huaweicloud-devkit 1.0.3-dev.0 → 1.0.3-next.0

package/plugins/huaweicloud-core/skills/huawei-deployment/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-deployment
-description: "Use when creating, managing, or running deployment tasks and pipelines on Huawei Cloud CloudDeploy. Triggers: CloudDeploy, deployment, CI/CD, pipeline, release, artifact deployment, deploy task. NOT for: CodeArts Build (build pipeline), SWR container registry."
+description: 'Use when creating, managing, or running deployment tasks and pipelines on Huawei Cloud CloudDeploy. Triggers: CloudDeploy, deployment, CI/CD, pipeline, release, artifact deployment, deploy task. NOT for: CodeArts Build (build pipeline), SWR container registry.'
 version: 1
 ---
 
@@ -16,32 +16,33 @@ Domain expertise for Huawei Cloud CloudDeploy. Covers application creation, depl
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Service name may be `CodeArtsDeploy` | hcloud service name for deployment may be `CodeArtsDeploy` instead of `CloudDeploy`. Run `hcloud --help` to verify |
-| Deployment hosts need agent | Install CloudDeploy agent on target hosts first |
-| Task must reference application first | Create application before task |
-| Artifact source defaults to OBS | Most deployment tasks pull artifacts from OBS. Ensure bucket and object exist |
-| Parallel deployments may conflict | Lock resources or use deployment groups |
+| Trap                                                  | Why                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| ----------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Flyway SQL dialect mismatch (H2 dev → MySQL prod)** | Spring Boot apps commonly develop with H2 in-memory DB, then deploy to RDS MySQL. Flyway migrations using H2-specific syntax (e.g. `DATEADD`, `CHARACTER_LENGTH`, `BOOLEAN`) silently succeed on H2 but fail on MySQL. Before deploying, audit `V*__*.sql` migration files: replace `DATEADD` with `DATE_ADD`, `BOOLEAN` with `TINYINT(1)`, remove `characterEncoding=utf8mb4` from Spring Boot datasource URL (KooCLI RDS CreateInstance sets charset at the instance level). Use `Flyway.validate-on-migrate=true` in CI to catch dialect issues early. |
+| Service name may be `CodeArtsDeploy`                  | hcloud service name for deployment may be `CodeArtsDeploy` instead of `CloudDeploy`. Run `hcloud --help` to verify                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| Deployment hosts need agent                           | Install CloudDeploy agent on target hosts first                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| Task must reference application first                 | Create application before task                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| Artifact source defaults to OBS                       | Most deployment tasks pull artifacts from OBS. Ensure bucket and object exist                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Parallel deployments may conflict                     | Lock resources or use deployment groups                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 
 ## Common Workflows
 
-| Task | Operation |
-|------|-----------|
-| Create application | `CreateApp --name=<n> --platform=<p> --cli-region=<r>` |
+| Task                   | Operation                                                        |
+| ---------------------- | ---------------------------------------------------------------- |
+| Create application     | `CreateApp --name=<n> --platform=<p> --cli-region=<r>`           |
 | Create deployment task | `CreateTask --name=<n> --app_id=<id> --artifact_source_type=OBS` |
-| Start deployment | `StartTask --task_id=<id>` |
-| List tasks | `ListTasks --app_id=<id>` |
-| Delete task | `DeleteTask --task_id=<id>` |
+| Start deployment       | `StartTask --task_id=<id>`                                       |
+| List tasks             | `ListTasks --app_id=<id>`                                        |
+| Delete task            | `DeleteTask --task_id=<id>`                                      |
 
 ## Troubleshooting
 
-| Error | Fix |
-|-------|-----|
-| Agent offline | Check agent service on target host, network connectivity, firewall rules |
-| Deployment timeout | Check artifact size, increase task timeout, verify target host resources |
-| Artifact not found | Verify OBS bucket and object path, check artifact permissions |
-| Permission denied | Verify IAM roles for deployment: `CodeArtsDeploy FullAccess` or custom policy |
+| Error              | Fix                                                                           |
+| ------------------ | ----------------------------------------------------------------------------- |
+| Agent offline      | Check agent service on target host, network connectivity, firewall rules      |
+| Deployment timeout | Check artifact size, increase task timeout, verify target host resources      |
+| Artifact not found | Verify OBS bucket and object path, check artifact permissions                 |
+| Permission denied  | Verify IAM roles for deployment: `CodeArtsDeploy FullAccess` or custom policy |
 
