npm - huaweicloud-devkit - Versions diffs - 1.0.2-next.7 → 1.0.2-next.9 - Mend

huaweicloud-devkit 1.0.2-next.7 → 1.0.2-next.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (87) hide show

package/plugins/huaweicloud-core/skills/huawei-rds/SKILL.md CHANGED Viewed

@@ -1,6 +1,6 @@
 ---
 name: huawei-rds
-description: "Use when creating, configuring, managing, or troubleshooting RDS instances on Huawei Cloud. Covers MySQL, PostgreSQL, SQL Server. Triggers: RDS, MySQL, PostgreSQL, database instance, backup, read replica. NOT for: GaussDB (use huawei-gaussdb), DDS (use huawei-dds-dcs)."
+description: 'Use when creating, configuring, managing, or troubleshooting RDS instances on Huawei Cloud. Covers MySQL, PostgreSQL, SQL Server. Triggers: RDS, MySQL, PostgreSQL, database instance, backup, read replica. NOT for: GaussDB (use huawei-gaussdb), DDS (use huawei-dds-dcs).'
 version: 1
 ---
@@ -13,6 +13,7 @@ Always run `hcloud RDS <Operation> --help` before constructing commands to disco
 ## Prerequisites
 Before creating an RDS instance, you MUST have:
 - A VPC and subnet (see `huawei-vpc`)
 - A security group with database port open (MySQL=3306, PostgreSQL=5432, SQL Server=1433)
 - Run `hcloud RDS ListFlavors --database_name=<engine> --cli-region=<r>` to get spec codes
@@ -23,32 +24,33 @@ Before creating an RDS instance, you MUST have:
 hcloud RDS <Operation> --cli-region=<region> [--key=value ...]
 ```
-| Rule | Detail |
-|------|--------|
-| Service name | `RDS` (uppercase) |
-| Operation | PascalCase: `ListInstances`, `CreateManualBackup` |
-| Params | `--key=value` format. JSON params: `--key='{"k":"v"}'` |
-| Array params | 1-based: `--instance_ids.1=xxx` |
+| Rule           | Detail                                                                            |
+| -------------- | --------------------------------------------------------------------------------- |
+| Service name   | `RDS` (uppercase)                                                                 |
+| Operation      | PascalCase: `ListInstances`, `CreateManualBackup`                                 |
+| Params         | `--key=value` format. JSON params: `--key='{"k":"v"}'`                            |
+| Array params   | 1-based: `--instance_ids.1=xxx`                                                   |
 | Password param | Conflicts with KooCLI system param; use `--cli-jsonInput` (see Critical Warnings) |
 ## Critical Warnings
-| Trap | Why |
-|------|-----|
-| Engine version immutable | Cannot change MySQL to PostgreSQL in-place |
-| Automated backups use OBS | Backup storage incurs separate charges. Set retention period explicitly |
-| Storage auto-scaling off by default | Enable before storage runs out or instance goes read-only |
-| `--password` conflicts with KooCLI | Use `--cli-jsonInput=<file>` with JSON file (see `--cli-jsonInput` section below). The `printf "b\n"` workaround is broken in KooCLI 7.2.12+ |
-| Volume type must match flavor | General→CLOUDSSD; Dedicated→CLOUDSSD\|ESSD; ARM→ULTRAHIGH |
-| Flavor not in region | Always `ListFlavors` first. Spec codes vary by region |
-| `database_name` is case-sensitive | Use `MySQL` / `PostgreSQL` / `SQLServer` / `MariaDB` — NOT lower-case `mysql` |
-| Instance creation takes 3–8 min | Status: BUILD→MODIFYING→ACTIVE. Poll every 15s: `hcloud RDS ListInstances --cli-region=<r> --instance_id=<id> \| jq '.instances[0].status'` |
-| Body `--region` is required | CreateInstance body requires `--region=<r>` (same as `--cli-region`) or `DBS.280243` |
-| Restore creates new instance | No in-place restore. Verify target flavor before restoring |
+| Trap                                | Why                                                                                                                                          |
+| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Engine version immutable            | Cannot change MySQL to PostgreSQL in-place                                                                                                   |
+| Automated backups use OBS           | Backup storage incurs separate charges. Set retention period explicitly                                                                      |
+| Storage auto-scaling off by default | Enable before storage runs out or instance goes read-only                                                                                    |
+| `--password` conflicts with KooCLI  | Use `--cli-jsonInput=<file>` with JSON file (see `--cli-jsonInput` section below). The `printf "b\n"` workaround is broken in KooCLI 7.2.12+ |
+| Volume type must match flavor       | General→CLOUDSSD; Dedicated→CLOUDSSD\|ESSD; ARM→ULTRAHIGH                                                                                    |
+| Flavor not in region                | Always `ListFlavors` first. Spec codes vary by region                                                                                        |
+| `database_name` is case-sensitive   | Use `MySQL` / `PostgreSQL` / `SQLServer` / `MariaDB` — NOT lower-case `mysql`                                                                |
