error                                 | Root Cause -> Fix                                                                                                                                                                                                                                      |
+| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| AccessDenied on bucket                | IAM/bucket policy/ACL conflict -> Check all three layers                                                                                                                                                                                               |
+| BucketAlreadyExists                   | Name taken globally -> Generate unique name with timestamp suffix: `{prefix}-{yyyymmddHHMMSS}`                                                                                                                                                         |
+| NoSuchKey                             | Object doesn't exist or wrong region -> Verify key and region                                                                                                                                                                                          |
+| InvalidAccessKeyId                    | OBS uses AK/SK directly -> Verify AK/SK validity, OBS endpoint, OBS permissions                                                                                                                                                                        |
+| EntityTooLarge                        | Single PUT limit 5GB -> Use multipart upload                                                                                                                                                                                                           |
+| OBS --help fails                      | KooCLI OBS uses `help` not `--help` -> Run `hcloud OBS help`                                                                                                                                                                                           |
 | Configuration file is not well-formed | `~/.obsutilconfig` was generated by a non-standard path (CRLF line endings or field-order differences). Even `hcloud OBS --help` fails. Rebuild it with `hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK>` (or `huaweicloud_setup_obs_config`) -> retry |
 
 ## Security Considerations

package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-create.md

@@ -4,14 +4,14 @@ From Huawei Cloud marketplace best practices.
 
 ## Naming Rules
 
-| Rule | Detail |
-|------|--------|
-| Length | 3-63 characters |
-| Characters | Lowercase letters, numbers, `-`, `.` |
-| No IP format | Cannot be IP address pattern |
-| No leading/trailing `-` or `.` | Start and end must be alphanumeric |
-| No `..` | Adjacent dots forbidden |
-| No `-.` or `.-` | Adjacent dot-hyphen combos forbidden |
+| Rule                           | Detail                               |
+| ------------------------------ | ------------------------------------ |
+| Length                         | 3-63 characters                      |
+| Characters                     | Lowercase letters, numbers, `-`, `.` |
+| No IP format                   | Cannot be IP address pattern         |
+| No leading/trailing `-` or `.` | Start and end must be alphanumeric   |
+| No `..`                        | Adjacent dots forbidden              |
+| No `-.` or `.-`                | Adjacent dot-hyphen combos forbidden |
 