 ## Security
 

package/plugins/huaweicloud-core/skills/huawei-dew/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-dew
-description: "Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secrets, KMS for encryption keys, and credential rotation. Triggers on: secret, credential, API key, token, password, encrypt, decrypt, KMS, CSMS, DEW, certificate, CSR, rotation. Activates for ANY task involving secrets or credentials — load this skill first before touching secrets."
+description: 'Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secrets, KMS for encryption keys, and credential rotation. Triggers on: secret, credential, API key, token, password, encrypt, decrypt, KMS, CSMS, DEW, certificate, CSR, rotation. Activates for ANY task involving secrets or credentials — load this skill first before touching secrets.'
 version: 1
 ---
 
@@ -16,64 +16,73 @@ Domain expertise for Huawei Cloud Data Encryption Workshop (DEW). Covers CSMS fo
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| NEVER fetch secret values into agent context | Use {{resolve:csms:secret-id:SecretString:key}} runtime injection |
-| NEVER echo credentials in conversation | AK/SK, passwords, tokens must never appear in chat |
-| KMS key deletion is irreversible | 7-30 day pending deletion window. Once gone, data is unrecoverable |
-| Secret rotation requires automation | Manual rotation risks stale credentials |
-| Cross-account KMS needs grants | KMS keys are regional. Cross-region data needs grant setup |
+| Trap                                         | Why                                                                |
+| -------------------------------------------- | ------------------------------------------------------------------ |
+| NEVER fetch secret values into agent context | Use {{resolve:csms:secret-id:SecretString:key}} runtime injection  |
+| NEVER echo credentials in conversation       | AK/SK, passwords, tokens must never appear in chat                 |
+| KMS key deletion is irreversible             | 7-30 day pending deletion window. Once gone, data is unrecoverable |
+| Secret rotation requires automation          | Manual rotation risks stale credentials                            |
+| Cross-account KMS needs grants               | KMS keys are regional. Cross-region data needs grant setup         |
 
 ## CSMS Operations
 
 ### Read-only (safe — metadata only)
-| Operation | Description |
-|-----------|-------------|
-| ListSecrets | List all secrets (names only, no values) |
-| DescribeSecret | Get secret metadata (rotation config, KMS key, status) |
-| ListSecretVersions | List version IDs and stages (no values) |
+
+| Operation          | Description                                            |
+| ------------------ | ------------------------------------------------------ |
+| ListSecrets        | List all secrets (names only, no values)               |
+| DescribeSecret     | Get secret metadata (rotation config, KMS key, status) |
+| ListSecretVersions | List version IDs and stages (no values)                |
 
 ### Secret Value (blocked by policy — use runtime injection)
-| Operation | Safe Alternative |
-|-----------|-----------------|
-| DownloadSecret | Use {{resolve:csms:secret-id}} in IaC or SDK |
+
+| Operation         | Safe Alternative                              |
+| ----------------- | --------------------------------------------- |
+| DownloadSecret    | Use {{resolve:csms:secret-id}} in IaC or SDK  |
 | ShowSecretVersion | Use runtime injection, never in agent context |
-| GetSecretValue | Blocked. Use MCP proxy resolve pattern |
+| GetSecretValue    | Blocked. Use MCP proxy resolve pattern        |
 
 ## KMS Operations
 
-| Task | Command | Notes |
-|------|---------|-------|
-| List keys | hcloud KMS ListKeys | Read-only |
-| Create key | hcloud KMS CreateKey --key_alias=<name> | Requires write approval |
-| Encrypt | hcloud KMS EncryptData --key_id=<id> --plaintext=<b64> | Prefer SDK offline encrypt |
-| Decrypt | hcloud KMS DecryptData (**BLOCKED**) | Use runtime injection |
+| Task       | Command                                                | Notes                      |
+| ---------- | ------------------------------------------------------ | -------------------------- |
+| List keys  | hcloud KMS ListKeys                                    | Read-only                  |
+| Create key | hcloud KMS CreateKey --key_alias=<name>                | Requires write approval    |
+| Encrypt    | hcloud KMS EncryptData --key_id=<id> --plaintext=<b64> | Prefer SDK offline encrypt |
+| Decrypt    | hcloud KMS DecryptData (**BLOCKED**)                   | Use runtime injection      |
 