+| Instance creation takes 3–8 min     | Status: BUILD→MODIFYING→ACTIVE. Poll every 15s: `hcloud RDS ListInstances --cli-region=<r> --instance_id=<id> \| jq '.instances[0].status'`  |
+| Body `--region` is required         | CreateInstance body requires `--region=<r>` (same as `--cli-region`) or `DBS.280243`                                                         |
+| Restore creates new instance        | No in-place restore. Verify target flavor before restoring                                                                                   |
 ## Instance Management
 ### List
 ```bash
 hcloud RDS ListInstances --cli-region=<r>
 hcloud RDS ListFlavors --database_name=<engine> --cli-region=<r>
@@ -57,6 +59,7 @@ hcloud RDS ListEngineFlavors --instance_id=<id> --cli-region=<r>
 ```
 ### Create Instance
 ```bash
 hcloud RDS CreateInstance --cli-region=<r> \
   --region=<r> \
@@ -101,21 +104,22 @@ hcloud RDS CreateInstance --cli-region=<r> \
 > Save as `rds-create.json` then: `hcloud RDS CreateInstance --cli-jsonInput=rds-create.json`. For `project_id`, run `hcloud IAM KeystoneListProjects`.
-| Param | Required | Note |
-|-------|----------|------|
-| `--name` | Yes | Instance name |
-| `--datastore` | Yes | `--datastore.type=<engine> --datastore.version=<version>` |
-| `--flavor_ref` | Yes | From `ListFlavors` output |
-| `--volume` | Yes | Type matching: General→CLOUDSSD, Dedicated→CLOUDSSD\|ESSD, ARM→ULTRAHIGH |
-| `--vpc_id` | Yes | Must exist in target region |
-| `--subnet_id` | Yes | Must exist in target region |
-| `--security_group_id` | Yes | Must have DB port open |
-| `--availability_zone` | Yes | Use AZ code from `NovaListAvailabilityZones` |
-| `--charge_info` | No | `--charge_info.charge_mode=<mode>`. Default postPaid (pay-per-use). Run `--help` for options |
-| `--password` | Yes | 8-32 chars, uppercase+lowercase+digit+special |
-| `--port` | No | Default 3306 (MySQL) / 5432 (PG) / 1433 (SQL Server) |
+| Param                 | Required | Note                                                                                         |
+| --------------------- | -------- | -------------------------------------------------------------------------------------------- |
+| `--name`              | Yes      | Instance name                                                                                |
+| `--datastore`         | Yes      | `--datastore.type=<engine> --datastore.version=<version>`                                    |
+| `--flavor_ref`        | Yes      | From `ListFlavors` output                                                                    |
+| `--volume`            | Yes      | Type matching: General→CLOUDSSD, Dedicated→CLOUDSSD\|ESSD, ARM→ULTRAHIGH                     |
+| `--vpc_id`            | Yes      | Must exist in target region                                                                  |
+| `--subnet_id`         | Yes      | Must exist in target region                                                                  |
+| `--security_group_id` | Yes      | Must have DB port open                                                                       |
+| `--availability_zone` | Yes      | Use AZ code from `NovaListAvailabilityZones`                                                 |
+| `--charge_info`       | No       | `--charge_info.charge_mode=<mode>`. Default postPaid (pay-per-use). Run `--help` for options |
+| `--password`          | Yes      | 8-32 chars, uppercase+lowercase+digit+special                                                |
+| `--port`              | No       | Default 3306 (MySQL) / 5432 (PG) / 1433 (SQL Server)                                         |
 ### Modify / Resize
 ```bash
 hcloud RDS StartInstanceRestartAction --instance_id=<id> --cli-region=<r>
 hcloud RDS StartResizeFlavorAction --instance_id=<id> --flavor_ref=<new-id> --cli-region=<r>
@@ -125,6 +129,7 @@ hcloud RDS UpdateInstanceAlias --instance_id=<id> --alias=<new-name> --cli-regio
 ```
 ### Delete
 ```bash
 hcloud RDS DeleteInstance --instance_id=<id> --cli-region=<r>
 ```
@@ -172,41 +177,41 @@ psql -h <private_ip> -p 5432 -U root -d postgres
 If a database client is not installed on the agent's machine, install one:
-| Platform | MySQL | PostgreSQL |
-|----------|-------|------------|
-| **Linux** | `apt install mysql-client` / `yum install mysql` | `apt install postgresql-client` |
-| **macOS** | `brew install mysql-client` | `brew install libpq` |
-| **Windows** | Download MySQL Workbench or `winget install Oracle.MySQL` | Download pgAdmin or `winget install PostgreSQL.PostgreSQL` |
+| Platform         | MySQL                                                        | PostgreSQL                                                     |
+| ---------------- | ------------------------------------------------------------ | -------------------------------------------------------------- |
+| **Linux**        | `apt install mysql-client` / `yum install mysql`             | `apt install postgresql-client`                                |
