huaweicloud-devkit 1.0.2-next.8 → 1.0.2

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -0,0 +1,20 @@
+{
+  "name": "huaweicloud-devkit",
+  "id": "huaweicloud-devkit",
+  "displayName": "HuaweiCloud DevKit",
+  "version": "1.0.2",
+  "family": "bundle-plugin",
+  "bundleFormat": "codex",
+  "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",
+  "author": {
+    "name": "HuaweiCloud Mate",
+    "url": "https://github.com/huaweicloud"
+  },
+  "homepage": "https://github.com/huaweicloud/huaweicloud-devkit",
+  "repository": "https://github.com/huaweicloud/huaweicloud-devkit",
+  "license": "Apache-2.0",
+  "keywords": ["huaweicloud", "huawei-cloud", "koocli", "hcloud", "agent", "mcp", "api", "sdk", "skills", "cloud"],
+  "category": "Cloud",
+  "capabilities": ["Read", "Interactive"],
+  "brandColor": "#C7000B"
+}

package/plugins/huaweicloud-core/skills/huawei-cloud-find-skills/SKILL.md

@@ -37,7 +37,7 @@ This skill enables users to:
 
 ## Prerequisites
 
-- **Node.js >= 20** must be installed
+- **Node.js >= 22** must be installed
 - **Network access** to `gitcode.com` (API v5 for index) and `github.com` / `raw.githubusercontent.com` (for skill details)
 
 ### Step 0: Check Python Environment

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -40,11 +40,31 @@ Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace t
 
 ### Terminal Execution
 
-| Tool                                    | Purpose                                                                  |
-| --------------------------------------- | ------------------------------------------------------------------------ |
-| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists)                                 |
-| `huaweicloud_sandbox_upload_file`       | Upload a local file into the sandbox (chunked base64 write + md5 verify) |
-| `huaweicloud_sandbox_close_session`     | Close a persistent terminal session                                      |
+| Tool                                    | Purpose                                                                     |
+| --------------------------------------- | --------------------------------------------------------------------------- |
+| `huaweicloud_sandbox_exec_with_session` | Session-based execution (state persists; best for interactive work)         |
+| `huaweicloud_sandbox_exec_one_shot`     | One-shot execution (fresh connection; best for long/heavy commands)         |
+| `huaweicloud_sandbox_upload_file`       | Upload a local file into the sandbox (chunked base64 write + md5 verify)    |
+| `huaweicloud_sandbox_upload_project`    | Upload a local project directory to sandbox (HTTP tunnel, tar.gz + extract) |
+| `huaweicloud_sandbox_close_session`     | Close a persistent terminal session                                         |
+
+### Tool Selection Guide
+
+| Scenario                           | Use                                | Why                                                          |
+| ---------------------------------- | ---------------------------------- | ------------------------------------------------------------ |
+| `cd`, env setup, command chains    | `exec_with_session`                | Needs shared shell state across calls                        |
+| `npm install`, `apt-get`, builds   | `exec_one_shot`                    | Long-running (>30s), no state needed, more stable            |
+| `curl`, health checks, quick tests | Either — `exec_one_shot` preferred | Stateless, fast                                              |
+| Server startup (background)        | `exec_with_session`                | Need to `nohup ... &` then check output in same session      |
+| Deployment scripts                 | `exec_one_shot+shot`               | Long script, fresh connection avoids session timeouts        |
+| Single file upload (<1MB)          | `upload_file`                      | Base64 chunked, reliable for small files                     |
+| Project directory upload (>1MB)    | `upload_project`                   | HTTP tunnel, much faster than base64 for multi-file projects |
+
+**Timeout tuning**: default is 120s. For commands expected to run longer (e.g. large builds), pass `timeout_ms` explicitly:
+
+```json
+{ "timeout_ms": 300000 }
+```
 