 ## Runtime Injection Pattern
 
 `ash
+
 # Terraform / IaC
+
 resource "huaweicloud_csms_secret" "db_password" {
-  secret_string = var.db_password  # NEVER hardcode
+secret_string = var.db_password # NEVER hardcode
 }
 
 # SDK
+
 secret_value = client.get_secret(secret_id="my-secret")
+
 # Use immediately, never print or store in context
 
 # hcloud (for approved automation only)
+
 hcloud CSMS DownloadSecret --secret_name=<name>
+
 # WARNING: Output goes to stdout. Pipe directly, never capture in agent.
+
 `
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Secret not found | Wrong region or project -> Verify secret ARN includes region/project |
-| AccessDenied on CSMS | Missing IAM CSMS policy -> Add csms:DescribeSecret + kms:Decrypt |
-| KMS key disabled | Key scheduled for deletion or manually disabled -> Enable or create new key |
-| Rotation stuck | Lambda/Python function error -> Check rotation function logs |
+| Error                | Root Cause -> Fix                                                           |
+| -------------------- | --------------------------------------------------------------------------- |
+| Secret not found     | Wrong region or project -> Verify secret ARN includes region/project        |
+| AccessDenied on CSMS | Missing IAM CSMS policy -> Add csms:DescribeSecret + kms:Decrypt            |
+| KMS key disabled     | Key scheduled for deletion or manually disabled -> Enable or create new key |
+| Rotation stuck       | Lambda/Python function error -> Check rotation function logs                |
 
 ## Security Considerations
 

package/plugins/huaweicloud-core/skills/huawei-dew/references/csms-usage.md

@@ -1,28 +1,35 @@
 # CSMS Usage Guide
 
 ## Create Secret
+
 hcloud CSMS CreateSecret --secret_name=prod-db-password --secret_string='{"password":"CHANGE_ME"}'
 
 ## List Secrets (metadata only)
+
 hcloud CSMS ListSecrets
 
 ## Describe Secret
+
 hcloud CSMS DescribeSecret --secret_name=prod-db-password
 
 ## List Versions
+
 hcloud CSMS ListSecretVersions --secret_name=prod-db-password
 
 ## Runtime Injection (Terraform)
+
 data "huaweicloud_csms_secret" "db" {
-  secret_name = "prod-db-password"
+secret_name = "prod-db-password"
 }
 Use: data.huaweicloud_csms_secret.db.secret_string
 
 ## Rotation
+
 - Enable auto-rotation: hcloud CSMS EnableSecretRotation --secret_name=<name> --rotation_interval=30
 - Rotation function ARN: provide Lambda to generate new secret value
 
 ## Policy Rules
+
 - hcloud CSMS DownloadSecret -> BLOCKED (use runtime injection)
 - hcloud CSMS ShowSecretVersion -> BLOCKED
 - hcloud CSMS ListSecrets -> ALLOWED (metadata only)

package/plugins/huaweicloud-core/skills/huawei-dew/references/kms-usage.md

@@ -1,23 +1,29 @@
 # KMS Usage Guide
 
 ## Create Key
+
 hcloud KMS CreateKey --key_alias=app-encryption-key --key_description="Application data encryption"
 
 ## List Keys (metadata only)
+
 hcloud KMS ListKeys
 
 ## Encrypt (offline preferred)
+
 hcloud KMS EncryptData --key_id=<key-id> --plaintext=<base64-data>
 
 ## Decrypt (BLOCKED - use runtime)
+
 DO NOT use hcloud KMS DecryptData directly.
 Use SDK with KMS client in application runtime.
 