+| **macOS**        | `brew install mysql-client`                                  | `brew install libpq`                                           |
+| **Windows**      | Download MySQL Workbench or `winget install Oracle.MySQL`    | Download pgAdmin or `winget install PostgreSQL.PostgreSQL`     |
 | **Python (any)** | `pip install pymysql` then `python -c "import pymysql; ..."` | `pip install psycopg2` then `python -c "import psycopg2; ..."` |
-| **Docker (any)** | `docker run -it --rm mysql:8 mysql -h <ip> -u root -p` | `docker run -it --rm postgres:16 psql -h <ip> -U root` |
+| **Docker (any)** | `docker run -it --rm mysql:8 mysql -h <ip> -u root -p`       | `docker run -it --rm postgres:16 psql -h <ip> -U root`         |
 > If no client can be installed, use the Huawei Cloud **Data Studio** console: https://console.huaweicloud.com/dms/
 ## Mutating Operations (Require Approval)
-| Operation | Effect |
-|-----------|--------|
-| `CreateInstance` | New instance (billing starts) |
-| `DeleteInstance` | Irreversible data loss |
-| `StartResizeFlavorAction` | Brief interruption during switchover |
-| `StartInstanceEnlargeVolumeAction` | Online, but irreversible |
-| `StartFailover` | Primary-standby switchover |
-| `CreateRestoreInstance` | Creates new instance from backup |
-| `CreateManualBackup` | Incurs OBS storage charges |
-| `DeleteManualBackup` | Irreversible |
+| Operation                          | Effect                               |
+| ---------------------------------- | ------------------------------------ |
+| `CreateInstance`                   | New instance (billing starts)        |
+| `DeleteInstance`                   | Irreversible data loss               |
+| `StartResizeFlavorAction`          | Brief interruption during switchover |
+| `StartInstanceEnlargeVolumeAction` | Online, but irreversible             |
+| `StartFailover`                    | Primary-standby switchover           |
+| `CreateRestoreInstance`            | Creates new instance from backup     |
+| `CreateManualBackup`               | Incurs OBS storage charges           |
+| `DeleteManualBackup`               | Irreversible                         |
 ## Troubleshooting
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| Connection refused | SG missing DB port. Add ingress rule |
-| Storage full | Manual resize or enable auto-scaling |
-| DBS.280241 Invalid storage type | Volume type doesn't match flavor group |
-| DBS.280448 Sold out | Try different volume type or AZ |
-| Replication lag | Check `ShowReplicationStatus`. Consider read replica |
-| Instance stuck BUILDING | Check task status: `hcloud RDS ListTasks` |
-| SYS.0403 | SCP policy denies this operation (e.g. security group rules, EIP binding). See `huawei-vpc` troubleshooting |
-| EIP.7905 | EIP quota exceeded — cannot create new EIP for public access. See `huawei-vpc` troubleshooting |
+| Error                           | Root Cause -> Fix                                                                                           |
+| ------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| Connection refused              | SG missing DB port. Add ingress rule                                                                        |
+| Storage full                    | Manual resize or enable auto-scaling                                                                        |
+| DBS.280241 Invalid storage type | Volume type doesn't match flavor group                                                                      |
+| DBS.280448 Sold out             | Try different volume type or AZ                                                                             |
+| Replication lag                 | Check `ShowReplicationStatus`. Consider read replica                                                        |
+| Instance stuck BUILDING         | Check task status: `hcloud RDS ListTasks`                                                                   |
+| SYS.0403                        | SCP policy denies this operation (e.g. security group rules, EIP binding). See `huawei-vpc` troubleshooting |
+| EIP.7905                        | EIP quota exceeded — cannot create new EIP for public access. See `huawei-vpc` troubleshooting              |
 ## Security

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md CHANGED Viewed

@@ -1,6 +1,6 @@
 ---
 name: huawei-sandbox
-description: "Use when creating, connecting, or managing Huawei Cloud Sandbox instances and workspace terminals, or when a task needs a temporary runtime to deploy, run, or preview a web application. Covers sandbox lifecycle (check-user, sign-agreement, connect, release), session-based terminal execution, and credential injection. Triggers on: sandbox, workspace, terminal, web app deployment, deploy web app, preview app, deploy github, github repo, deploy repo, website, static site, web application, hwlink, devstation, hdkitservice, remote exec. NOT for: ECS instances (use huawei-ecs), CCE clusters (use huawei-cce)."
