huaweicloud-devkit 1.1.0-next.2 → 1.1.0-next.21

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -105,6 +105,17 @@ function codeartsPluginsDir() {
   return join(homedir(), '.codeartsdoer', 'huaweicloud-plugins');
 }
 
+// CodeArts Work (CodeArts Space) — user-level only
+function codeartsWorkSkillsDir() {
+  return join(homedir(), '.codeartswork', 'skills');
+}
+function codeartsWorkMcpSettingsFile() {
+  return join(homedir(), '.codeartswork', 'mcp', 'mcp_settings.json');
+}
+function codeartsWorkPluginsDir() {
+  return join(homedir(), '.codeartswork', 'huaweicloud-plugins');
+}
+
 function workbuddySkillsDir() {
   return join(homedir(), '.workbuddy', 'skills');
 }
@@ -463,6 +474,7 @@ function installRuntimeDeps(pluginsDir) {
   };
   let r = spawnSync('npm', ['install', '--omit=dev'], spawnOpts);
   const isRetryable = (res) => {
+    if (res.status === 0) return false;
     const stderr = (res.stderr || '').toString();
     return res.error?.code === 'EPERM' || res.error?.code === 'EBUSY' || /EPERM|EBUSY/.test(stderr);
   };
@@ -471,6 +483,11 @@ function installRuntimeDeps(pluginsDir) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2000);
     r = spawnSync('npm', ['install', '--omit=dev'], spawnOpts);
   }
+  if (r.status !== 0 && !isRetryable(r)) {
+    console.log(`  \x1b[33m[RETRY]\x1b[0m npm install failed (exit ${r.status}), retrying in 3s...`);
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 3000);
+    r = spawnSync('npm', ['install', '--omit=dev'], spawnOpts);
+  }
   const undiciDir = join(pluginsDir, 'node_modules', 'undici');
   if (r.status === 0 && existsSync(undiciDir)) {
     console.log(`  Runtime deps installed -> ${join(pluginsDir, 'node_modules')}`);
@@ -478,12 +495,14 @@ function installRuntimeDeps(pluginsDir) {
     const errCode = r.error?.code;
     const err = (r.stderr || '').toString().trim().split(/\r?\n/).slice(-2).join(' ');
     const hint = errCode === 'ENOENT' ? ' (npm not found — ensure Node.js/npm is in PATH)' : '';
-    console.log(`  \x1b[33m[WARN]\x1b[0m npm install failed in ${pluginsDir}${err ? `: ${err}` : ''}${hint}`);
+    const msg = `npm install failed in ${pluginsDir}${err ? `: ${err}` : ''}${hint}`;
+    console.log(`  \x1b[31m[ERROR]\x1b[0m ${msg}`);
     console.log('  Manual fix: cd %s && npm install', pluginsDir);
     if (!existsSync(undiciDir)) {
       console.log(`  \x1b[31m[ERROR]\x1b[0m undici is NOT installed. MCP server will fail to start.`);
       console.log(`  Run manually: cd "${pluginsDir}" && npm install undici@^8.10.0`);
     }
+    throw new Error(msg);
   }
 }
 