 ## Key Rotation
+
 - Enable: hcloud KMS EnableKeyRotation --key_id=<key-id>
 - Rotation period: 365 days (default)
 
 ## Key Deletion
+
 - Schedule: hcloud KMS ScheduleKeyDeletion --key_id=<key-id> --pending_days=7
 - Cancel during pending window: hcloud KMS CancelKeyDeletion --key_id=<key-id>
 - WARNING: After deletion window passes, data encrypted with this key is UNRECOVERABLE

package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-ecs
-description: "Use when creating, configuring, managing, or troubleshooting ECS instances on Huawei Cloud. Covers instance creation (hcloud ECS CreateServers), flavor selection, image management, security groups, EIP binding, disk attachment, auto-scaling (AS), and troubleshooting. Triggers on: ECS, instance, flavor, image, security group, EIP, EVS, auto-scaling. NOT for: CCE container workloads (use huawei-cce), BMS bare metal servers."
+description: 'Use when creating, configuring, managing, or troubleshooting ECS instances on Huawei Cloud. Covers instance creation (hcloud ECS CreateServers), flavor selection, image management, security groups, EIP binding, disk attachment, auto-scaling (AS), and troubleshooting. Triggers on: ECS, instance, flavor, image, security group, EIP, EVS, auto-scaling. NOT for: CCE container workloads (use huawei-cce), BMS bare metal servers.'
 version: 1
 ---
 
@@ -17,6 +17,7 @@ Domain expertise for Huawei Cloud Elastic Cloud Server (ECS). Covers instance li
 ## Prerequisites
 
 Before creating an ECS instance from scratch, you MUST have:
+
 - A VPC (see `huawei-vpc`)
 - A subnet with DNS configured (see `huawei-vpc`)
 - A security group with application ports open (see `huawei-vpc`)
@@ -25,39 +26,39 @@ If these do not exist, load the `huawei-vpc` skill first and create them before
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Flavor not in region | Not all flavors available everywhere. Check with ECS ListFlavors first |
-| Security group denies all | New SGs deny ALL inbound. Must explicitly add rules |
-| EIP bills when idle | Unattached EIP still incurs charges |
-| Stopped instance still bills | Pay-per-use instances bill when stopped (unless shutdown-no-billing flavor) |
-| Disk survives instance delete | Deleting instance does NOT delete system disk by default |
+| Trap                          | Why                                                                         |
+| ----------------------------- | --------------------------------------------------------------------------- |
+| Flavor not in region          | Not all flavors available everywhere. Check with ECS ListFlavors first      |
+| Security group denies all     | New SGs deny ALL inbound. Must explicitly add rules                         |
+| EIP bills when idle           | Unattached EIP still incurs charges                                         |
+| Stopped instance still bills  | Pay-per-use instances bill when stopped (unless shutdown-no-billing flavor) |
+| Disk survives instance delete | Deleting instance does NOT delete system disk by default                    |
 
 ## Flavor Selection Guide
 
 Flavor families are **region-dependent**. Always run `hcloud ECS ListFlavors --cli-region=<r>` to discover available flavors before recommending.
 
-| Scenario | Family | What to look for |
-|----------|--------|-----------------|
-| Web app / microservices | General-purpose (ac, s, sn, c) | 2-4 vCPU, 4-8 GB RAM |
-| Database / big data | Memory-optimized (m, r) | 4-8 vCPU, 16-64 GB RAM |
-| AI inference | GPU (g, p) | 8+ vCPU, 64+ GB RAM + GPU |
-| HPC | High-IO (h, ir, i) | 8+ vCPU, local SSD |
+| Scenario                | Family                         | What to look for          |
+| ----------------------- | ------------------------------ | ------------------------- |
+| Web app / microservices | General-purpose (ac, s, sn, c) | 2-4 vCPU, 4-8 GB RAM      |
+| Database / big data     | Memory-optimized (m, r)        | 4-8 vCPU, 16-64 GB RAM    |
+| AI inference            | GPU (g, p)                     | 8+ vCPU, 64+ GB RAM + GPU |
+| HPC                     | High-IO (h, ir, i)             | 8+ vCPU, local SSD        |
 
 > See `references/flavors.md` for discovery workflow. **Do not hardcode flavor names** — availability changes by region and over time.
 