 ## Create Bucket
 
@@ -19,11 +19,11 @@ From Huawei Cloud marketplace best practices.
 hcloud OBS mb obs://<bucket> [-acl=xxx] [-location=<r>] [-sc=xxx]
 ```
 
-| Option | Values | Default |
-|--------|--------|---------|
-| `-acl` | private, public-read, public-read-write | private |
-| `-location` | cn-south-1, cn-north-4, ... | config default |
-| `-sc` | standard, warm, cold, deep-archive | standard |
+| Option      | Values                                  | Default        |
+| ----------- | --------------------------------------- | -------------- |
+| `-acl`      | private, public-read, public-read-write | private        |
+| `-location` | cn-south-1, cn-north-4, ...             | config default |
+| `-sc`       | standard, warm, cold, deep-archive      | standard       |
 
 ## Quick Verify
 
@@ -34,12 +34,12 @@ hcloud OBS stat obs://<bucket>
 
 ## Storage Class Guide
 
-| Class | Access Frequency | Min Storage | Retrieval Cost |
-|-------|-----------------|-------------|----------------|
-| standard | Frequent | None | No |
-| warm | Infrequent | 30 days | Yes |
-| cold | Rare | 90 days | Yes |
-| deep-archive | Archive | 180 days | Yes |
+| Class        | Access Frequency | Min Storage | Retrieval Cost |
+| ------------ | ---------------- | ----------- | -------------- |
+| standard     | Frequent         | None        | No             |
+| warm         | Infrequent       | 30 days     | Yes            |
+| cold         | Rare             | 90 days     | Yes            |
+| deep-archive | Archive          | 180 days    | Yes            |
 
 ## Critical Rules
 

package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-lifecycle.md

@@ -3,24 +3,29 @@
 > KooCLI OBS uses obsutil-style commands. `OBS CreateBucket` → `OBS mb`. `SetBucketWebsite` is NOT supported in KooCLI OBS (use API/SDK).
 
 ## Create Bucket
+
 hcloud OBS mb obs://<bucket> -location=<region>
 
 ## Lifecycle Rules (JSON)
+
 {
-  "Rules": [{
-    "ID": "move-to-ia-after-30d",
-    "Status": "Enabled",
-    "Filter": {"Prefix": ""},
-    "Transitions": [{"Days": 30, "StorageClass": "STANDARD_IA"}],
-    "Expiration": {"Days": 365}
-  }]
+"Rules": [{
+"ID": "move-to-ia-after-30d",
+"Status": "Enabled",
+"Filter": {"Prefix": ""},
+"Transitions": [{"Days": 30, "StorageClass": "STANDARD_IA"}],
+"Expiration": {"Days": 365}
+}]
 }
 
 ## Apply
+
 hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<lifecycle.json>
 
 ## Static Website
+
 Not available via KooCLI OBS CLI. Use `hcloud OBS chattri obs://<bucket> -acl=public-read` for bucket ACL, or use API/SDK for website configuration.
 
 ## Cross-Region Replication
+
 Requires: source bucket versioning enabled, destination bucket in different region, replication IAM role.

package/plugins/huaweicloud-core/skills/huawei-obs/references/common-pitfalls.md

@@ -6,13 +6,13 @@
 
 OBS 使用 **obsutil-style** 子命令，不是 API-style 操作名：
 
-| 错误写法（API-style） | 正确写法（obsutil-style） |
-|----------------------|--------------------------|
-| `OBS --help` | `hcloud OBS help`（无 `--`，`help` 是子命令） |
-| `OBS CreateBucket` | `hcloud OBS mb obs://<bucket>` |
-| `OBS PutObject` | `hcloud OBS cp <file> obs://<bucket>/` |
-| `OBS DeleteBucket` | `hcloud OBS rm obs://<bucket> -r` |
-| `OBS ListBuckets` | `hcloud OBS ls` |
+| 错误写法（API-style） | 正确写法（obsutil-style）                     |
+| --------------------- | --------------------------------------------- |
+| `OBS --help`          | `hcloud OBS help`（无 `--`，`help` 是子命令） |
+| `OBS CreateBucket`    | `hcloud OBS mb obs://<bucket>`                |
+| `OBS PutObject`       | `hcloud OBS cp <file> obs://<bucket>/`        |
+| `OBS DeleteBucket`    | `hcloud OBS rm obs://<bucket> -r`             |
+| `OBS ListBuckets`     | `hcloud OBS ls`                               |
 
 ## 独立凭证配置
 
@@ -45,6 +45,7 @@ hcloud OBS config -i
 ```
 
 **规避方法**：
+
 1. 先 `-dryRun` 预览实际键名，再执行真实上传
 2. 或先将本地目录重命名为目标前缀名，如 `mv devkit/ root/` 后上传 `root/`
 3. 或使用 `-flat` 参数（如支持）
@@ -60,11 +61,11 @@ KooCLI OBS **不支持** `SetBucketWebsite` 命令。配置静态网站托管需
 
 ## 权限模型（三层）
 
-| 层级 | 作用域 | 优先级 |
-|------|--------|--------|
-| IAM Policy | 用户/用户组 | 最高 |
-| Bucket Policy | 桶级 | 中 |
-| ACL | 对象级 | 最低 |
+| 层级          | 作用域      | 优先级 |
+| ------------- | ----------- | ------ |
+| IAM Policy    | 用户/用户组 | 最高   |
+| Bucket Policy | 桶级        | 中     |
+| ACL           | 对象级      | 最低   |
 
