huaweicloud-devkit 1.1.0-next.17 → 1.1.0-next.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.0-next.17",
+  "version": "1.1.0-next.18",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
   "files": [

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.0-next.17",
+  "version": "1.1.0-next.18",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.0-next.17",
+  "version": "1.1.0-next.18",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.0-next.17",
+  "version": "1.1.0-next.18",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.0-next.17",
+  "version": "1.1.0-next.18",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.0-next.17",
+  "version": "1.1.0-next.18",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.0-next.17",
+  "version": "1.1.0-next.18",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json

@@ -157,7 +157,7 @@
       "match": {
         "all": [
           { "field": "text", "regex": "(Delete|BatchDelete|Remove|\\brm\\b|delete)" },
-          { "field": "text", "regex": "(--force|-f|--recursive|-r|delete_publicip\\s*[=:]\\s*true)" }
+          { "field": "text", "regex": "(\\s--force|\\s-f\\s|\\s--recursive|\\s-r\\s|delete_publicip\\s*[=:]\\s*true)" }
         ]
       },
       "message": "The command combines deletion with force, recursive, or cascading deletion behavior.",

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -95,7 +95,7 @@ Setup is a **plugin-side preflight** — the developer should be asked a questio
 2. **Real-name verification only** (`HDKIT_NOT_REALNAME`): tell the developer once, "Huawei Cloud requires real-name verification before using the sandbox — please complete it in the Huawei Cloud console (实名认证)." and stop — do not retry `connect` in a loop
 3. **Sign agreement only** (`HDKIT_NOT_AGREEMENT`): **STOP and do NOT sign on your own.** Ask the developer: "Huawei Cloud sandbox requires signing the latest developer service agreement. May I sign it for you?" Then **wait for the developer to explicitly agree** (e.g. "签署" / "确认" / "sign it"). Only after explicit consent call `huaweicloud_sandbox_sign_agreement` and return its result (`signed`/`signedCount`) to the developer. **Never sign a legal agreement on the developer's behalf without their explicit, unambiguous consent.** Do not expose the underlying sandbox/DevBridge service as a separate entity the developer must understand or sign up for
 4. **Both missing** (`HDKIT_NOT_REALNAME_AND_AGREEMENT`): present **both** requirements together in one message — the real-name verification steps (console, step 2) **and** the agreement-signing request (step 3, wait for explicit consent) — so the developer can complete both at once
-5. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`. The `source` parameter identifies the calling agent (valid values: `'CLI'`, `'WEb'`, `'VSCODE'`, `'CURSO'`, `'WEBIDE'`, etc. — case-sensitive). The `git` parameter (with `repo_url`, `repo_name`, `target_path`) is accepted but does NOT auto-clone the repository — always clone manually.
+5. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`. The `source` parameter identifies the calling agent (valid values: `CLI`, `WEB`, `VSCODE`, `WEBVNC`, `WEBPTY`, `WEBIDE`, `CURSOR`, etc. — case-sensitive, all uppercase). The `git` parameter (with `repo_url`, `repo_name`, `target_path`) is accepted but does NOT auto-clone the repository — always clone manually.
 6. **Cleanup previous deployments** (after first connect to a sandbox): nginx configs, DevBridge tunnels, and stale web processes from previous deployments can cause port conflicts and quota errors. Run cleanup immediately after connect:
 
    ```bash
@@ -357,13 +357,13 @@ Use the detected `PKG_MGR` for all package installations below.
 
 **Architecture awareness**: the sandbox runs Linux aarch64 (ARM64). Native binaries built on x64 (Windows/macOS Intel) will not execute. Always install dependencies and build inside the sandbox. For projects with native addons (Taro `@swc/core`, Prisma, `esbuild`, `node-gyp`), local x64 pre-build + upload of `dist/` output is a viable alternative when sandbox builds fail.
 
-**GitCode SSL**: if `git clone` from GitCode fails with SSL certificate errors:
+**GitCode SSL**: if `git clone` from GitCode fails with SSL certificate errors, use a one-shot override (do NOT set it globally — that would disable cert verification for every repo):
 
 ```bash
-git config --global http.sslVerify false
+git -c http.sslVerify=false clone <repo-url>
 ```
 
-Then retry the clone. This is a known sandbox environment limitation.
+Then retry the clone. This bypasses SSL verification only for this single clone.
 
 #### 3b: Install nginx (before project upload)
 

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -71,6 +71,7 @@ function runHcloudOnce(plan, options) {
   const executable = options.executable || options.env?.HCLOUD_BIN || discoverHcloudPath() || 'hcloud';
   const executableArgs = Array.isArray(options.executableArgs) ? options.executableArgs.map(String) : [];
   const cwd = options.cwd || undefined;
+  const stdin = options.stdin ?? 'y\n';
 
   return new Promise((resolve) => {
     const proxySettings = getProxySettings();
@@ -90,11 +91,11 @@ function runHcloudOnce(plan, options) {
         ...options.env,
       },
     });
-    if (options.stdin) {
-      if (typeof options.stdin === 'function') {
-        options.stdin(child.stdin);
+    if (stdin) {
+      if (typeof stdin === 'function') {
+        stdin(child.stdin);
       } else {
-        child.stdin.write(String(options.stdin));
+        child.stdin.write(String(stdin));
         child.stdin.end();
       }
     }