+description: 'Use when creating, connecting, or managing Huawei Cloud Sandbox instances and workspace terminals, or when a task needs a temporary runtime to deploy, run, or preview a web application. Covers sandbox lifecycle (check-user, sign-agreement, connect, release), session-based terminal execution, and credential injection. Triggers on: sandbox, workspace, terminal, web app deployment, deploy web app, preview app, deploy github, github repo, deploy repo, website, static site, web application, hwlink, devstation, hdkitservice, remote exec. NOT for: ECS instances (use huawei-ecs), CCE clusters (use huawei-cce).'
 version: 1
 ---
@@ -26,25 +26,25 @@ Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace t
 ### User Verification (Prerequisites)
-| Tool | Purpose |
-|------|---------|
-| `huaweicloud_sandbox_check_user` | Check real-name verification and agreement signing status |
+| Tool                                 | Purpose                                                     |
+| ------------------------------------ | ----------------------------------------------------------- |
+| `huaweicloud_sandbox_check_user`     | Check real-name verification and agreement signing status   |
 | `huaweicloud_sandbox_sign_agreement` | Sign unsigned/outdated agreements (required before connect) |
 ### Sandbox Lifecycle
-| Tool | Purpose |
-|------|---------|
-| `huaweicloud_sandbox_connect` | Connect to sandbox (one user one instance, reuses existing if available) |
-| `huaweicloud_sandbox_credentials` | Inject temporary AK/SK into a running sandbox |
+| Tool                              | Purpose                                                                  |
+| --------------------------------- | ------------------------------------------------------------------------ |
+| `huaweicloud_sandbox_connect`     | Connect to sandbox (one user one instance, reuses existing if available) |
+| `huaweicloud_sandbox_credentials` | Inject temporary AK/SK into a running sandbox                            |
 ### Terminal Execution
-| Tool | Purpose |
-|------|---------|
-| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists) |
-| `huaweicloud_sandbox_upload_file` | Upload a local file into the sandbox (chunked base64 write + md5 verify) |
-| `huaweicloud_sandbox_close_session` | Close a persistent terminal session |
+| Tool                                    | Purpose                                                                  |
+| --------------------------------------- | ------------------------------------------------------------------------ |
+| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists)                                 |
+| `huaweicloud_sandbox_upload_file`       | Upload a local file into the sandbox (chunked base64 write + md5 verify) |
+| `huaweicloud_sandbox_close_session`     | Close a persistent terminal session                                      |
 ## Workflow
@@ -74,11 +74,11 @@ There is no general file-upload primitive on the sandbox service itself. Get loc
 `huaweicloud_sandbox_exec_with_session` is fragile for long commands and large inline content. Do NOT paste a file's base64 directly into a single command:
-| Payload | Result |
-|---------|--------|
-| ~30KB base64 in one command | exec timeout |
+| Payload                     | Result                                 |
+| --------------------------- | -------------------------------------- |
+| ~30KB base64 in one command | exec timeout                           |
 | ~12KB base64 in one command | session crash (`session is not ready`) |
-| ~4–5KB normal command | OK |
+| ~4–5KB normal command       | OK                                     |
 Keep individual exec commands small (≤ ~4KB). For larger content, use `huaweicloud_sandbox_upload_file` instead.