 **关键规则**：三层中**最严格**的生效。Bucket Policy 设为 public-read，但 IAM deny 了 → 结果是 deny。
 

package/plugins/huaweicloud-core/skills/huawei-obs/references/single-file-share.md

@@ -2,10 +2,10 @@
 
 Host one file and get a shareable link in seconds. Two options:
 
-| Option | Link type | Bucket/object visibility | Expiry |
-|--------|-----------|--------------------------|--------|
-| Presigned URL | Time-limited private link | Keep private | `-e=<seconds>`, max 7 days |
-| Public URL | Permanent public link | Set object `-acl=public-read` | None |
+| Option        | Link type                 | Bucket/object visibility      | Expiry                     |
+| ------------- | ------------------------- | ----------------------------- | -------------------------- |
+| Presigned URL | Time-limited private link | Keep private                  | `-e=<seconds>`, max 7 days |
+| Public URL    | Permanent public link     | Set object `-acl=public-read` | None                       |
 
 ## Option 1: Presigned URL (private, time-limited)
 

package/plugins/huaweicloud-core/skills/huawei-rds/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-rds
-description: "Use when creating, configuring, managing, or troubleshooting RDS instances on Huawei Cloud. Covers MySQL, PostgreSQL, SQL Server. Triggers: RDS, MySQL, PostgreSQL, database instance, backup, read replica. NOT for: GaussDB (use huawei-gaussdb), DDS (use huawei-dds-dcs)."
+description: 'Use when creating, configuring, managing, or troubleshooting RDS instances on Huawei Cloud. Covers MySQL, PostgreSQL, SQL Server. Triggers: RDS, MySQL, PostgreSQL, database instance, backup, read replica. NOT for: GaussDB (use huawei-gaussdb), DDS (use huawei-dds-dcs).'
 version: 1
 ---
 
@@ -13,6 +13,7 @@ Always run `hcloud RDS <Operation> --help` before constructing commands to disco
 ## Prerequisites
 