@@ -1248,6 +1267,146 @@ function codeartsStatus() {
   }
 }
 
+// --- CodeArts Work (CodeArts Space) ---
+
+function registerCodeartsWorkMcp() {
+  const configPath = codeartsWorkMcpSettingsFile();
+  const mcpPath = join(codeartsWorkPluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
+  const env = { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' };
+  const hcloudBin = findHcloudBin();
+  if (hcloudBin) env.HCLOUD_BIN = hcloudBin.replace(/\\/g, '/');
+  let config = {};
+  if (existsSync(configPath)) {
+    try {
+      config = JSON.parse(readFileSync(configPath, 'utf8'));
+    } catch {
+      console.log(
+        `  \x1b[33m[WARN]\x1b[0m Could not parse ${configPath}. Skipping MCP config write; ensure "mcpServers.huaweicloud-devkit" points to ${mcpPath}.`,
+      );
+      return;
+    }
+    const existing = config.mcpServers?.['huaweicloud-devkit'];
+    if (
+      existing &&
+      existing.command === 'node' &&
+      Array.isArray(existing.args) &&
+      existing.args[0] === mcpPath &&
+      existing.timeout === 300000
+    ) {
+      console.log(`  MCP config unchanged: ${configPath}`);
+      return;
+    }
+  }
+  config.mcpServers = config.mcpServers || {};
+  config.mcpServers['huaweicloud-devkit'] = {
+    command: 'node',
+    args: [mcpPath],
+    env,
+    enabled: true,
+    timeout: 300000,
+  };
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(configPath, JSON.stringify(config, null, 2));
+  console.log(`  MCP config updated: ${configPath}`);
+}
+
+async function installCodeArtsWork() {
+  const skillsSrc = join(PLUGIN_ROOT, 'skills');
+  const srcDir = join(PLUGIN_ROOT, 'src');
+  const safetyDir = join(PLUGIN_ROOT, 'safety');
+
+  copyDir(skillsSrc, codeartsWorkSkillsDir());
+  console.log(`  Skills -> ${codeartsWorkSkillsDir()}`);
+
+  const pluginDest = codeartsWorkPluginsDir();
+  copyDir(srcDir, join(pluginDest, 'src'));
+  console.log(`  MCP Server -> ${join(pluginDest, 'src')}`);
+  copyDir(safetyDir, join(pluginDest, 'safety'));
+  console.log(`  Safety Policy -> ${join(pluginDest, 'safety')}`);
+
+  registerCodeartsWorkMcp();
+  installRuntimeDeps(pluginDest);
+}
+
+async function updateCodeArtsWork() {
+  const skillsSrc = join(PLUGIN_ROOT, 'skills');
+  const srcDir = join(PLUGIN_ROOT, 'src');
+  const safetyDir = join(PLUGIN_ROOT, 'safety');
+  const pluginDest = codeartsWorkPluginsDir();
+
+  copyDir(skillsSrc, codeartsWorkSkillsDir());
+  console.log(`  Skills updated -> ${codeartsWorkSkillsDir()}`);
+  copyDir(srcDir, join(pluginDest, 'src'));
+  console.log(`  MCP Server updated -> ${join(pluginDest, 'src')}`);
+  copyDir(safetyDir, join(pluginDest, 'safety'));
+  console.log(`  Safety Policy updated -> ${join(pluginDest, 'safety')}`);
+  registerCodeartsWorkMcp();
+  mkdirSync(pluginDest, { recursive: true });
+  writeFileSync(join(pluginDest, '.installed'), new Date().toISOString());
+  installRuntimeDeps(pluginDest);
+}
+
+function uninstallCodeArtsWork() {
+  const skillsDir = codeartsWorkSkillsDir();
+  if (existsSync(skillsDir)) {
+    let removed = 0;
+    for (const entry of readdirSync(skillsDir, { withFileTypes: true })) {
+      if (entry.name.startsWith('huawei')) {
+        removeIfExists(join(skillsDir, entry.name));
+        removed++;
+      }
+    }
+    if (removed > 0) console.log(`  Removed ${removed} skills`);
+  }
+
+  if (removeIfExists(codeartsWorkPluginsDir())) {
+    console.log('  Removed MCP server and safety policy');
+  }
+
+  const configPath = codeartsWorkMcpSettingsFile();
+  if (existsSync(configPath)) {
+    let config = {};
+    try {
+      config = JSON.parse(readFileSync(configPath, 'utf8'));
+    } catch {}
+    if (config.mcpServers?.['huaweicloud-devkit']) {
+      delete config.mcpServers['huaweicloud-devkit'];
+      if (Object.keys(config.mcpServers).length === 0) delete config.mcpServers;
+      writeFileSync(configPath, JSON.stringify(config, null, 2));
+      console.log(`  Config cleaned: ${configPath}`);
+    }
+  }
+}
+
+function codeartsWorkStatus() {
+  const pluginDir = codeartsWorkPluginsDir();
+  console.log(
+    `  MCP Server: ${existsSync(join(pluginDir, 'src', 'mcp-server.mjs')) ? '\x1b[32mInstalled\x1b[0m' : '\x1b[31mNot installed\x1b[0m'}`,
+  );
+  console.log(
+    `  Safety Policy: ${existsSync(join(pluginDir, 'safety', 'policy.json')) ? '\x1b[32mInstalled\x1b[0m' : '\x1b[31mNot installed\x1b[0m'}`,
+  );
+  let skillCount = 0;
+  if (existsSync(codeartsWorkSkillsDir())) {
+    skillCount = readdirSync(codeartsWorkSkillsDir(), { withFileTypes: true }).filter(
+      (d) => d.isDirectory() && d.name.startsWith('huawei'),
+    ).length;
+  }
+  console.log(
+    `  Skills: ${skillCount > 0 ? `\x1b[32m${skillCount} installed\x1b[0m` : '\x1b[31mNot installed\x1b[0m'}`,
+  );
+  if (existsSync(codeartsWorkMcpSettingsFile())) {
+    try {
+      const config = JSON.parse(readFileSync(codeartsWorkMcpSettingsFile(), 'utf8'));
+      console.log(
+        `  MCP config: ${config.mcpServers?.['huaweicloud-devkit'] ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`,
+      );
+    } catch {
+      console.log(`  MCP config: \x1b[31mInvalid\x1b[0m`);
+    }
+  }
+}
+
 // Returns true when the config file was written, false when it was already correct.
 function ensureWorkbuddyMcpConfig() {
   const configPath = workbuddyMcpConfigFile();
@@ -1957,6 +2116,14 @@ function hermesPluginsDir() {
   return join(hermesHomeDir(), 'huaweicloud-plugins');
 }
 