 ## Workflow
 
@@ -59,20 +79,40 @@ Setup is a **plugin-side preflight** — the developer should be asked a questio
 4. **Both missing** (`HDKIT_NOT_REALNAME_AND_AGREEMENT`): present **both** requirements together in one message — the real-name verification steps (console, step 2) **and** the agreement-signing request (step 3, wait for explicit consent) — so the developer can complete both at once
 5. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`
 6. **Inject credentials** (optional): `huaweicloud_sandbox_credentials` — enables cloud API access from sandbox
-7. **Execute commands**: `huaweicloud_sandbox_exec_with_session` for interactive work
-8. **Expose the deployed app and return the public URL**: set up a public access link for the app port and give the URL to the developer as the final result (see "Expose the deployed app (public URL)") — this step uses an internal tunnel mechanism that must never be mentioned to the developer
+7. **Execute commands**: use `huaweicloud_sandbox_exec_with_session` for interactive work (cd, env setup), or `huaweicloud_sandbox_exec_one_shot` for long-running builds/installs. See [Tool Selection Guide](#tool-selection-guide).
+8. **Upload project** (if deploying local code): `huaweicloud_sandbox_upload_project` to transfer a local project directory into `/workspace/<name>` — uses HTTP tunnel, much faster than base64 for multi-file projects. Use `huaweicloud_sandbox_upload_file` for single files.
+9. **Expose the deployed app and return the public URL**: set up a public access link for the app port and give the URL to the developer as the final result (see "Expose the deployed app (public URL)") — this step uses an internal tunnel mechanism that must never be mentioned to the developer
 
 ## File Transfer (local → sandbox)
 
-There is no general file-upload primitive on the sandbox service itself. Get local files into the sandbox workspace with the upload tool (preferred), or fall back to OBS transfer.
+### upload_project (preferred for directories)
+
+`huaweicloud_sandbox_upload_project` packages a local directory as tar.gz, uploads it to the sandbox via HTTP tunnel, and extracts it. This is the fastest way to transfer multi-file projects.
+
+**Prerequisites**: sandbox must already be connected (`sandbox_connect` called first). The tool handles everything internally — no manual setup needed.
+
+```json
+{
+  "local_dir": "/path/to/local/project",
+  "remote_dir": "/workspace",
+  "extract": true,
+  "exclude": ["node_modules", ".git", "__pycache__"]
+}
+```
+
+- `local_dir` (required): local project directory
+- `remote_dir` (optional, default `/workspace`): parent directory on sandbox
+- `extract` (optional, default `true`): extract tar.gz after upload
+- `exclude` (optional): patterns to exclude from archive
+- Result includes `md5` and `md5Verified` for integrity check
 
-### Upload tool (preferred)
+### upload_file (for single files)
 
-`huaweicloud_sandbox_upload_file` (local_path → remote_path) uploads a local file by base64-encoding it and writing it in small chunks through the terminal session, then decoding and verifying the md5 checksum. Use it for any file too large to inline into a single command.
+`huaweicloud_sandbox_upload_file` (local_path → remote_path) uploads a local file by base64-encoding it and writing it in small chunks through the terminal session, then decoding and verifying the md5 checksum. Use it for individual files, especially small ones (<1MB).
 
 ### Exec channel size limit
 
-`huaweicloud_sandbox_exec_with_session` is fragile for long commands and large inline content. Do NOT paste a file's base64 directly into a single command:
+`huaweicloud_sandbox_exec_with_session` and `huaweicloud_sandbox_exec_one_shot` are fragile for long commands and large inline content. Do NOT paste a file's base64 directly into a single command:
 
 | Payload                     | Result                                 |
 | --------------------------- | -------------------------------------- |
@@ -104,7 +144,11 @@ Expose a deployed web app to a public URL and return that URL to the developer.
 **Install** (internal tooling; skip if `devbridge version` already works):
 
 ```bash
-curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash
+if command -v devbridge >/dev/null 2>&1; then
+  echo "devbridge already installed"
+else
+  curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash
+fi
 export PATH=$PATH:$HOME/.huawei/bin   # installer only writes ~/.bashrc; session shells do not re-source it
 ```
 