 Before creating an RDS instance, you MUST have:
+
 - A VPC and subnet (see `huawei-vpc`)
 - A security group with database port open (MySQL=3306, PostgreSQL=5432, SQL Server=1433)
 - Run `hcloud RDS ListFlavors --database_name=<engine> --cli-region=<r>` to get spec codes
@@ -23,32 +24,33 @@ Before creating an RDS instance, you MUST have:
 hcloud RDS <Operation> --cli-region=<region> [--key=value ...]
 ```
 
-| Rule | Detail |
-|------|--------|
-| Service name | `RDS` (uppercase) |
-| Operation | PascalCase: `ListInstances`, `CreateManualBackup` |
-| Params | `--key=value` format. JSON params: `--key='{"k":"v"}'` |
-| Array params | 1-based: `--instance_ids.1=xxx` |
+| Rule           | Detail                                                                            |
+| -------------- | --------------------------------------------------------------------------------- |
+| Service name   | `RDS` (uppercase)                                                                 |
+| Operation      | PascalCase: `ListInstances`, `CreateManualBackup`                                 |
+| Params         | `--key=value` format. JSON params: `--key='{"k":"v"}'`                            |
+| Array params   | 1-based: `--instance_ids.1=xxx`                                                   |
 | Password param | Conflicts with KooCLI system param; use `--cli-jsonInput` (see Critical Warnings) |
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Engine version immutable | Cannot change MySQL to PostgreSQL in-place |
-| Automated backups use OBS | Backup storage incurs separate charges. Set retention period explicitly |
-| Storage auto-scaling off by default | Enable before storage runs out or instance goes read-only |
-| `--password` conflicts with KooCLI | Use `--cli-jsonInput=<file>` with JSON file (see `--cli-jsonInput` section below). The `printf "b\n"` workaround is broken in KooCLI 7.2.12+ |
-| Volume type must match flavor | General→CLOUDSSD; Dedicated→CLOUDSSD\|ESSD; ARM→ULTRAHIGH |
-| Flavor not in region | Always `ListFlavors` first. Spec codes vary by region |
-| `database_name` is case-sensitive | Use `MySQL` / `PostgreSQL` / `SQLServer` / `MariaDB` — NOT lower-case `mysql` |
-| Instance creation takes 3–8 min | Status: BUILD→MODIFYING→ACTIVE. Poll every 15s: `hcloud RDS ListInstances --cli-region=<r> --instance_id=<id> \| jq '.instances[0].status'` |
-| Body `--region` is required | CreateInstance body requires `--region=<r>` (same as `--cli-region`) or `DBS.280243` |
-| Restore creates new instance | No in-place restore. Verify target flavor before restoring |
+| Trap                                | Why                                                                                                                                          |
+| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Engine version immutable            | Cannot change MySQL to PostgreSQL in-place                                                                                                   |
+| Automated backups use OBS           | Backup storage incurs separate charges. Set retention period explicitly                                                                      |
+| Storage auto-scaling off by default | Enable before storage runs out or instance goes read-only                                                                                    |
+| `--password` conflicts with KooCLI  | Use `--cli-jsonInput=<file>` with JSON file (see `--cli-jsonInput` section below). The `printf "b\n"` workaround is broken in KooCLI 7.2.12+ |
+| Volume type must match flavor       | General→CLOUDSSD; Dedicated→CLOUDSSD\|ESSD; ARM→ULTRAHIGH                                                                                    |
+| Flavor not in region                | Always `ListFlavors` first. Spec codes vary by region                                                                                        |
+| `database_name` is case-sensitive   | Use `MySQL` / `PostgreSQL` / `SQLServer` / `MariaDB` — NOT lower-case `mysql`                                                                |
+| Instance creation takes 3–8 min     | Status: BUILD→MODIFYING→ACTIVE. Poll every 15s: `hcloud RDS ListInstances --cli-region=<r> --instance_id=<id> \| jq '.instances[0].status'`  |
+| Body `--region` is required         | CreateInstance body requires `--region=<r>` (same as `--cli-region`) or `DBS.280243`                                                         |
+| Restore creates new instance        | No in-place restore. Verify target flavor before restoring                                                                                   |
 
 ## Instance Management
 
 ### List
+
 ```bash
 hcloud RDS ListInstances --cli-region=<r>
 hcloud RDS ListFlavors --database_name=<engine> --cli-region=<r>
@@ -57,6 +59,7 @@ hcloud RDS ListEngineFlavors --instance_id=<id> --cli-region=<r>
 ```
 
 ### Create Instance
+
 ```bash
 hcloud RDS CreateInstance --cli-region=<r> \
   --region=<r> \
@@ -101,21 +104,22 @@ hcloud RDS CreateInstance --cli-region=<r> \
 
 > Save as `rds-create.json` then: `hcloud RDS CreateInstance --cli-jsonInput=rds-create.json`. For `project_id`, run `hcloud IAM KeystoneListProjects`.
 