+function hermesPythonPluginsDir() {
+  return join(hermesHomeDir(), 'plugins');
+}
+
+function hermesSafetyPluginDir() {
+  return join(hermesPythonPluginsDir(), 'huaweicloud-safety');
+}
+
 function hermesConfigFile() {
   return join(hermesHomeDir(), 'config.yaml');
 }
@@ -2035,28 +2202,298 @@ function removeHermesMcpConfigBlock() {
   console.log('  MCP config cleaned');
 }
 
+function hermesHookScript() {
+  return join(hermesPluginsDir(), 'hooks', 'huaweicloud-safety.py').replace(/\\/g, '/');
+}
+
+function hermesHookCommand() {
+  const pythonBin = process.platform === 'win32' ? 'python' : 'python3';
+  return `${pythonBin} ${hermesHookScript()}`;
+}
+
+function ensureHermesHooksConfig() {
+  const configPath = hermesConfigFile();
+  const hookCommand = hermesHookCommand();
+
+  const blockLines = [
+    'hooks:',
+    '  pre_tool_call:',
+    '    - matcher: "terminal"',
+    `      command: "${hookCommand}"`,
+    '      timeout: 5',
+    '      fail_closed: true',
+  ];
+  const block = blockLines.join('\n');
+
+  let existing = '';
+  if (existsSync(configPath)) {
+    try {
+      existing = readFileSync(configPath, 'utf8');
+    } catch {}
+    if (
+      existing.includes('hooks:') &&
+      existing.includes(`command: "${hookCommand}"`) &&
+      existing.includes('fail_closed: true')
+    ) {
+      console.log(`  Hooks config unchanged: ${configPath}`);
+      return false;
+    }
+    removeHermesHooksConfigBlock();
+    existing = '';
+    if (existsSync(configPath)) {
+      try {
+        existing = readFileSync(configPath, 'utf8');
+      } catch {}
+    }
+  }
+  mkdirSync(dirname(configPath), { recursive: true });
+  const newContent = existing ? `${existing.trimEnd()}\n\n${block}\n` : `${block}\n`;
+  writeFileSync(configPath, newContent);
+  console.log(`  Hooks config updated: ${configPath}`);
+  return true;
+}
+
+function hermesHookScriptMtime() {
+  const scriptPath = hermesHookScript();
+  try {
+    return statSync(scriptPath).mtime.toISOString();
+  } catch {
+    return null;
+  }
+}
+
+function hermesAllowlistPath() {
+  return join(hermesHomeDir(), 'shell-hooks-allowlist.json');
+}
+
+function ensureHermesHookAllowlist() {
+  const hookCommand = hermesHookCommand();
+  const allowlistPath = hermesAllowlistPath();
+
+  let data = { approvals: [] };
+  if (existsSync(allowlistPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync(allowlistPath, 'utf8'));
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+        data = parsed;
+      }
+    } catch {}
+  }
+  const approvals = Array.isArray(data.approvals) ? data.approvals : [];
+  const already = approvals.some(
+    (a) => a && typeof a === 'object' && a.event === 'pre_tool_call' && a.command === hookCommand,
+  );
+  if (already) {
+    console.log(`  Hook allowlist unchanged: ${allowlistPath}`);
+    return false;
+  }
+
+  const entry = {
+    event: 'pre_tool_call',
+    command: hookCommand,
+    approved_at: new Date().toISOString(),
+    script_mtime_at_approval: hermesHookScriptMtime(),
+  };
+  data.approvals = [...approvals, entry];
+  mkdirSync(dirname(allowlistPath), { recursive: true });
+  writeFileSync(allowlistPath, JSON.stringify(data, null, 2));
+  console.log(`  Hook allowlist updated: ${allowlistPath}`);
+  return true;
+}
+
+function hermesHookAllowlisted() {
+  const allowlistPath = hermesAllowlistPath();
+  if (!existsSync(allowlistPath)) return false;
+  try {
+    const data = JSON.parse(readFileSync(allowlistPath, 'utf8'));
+    const cmd = hermesHookCommand();
+    return (
+      Array.isArray(data?.approvals) &&
+      data.approvals.some((a) => a && typeof a === 'object' && a.event === 'pre_tool_call' && a.command === cmd)
+    );
+  } catch {
+    return false;
+  }
+}
+
+function hermesHookPluginInit() {
+  const script = hermesHookScript();
+  return [
+    'import importlib.util',
+    '',
+    `SAFETY_SCRIPT = ${JSON.stringify(script)}`,
+    '',
+    '',
+    'def _load_safety():',
+    '    spec = importlib.util.spec_from_file_location("huaweicloud_safety_hook", SAFETY_SCRIPT)',
+    '    module = importlib.util.module_from_spec(spec)',
+    '    spec.loader.exec_module(module)',
+    '    return module',
+    '',
+    '',
+    '_safety = _load_safety()',
+    '',
+    '',
+    'def register(ctx):',
+    '    ctx.register_hook("pre_tool_call", _check)',
+    '',
+    '',
+    'def _check(tool_name=None, args=None, **kwargs):',