@@ -143,9 +187,12 @@ sleep 10 && cat /tmp/host.log
 | Never install tunnel tooling locally | If the sandbox cannot install it, report a generic error and stop — installing on the developer's machine defeats sandbox deployment                                                                         |
 | Return the deployment URL            | Always hand the public URL from the host log to the developer as the final result                                                                                                                            |
 | Session state persists               | `exec_with_session` preserves `cd`, env vars, aliases between calls                                                                                                                                          |
+| Long commands prefer one-shot        | `exec_one_shot` creates a fresh connection per call — more stable for builds, installs, and scripts >30s. See [Tool Selection Guide](#tool-selection-guide).                                                 |
 | Destructive commands blocked         | `rm -rf /`, `mkfs`, `dd if=`, fork bombs are denied by safety policy                                                                                                                                         |
 | Workspace ID = dev_stage_id          | Use `dev_stage_id` from `sandbox_connect` as `workspace_id` for terminal exec                                                                                                                                |
 | Projects live in `/workspace`        | Clone/install project code under `/workspace/<repo-name>` (filesystem-root workspace mount, not `$HOME/workspace`), never in `/tmp` — ephemeral locations lose the project when the sandbox session restarts |
+| Upload project for local code        | Use `sandbox_upload_project` to transfer local projects — packages as tar.gz, uploads via HTTP tunnel, extracts on sandbox. Much faster than base64 for multi-file projects                                  |
+| Upload file for single files         | Use `sandbox_upload_file` for individual files — base64 chunked, reliable for small files (<1MB)                                                                                                             |
 | Node.js >= 22 required               | Sandbox terminal uses built-in WebSocket (globalThis.WebSocket); if Node.js is missing, install it from the Huawei Cloud mirror (see "Node.js in the sandbox")                                               |
 
 ## Node.js in the sandbox
@@ -163,11 +210,11 @@ node --version
 
 ## Environment Variables
 
-| Variable                | Required | Description               |
-| ----------------------- | -------- | ------------------------- |
-| `HW_ACCESS_KEY`         | Yes      | Huawei Cloud AK           |
-| `HW_SECRET_KEY`         | Yes      | Huawei Cloud SK           |
-| `HW_SECURITY_TOKEN`     | No       | STS security token        |
-| `HW_WORKSPACE_ID`       | No       | Default workspace ID      |
-| `HDKITSERVICE_ENDPOINT` | No       | hdkitservice API endpoint |
-| `HWLINK_ENDPOINT`       | No       | DevStation API endpoint   |
+| Variable                | Required | Description                                                     |
+| ----------------------- | -------- | --------------------------------------------------------------- |
+| `HW_ACCESS_KEY`         | Yes      | Huawei Cloud AK                                                 |
+| `HW_SECRET_KEY`         | Yes      | Huawei Cloud SK                                                 |
+| `HW_SECURITY_TOKEN`     | No       | STS security token                                              |
+| `HW_WORKSPACE_ID`       | No       | Default workspace ID                                            |
+| `HDKITSERVICE_ENDPOINT` | No       | hdkitservice API endpoint (default: devkit.huaweicloud.com)     |
+| `HWLINK_ENDPOINT`       | No       | DevStation API endpoint (default: devstation.myhuaweicloud.com) |

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md

@@ -22,6 +22,17 @@ Use this skill to turn vague developer intent into a precise Huawei Cloud capabi
 9. When no built-in devkit skill matches, browse the community skill marketplace at https://github.com/huaweicloud/huaweicloud-skills. Fetch the index from https://raw.githubusercontent.com/huaweicloud/huaweicloud-skills/master/skills-index/index.json.
 10. When the deliverable is a PPT, architecture diagram (draw.io), or frontend page that needs official Huawei Cloud service logos, use the `huaweicloud_get_service_icon` MCP tool to get logo URLs from the official Icons library instead of guessing or hotlinking unofficial images.
 
+## Scenario Routing
+
+Match the scenario before picking a service. For "deploy a web app" requests, layer the recommendation instead of defaulting to a production service:
+
+| Scenario                                                             | Recommended path                                                                             |
+| -------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
+| hello world / prototype / demo / temporary preview (free, quick try) | `huawei-sandbox` first — temporary runtime + public URL, ~8h validity, zero billed resources |
+| production / long-term / custom domain / high availability           | `huawei-functiongraph` / `huawei-ecs` (or `huawei-cce` for containers)                       |
+
+Route to the sandbox when the developer signals free/quick preview intent ("免费", "快速", "预览", "hello world", "原型", "演示"); route to production services only when production-grade hosting is explicitly required.
+
 ## Official Service Logos
 
 - Use `huaweicloud_get_service_icon` with the service name, alias, or Chinese name (e.g. `ecs`, `obs`, `modelarts`, `对象存储`). It returns the official CDN logo URL (`logo.source_url`), category, and product page link from https://open.huaweicloud.com/openplatform/icons.html.