@@ -133,20 +133,20 @@ sleep 10 && cat /tmp/host.log
 ## Critical Warnings
-| Trap | Why |
-|------|-----|
-| Agreement required first | `sandbox_connect` fails if the agreement isn't signed; the `sandbox_check_user` preflight detects this, so surface it to the developer only when signing is needed |
-| Real-name required | `sandbox_connect` fails if `realnameVerified=false`; tell the developer once and stop, don't loop on connect |
-| Never expose tunnel details | Do not mention "DevBridge"/"tunnel"/"devbridge" to the developer — say "正在生成访问地址..." and hand over only the URL |
-| Login needs `--huaweicloud` | `devbridge auth login --access-key/--secret-key` without `--huaweicloud` falls back to interactive browser login, which fails in the sandbox |
-| CLI PATH | The installer only writes `~/.bashrc`; run `export PATH=$PATH:$HOME/.huawei/bin` in the session before using `devbridge` |
-| Never install tunnel tooling locally | If the sandbox cannot install it, report a generic error and stop — installing on the developer's machine defeats sandbox deployment |
-| Return the deployment URL | Always hand the public URL from the host log to the developer as the final result |
-| Session state persists | `exec_with_session` preserves `cd`, env vars, aliases between calls |
-| Destructive commands blocked | `rm -rf /`, `mkfs`, `dd if=`, fork bombs are denied by safety policy |
-| Workspace ID = dev_stage_id | Use `dev_stage_id` from `sandbox_connect` as `workspace_id` for terminal exec |
-| Projects live in `/workspace` | Clone/install project code under `/workspace/<repo-name>` (filesystem-root workspace mount, not `$HOME/workspace`), never in `/tmp` — ephemeral locations lose the project when the sandbox session restarts |
-| Node.js >= 22 required | Sandbox terminal uses built-in WebSocket (globalThis.WebSocket); if Node.js is missing, install it from the Huawei Cloud mirror (see "Node.js in the sandbox") |
+| Trap                                 | Why                                                                                                                                                                                                          |
+| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Agreement required first             | `sandbox_connect` fails if the agreement isn't signed; the `sandbox_check_user` preflight detects this, so surface it to the developer only when signing is needed                                           |
+| Real-name required                   | `sandbox_connect` fails if `realnameVerified=false`; tell the developer once and stop, don't loop on connect                                                                                                 |
+| Never expose tunnel details          | Do not mention "DevBridge"/"tunnel"/"devbridge" to the developer — say "正在生成访问地址..." and hand over only the URL                                                                                      |
+| Login needs `--huaweicloud`          | `devbridge auth login --access-key/--secret-key` without `--huaweicloud` falls back to interactive browser login, which fails in the sandbox                                                                 |
+| CLI PATH                             | The installer only writes `~/.bashrc`; run `export PATH=$PATH:$HOME/.huawei/bin` in the session before using `devbridge`                                                                                     |
+| Never install tunnel tooling locally | If the sandbox cannot install it, report a generic error and stop — installing on the developer's machine defeats sandbox deployment                                                                         |
+| Return the deployment URL            | Always hand the public URL from the host log to the developer as the final result                                                                                                                            |
+| Session state persists               | `exec_with_session` preserves `cd`, env vars, aliases between calls                                                                                                                                          |
+| Destructive commands blocked         | `rm -rf /`, `mkfs`, `dd if=`, fork bombs are denied by safety policy                                                                                                                                         |
+| Workspace ID = dev_stage_id          | Use `dev_stage_id` from `sandbox_connect` as `workspace_id` for terminal exec                                                                                                                                |
+| Projects live in `/workspace`        | Clone/install project code under `/workspace/<repo-name>` (filesystem-root workspace mount, not `$HOME/workspace`), never in `/tmp` — ephemeral locations lose the project when the sandbox session restarts |
+| Node.js >= 22 required               | Sandbox terminal uses built-in WebSocket (globalThis.WebSocket); if Node.js is missing, install it from the Huawei Cloud mirror (see "Node.js in the sandbox")                                               |
 ## Node.js in the sandbox
@@ -163,11 +163,11 @@ node --version
 ## Environment Variables
-| Variable | Required | Description |
-|----------|----------|-------------|
-| `HW_ACCESS_KEY` | Yes | Huawei Cloud AK |
-| `HW_SECRET_KEY` | Yes | Huawei Cloud SK |
-| `HW_SECURITY_TOKEN` | No | STS security token |
-| `HW_WORKSPACE_ID` | No | Default workspace ID |
-| `HDKITSERVICE_ENDPOINT` | No | hdkitservice API endpoint |
-| `HWLINK_ENDPOINT` | No | DevStation API endpoint |
+| Variable                | Required | Description               |
+| ----------------------- | -------- | ------------------------- |
+| `HW_ACCESS_KEY`         | Yes      | Huawei Cloud AK           |
+| `HW_SECRET_KEY`         | Yes      | Huawei Cloud SK           |
+| `HW_SECURITY_TOKEN`     | No       | STS security token        |
+| `HW_WORKSPACE_ID`       | No       | Default workspace ID      |
+| `HDKITSERVICE_ENDPOINT` | No       | hdkitservice API endpoint |
+| `HWLINK_ENDPOINT`       | No       | DevStation API endpoint   |

package/plugins/huaweicloud-core/skills/huawei-smn-dms/SKILL.md CHANGED Viewed

@@ -1,6 +1,6 @@
 ---
 name: huawei-smn-dms
-description: "Use when creating or managing SMN topics/subscriptions/messages or DMS Kafka/RabbitMQ/RocketMQ queues on Huawei Cloud. Triggers: SMN, DMS, notification, message queue, Kafka, RabbitMQ, RocketMQ, topic, subscription. NOT for: APIG (use huawei-apig), FunctionGraph triggers (use huawei-functiongraph)."