+    '    if tool_name != "terminal":',
+    '        return None',
+    '    if not (isinstance(args, dict) and "command" in args):',
+    '        return None',
+    '    reason = _safety.evaluate(tool_name, args)',
+    '    if reason:',
+    '        return {"action": "block", "message": _safety.DENY_PREFIX + reason}',
+    '    return None',
+    '',
+  ].join('\n');
+}
+
+function ensureHermesHookPlugin() {
+  const pluginDir = hermesSafetyPluginDir();
+  const manifestPath = join(pluginDir, 'plugin.yaml');
+  const initPath = join(pluginDir, '__init__.py');
+
+  const manifest = [
+    'name: huaweicloud-safety',
+    `version: "${pkgVersion}"`,
+    'description: Huawei Cloud safety pre_tool_call hook',
+    'author: HuaweiCloud Mate',
+    'provides_hooks:',
+    '  - pre_tool_call',
+    '',
+  ].join('\n');
+  const init = hermesHookPluginInit();
+
+  const manifestCurrent = existsSync(manifestPath) ? readFileSync(manifestPath, 'utf8') : '';
+  const initCurrent = existsSync(initPath) ? readFileSync(initPath, 'utf8') : '';
+  if (manifestCurrent === manifest && initCurrent === init) {
+    console.log(`  Hook plugin unchanged: ${pluginDir}`);
+    return false;
+  }
+
+  mkdirSync(pluginDir, { recursive: true });
+  writeFileSync(manifestPath, manifest);
+  writeFileSync(initPath, init);
+  console.log(`  Hook plugin installed: ${pluginDir}`);
+  return true;
+}
+
+function removeHermesHookPlugin() {
+  const pluginDir = hermesSafetyPluginDir();
+  if (!existsSync(pluginDir)) return false;
+  rmSync(pluginDir, { recursive: true, force: true });
+  console.log(`  Removed hook plugin: ${pluginDir}`);
+  const parent = hermesPythonPluginsDir();
+  try {
+    if (existsSync(parent) && readdirSync(parent).length === 0) {
+      rmSync(parent, { recursive: true, force: true });
+    }
+  } catch {}
+  return true;
+}
+
+function hermesHookPluginInstalled() {
+  return (
+    existsSync(join(hermesSafetyPluginDir(), 'plugin.yaml')) && existsSync(join(hermesSafetyPluginDir(), '__init__.py'))
+  );
+}
+
+function removeHermesHooksConfigBlock() {
+  const configPath = hermesConfigFile();
+  if (!existsSync(configPath)) return;
+  const lines = readFileSync(configPath, 'utf8').split(/\r?\n/);
+  let inHooksBlock = false;
+  const out = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === 'hooks:' && !inHooksBlock) {
+      inHooksBlock = true;
+      continue;
+    }
+    if (inHooksBlock) {
+      if (trimmed === '' || line.startsWith(' ') || line.startsWith('\t')) {
+        continue;
+      }
+      inHooksBlock = false;
+    }
+    out.push(line);
+  }
+  const cleaned = out.join('\n').trimEnd();
+  writeFileSync(configPath, cleaned ? `${cleaned}\n` : '');
+  console.log('  Hooks config cleaned');
+}
+
+function ensureHermesMcpSdk() {
+  const pythonBin = process.platform === 'win32' ? 'python' : 'python3';
+  try {
+    const r = spawnSync(pythonBin, ['-c', 'import mcp; print("ok")'], { encoding: 'utf8', timeout: 5000 });
+    if (r.status === 0 && r.stdout.trim() === 'ok') {
+      console.log('  MCP Python SDK: \x1b[32mAlready installed\x1b[0m');
+      return true;
+    }
+  } catch {}
+  console.log('  Installing Hermes MCP Python SDK...');
+  try {
+    const pip = spawnSync(pythonBin, ['-m', 'pip', 'install', 'mcp', '--quiet'], { encoding: 'utf8', timeout: 60000 });
+    if (pip.status === 0) {
+      console.log('  MCP Python SDK: \x1b[32mInstalled\x1b[0m');
+      return true;
+    }
+    console.log(`  MCP Python SDK: \x1b[33mInstall failed\x1b[0m`);
+    console.log(`  \x1b[33m  Run manually: ${pythonBin} -m pip install mcp\x1b[0m`);
+  } catch (error) {
+    console.log(`  MCP Python SDK: \x1b[33m${error.message}\x1b[0m`);
+    console.log(`  \x1b[33m  Run manually: ${pythonBin} -m pip install mcp\x1b[0m`);
+  }
+  return false;
+}
+
+function hermesMcpSdkOk() {
+  const pythonBin = process.platform === 'win32' ? 'python' : 'python3';
+  try {
+    const r = spawnSync(pythonBin, ['-c', 'import mcp; print("ok")'], { encoding: 'utf8', timeout: 5000 });
+    return r.status === 0 && r.stdout.trim() === 'ok';
+  } catch {
+    return false;
+  }
+}
+
 async function installHermes() {
   const skillsSrc = join(PLUGIN_ROOT, 'skills');
   const srcDir = join(PLUGIN_ROOT, 'src');
   const safetyDir = join(PLUGIN_ROOT, 'safety');
+  const hooksDir = join(PLUGIN_ROOT, 'hooks');
   const pluginDest = hermesPluginsDir();
+  const skipMcp = process.argv.includes('--skip-mcp-server');
 