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -121,8 +121,24 @@ hcloud <Service> <ListOp> --cli-output=json --cli-query "items[?status=='ACTIVE'
 hcloud <Service> <Op> --cli-debug=true
 ```
 
+## Credential Resolution Priority
+
+Credentials are resolved in this order (highest priority first):
+
+| Priority | Source                  | Mechanism                                                  | Persistence                     |
+| -------- | ----------------------- | ---------------------------------------------------------- | ------------------------------- |
+| 1        | Runtime credentials     | `huaweicloud_auth_init` tool                               | Memory (cleared on MCP restart) |
+| 2        | Environment variables   | `HW_ACCESS_KEY` / `HW_SECRET_KEY`                          | MCP process lifetime            |
+| 3        | CodeArts project config | `.codeartsdoer/mcp/mcp_settings.json` (project, then user) | File                            |
+| 4        | Global config file      | `~/.config/huaweicloud/credentials.json`                   | Permanent                       |
+| 5        | KooCLI profile          | `~/.hcloud/config.json` (KooCLI only)                      | Permanent                       |
+
+When switching accounts within the same Agent session, use `huaweicloud_auth_init` to set runtime credentials. This overrides all other sources for the current MCP process.
+
 ## Preferred Toolkit Tools
 
+- `huaweicloud_auth_init`
+- `huaweicloud_auth_status`
 - `huaweicloud_check_cli`
 - `huaweicloud_show_profile_redacted`
 - `huaweicloud_plan_cli_command`

package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md

@@ -46,30 +46,32 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 
 ## Service Map
 
-| Workload                              | Primary Service      | Skill                    |
-| ------------------------------------- | -------------------- | ------------------------ |
-| Web application hosting               | ECS                  | huawei-ecs               |
-| Containerized microservices           | CCE                  | huawei-cce               |
-| Static file storage / CDN (long-term) | OBS                  | huawei-obs               |
-| Relational database (MySQL/PG)        | RDS                  | huawei-rds               |
-| Distributed SQL database              | GaussDB              | huawei-gaussdb           |
-| Document database (MongoDB API)       | DDS                  | huawei-dds-dcs           |
-| In-memory cache                       | DCS (Redis)          | huawei-dds-dcs           |
-| Serverless functions                  | FunctionGraph        | huawei-functiongraph     |
-| API management                        | APIG                 | huawei-apig              |
-| AI model training/inference           | ModelArts            | huawei-modelarts         |
-| Message queuing                       | DMS (Kafka/RabbitMQ) | huawei-smn-dms           |
-| Push notifications                    | SMN                  | huawei-smn-dms           |
-| Secret management                     | DEW (CSMS)           | huawei-dew               |
-| Key management                        | DEW (KMS)            | huawei-dew               |
-| DDoS protection                       | AAD                  | huawei-waf-aad           |
-| Web firewall                          | WAF                  | huawei-waf-aad           |
-| Monitoring dashboards                 | Cloud Eye (CES)      | huawei-cloud-eye         |
-| Audit trails                          | CTS                  | huawei-cts               |
-| Backup / disaster recovery            | CBR                  | huawei-cbr               |
-| CI/CD pipeline                        | CloudDeploy          | huawei-deployment        |
-| Temporary runtime / web app preview   | Sandbox (DevStation) | huawei-sandbox           |
-| Getting started                       | Account setup        | huaweicloud-cli-and-auth |
+| Workload                                         | Primary Service      | Skill                    |
