huaweicloud-devkit 1.1.0-next.19 → 1.1.0-next.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.0-next.19",
+  "version": "1.1.0-next.20",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
   "files": [

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.0-next.19",
+  "version": "1.1.0-next.20",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.0-next.19",
+  "version": "1.1.0-next.20",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.0-next.19",
+  "version": "1.1.0-next.20",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.0-next.19",
+  "version": "1.1.0-next.20",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.0-next.19",
+  "version": "1.1.0-next.20",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.0-next.19",
+  "version": "1.1.0-next.20",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -1,4 +1,5 @@
 import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
@@ -9,9 +10,35 @@ import { getProxySettings } from './proxy/proxy-config.mjs';
 const DEFAULT_TIMEOUT_MS = 60_000;
 const DEFAULT_FORCE_KILL_AFTER_MS = 2_000;
 const DEFAULT_MAX_RETRIES = 1;
+const APPROVAL_TTL_MS = 5 * 60_000;
 const LARGE_OUTPUT_THRESHOLD = 50_000;
 const OUTPUT_DIR = join('/tmp', 'huaweicloud-devkit');
 
+const approvalStore = new Map();
+
+export function createApprovalToken(rawArgs) {
+  const token = randomUUID();
+  approvalStore.set(token, { rawArgs, createdAt: Date.now() });
+  if (approvalStore.size % 20 === 0) {
+    const now = Date.now();
+    for (const [k, v] of approvalStore) {
+      if (now - v.createdAt > APPROVAL_TTL_MS) approvalStore.delete(k);
+    }
+  }
+  return token;
+}
+
+export function consumeApprovalToken(token) {
+  const entry = approvalStore.get(token);
+  if (!entry) return null;
+  if (Date.now() - entry.createdAt > APPROVAL_TTL_MS) {
+    approvalStore.delete(token);
+    return null;
+  }
+  approvalStore.delete(token);
+  return entry.rawArgs;
+}
+
 function saveLargeOutput(rawStdout) {
   if (rawStdout.length <= LARGE_OUTPUT_THRESHOLD) return null;
   try {
@@ -43,6 +70,7 @@ export function planHcloudCommand(args, options = {}) {
     executableBlock: redactOutput(command),
     warnings,
     classification,
+    approvalToken: createApprovalToken(normalizedArgs),
     safeToRun: classification.decision === 'allow',
   };
 }

package/plugins/huaweicloud-core/src/sandbox/session-manager.mjs

@@ -940,7 +940,24 @@ if [ -f "${outputPath}/qr.png" ]; then
   echo "qr_code:PASS"
   PASS=$((PASS+1))
 else
-  echo "qr_code:FAIL (no QR code — generate one for cross-platform H5 apps)"
+  ${
+    isCrossPlatform
+      ? `
+  if [ -n "$TUNNEL_URL" ]; then
+    curl -s "https://api.qrserver.com/v1/create-qr-code/?size=300x300&data=$(python3 -c "import urllib.parse, sys; print(urllib.parse.quote(sys.argv[1]))" "$TUNNEL_URL" 2>/dev/null)" -o "${outputPath}/qr.png" 2>/dev/null
+    chmod o+r "${outputPath}/qr.png" 2>/dev/null || true
+    if [ -f "${outputPath}/qr.png" ] && [ -s "${outputPath}/qr.png" ]; then
+      echo "qr_code:PASS (auto-generated)"
+      PASS=$((PASS+1))
+    else
+      echo "qr_code:FAIL (QR generation failed)"
+    fi
+  else
+    echo "qr_code:FAIL (no tunnel URL for QR generation)"
+  fi
+`
+      : `echo "qr_code:FAIL (no QR code — generate one for cross-platform H5 apps)"`
+  }
 fi
 `}`,
     `echo "SCORE:\${PASS}/\${TOTAL}"`,

package/plugins/huaweicloud-core/src/tools.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from 'node:child_process';
 
 import { evaluateArtifacts, evaluateCommandRisk, evaluateDeployPlan } from './risk-rule-engine.mjs';
 import { classifyTextCommand, redactSecrets } from './safety-policy.mjs';
-import { planHcloudCommand, runHcloud } from './hcloud-cli.mjs';
+import { planHcloudCommand, runHcloud, consumeApprovalToken } from './hcloud-cli.mjs';
 import { searchMarketplace } from './search-market.mjs';
 import { getServiceIcon } from './icon-library.mjs';
 import { detectFramework } from './detect-framework.mjs';
@@ -224,16 +224,16 @@ export const TOOL_DEFINITIONS = [
       'Run a write-capable hcloud command only after the exact command has been shown and explicitly approved by the user.',
     inputSchema: {
       type: 'object',
-      required: ['args', 'approvedCommand', 'approvedByUser'],
+      required: ['args', 'approvalToken', 'approvedByUser'],
       properties: {
         args: {
           type: 'array',
           items: { type: 'string' },
           description: 'hcloud arguments, excluding the hcloud executable.',
         },
-        approvedCommand: {
+        approvalToken: {
           type: 'string',
-          description: 'The exact command string previously shown to the user.',
+          description: 'The approvalToken returned by huaweicloud_plan_cli_command.',
         },
         approvedByUser: {
           type: 'boolean',
@@ -1231,15 +1231,17 @@ async function runApprovedCommand(args = {}) {
   if (args.approvedByUser !== true) {
     throw new Error('approvedByUser must be true after explicit user approval for this exact command.');
   }
-  const strictPlan = planHcloudCommand(args.args || [], { allowWrites: false });
-  const plan = planHcloudCommand(args.args || [], { allowWrites: true });
-  const approved = String(args.approvedCommand || '');
-  const planned = String(plan.command || '');
-  const normalized = (s) => s.replace(/--\S+[= ]<redacted>/g, '--<placeholder>');
-  if (normalized(approved) !== normalized(planned)) {
-    throw new Error('approvedCommand must exactly match the planned hcloud command.');
+  const token = String(args.approvalToken || '');
+  const storedArgs = consumeApprovalToken(token);
+  if (!storedArgs || storedArgs.length === 0) {
+    throw new Error('Invalid or expired approval token. Please re-plan the command.');
   }
-  const result = await runHcloud(args.args || [], {
+  const providedArgs = Array.isArray(args.args) ? args.args.map(String) : [];
+  if (JSON.stringify(storedArgs) !== JSON.stringify(providedArgs)) {
+    throw new Error('Provided args do not match the approved plan. Use the exact args from the plan.');
+  }
+  const strictPlan = planHcloudCommand(providedArgs, { allowWrites: false });
+  const result = await runHcloud(providedArgs, {
     allowWrites: true,
     timeoutMs: args.timeoutMs,
     maxRetries: args.maxRetries,