+description: 'Use when creating or managing SMN topics/subscriptions/messages or DMS Kafka/RabbitMQ/RocketMQ queues on Huawei Cloud. Triggers: SMN, DMS, notification, message queue, Kafka, RabbitMQ, RocketMQ, topic, subscription. NOT for: APIG (use huawei-apig), FunctionGraph triggers (use huawei-functiongraph).'
 version: 1
 ---
@@ -18,50 +18,50 @@ Domain expertise for SMN (Simple Message Notification) and DMS (Distributed Mess
 ## Critical Warnings
-| Trap | Why |
-|------|-----|
+| Trap                      | Why                                                           |
+| ------------------------- | ------------------------------------------------------------- |
 | Subscription confirmation | HTTP/HTTPS subscriptions need endpoint ping-back confirmation |
-| Email subscription delay | Email subscriptions require user to click confirmation link |
-| SMS charge per message | Template SMS incurs per-delivery charges |
+| Email subscription delay  | Email subscriptions require user to click confirmation link   |
+| SMS charge per message    | Template SMS incurs per-delivery charges                      |
 ### Common Workflows
-| Task | Operation |
-|------|-----------|
-| List topics | `ListTopics --cli-region=<r> --project_id=<p>` |
-| Create topic | `CreateTopic --cli-region=<r> --project_id=<p>` |
-| Add subscription | `AddSubscription --cli-region=<r> --project_id=<p>` |
-| List subscriptions | `ListSubscriptions --cli-region=<r> --project_id=<p>` |
+| Task                    | Operation                                                 |
+| ----------------------- | --------------------------------------------------------- |
+| List topics             | `ListTopics --cli-region=<r> --project_id=<p>`            |
+| Create topic            | `CreateTopic --cli-region=<r> --project_id=<p>`           |
+| Add subscription        | `AddSubscription --cli-region=<r> --project_id=<p>`       |
+| List subscriptions      | `ListSubscriptions --cli-region=<r> --project_id=<p>`     |
 | Create message template | `CreateMessageTemplate --cli-region=<r> --project_id=<p>` |
-| Publish message | `PublishMessage --cli-region=<r> --project_id=<p>` |
-| Delete topic | `DeleteTopic --cli-region=<r> --project_id=<p>` |
+| Publish message         | `PublishMessage --cli-region=<r> --project_id=<p>`        |
+| Delete topic            | `DeleteTopic --cli-region=<r> --project_id=<p>`           |
 ## DMS
 ### Service Types
-| Type | KooCLI Service |
-|------|---------------|
-| Kafka | `hcloud DMS` |
-| RabbitMQ | `hcloud DMS` |
-| RocketMQ | `hcloud DMS` |
+| Type     | KooCLI Service |
+| -------- | -------------- |
+| Kafka    | `hcloud DMS`   |
+| RabbitMQ | `hcloud DMS`   |
+| RocketMQ | `hcloud DMS`   |
 ### Common Workflows
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| Task                  | Operation                                          |
+| --------------------- | -------------------------------------------------- |
+| List instances        | `ListInstances --cli-region=<r> --project_id=<p>`  |
 | Create Kafka instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
-| List Kafka topics | `ListTopics --cli-region=<r> --project_id=<p>` |
+| List Kafka topics     | `ListTopics --cli-region=<r> --project_id=<p>`     |
 Discover exact parameters with `--help` before executing any command.