-| Param | Required | Note |
-|-------|----------|------|
-| `--name` | Yes | Instance name |
-| `--datastore` | Yes | `--datastore.type=<engine> --datastore.version=<version>` |
-| `--flavor_ref` | Yes | From `ListFlavors` output |
-| `--volume` | Yes | Type matching: General→CLOUDSSD, Dedicated→CLOUDSSD\|ESSD, ARM→ULTRAHIGH |
-| `--vpc_id` | Yes | Must exist in target region |
-| `--subnet_id` | Yes | Must exist in target region |
-| `--security_group_id` | Yes | Must have DB port open |
-| `--availability_zone` | Yes | Use AZ code from `NovaListAvailabilityZones` |
-| `--charge_info` | No | `--charge_info.charge_mode=<mode>`. Default postPaid (pay-per-use). Run `--help` for options |
-| `--password` | Yes | 8-32 chars, uppercase+lowercase+digit+special |
-| `--port` | No | Default 3306 (MySQL) / 5432 (PG) / 1433 (SQL Server) |
+| Param                 | Required | Note                                                                                         |
+| --------------------- | -------- | -------------------------------------------------------------------------------------------- |
+| `--name`              | Yes      | Instance name                                                                                |
+| `--datastore`         | Yes      | `--datastore.type=<engine> --datastore.version=<version>`                                    |
+| `--flavor_ref`        | Yes      | From `ListFlavors` output                                                                    |
+| `--volume`            | Yes      | Type matching: General→CLOUDSSD, Dedicated→CLOUDSSD\|ESSD, ARM→ULTRAHIGH                     |
+| `--vpc_id`            | Yes      | Must exist in target region                                                                  |
+| `--subnet_id`         | Yes      | Must exist in target region                                                                  |
+| `--security_group_id` | Yes      | Must have DB port open                                                                       |
+| `--availability_zone` | Yes      | Use AZ code from `NovaListAvailabilityZones`                                                 |
+| `--charge_info`       | No       | `--charge_info.charge_mode=<mode>`. Default postPaid (pay-per-use). Run `--help` for options |
+| `--password`          | Yes      | 8-32 chars, uppercase+lowercase+digit+special                                                |
+| `--port`              | No       | Default 3306 (MySQL) / 5432 (PG) / 1433 (SQL Server)                                         |
 
 ### Modify / Resize
+
 ```bash
 hcloud RDS StartInstanceRestartAction --instance_id=<id> --cli-region=<r>
 hcloud RDS StartResizeFlavorAction --instance_id=<id> --flavor_ref=<new-id> --cli-region=<r>
@@ -125,6 +129,7 @@ hcloud RDS UpdateInstanceAlias --instance_id=<id> --alias=<new-name> --cli-regio
 ```
 
 ### Delete
+
 ```bash
 hcloud RDS DeleteInstance --instance_id=<id> --cli-region=<r>
 ```
@@ -172,41 +177,41 @@ psql -h <private_ip> -p 5432 -U root -d postgres
 
 If a database client is not installed on the agent's machine, install one:
 
-| Platform | MySQL | PostgreSQL |
-|----------|-------|------------|
-| **Linux** | `apt install mysql-client` / `yum install mysql` | `apt install postgresql-client` |
-| **macOS** | `brew install mysql-client` | `brew install libpq` |
-| **Windows** | Download MySQL Workbench or `winget install Oracle.MySQL` | Download pgAdmin or `winget install PostgreSQL.PostgreSQL` |
+| Platform         | MySQL                                                        | PostgreSQL                                                     |
+| ---------------- | ------------------------------------------------------------ | -------------------------------------------------------------- |
+| **Linux**        | `apt install mysql-client` / `yum install mysql`             | `apt install postgresql-client`                                |
+| **macOS**        | `brew install mysql-client`                                  | `brew install libpq`                                           |
+| **Windows**      | Download MySQL Workbench or `winget install Oracle.MySQL`    | Download pgAdmin or `winget install PostgreSQL.PostgreSQL`     |
 | **Python (any)** | `pip install pymysql` then `python -c "import pymysql; ..."` | `pip install psycopg2` then `python -c "import psycopg2; ..."` |
-| **Docker (any)** | `docker run -it --rm mysql:8 mysql -h <ip> -u root -p` | `docker run -it --rm postgres:16 psql -h <ip> -U root` |
+| **Docker (any)** | `docker run -it --rm mysql:8 mysql -h <ip> -u root -p`       | `docker run -it --rm postgres:16 psql -h <ip> -U root`         |
 
 > If no client can be installed, use the Huawei Cloud **Data Studio** console: https://console.huaweicloud.com/dms/
 