+| ------------------------------------------------ | -------------------- | ------------------------ |
+| Web application hosting (production / long-term) | ECS                  | huawei-ecs               |
+| Containerized microservices                      | CCE                  | huawei-cce               |
+| Static file storage / CDN (long-term)            | OBS                  | huawei-obs               |
+| Relational database (MySQL/PG)                   | RDS                  | huawei-rds               |
+| Distributed SQL database                         | GaussDB              | huawei-gaussdb           |
+| Document database (MongoDB API)                  | DDS                  | huawei-dds-dcs           |
+| In-memory cache                                  | DCS (Redis)          | huawei-dds-dcs           |
+| Serverless functions                             | FunctionGraph        | huawei-functiongraph     |
+| API management                                   | APIG                 | huawei-apig              |
+| AI model training/inference                      | ModelArts            | huawei-modelarts         |
+| Message queuing                                  | DMS (Kafka/RabbitMQ) | huawei-smn-dms           |
+| Push notifications                               | SMN                  | huawei-smn-dms           |
+| Secret management                                | DEW (CSMS)           | huawei-dew               |
+| Key management                                   | DEW (KMS)            | huawei-dew               |
+| DDoS protection                                  | AAD                  | huawei-waf-aad           |
+| Web firewall                                     | WAF                  | huawei-waf-aad           |
+| Monitoring dashboards                            | Cloud Eye (CES)      | huawei-cloud-eye         |
+| Audit trails                                     | CTS                  | huawei-cts               |
+| Backup / disaster recovery                       | CBR                  | huawei-cbr               |
+| CI/CD pipeline                                   | CloudDeploy          | huawei-deployment        |
+| Temporary runtime / web app preview              | Sandbox (DevStation) | huawei-sandbox           |
+| Getting started                                  | Account setup        | huaweicloud-cli-and-auth |
+
+**Web app scenario layering**: for "deploy a web app", prefer `huawei-sandbox` for free/quick try (hello world, prototype, demo, temporary preview — temporary runtime + public URL, ~8h validity, zero billed resources); route to `huawei-functiongraph` / `huawei-ecs` (or `huawei-cce`) for production / long-term / custom-domain / high-availability hosting.
 
 ## Deployment Target Options
 
@@ -100,6 +102,7 @@ When the intent is to **deploy, host, or preview a web app or static website** (
 
 - Use huaweicloud_search_docs to discover skills covering a topic
 - Use huaweicloud_retrieve_skill to load a full SKILL.md after routing
+- Use huaweicloud_auth_init to switch credentials at runtime when different accounts co-exist in the same session
 - If no built-in skill matches, consult huaweicloud-capability-discovery for external marketplace options
 - Use huaweicloud_list_regions before creating regional resources
 - Use huaweicloud_get_regional_availability when unsure about service-region pairs

package/plugins/huaweicloud-core/skills/huaweicloud-core/references/select.md

@@ -28,3 +28,15 @@ Route based on answers:
 - SQL + massive scale / distributed -> huawei-gaussdb
 - Document model (MongoDB-compatible) -> huawei-dds-dcs
 - Cache / key-value -> huawei-dds-dcs (DCS)
+
+## Example: I need to deploy a web app
+
+Ask:
+
+- Is this a quick try / prototype / demo / temporary preview (free)?
+- Or production (long-term, custom domain, high availability)?
+
+Route by scenario:
+
+- Free / quick try / prototype / demo / temporary preview -> huawei-sandbox (temporary runtime + public URL, ~8h validity, zero billed resources)