 ## Troubleshooting
-| Error | Fix |
-|-------|-----|
-| Subscription not confirmed | SMN subscriptions need endpoint/user confirmation |
-| DMS instance creation fails | Check VPC/subnet availability and engine version |
+| Error                       | Fix                                               |
+| --------------------------- | ------------------------------------------------- |
+| Subscription not confirmed  | SMN subscriptions need endpoint/user confirmation |
+| DMS instance creation fails | Check VPC/subnet availability and engine version  |
 ## Cross-Skill References

package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md CHANGED Viewed

@@ -1,6 +1,6 @@
 ---
 name: huawei-vpc
-description: "Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration."
+description: 'Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration.'
 version: 1
 ---
@@ -18,50 +18,50 @@ Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet
 ## Critical Warnings
-| Trap | Why |
-|------|-----|
-| VPC CIDR cannot change | Once set, VPC CIDR block is immutable |
-| Security group stateful | SG rules are stateful. Return traffic auto-allowed |
-| Network ACL stateless | ACL rules must allow both inbound AND outbound |
-| EIP bills when idle | Unbound EIP still charges. Release when unused |
-| Subnet AZ binding | Subnet tied to single AZ. Cross-AZ needs multiple subnets |
-| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required |
-| **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |
-| **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |
-| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS IPs: cn-north-4 (100.125.1.250 / 100.125.1.251), cn-north-1 (100.125.1.250 / 100.125.129.250), cn-east-3 (100.125.1.250 / 100.125.129.250), ap-southeast-3 (100.125.1.250 / 100.125.128.250) |
-| SCP blocks 0.0.0.0/0 SG rules | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead |
-| **VPC tags use `*` separator** | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value` |
+| Trap                                  | Why                                                                                                                                                                                                                                                                                                                                                                                                |
+| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| VPC CIDR cannot change                | Once set, VPC CIDR block is immutable                                                                                                                                                                                                                                                                                                                                                              |
+| Security group stateful               | SG rules are stateful. Return traffic auto-allowed                                                                                                                                                                                                                                                                                                                                                 |
+| Network ACL stateless                 | ACL rules must allow both inbound AND outbound                                                                                                                                                                                                                                                                                                                                                     |
+| EIP bills when idle                   | Unbound EIP still charges. Release when unused                                                                                                                                                                                                                                                                                                                                                     |
+| Subnet AZ binding                     | Subnet tied to single AZ. Cross-AZ needs multiple subnets                                                                                                                                                                                                                                                                                                                                          |
+| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required                                                                                                                                                                                                                                                                                                                 |
+| **VPC params need nested prefix**     | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx`                                                                                                                                                                                                                                                                |
+| **Security group needs no vpc_id**    | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound                                                                                                                                                                                                                                                                                         |
+| Subnet DNS empty → ECS no DNS         | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS IPs: cn-north-4 (100.125.1.250 / 100.125.1.251), cn-north-1 (100.125.1.250 / 100.125.129.250), cn-east-3 (100.125.1.250 / 100.125.129.250), ap-southeast-3 (100.125.1.250 / 100.125.128.250) |
+| SCP blocks 0.0.0.0/0 SG rules         | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead                                                                                                                                                                                         |
+| **VPC tags use `*` separator**        | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value`                                                                                                                                                                                                                         |
 ## Common Workflows
-| Task | Command | Steps |
-|------|---------|-------|
-| Create VPC | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr> | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first |
-| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
-| Update subnet | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2> | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes |
-| Security group | hcloud VPC CreateSecurityGroup --security_group.name=<name> | references/security-group.md |
-| SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |
-| Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |
-| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
-| Unbind EIP | hcloud EIP DisassociatePublicip --publicip_id=<id> | references/eip.md |
-| Delete EIP | hcloud EIP DeletePublicip --publicip_id=<id> | references/eip.md |
-| List EIPs | hcloud EIP ListPublicips | |
-| NAT gateway | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id> | Run `hcloud NAT CreateNatGateway --help` for available spec values |
+| Task            | Command                                                                                                                                                                                                                                                    | Steps                                                                                                                |
+| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
+| Create VPC      | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr>                                                                                                                                                                                                   | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first                                           |
+| Create subnet   | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az>                                                  | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