 ## Mutating Operations (Require Approval)
 
-| Operation | Effect |
-|-----------|--------|
-| `CreateInstance` | New instance (billing starts) |
-| `DeleteInstance` | Irreversible data loss |
-| `StartResizeFlavorAction` | Brief interruption during switchover |
-| `StartInstanceEnlargeVolumeAction` | Online, but irreversible |
-| `StartFailover` | Primary-standby switchover |
-| `CreateRestoreInstance` | Creates new instance from backup |
-| `CreateManualBackup` | Incurs OBS storage charges |
-| `DeleteManualBackup` | Irreversible |
+| Operation                          | Effect                               |
+| ---------------------------------- | ------------------------------------ |
+| `CreateInstance`                   | New instance (billing starts)        |
+| `DeleteInstance`                   | Irreversible data loss               |
+| `StartResizeFlavorAction`          | Brief interruption during switchover |
+| `StartInstanceEnlargeVolumeAction` | Online, but irreversible             |
+| `StartFailover`                    | Primary-standby switchover           |
+| `CreateRestoreInstance`            | Creates new instance from backup     |
+| `CreateManualBackup`               | Incurs OBS storage charges           |
+| `DeleteManualBackup`               | Irreversible                         |
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| Connection refused | SG missing DB port. Add ingress rule |
-| Storage full | Manual resize or enable auto-scaling |
-| DBS.280241 Invalid storage type | Volume type doesn't match flavor group |
-| DBS.280448 Sold out | Try different volume type or AZ |
-| Replication lag | Check `ShowReplicationStatus`. Consider read replica |
-| Instance stuck BUILDING | Check task status: `hcloud RDS ListTasks` |
-| SYS.0403 | SCP policy denies this operation (e.g. security group rules, EIP binding). See `huawei-vpc` troubleshooting |
-| EIP.7905 | EIP quota exceeded — cannot create new EIP for public access. See `huawei-vpc` troubleshooting |
+| Error                           | Root Cause -> Fix                                                                                           |
+| ------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| Connection refused              | SG missing DB port. Add ingress rule                                                                        |
+| Storage full                    | Manual resize or enable auto-scaling                                                                        |
+| DBS.280241 Invalid storage type | Volume type doesn't match flavor group                                                                      |
+| DBS.280448 Sold out             | Try different volume type or AZ                                                                             |
+| Replication lag                 | Check `ShowReplicationStatus`. Consider read replica                                                        |
+| Instance stuck BUILDING         | Check task status: `hcloud RDS ListTasks`                                                                   |
+| SYS.0403                        | SCP policy denies this operation (e.g. security group rules, EIP binding). See `huawei-vpc` troubleshooting |
+| EIP.7905                        | EIP quota exceeded — cannot create new EIP for public access. See `huawei-vpc` troubleshooting              |
 
 ## Security
 

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-sandbox
-description: "Use when creating, connecting, or managing Huawei Cloud Sandbox instances and workspace terminals, or when a task needs a temporary runtime to deploy, run, or preview a web application. Covers sandbox lifecycle (check-user, sign-agreement, connect, release), session-based terminal execution, and credential injection. Triggers on: sandbox, workspace, terminal, web app deployment, deploy web app, preview app, deploy github, github repo, deploy repo, website, static site, web application, hwlink, devstation, hdkitservice, remote exec. NOT for: ECS instances (use huawei-ecs), CCE clusters (use huawei-cce)."
+description: 'Use when creating, connecting, or managing Huawei Cloud Sandbox instances and workspace terminals, or when a task needs a temporary runtime to deploy, run, or preview a web application. Covers sandbox lifecycle (check-user, sign-agreement, connect, release), session-based terminal execution, and credential injection. Triggers on: sandbox, workspace, terminal, web app deployment, deploy web app, preview app, deploy github, github repo, deploy repo, website, static site, web application, hwlink, devstation, hdkitservice, remote exec. NOT for: ECS instances (use huawei-ecs), CCE clusters (use huawei-cce).'
 version: 1
 ---
 