   copyDir(skillsSrc, hermesSkillsDir());
   console.log(`  Skills -> ${hermesSkillsDir()}`);
 
-  copyDir(srcDir, join(pluginDest, 'src'));
-  console.log(`  MCP Server -> ${join(pluginDest, 'src')}`);
+  if (!skipMcp) {
+    copyDir(srcDir, join(pluginDest, 'src'));
+    console.log(`  MCP Server -> ${join(pluginDest, 'src')}`);
+  }
   copyDir(safetyDir, join(pluginDest, 'safety'));
   console.log(`  Safety Policy -> ${join(pluginDest, 'safety')}`);
+  copyDir(hooksDir, join(pluginDest, 'hooks'));
+  console.log(`  Safety Hooks -> ${join(pluginDest, 'hooks')}`);
 
-  ensureHermesMcpConfig();
-  installRuntimeDeps(pluginDest);
+  if (!skipMcp) ensureHermesMcpConfig();
+  ensureHermesHooksConfig();
+  ensureHermesHookAllowlist();
+  ensureHermesHookPlugin();
+  if (!skipMcp) installRuntimeDeps(pluginDest);
+  if (!skipMcp) ensureHermesMcpSdk();
 }
 
 async function updateHermes() {
   const skillsSrc = join(PLUGIN_ROOT, 'skills');
   const srcDir = join(PLUGIN_ROOT, 'src');
   const safetyDir = join(PLUGIN_ROOT, 'safety');
+  const hooksDir = join(PLUGIN_ROOT, 'hooks');
   const pluginDest = hermesPluginsDir();
 