+| Update subnet   | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2>                                                                                                                                                               | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes                             |
+| Security group  | hcloud VPC CreateSecurityGroup --security_group.name=<name>                                                                                                                                                                                                | references/security-group.md                                                                                         |
+| SG rule         | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md                                                                                         |
+| Create EIP      | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>                                                                                                                       | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region                                       |
+| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT                                                                                                                        | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id`                             |
+| Unbind EIP      | hcloud EIP DisassociatePublicip --publicip_id=<id>                                                                                                                                                                                                         | references/eip.md                                                                                                    |
+| Delete EIP      | hcloud EIP DeletePublicip --publicip_id=<id>                                                                                                                                                                                                               | references/eip.md                                                                                                    |
+| List EIPs       | hcloud EIP ListPublicips                                                                                                                                                                                                                                   |                                                                                                                      |
+| NAT gateway     | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id>                                                                                                                                     | Run `hcloud NAT CreateNatGateway --help` for available spec values                                                   |
 ## Troubleshooting
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Cannot reach instance | SG missing rule or no EIP -> Add SG rule / Bind EIP |
-| Subnet CIDR conflict | Overlapping with existing subnets -> Choose non-overlapping CIDR |
-| NAT gateway no internet | Route table missing default route -> Add 0.0.0.0/0 via NAT |
-| EIP quota exceeded | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10) |
-| EIP.7905 | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage |
-| VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |
-| EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
-| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help` |
-| VPC.0209: Subnet still used | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet |
-| SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |
+| Error                                              | Root Cause -> Fix                                                                                                                                                                                                                            |
+| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Cannot reach instance                              | SG missing rule or no EIP -> Add SG rule / Bind EIP                                                                                                                                                                                          |
+| Subnet CIDR conflict                               | Overlapping with existing subnets -> Choose non-overlapping CIDR                                                                                                                                                                             |
+| NAT gateway no internet                            | Route table missing default route -> Add 0.0.0.0/0 via NAT                                                                                                                                                                                   |
+| EIP quota exceeded                                 | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10)                                                                                                             |
+| EIP.7905                                           | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage                                                                                                                                                                 |
+| VPC.0301: Bandwidth name invalid                   | PER type requires `--bandwidth.name`, even though `--help` marks it optional                                                                                                                                                                 |
+| EIP has no public IP after binding                 | May need AddIngressEipV2 for ELB-type resources (see huawei-apig)                                                                                                                                                                            |
+| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help`      |
+| VPC.0209: Subnet still used                        | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet                                                                                                                                                               |
+| SYS.0403 / SCP deny                                | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |
 ## Security Considerations

package/plugins/huaweicloud-core/skills/huawei-vpc/references/network.md CHANGED Viewed

@@ -4,15 +4,16 @@
 Subnets without DNS configuration will fail cloud-init. Use these DNS addresses:
-| Region | Primary DNS | Secondary DNS |
-|--------|------------|---------------|
-| cn-north-1 | 100.125.1.250 | 100.125.129.250 |
-| cn-north-4 | 100.125.1.250 | 100.125.129.250 |
-| cn-east-3 | 100.125.1.250 | 100.125.129.250 |
-| cn-south-1 | 100.125.1.250 | 100.125.129.250 |
+| Region         | Primary DNS   | Secondary DNS   |
+| -------------- | ------------- | --------------- |
+| cn-north-1     | 100.125.1.250 | 100.125.129.250 |
+| cn-north-4     | 100.125.1.250 | 100.125.129.250 |
+| cn-east-3      | 100.125.1.250 | 100.125.129.250 |
+| cn-south-1     | 100.125.1.250 | 100.125.129.250 |
 | ap-southeast-3 | 100.125.1.250 | 100.125.129.250 |
 **Subnet create with DNS**:
 ```bash
 hcloud VPC CreateSubnet \
   --subnet.name=<name> \
@@ -28,12 +29,12 @@ hcloud VPC CreateSubnet \
 KooCLI 7.x VPC API requires nested prefixes:
-| Resource | Create Param Prefix | Example |
-|----------|---------------------|---------|
-| VPC | `--vpc.` | `--vpc.name=my-vpc --vpc.cidr=192.168.0.0/16` |
-| Subnet | `--subnet.` | `--subnet.name=web --subnet.vpc_id=<id> --subnet.cidr=192.168.1.0/24` |
-| Security Group | `--security_group.` | `--security_group.name=sg-web` |
-| SG Rule | `--security_group_rule.` | `--security_group_rule.direction=ingress` |
+| Resource       | Create Param Prefix      | Example                                                               |
+| -------------- | ------------------------ | --------------------------------------------------------------------- |
+| VPC            | `--vpc.`                 | `--vpc.name=my-vpc --vpc.cidr=192.168.0.0/16`                         |
+| Subnet         | `--subnet.`              | `--subnet.name=web --subnet.vpc_id=<id> --subnet.cidr=192.168.1.0/24` |
+| Security Group | `--security_group.`      | `--security_group.name=sg-web`                                        |
+| SG Rule        | `--security_group_rule.` | `--security_group_rule.direction=ingress`                             |
 ## EIP Management