package/plugins/huaweicloud-core/src/sandbox/session-manager.mjs

@@ -948,6 +948,7 @@ fi
         : ''
     }`,
     `echo "SCORE:\${PASS}/\${TOTAL}"`,
+    `echo "TUNNEL_URL:\${TUNNEL_URL:-}"`,
     `[ "\${PASS}" = "\${TOTAL}" ] && echo "VERDICT:COMPLETE" || echo "VERDICT:INCOMPLETE"`,
   ]
     .filter(Boolean)
@@ -958,10 +959,11 @@ fi
   const checks = {};
   const lines = stdout.split('\n');
   for (const line of lines) {
-    const m = line.match(/^(\w+):(PASS|FAIL)\b(.*)/);
+    const m = line.match(/^(\w+):(\w+)\b(.*)/);
     if (m) checks[m[1]] = { status: m[2], detail: (m[3] || '').trim() };
   }
   const scoreMatch = stdout.match(/SCORE:(\d+)\/(\d+)/);
+  const tunnelMatch = stdout.match(/TUNNEL_URL:(https:\/\/[^\s]+)/);
   const complete = /VERDICT:COMPLETE/.test(stdout);
 
   const missing = [];
@@ -977,6 +979,7 @@ fi
     checkType: isCrossPlatform ? 'cross-platform' : 'standard',
     checks,
     score: scoreMatch ? { pass: parseInt(scoreMatch[1], 10), total: parseInt(scoreMatch[2], 10) } : null,
+    publicUrl: tunnelMatch ? tunnelMatch[1] : undefined,
     missingSteps: missing.length > 0 ? missing.join(', ') : undefined,
     nextStep: !complete
       ? missing.includes('devbridge_tunnel') || missing.includes('tunnel_url_accessible')

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -474,6 +474,7 @@ function installRuntimeDeps(pluginsDir) {
   };
   let r = spawnSync('npm', ['install', '--omit=dev'], spawnOpts);
   const isRetryable = (res) => {
+    if (res.status === 0) return false;
     const stderr = (res.stderr || '').toString();
     return res.error?.code === 'EPERM' || res.error?.code === 'EBUSY' || /EPERM|EBUSY/.test(stderr);
   };
@@ -482,6 +483,11 @@ function installRuntimeDeps(pluginsDir) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2000);
     r = spawnSync('npm', ['install', '--omit=dev'], spawnOpts);
   }
+  if (r.status !== 0 && !isRetryable(r)) {
+    console.log(`  \x1b[33m[RETRY]\x1b[0m npm install failed (exit ${r.status}), retrying in 3s...`);
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 3000);
+    r = spawnSync('npm', ['install', '--omit=dev'], spawnOpts);
+  }
   const undiciDir = join(pluginsDir, 'node_modules', 'undici');
   if (r.status === 0 && existsSync(undiciDir)) {
     console.log(`  Runtime deps installed -> ${join(pluginsDir, 'node_modules')}`);
@@ -489,12 +495,14 @@ function installRuntimeDeps(pluginsDir) {
     const errCode = r.error?.code;
     const err = (r.stderr || '').toString().trim().split(/\r?\n/).slice(-2).join(' ');
     const hint = errCode === 'ENOENT' ? ' (npm not found — ensure Node.js/npm is in PATH)' : '';
-    console.log(`  \x1b[33m[WARN]\x1b[0m npm install failed in ${pluginsDir}${err ? `: ${err}` : ''}${hint}`);
+    const msg = `npm install failed in ${pluginsDir}${err ? `: ${err}` : ''}${hint}`;
+    console.log(`  \x1b[31m[ERROR]\x1b[0m ${msg}`);
     console.log('  Manual fix: cd %s && npm install', pluginsDir);
     if (!existsSync(undiciDir)) {
       console.log(`  \x1b[31m[ERROR]\x1b[0m undici is NOT installed. MCP server will fail to start.`);
       console.log(`  Run manually: cd "${pluginsDir}" && npm install undici@^8.10.0`);
     }
+    throw new Error(msg);
   }
 }
 

package/plugins/huaweicloud-core/src/tools.mjs

@@ -106,6 +106,10 @@ function hermesSkillsDir() {
   return join(home, '.hermes', 'skills');
 }
 
+function codexDesktopSkillsDir() {
+  return join(homedir(), '.agents', 'skills');
+}
+
 export function listSkillDirs(root) {
   if (!existsSync(root)) return [];
   try {
@@ -135,6 +139,7 @@ function resolveSkillsRoot() {
       workbuddySkillsDir(),
       officeaceSkillsRoot(),
       hermesSkillsDir(),
+      codexDesktopSkillsDir(),
     ]) || SKILLS_ROOT_DEV
   );
 }
@@ -1228,7 +1233,10 @@ async function runApprovedCommand(args = {}) {
   }
   const strictPlan = planHcloudCommand(args.args || [], { allowWrites: false });
   const plan = planHcloudCommand(args.args || [], { allowWrites: true });
-  if (String(args.approvedCommand || '') !== plan.command) {
+  const approved = String(args.approvedCommand || '');
+  const planned = String(plan.command || '');
+  const normalized = (s) => s.replace(/--\S+[= ]<redacted>/g, '--<placeholder>');
+  if (normalized(approved) !== normalized(planned)) {
     throw new Error('approvedCommand must exactly match the planned hcloud command.');
   }
   const result = await runHcloud(args.args || [], {