+- Production / long-term / custom domain / high availability -> huawei-functiongraph / huawei-ecs (or huawei-cce for containers)

package/plugins/huaweicloud-core/src/auth/agent-registration.mjs

@@ -1,7 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
 
 export const SUPPORTED_AGENT_TARGETS = [
   'opencode',
@@ -11,6 +12,8 @@ export const SUPPORTED_AGENT_TARGETS = [
   'workbuddy',
   'dsh',
   'officeace',
+  'hermes',
+  'openclaw',
 ];
 
 function baseHome() {
@@ -98,30 +101,94 @@ function dshRegistered() {
   }
 }
 
+function readOfficeaceRegistryInstallDir() {
+  if (process.platform !== 'win32') return null;
+  try {
+    const r = spawnSync('reg', ['query', 'HKCU\\SOFTWARE\\OfficeAce\\OfficeAce', '/v', 'InstallDir'], {
+      encoding: 'utf8',
+      windowsHide: true,
+      timeout: 5000,
+    });
+    if (r.status === 0) {
+      const m = r.stdout.match(/InstallDir\s+REG_SZ\s+(.+)/);
+      if (m) return m[1].trim();
+    }
+  } catch {}
+  return null;
+}
+
 function officeaceCapabilitiesDir() {
-  if (process.env.OFFICEACE_HOME) return process.env.OFFICEACE_HOME;
-  const dotDir = join(baseHome(), '.office-claw');
-  const dotCapFile = join(dotDir, 'capabilities.json');
-  if (existsSync(dotCapFile)) return dotDir;
+  const configRoot = process.env.OFFICE_CLAW_CONFIG_ROOT;
+  if (configRoot && existsSync(join(configRoot, 'capabilities.json'))) return configRoot;
+  const regDir = readOfficeaceRegistryInstallDir();
+  if (regDir) {
+    const dir = join(regDir, '.office-claw');
+    if (existsSync(join(dir, 'capabilities.json'))) return dir;
+  }
   if (process.platform === 'win32') {
-    for (const base of [process.env.ProgramFiles, 'C:\\Program Files', 'D:\\Program Files']) {
+    const bases = [process.env.ProgramFiles, 'C:\\Program Files', 'D:\\Program Files'];
+    if (process.env.LOCALAPPDATA) bases.push(join(process.env.LOCALAPPDATA, 'Programs'));
+    for (const base of bases) {
       if (!base) continue;
       const dir = join(base, 'OfficeAce', '.office-claw');
       if (existsSync(join(dir, 'capabilities.json'))) return dir;
     }
   }
-  return dotDir;
+  return null;
+}
+
+function officeaceCapabilitiesDirSafe() {
+  return officeaceCapabilitiesDir() || join(baseHome(), '.office-claw');
+}
+
+function officeaceSqlitePath() {
+  const capDir = officeaceCapabilitiesDirSafe();
+  return join(resolve(capDir, '..'), 'data', 'mcp-connectors.sqlite');
 }
 
 function officeaceRegistered() {
-  const capFile = join(officeaceCapabilitiesDir(), 'capabilities.json');
+  let hasMcp = false;
+  const dbPath = officeaceSqlitePath();
+  if (existsSync(dbPath)) {
+    const nodeMajor = Number(process.versions.node.split('.')[0]);
+    if (nodeMajor >= 22) {
+      try {
+        const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
+        const db = new DatabaseSync(dbPath, { readonly: true });
+        const row = db.prepare("SELECT enabled FROM mcp_connectors WHERE name = 'huaweicloud-devkit'").get();
+        db.close();
+        hasMcp = Boolean(row?.enabled);
+      } catch {}
+    }
+  }
+
+  const capFile = join(officeaceCapabilitiesDirSafe(), 'capabilities.json');
   const cfg = readJsonSafe(capFile);
-  if (!cfg?.capabilities) return false;
-  const hasMcp = cfg.capabilities.some((c) => c.id === 'huaweicloud-devkit' && c.type === 'mcp');
-  const hasSkills = cfg.capabilities.some((c) => c.id === 'huaweicloud-core' && c.type === 'skill');
+  const hasSkills = cfg?.capabilities?.some((c) => c.id === 'huaweicloud-core' && c.type === 'skill') ?? false;
+
   return hasMcp || hasSkills;
 }
 
+function hermesHome() {
+  if (process.env.HERMES_HOME) return process.env.HERMES_HOME;
+  // Hermes on Windows stores under LOCALAPPDATA, not ~/.hermes
+  if (process.platform === 'win32' && process.env.LOCALAPPDATA) {
+    return join(process.env.LOCALAPPDATA, 'hermes');
+  }
+  return join(baseHome(), '.hermes');
+}
+
+function hermesRegistered() {
+  const configPath = join(hermesHome(), 'config.yaml');
+  if (!existsSync(configPath)) return false;
+  try {