 ## Common Workflows
 
-| Task | Command | Steps |
-|------|---------|-------|
-| List flavors | hcloud ECS ListFlavors --cli-region=<region> | references/flavors.md |
-| Create instance | hcloud ECS CreateServers --server.name=<n> --server.flavorRef=<id> --server.imageRef=<id> --server.nics.1.subnet_id=<id> --server.availability_zone=<az> | references/create-instance.md |
-| Find by name | See "How to search for instances" below | |
-| Bind EIP | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
-| Security group rule | hcloud VPC CreateSecurityGroupRule --security_group_id=<id> --direction=<direction> --protocol=<protocol> | references/sg.md |
-| Attach disk | hcloud EVS AttachVolume --volume_id=<id> --server_id=<id> | references/evs.md |
-| Delete instance | hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true | references/create-instance.md |
-| Reboot instance | hcloud ECS BatchRebootServers --reboot.servers.1.id=<id> --reboot.type=SOFT | NOT `RebootServer` — that operation does not exist |
+| Task                | Command                                                                                                                                                  | Steps                                                                                    |
+| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
+| List flavors        | hcloud ECS ListFlavors --cli-region=<region>                                                                                                             | references/flavors.md                                                                    |
+| Create instance     | hcloud ECS CreateServers --server.name=<n> --server.flavorRef=<id> --server.imageRef=<id> --server.nics.1.subnet_id=<id> --server.availability_zone=<az> | references/create-instance.md                                                            |
+| Find by name        | See "How to search for instances" below                                                                                                                  |                                                                                          |
+| Bind EIP            | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT                      | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
+| Security group rule | hcloud VPC CreateSecurityGroupRule --security_group_id=<id> --direction=<direction> --protocol=<protocol>                                                | references/sg.md                                                                         |
+| Attach disk         | hcloud EVS AttachVolume --volume_id=<id> --server_id=<id>                                                                                                | references/evs.md                                                                        |
+| Delete instance     | hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true                                                                 | references/create-instance.md                                                            |
+| Reboot instance     | hcloud ECS BatchRebootServers --reboot.servers.1.id=<id> --reboot.type=SOFT                                                                              | NOT `RebootServer` — that operation does not exist                                       |
 