   copyDir(skillsSrc, hermesSkillsDir());
@@ -2066,7 +2503,13 @@ async function updateHermes() {
   console.log(`  MCP Server updated -> ${join(pluginDest, 'src')}`);
   copyDir(safetyDir, join(pluginDest, 'safety'));
   console.log(`  Safety Policy updated -> ${join(pluginDest, 'safety')}`);
+  copyDir(hooksDir, join(pluginDest, 'hooks'));
+  console.log(`  Safety Hooks updated -> ${join(pluginDest, 'hooks')}`);
   ensureHermesMcpConfig();
+  ensureHermesHooksConfig();
+  ensureHermesHookAllowlist();
+  ensureHermesHookPlugin();
+  ensureHermesMcpSdk();
   mkdirSync(pluginDest, { recursive: true });
   writeFileSync(join(pluginDest, '.installed'), new Date().toISOString());
   installRuntimeDeps(pluginDest);
@@ -2075,6 +2518,40 @@ async function updateHermes() {
 function uninstallHermes() {
   const skillsDir = hermesSkillsDir();
   let removed = 0;
+
+  // 1. Remove hook config from config.yaml (before deleting script files)
+  removeHermesHooksConfigBlock();
+  console.log('  Hooks config removed');
+
+  // 1b. Remove the Python safety hook plugin (v0.9.0+ enforcement path)
+  removeHermesHookPlugin();
+
+  // 2. Clean shell-hooks-allowlist.json (remove approved hook references)
+  const hermesHome = hermesHomeDir();
+  const allowlistPath = join(hermesHome, 'shell-hooks-allowlist.json');
+  if (existsSync(allowlistPath)) {
+    try {
+      const allowlist = JSON.parse(readFileSync(allowlistPath, 'utf8'));
+      const before = (allowlist.approvals || []).length;
+      allowlist.approvals = (allowlist.approvals || []).filter((a) => {
+        const cmd = typeof a === 'string' ? a : a?.command;
+        return !(typeof cmd === 'string' && cmd.includes('huaweicloud-safety.py'));
+      });
+      if (allowlist.approvals.length < before) {
+        writeFileSync(allowlistPath, JSON.stringify(allowlist, null, 2));
+        console.log(`  Removed ${before - allowlist.approvals.length} hook approvals from allowlist`);
+      }
+    } catch {
+      removeIfExists(allowlistPath);
+      console.log('  Removed hook allowlist file');
+    }
+  }
+
+  // 3. Remove MCP config from config.yaml
+  removeHermesMcpConfigBlock();
+  console.log('  MCP config removed');
+
+  // 4. Remove skills (file deletion comes after config cleanup)
   if (existsSync(skillsDir)) {
     for (const entry of readdirSync(skillsDir, { withFileTypes: true })) {
       if (entry.name.startsWith('huawei')) {
@@ -2091,10 +2568,10 @@ function uninstallHermes() {
     } catch {}
   }
 
+  // 5. Remove plugin directory (hook script files deleted last)
   if (removeIfExists(hermesPluginsDir())) {
-    console.log('  Removed MCP server and safety policy');
+    console.log('  Removed MCP server, safety policy and hooks');
   }
-  removeHermesMcpConfigBlock();
 }
 
 function hermesStatus() {
@@ -2106,6 +2583,16 @@ function hermesStatus() {
   console.log(
     `  Safety Policy: ${existsSync(join(pluginDir, 'safety', 'policy.json')) ? '\x1b[32mInstalled\x1b[0m' : '\x1b[31mNot installed\x1b[0m'}`,
   );
+  console.log(
+    `  Safety Hooks: ${existsSync(join(pluginDir, 'hooks', 'huaweicloud-safety.py')) ? '\x1b[32mInstalled\x1b[0m' : '\x1b[31mNot installed\x1b[0m'}`,
+  );
+  console.log(
+    `  Hook allowlist: ${hermesHookAllowlisted() ? '\x1b[32mApproved\x1b[0m' : '\x1b[31mNot allowlisted\x1b[0m'}`,
+  );
+  console.log(
+    `  Hook plugin: ${hermesHookPluginInstalled() ? '\x1b[32mInstalled\x1b[0m' : '\x1b[31mNot installed\x1b[0m'}`,
+  );
+  console.log(`  MCP Python SDK: ${hermesMcpSdkOk() ? '\x1b[32mReady\x1b[0m' : '\x1b[31mMissing\x1b[0m'}`);
   let skillCount = 0;
   if (existsSync(skillsDir)) {
     skillCount = readdirSync(skillsDir, { withFileTypes: true }).filter(
@@ -2119,13 +2606,17 @@ function hermesStatus() {
   if (existsSync(configPath)) {
     try {
       const config = readFileSync(configPath, 'utf8');
-      const configured = config.includes('mcp_servers:') && config.includes('huaweicloud-devkit');
-      console.log(`  MCP config: ${configured ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`);
+      const mcpConfigured = config.includes('mcp_servers:') && config.includes('huaweicloud-devkit');
+      const hooksConfigured = config.includes('hooks:') && config.includes('huaweicloud-safety.py');
+      console.log(`  MCP config: ${mcpConfigured ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`);
+      console.log(`  Hooks config: ${hooksConfigured ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`);
     } catch {
       console.log(`  MCP config: \x1b[31mInvalid\x1b[0m`);
+      console.log(`  Hooks config: \x1b[31mInvalid\x1b[0m`);
     }
   } else {
     console.log(`  MCP config: \x1b[31mNot found\x1b[0m`);
+    console.log(`  Hooks config: \x1b[31mNot found\x1b[0m`);
   }
 }
 