+    const content = readFileSync(configPath, 'utf8');
+    return content.includes('mcp_servers:') && content.includes('huaweicloud-devkit');
+  } catch {
+    return false;
+  }
+}
+
 export function getAgentRegistrationStatuses(target = 'all') {
   const requested = target === 'all' ? SUPPORTED_AGENT_TARGETS : [target];
   const result = { target, agents: {} };
@@ -134,6 +201,7 @@ export function getAgentRegistrationStatuses(target = 'all') {
     if (agent === 'workbuddy') configured = workbuddyRegistered();
     if (agent === 'dsh') configured = dshRegistered();
     if (agent === 'officeace') configured = officeaceRegistered();
+    if (agent === 'hermes') configured = hermesRegistered();
     result.agents[agent] = { configured };
   }
   return result;

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -84,6 +84,13 @@ export function resolveCredentials(options = {}) {
   let securityToken = process.env.HW_SECURITY_TOKEN;
   let region = process.env.HW_REGION || process.env.HUAWEICLOUD_REGION || '';
 
+  const codeartsCreds = isCodeArtsContext() ? readCodeArtsCredentials() : null;
+  if (codeartsCreds) {
+    if (!ak && codeartsCreds.ak) ak = codeartsCreds.ak;
+    if (!sk && codeartsCreds.sk) sk = codeartsCreds.sk;
+    if (!region && codeartsCreds.region) region = codeartsCreds.region;
+  }
+
   const stored = readGlobalCredentials();
   if (stored) {
     if (!ak && stored.ak) ak = stored.ak;
@@ -101,3 +108,61 @@ export function resolveCredentials(options = {}) {
 
   return { ak, sk, securityToken, region };
 }
+
+function isCodeArtsContext() {
+  return existsSync(join(process.cwd(), '.codeartsdoer')) || existsSync(join(homedir(), '.codeartsdoer'));
+}
+
+function readCodeArtsCredentials() {
+  const searchPaths = [
+    join(process.cwd(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+    join(homedir(), '.codeartsdoer', 'mcp', 'mcp_settings.json'),
+  ];
+
+  for (const path of searchPaths) {
+    try {
+      if (!existsSync(path)) continue;
+      const config = JSON.parse(readFileSync(path, 'utf8'));
+      const server = config?.mcpServers?.['huaweicloud-devkit'];
+      if (!server?.env) continue;
+
+      const ak = server.env.HW_ACCESS_KEY;
+      const sk = server.env.HW_SECRET_KEY;
+      if (ak && sk) {
+        return {
+          ak,
+          sk,
+          securityToken: server.env.HW_SECURITY_TOKEN || '',
+          region: server.env.HW_REGION || server.env.HUAWEICLOUD_REGION || '',
+        };
+      }
+    } catch {
+      // mcp_settings.json missing or invalid — skip
+    }
+  }
+
+  return null;
+}
+
+let runtimeCredentials = null;
+
+export function setRuntimeCredentials(ak, sk, securityToken, region) {
+  runtimeCredentials = { ak, sk, securityToken: securityToken || '', region: region || '' };
+}
+
+export function clearRuntimeCredentials() {
+  runtimeCredentials = null;
+}
+
+export function resolveCredentialsWithRuntime(options = {}) {
+  if (runtimeCredentials) {
+    return {
+      ak: runtimeCredentials.ak,
+      sk: runtimeCredentials.sk,
+      securityToken: runtimeCredentials.securityToken,
+      region: runtimeCredentials.region,
+    };
+  }
+
+  return resolveCredentials(options);
+}

package/plugins/huaweicloud-core/src/mcp-server.mjs

@@ -1,10 +1,23 @@
-process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+#!/usr/bin/env node
 import { stdin, stdout } from 'node:process';
-import { rmSync, existsSync } from 'node:fs';
-import { resolve, dirname } from 'node:path';
+import { rmSync, existsSync, readFileSync } from 'node:fs';
+import { resolve, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { TOOL_DEFINITIONS, callTool } from './tools.mjs';
 
+try {
+  const { readProxyConfig } = await import('./proxy/proxy-config.mjs');
+  const proxyConfig = readProxyConfig();
+  if (proxyConfig) {
+    if (proxyConfig.https_proxy || proxyConfig.HTTPS_PROXY) {
+      process.env.HTTPS_PROXY = process.env.HTTPS_PROXY || proxyConfig.https_proxy || proxyConfig.HTTPS_PROXY;
+    }
+    if (proxyConfig.http_proxy || proxyConfig.HTTP_PROXY) {