 ## How to Search for Instances
 
@@ -112,6 +113,7 @@ ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'command'
 ```
 
 Example — re-run failed cloud-init setup manually:
+
 ```bash
 ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'dnf install -y nginx && systemctl enable --now nginx'
 ```
@@ -127,14 +129,14 @@ ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'dnf install -y ngin
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Cannot SSH | SG missing port 22 or no EIP -> Add ingress rule / Bind EIP |
-| Flavor unavailable | Region limitation -> ListFlavors in target region |
-| Insufficient resources | Stock depleted -> Change flavor or AZ |
-| AuthFailure | Expired AK/SK -> re-run `npx huaweicloud-devkit auth init` |
-| APIGW.0802 / region permission | IAM user has no access to this region -> IAM console → User → Permissions → add region, or switch to another region |
-| Cannot SSH (port 22 open) | SCP policy may be blocking SSH. Check `SYS.0403` errors in command output -> Use cloud-init/user_data for initial setup instead. See `references/create-instance.md` §Bootstrap |
+| Error                          | Root Cause -> Fix                                                                                                                                                               |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Cannot SSH                     | SG missing port 22 or no EIP -> Add ingress rule / Bind EIP                                                                                                                     |
+| Flavor unavailable             | Region limitation -> ListFlavors in target region                                                                                                                               |
+| Insufficient resources         | Stock depleted -> Change flavor or AZ                                                                                                                                           |
+| AuthFailure                    | Expired AK/SK -> re-run `npx huaweicloud-devkit auth init`                                                                                                                      |
+| APIGW.0802 / region permission | IAM user has no access to this region -> IAM console → User → Permissions → add region, or switch to another region                                                             |
+| Cannot SSH (port 22 open)      | SCP policy may be blocking SSH. Check `SYS.0403` errors in command output -> Use cloud-init/user_data for initial setup instead. See `references/create-instance.md` §Bootstrap |
 
 ## Security Considerations
 
@@ -158,6 +160,7 @@ Prefer these tools over raw hcloud CLI — they enforce safety policies:
 ## Without MCP (Fallback)
 
 If MCP tools are NOT available (new install, session not restarted):
+
 - Raw hcloud commands WILL appear in shell history — passwords and secrets are at risk
 - Always use key_name instead of adminPass
 - Verify safety manually: no secret value reads, no credential file access
@@ -171,10 +174,10 @@ Fall back to hcloud CLI. State: "MCP unavailable, using local hcloud CLI."
 
 Flexus is the lightweight ECS family. Two variants:
 
-| Variant | API | CLI | Billing |
-|---------|-----|:---:|---------|
-| **Flexus L** | HCSS (hcss:lightInstances) | ❌ No hcloud — Python SDK only | Prepaid only |
-| **Flexus X** | Standard ECS API | ✅ `hcloud ECS` with `x1.*` flavors | On-demand & prepaid |
+| Variant      | API                        |                 CLI                 | Billing             |
+| ------------ | -------------------------- | :---------------------------------: | ------------------- |
+| **Flexus L** | HCSS (hcss:lightInstances) |   ❌ No hcloud — Python SDK only    | Prepaid only        |
+| **Flexus X** | Standard ECS API           | ✅ `hcloud ECS` with `x1.*` flavors | On-demand & prepaid |
 
 For Flexus X, use standard ECS CreateServers flow with `x1.*` flavors. For Flexus L, manual console provisioning is recommended — no KooCLI path exists.
 

package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md

@@ -3,10 +3,12 @@
 **Before executing any command: If MCP tools are not available** (new session after install), restart your session or use hcloud CLI directly with caution. Commands using adminPass/password WILL appear in shell history — prefer key_name.
 
 ## 1. Discover flavors
+
 hcloud ECS ListFlavors --cli-region=<region> --cli-output=json
 Filter for `os_extra_specs.cond:operation:status == normal` — most results are abandoned. See references/flavors.md.
 
 ## 2. Find availability zones
+
 hcloud ECS NovaListAvailabilityZones --cli-region=<region>
 
 ## 3. Find image
@@ -19,27 +21,32 @@ hcloud IMS ListImages --cli-region=<region> --__imagetype=gold --__isregistered=
 If searching by name (e.g. --name="Ubuntu") returns empty: use broad search without name filter, pick from results. Some regions only offer Huawei Cloud EulerOS (HCE).
 
 Common images (verify live per region):
-| Image | Region | ID |
-|-------|--------|----|
+
+| Image            | Region     | ID                                   |
+| ---------------- | ---------- | ------------------------------------ |
 | HCE 2.0 Standard | cn-north-4 | 7d940784-ac0a-425f-b3fa-8478f1a1df70 |
-| Ubuntu 22.04 | Query live | Query live |
-| CentOS 8.2 | Query live | Query live |
+| Ubuntu 22.04     | Query live | Query live                           |
+| CentOS 8.2       | Query live | Query live                           |
 
 ## 4. Verify or create VPC/subnet
+
 hcloud VPC ListVpcs --cli-region=<region>
 hcloud VPC ListSubnets --vpc_id=<vpc-id> --cli-region=<region>
 If no VPC/subnet exists: load `huawei-vpc` skill → create VPC → create subnet (with DNS) → create security group → return here.
 
 ## 5. Create keypair (recommended over adminPass)
+
 hcloud ECS NovaCreateKeypair --keypair.name=<name>
 Save the returned private key to a local file. The public key is auto-injected.
 
 Password alternative:
+
 - adminPass: 8-26 chars, must have uppercase + lowercase + digit + special char
 - Passwords appear ONCE in creation output and are not retrievable
 - Passwords are logged in shell history — this is a security risk
 
 ## 6. Create instance
+
 hcloud ECS CreateServers --cli-region=<region> --server.name=<name> --server.flavorRef=<flavor-id> --server.imageRef=<image-id> --server.nics.1.subnet_id=<subnet-id> --server.root_volume.volumetype=<type> --server.root_volume.size=<minsize> --server.vpcid=<vpc-id> --server.availability_zone=<az> --server.key_name=<keypair-name> --server.count=1
 
 ### Bootstrap with user_data (cloud-init)
@@ -63,6 +70,7 @@ hcloud ECS CreateServers ... --server.user_data=$user_data
 > **Debugging**: If the script didn't run, check `/var/log/cloud-init-output.log` on the instance.
 >
 > **Recovery after failure**: user_data only executes on **first boot**. Restarting the instance will NOT re-run user_data scripts. If cloud-init fails (e.g., DNS missing → `yum`/`apt` cannot resolve repos):
+>
 > 1. Fix the root cause (e.g., update subnet DNS via `VPC UpdateSubnet`)
 > 2. Either: SSH into the instance and run the setup commands manually (see `huawei-ecs` → SSH Connection Verification → Running Commands Inside the Instance)
 > 3. Or: Delete the instance and recreate with corrected user_data (fresh boot)
@@ -70,6 +78,7 @@ hcloud ECS CreateServers ... --server.user_data=$user_data
 ## 7. EIP (two methods)
 
 ### Method A: Inline with CreateServers (Recommended)
+
 Add EIP parameters to the `CreateServers` command in step 6:
 