@@ -26,25 +26,25 @@ Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace t
 
 ### User Verification (Prerequisites)
 
-| Tool | Purpose |
-|------|---------|
-| `huaweicloud_sandbox_check_user` | Check real-name verification and agreement signing status |
+| Tool                                 | Purpose                                                     |
+| ------------------------------------ | ----------------------------------------------------------- |
+| `huaweicloud_sandbox_check_user`     | Check real-name verification and agreement signing status   |
 | `huaweicloud_sandbox_sign_agreement` | Sign unsigned/outdated agreements (required before connect) |
 
 ### Sandbox Lifecycle
 
-| Tool | Purpose |
-|------|---------|
-| `huaweicloud_sandbox_connect` | Connect to sandbox (one user one instance, reuses existing if available) |
-| `huaweicloud_sandbox_credentials` | Inject temporary AK/SK into a running sandbox |
+| Tool                              | Purpose                                                                  |
+| --------------------------------- | ------------------------------------------------------------------------ |
+| `huaweicloud_sandbox_connect`     | Connect to sandbox (one user one instance, reuses existing if available) |
+| `huaweicloud_sandbox_credentials` | Inject temporary AK/SK into a running sandbox                            |
 
 ### Terminal Execution
 
-| Tool | Purpose |
-|------|---------|
-| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists) |
-| `huaweicloud_sandbox_upload_file` | Upload a local file into the sandbox (chunked base64 write + md5 verify) |
-| `huaweicloud_sandbox_close_session` | Close a persistent terminal session |
+| Tool                                    | Purpose                                                                  |
+| --------------------------------------- | ------------------------------------------------------------------------ |
+| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists)                                 |
+| `huaweicloud_sandbox_upload_file`       | Upload a local file into the sandbox (chunked base64 write + md5 verify) |
+| `huaweicloud_sandbox_close_session`     | Close a persistent terminal session                                      |
 
 ## Workflow
 
@@ -74,11 +74,11 @@ There is no general file-upload primitive on the sandbox service itself. Get loc
 
 `huaweicloud_sandbox_exec_with_session` is fragile for long commands and large inline content. Do NOT paste a file's base64 directly into a single command:
 
-| Payload | Result |
-|---------|--------|
-| ~30KB base64 in one command | exec timeout |
+| Payload                     | Result                                 |
+| --------------------------- | -------------------------------------- |
+| ~30KB base64 in one command | exec timeout                           |
 | ~12KB base64 in one command | session crash (`session is not ready`) |
-| ~4–5KB normal command | OK |
+| ~4–5KB normal command       | OK                                     |
 
 Keep individual exec commands small (≤ ~4KB). For larger content, use `huaweicloud_sandbox_upload_file` instead.
 