+      process.env.HTTP_PROXY = process.env.HTTP_PROXY || proxyConfig.http_proxy || proxyConfig.HTTP_PROXY;
+    }
+  }
+} catch {}
+
 // The MCP server is now loaded by a live agent session. Clear the install marker
 // in this plugin dir so `doctor` no longer reports "restart needed".
 try {
@@ -13,6 +26,20 @@ try {
   if (existsSync(marker)) rmSync(marker, { force: true });
 } catch {}
 
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const pluginRoot = resolve(__dirname, '..');
+const packageRoot = resolve(pluginRoot, '..', '..');
+let pkgVersion = '0.0.0';
+for (const base of [pluginRoot, packageRoot]) {
+  try {
+    const version = JSON.parse(readFileSync(join(base, 'package.json'), 'utf8')).version;
+    if (version) {
+      pkgVersion = version;
+      break;
+    }
+  } catch {}
+}
+
 let buffer = Buffer.alloc(0);
 let useContentLengthFraming = true;
 
@@ -90,7 +117,7 @@ async function dispatch(method, params) {
       },
       serverInfo: {
         name: 'huaweicloud-devkit',
-        version: '0.1.0',
+        version: pkgVersion,
       },
     };
   }

package/plugins/huaweicloud-core/src/proxy/proxy-agent.mjs

@@ -4,7 +4,12 @@ let cachedDispatcher = undefined;
 let cachedDispatcherProxyUrl = null;
 
 async function importUndici() {
-  return await import('undici');
+  try {
+    /* eslint-disable-next-line n/no-missing-import */
+    return await import('node:undici');
+  } catch {
+    return await import('undici');
+  }
 }
 
 export async function getProxyDispatcher(targetUrl) {

package/plugins/huaweicloud-core/src/sandbox/hdkitservice-api.mjs

@@ -29,8 +29,13 @@ async function hdkitRequest(method, path, body, timeoutMs = 300000) {
       body: body ? JSON.stringify(body) : undefined,
       signal: controller.signal,
     };
-    if (dispatcher) fetchOpts.dispatcher = dispatcher;
-    resp = await fetch(url, fetchOpts);
+    if (dispatcher) {
+      fetchOpts.dispatcher = dispatcher;
+      const { fetch: undiciFetch } = await import('undici');
+      resp = await undiciFetch(url, fetchOpts);
+    } else {
+      resp = await fetch(url, fetchOpts);
+    }
   } finally {
     clearTimeout(timer);
   }

package/plugins/huaweicloud-core/src/sandbox/hwlink-api.mjs

@@ -1,5 +1,5 @@
 import crypto from 'node:crypto';
-import { resolveCredentials } from '../auth/credentials.mjs';
+import { resolveCredentialsWithRuntime } from '../auth/credentials.mjs';
 import { getProxyDispatcher } from '../proxy/proxy-agent.mjs';
 
 const BASE_URL = process.env.HWLINK_ENDPOINT || 'https://devstation.myhuaweicloud.com';
@@ -77,7 +77,7 @@ function signRequest(method, path, query, body, ak, sk, securitytoken) {
 }
 
 export function getCredentials() {
-  const credentials = resolveCredentials();
+  const credentials = resolveCredentialsWithRuntime();
   return { ak: credentials.ak, sk: credentials.sk, securitytoken: credentials.securityToken };
 }
 
@@ -89,7 +89,12 @@ async function apiGet(path, query, ak, sk, securitytoken) {
   const url = `${BASE_URL}${fullPath}`;
   const dispatcher = await getProxyDispatcher(url);
   const fetchOpts = { headers };
-  if (dispatcher) fetchOpts.dispatcher = dispatcher;
+  if (dispatcher) {
+    fetchOpts.dispatcher = dispatcher;
+    const { fetch: undiciFetch } = await import('undici');
+    const resp = await undiciFetch(url, fetchOpts);
+    return { status: resp.status, data: await resp.json() };
+  }
   const resp = await fetch(url, fetchOpts);
   return { status: resp.status, data: await resp.json() };
 }
@@ -103,7 +108,12 @@ async function apiPost(path, body, ak, sk, securitytoken) {
     headers: { ...headers, 'Content-Type': 'application/json' },
     body: JSON.stringify(body),
   };
-  if (dispatcher) fetchOpts.dispatcher = dispatcher;
+  if (dispatcher) {
+    fetchOpts.dispatcher = dispatcher;
+    const { fetch: undiciFetch } = await import('undici');
+    const resp = await undiciFetch(url, fetchOpts);
+    return { status: resp.status, data: await resp.json() };
+  }
   const resp = await fetch(url, fetchOpts);
   return { status: resp.status, data: await resp.json() };
 }