 ```bash
@@ -84,6 +93,7 @@ hcloud ECS CreateServers \
 > **Trap**: Parameter names differ from `EIP CreatePublicip`. Use `iptype` (not `type`), `sharetype` (not `share_type`), and `chargemode` (not `charging_mode`). Always verify with `hcloud ECS CreateServers --help`.
 
 ### Method B: Create and bind separately
+
 hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
 
 ```bash
@@ -131,3 +141,4 @@ Warning: --delete_publicip and --delete_volume default to false. Set to true to
 - Flavor: must be available in target region — always ListFlavors first
 - Root volume: SSD 40GB min
 - Keypair is safer than adminPass (passwords leak into shell history)
+```

package/plugins/huaweicloud-core/skills/huawei-ecs/references/flavors.md

@@ -20,21 +20,23 @@ hcloud ECS ListFlavors --cli-region=<region> --cli-output=json \
 
 ## Step 2: Filter by scenario
 
-| Scenario | Look for | Preference |
-|----------|----------|------------|
-| Web app / microservices | General-purpose families (ac, s, sn) | 2-4 vCPU, 4-8 GB RAM |
-| Database / big data | Memory-optimized families (m, r) | 4-8 vCPU, 16-64 GB RAM |
-| AI inference / training | GPU families (g, p) | 8+ vCPU, 64+ GB RAM |
-| HPC / high throughput | High-IO families (h, ir, i) | 8+ vCPU, local SSD |
+| Scenario                | Look for                             | Preference             |
+| ----------------------- | ------------------------------------ | ---------------------- |
+| Web app / microservices | General-purpose families (ac, s, sn) | 2-4 vCPU, 4-8 GB RAM   |
+| Database / big data     | Memory-optimized families (m, r)     | 4-8 vCPU, 16-64 GB RAM |
+| AI inference / training | GPU families (g, p)                  | 8+ vCPU, 64+ GB RAM    |
+| HPC / high throughput   | High-IO families (h, ir, i)          | 8+ vCPU, local SSD     |
 
 ## Step 3: Match spec from ListFlavors output
 
 Common naming pattern: `<family><gen>.<type>x<ratio>`
+
 - `ac6.2xlarge.2` = ac6 family, 2xlarge (8 vCPU), ratio 2 (vCPU:RAM = 1:2 → 16 GB)
 
 ## Do Not Hardcode
 
 Flavor family names are region-dependent. Example discrepancies seen in testing:
+
 - cn-south-1: ac6/ac7/kc/r-c7e (s6/m6/g6 NOT available)
 - Other regions may have s6/m6/g6 families
 
@@ -44,10 +46,10 @@ Always run ListFlavors and pick from actual results.
 
 `ListFlavors` returns ALL specs including abandoned ones. Before selecting a spec, check the `os_extra_specs` field in the JSON response:
 
-| Field | Values | Meaning |
-|-------|--------|---------|
+| Field                                  | Values                         | Meaning                                                                              |
+| -------------------------------------- | ------------------------------ | ------------------------------------------------------------------------------------ |
 | `os_extra_specs.cond:operation:status` | `normal`, `abandon`, `sellout` | Only `normal` specs can be created. `abandon` = deprecated, `sellout` = out of stock |
-| `os_extra_specs.cond:operation:az` | e.g. `cn-north-4g(normal)` | Spec is available in this AZ. Multiple entries = multiple AZ support |
+| `os_extra_specs.cond:operation:az`     | e.g. `cn-north-4g(normal)`     | Spec is available in this AZ. Multiple entries = multiple AZ support                 |
 