@@ -133,20 +133,20 @@ sleep 10 && cat /tmp/host.log
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Agreement required first | `sandbox_connect` fails if the agreement isn't signed; the `sandbox_check_user` preflight detects this, so surface it to the developer only when signing is needed |
-| Real-name required | `sandbox_connect` fails if `realnameVerified=false`; tell the developer once and stop, don't loop on connect |
-| Never expose tunnel details | Do not mention "DevBridge"/"tunnel"/"devbridge" to the developer — say "正在生成访问地址..." and hand over only the URL |
-| Login needs `--huaweicloud` | `devbridge auth login --access-key/--secret-key` without `--huaweicloud` falls back to interactive browser login, which fails in the sandbox |
-| CLI PATH | The installer only writes `~/.bashrc`; run `export PATH=$PATH:$HOME/.huawei/bin` in the session before using `devbridge` |
-| Never install tunnel tooling locally | If the sandbox cannot install it, report a generic error and stop — installing on the developer's machine defeats sandbox deployment |
-| Return the deployment URL | Always hand the public URL from the host log to the developer as the final result |
-| Session state persists | `exec_with_session` preserves `cd`, env vars, aliases between calls |
-| Destructive commands blocked | `rm -rf /`, `mkfs`, `dd if=`, fork bombs are denied by safety policy |
-| Workspace ID = dev_stage_id | Use `dev_stage_id` from `sandbox_connect` as `workspace_id` for terminal exec |
-| Projects live in `/workspace` | Clone/install project code under `/workspace/<repo-name>` (filesystem-root workspace mount, not `$HOME/workspace`), never in `/tmp` — ephemeral locations lose the project when the sandbox session restarts |
-| Node.js >= 22 required | Sandbox terminal uses built-in WebSocket (globalThis.WebSocket); if Node.js is missing, install it from the Huawei Cloud mirror (see "Node.js in the sandbox") |
+| Trap                                 | Why                                                                                                                                                                                                          |
+| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Agreement required first             | `sandbox_connect` fails if the agreement isn't signed; the `sandbox_check_user` preflight detects this, so surface it to the developer only when signing is needed                                           |
+| Real-name required                   | `sandbox_connect` fails if `realnameVerified=false`; tell the developer once and stop, don't loop on connect                                                                                                 |
+| Never expose tunnel details          | Do not mention "DevBridge"/"tunnel"/"devbridge" to the developer — say "正在生成访问地址..." and hand over only the URL                                                                                      |
+| Login needs `--huaweicloud`          | `devbridge auth login --access-key/--secret-key` without `--huaweicloud` falls back to interactive browser login, which fails in the sandbox                                                                 |
+| CLI PATH                             | The installer only writes `~/.bashrc`; run `export PATH=$PATH:$HOME/.huawei/bin` in the session before using `devbridge`                                                                                     |
+| Never install tunnel tooling locally | If the sandbox cannot install it, report a generic error and stop — installing on the developer's machine defeats sandbox deployment                                                                         |
+| Return the deployment URL            | Always hand the public URL from the host log to the developer as the final result                                                                                                                            |
+| Session state persists               | `exec_with_session` preserves `cd`, env vars, aliases between calls                                                                                                                                          |
+| Destructive commands blocked         | `rm -rf /`, `mkfs`, `dd if=`, fork bombs are denied by safety policy                                                                                                                                         |
+| Workspace ID = dev_stage_id          | Use `dev_stage_id` from `sandbox_connect` as `workspace_id` for terminal exec                                                                                                                                |
+| Projects live in `/workspace`        | Clone/install project code under `/workspace/<repo-name>` (filesystem-root workspace mount, not `$HOME/workspace`), never in `/tmp` — ephemeral locations lose the project when the sandbox session restarts |
+| Node.js >= 22 required               | Sandbox terminal uses built-in WebSocket (globalThis.WebSocket); if Node.js is missing, install it from the Huawei Cloud mirror (see "Node.js in the sandbox")                                               |
 
 ## Node.js in the sandbox
 
@@ -163,11 +163,11 @@ node --version
 
 ## Environment Variables
 
-| Variable | Required | Description |
-|----------|----------|-------------|
-| `HW_ACCESS_KEY` | Yes | Huawei Cloud AK |
-| `HW_SECRET_KEY` | Yes | Huawei Cloud SK |
-| `HW_SECURITY_TOKEN` | No | STS security token |
-| `HW_WORKSPACE_ID` | No | Default workspace ID |
-| `HDKITSERVICE_ENDPOINT` | No | hdkitservice API endpoint |
-| `HWLINK_ENDPOINT` | No | DevStation API endpoint |
+| Variable                | Required | Description               |
+| ----------------------- | -------- | ------------------------- |
+| `HW_ACCESS_KEY`         | Yes      | Huawei Cloud AK           |
+| `HW_SECRET_KEY`         | Yes      | Huawei Cloud SK           |
+| `HW_SECURITY_TOKEN`     | No       | STS security token        |
+| `HW_WORKSPACE_ID`       | No       | Default workspace ID      |
+| `HDKITSERVICE_ENDPOINT` | No       | hdkitservice API endpoint |
+| `HWLINK_ENDPOINT`       | No       | DevStation API endpoint   |