@@ -2165,6 +2656,7 @@ function autoDetectTarget() {
     ['opencode', () => existsSync(join(homedir(), '.config', 'opencode'))],
     ['codex-desktop', () => existsSync(join(homedir(), '.codex'))],
     ['codearts', () => existsSync(join(homedir(), '.codeartsdoer'))],
+    ['codearts-work', () => existsSync(join(homedir(), '.codeartswork'))],
     ['workbuddy', () => existsSync(join(homedir(), '.workbuddy'))],
     [
       'dsh',
@@ -2217,6 +2709,10 @@ async function cmdInstall() {
     console.log('\n[CodeArts]');
     await installCodeArts();
   }
+  if (target === 'codearts-work' || target === 'all') {
+    console.log('\n[CodeArts Work]');
+    await installCodeArtsWork();
+  }
   if (target === 'workbuddy' || target === 'all') {
     console.log('\n[WorkBuddy]');
     await installWorkBuddy();
@@ -2268,23 +2764,25 @@ async function cmdInstall() {
   const appName =
     target === 'codearts'
       ? 'CodeArts'
-      : target === 'codex-desktop'
-        ? 'Codex Desktop'
-        : target === 'codex'
-          ? 'Codex'
-          : target === 'workbuddy'
-            ? 'WorkBuddy'
-            : target === 'dsh'
-              ? 'DSH'
-              : target === 'officeace'
-                ? 'OfficeAce'
-                : target === 'hermes'
-                  ? 'Hermes Agent'
-                  : target === 'openclaw'
-                    ? 'OpenClaw'
-                    : target === 'atomcode'
-                      ? 'AtomCode'
-                      : '当前 agent';
+      : target === 'codearts-work'
+        ? 'CodeArts Work'
+        : target === 'codex-desktop'
+          ? 'Codex Desktop'
+          : target === 'codex'
+            ? 'Codex'
+            : target === 'workbuddy'
+              ? 'WorkBuddy'
+              : target === 'dsh'
+                ? 'DSH'
+                : target === 'officeace'
+                  ? 'OfficeAce'
+                  : target === 'hermes'
+                    ? 'Hermes Agent'
+                    : target === 'openclaw'
+                      ? 'OpenClaw'
+                      : target === 'atomcode'
+                        ? 'AtomCode'
+                        : '当前 agent';
   const pad = ' '.repeat(24 - appName.length);
   if (target === 'officeace') {
     console.log(`\n\x1b[1m\x1b[33m╔══════════════════════════════════════════════════════════╗`);
@@ -2338,17 +2836,19 @@ async function cmdInstall() {
       ? dshPluginsDir()
       : target === 'codearts'
         ? codeartsPluginsDir()
-        : target === 'workbuddy'
-          ? workbuddyPluginsDir()
-          : target === 'officeace'
-            ? officeacePluginsDir()
-            : target === 'openclaw'
-              ? codexDesktopPluginsDir()
-              : target === 'atomcode'
-                ? atomcodePluginsDir()
-                : target === 'codex-desktop'
-                  ? codexDesktopPluginsDir()
-                  : opencodePluginsDir();
+        : target === 'codearts-work'
+          ? codeartsWorkPluginsDir()
+          : target === 'workbuddy'
+            ? workbuddyPluginsDir()
+            : target === 'officeace'
+              ? officeacePluginsDir()
+              : target === 'openclaw'
+                ? codexDesktopPluginsDir()
+                : target === 'atomcode'
+                  ? atomcodePluginsDir()
+                  : target === 'codex-desktop'
+                    ? codexDesktopPluginsDir()
+                    : opencodePluginsDir();
   mkdirSync(markerDir, { recursive: true });
   writeFileSync(join(markerDir, '.installed'), new Date().toISOString());
   if (target === 'opencode' || target === 'all') {
@@ -2357,6 +2857,9 @@ async function cmdInstall() {
   if (target === 'codearts' || target === 'all') {
     console.log('Or describe your Huawei Cloud task in CodeArts');
   }