 A flavor can be `normal` globally but `abandon` in specific AZs. Selecting an `abandon` or `sellout` spec will fail with **`Ecs.0019`** at creation time — there is no pre-flight validation in `ListFlavors`. If creation fails:
 

package/plugins/huaweicloud-core/skills/huawei-ecs/references/troubleshooting.md

@@ -4,16 +4,16 @@
 
 ## 错误码映射
 
-| 错误 | 根因 | 修复 |
-|------|------|------|
-| `Ecs.0005` flavor-image 不匹配 | 镜像虚拟化类型与规格不兼容 | 检查 image `__support_amd`/`__support_xen` 与 flavor `os_extra_specs`。BareMetal 镜像不兼容标准 ECS 规格 |
-| `[USE_ERROR]不正确的参数:imagetype` | 参数名错误 | KooCLI 使用双下划线前缀：`--__imagetype=gold`（不是 `--imagetype`） |
-| `[USE_ERROR]不正确的参数:chargingMode` | 参数路径错误 | 计费模式参数路径：`--server.extendparam.chargingMode=postPaid`。不传默认按需付费 |
-| `[USE_ERROR]不正确的参数:__support_amd` | 参数无效 | `IMS ListImages` 某些版本不支持此过滤。去掉该参数，使用 client-side 过滤 |
-| Cannot SSH | 安全组未开放22端口 或 未绑定EIP | 1) 添加入方向规则 tcp 22。2) `hcloud EIP BindPublicIp` |
-| Flavor unavailable | 区域不支持该规格 | `hcloud ECS ListFlavors --cli-region=<r>` 先查。不硬编码 s6/m6 等规格名 |
-| Insufficient resources | AZ 库存不足 | 换规格、换 AZ、或等待资源释放 |
-| AuthFailure | AK/SK 过期或无效 | `npx huaweicloud-devkit auth init` 重新配置统一凭据 |
+| 错误                                    | 根因                            | 修复                                                                                                     |
+| --------------------------------------- | ------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| `Ecs.0005` flavor-image 不匹配          | 镜像虚拟化类型与规格不兼容      | 检查 image `__support_amd`/`__support_xen` 与 flavor `os_extra_specs`。BareMetal 镜像不兼容标准 ECS 规格 |
+| `[USE_ERROR]不正确的参数:imagetype`     | 参数名错误                      | KooCLI 使用双下划线前缀：`--__imagetype=gold`（不是 `--imagetype`）                                      |
+| `[USE_ERROR]不正确的参数:chargingMode`  | 参数路径错误                    | 计费模式参数路径：`--server.extendparam.chargingMode=postPaid`。不传默认按需付费                         |
+| `[USE_ERROR]不正确的参数:__support_amd` | 参数无效                        | `IMS ListImages` 某些版本不支持此过滤。去掉该参数，使用 client-side 过滤                                 |
+| Cannot SSH                              | 安全组未开放22端口 或 未绑定EIP | 1) 添加入方向规则 tcp 22。2) `hcloud EIP BindPublicIp`                                                   |
+| Flavor unavailable                      | 区域不支持该规格                | `hcloud ECS ListFlavors --cli-region=<r>` 先查。不硬编码 s6/m6 等规格名                                  |
+| Insufficient resources                  | AZ 库存不足                     | 换规格、换 AZ、或等待资源释放                                                                            |
+| AuthFailure                             | AK/SK 过期或无效                | `npx huaweicloud-devkit auth init` 重新配置统一凭据                                                      |
 
 ## 创建失败诊断流程
 
@@ -38,10 +38,10 @@ hcloud IMS ListImages --cli-region=<r> --__imagetype=gold --__isregistered=true
 
 ## 密钥对 vs 密码
 
-| 方式 | 安全 | 建议 |
-|------|------|------|
+| 方式                       | 安全  | 建议                                               |
+| -------------------------- | ----- | -------------------------------------------------- |
 | `--server.key_name=<name>` | ✅ 高 | **推荐**。先 `hcloud DEW CreateKeypair` 创建密钥对 |
-| `--server.adminPass=<pw>` | ❌ 低 | 密码明文进入 shell 历史。仅测试用 |
+| `--server.adminPass=<pw>`  | ❌ 低 | 密码明文进入 shell 历史。仅测试用                  |
 
 密码要求：8-26 字符，含大写 + 小写 + 数字 + 特殊字符。