+  if (target === 'codearts-work' || target === 'all') {
+    console.log('Or describe your Huawei Cloud task in CodeArts Work');
+  }
   if (target === 'codex' || target === 'all') {
     console.log('Or mention @huaweicloud-core in Codex');
   }
@@ -2390,6 +2893,10 @@ async function cmdUninstall() {
     console.log('\n[CodeArts]');
     uninstallCodeArts();
   }
+  if (target === 'codearts-work' || target === 'all') {
+    console.log('\n[CodeArts Work]');
+    uninstallCodeArtsWork();
+  }
   if (target === 'workbuddy' || target === 'all') {
     console.log('\n[WorkBuddy]');
     uninstallWorkBuddy();
@@ -2454,6 +2961,10 @@ async function cmdStatus() {
     console.log('\n[CodeArts]');
     codeartsStatus();
   }
+  if (target === 'codearts-work' || target === 'all') {
+    console.log('\n[CodeArts Work]');
+    codeartsWorkStatus();
+  }
   if (target === 'workbuddy' || target === 'all') {
     console.log('\n[WorkBuddy]');
     workbuddyStatus();
@@ -2532,6 +3043,7 @@ async function cmdDoctor() {
   const opencodePluginDir = opencodePluginsDir();
   const codexPluginDir = codexDesktopPluginsDir();
   const codeartsPluginDir = codeartsPluginsDir();
+  const codeartsWorkPluginDir = codeartsWorkPluginsDir();
   const workbuddyPluginDir = workbuddyPluginsDir();
   const dshPluginDir = dshPluginsDir();
   const officeacePluginDir = officeacePluginsDir();
@@ -2541,6 +3053,7 @@ async function cmdDoctor() {
     existsSync(join(opencodePluginDir, 'src', 'mcp-server.mjs')) ||
     existsSync(join(codexPluginDir, 'src', 'mcp-server.mjs')) ||
     existsSync(join(codeartsPluginDir, 'src', 'mcp-server.mjs')) ||
+    existsSync(join(codeartsWorkPluginDir, 'src', 'mcp-server.mjs')) ||
     existsSync(join(workbuddyPluginDir, 'src', 'mcp-server.mjs')) ||
     existsSync(join(dshPluginDir, 'src', 'mcp-server.mjs')) ||
     existsSync(join(officeacePluginDir, 'src', 'mcp-server.mjs')) ||
@@ -2552,17 +3065,19 @@ async function cmdDoctor() {
       ? 'Codex Desktop'
       : existsSync(join(codeartsPluginDir, 'src', 'mcp-server.mjs'))
         ? 'CodeArts'
-        : existsSync(join(workbuddyPluginDir, 'src', 'mcp-server.mjs'))
-          ? 'WorkBuddy'
-          : existsSync(join(dshPluginDir, 'src', 'mcp-server.mjs'))
-            ? 'DSH'
-            : existsSync(join(officeacePluginDir, 'src', 'mcp-server.mjs'))
-              ? 'OfficeAce'
-              : existsSync(join(hermesPluginDir, 'src', 'mcp-server.mjs'))
-                ? 'Hermes Agent'
-                : existsSync(join(atomcodePluginDir, 'src', 'mcp-server.mjs'))
-                  ? 'AtomCode'
-                  : '';
+        : existsSync(join(codeartsWorkPluginDir, 'src', 'mcp-server.mjs'))
+          ? 'CodeArts Work'
+          : existsSync(join(workbuddyPluginDir, 'src', 'mcp-server.mjs'))
+            ? 'WorkBuddy'
+            : existsSync(join(dshPluginDir, 'src', 'mcp-server.mjs'))
+              ? 'DSH'
+              : existsSync(join(officeacePluginDir, 'src', 'mcp-server.mjs'))
+                ? 'OfficeAce'
+                : existsSync(join(hermesPluginDir, 'src', 'mcp-server.mjs'))
+                  ? 'Hermes Agent'
+                  : existsSync(join(atomcodePluginDir, 'src', 'mcp-server.mjs'))
+                    ? 'AtomCode'
+                    : '';
   check('MCP server installed', mcpOk, 'Run: npx huaweicloud-devkit install');
 
   if (mcpOk) {
@@ -2573,6 +3088,7 @@ async function cmdDoctor() {
     opencodePluginDir,
     codexPluginDir,
     codeartsPluginDir,
+    codeartsWorkPluginDir,
     workbuddyPluginDir,
     dshPluginDir,
     officeacePluginDir,
@@ -2585,6 +3101,7 @@ async function cmdDoctor() {
     existsSync(join(opencodePluginDir, 'safety', 'policy.json')) ||
     existsSync(join(codexPluginDir, 'safety', 'policy.json')) ||
     existsSync(join(codeartsPluginDir, 'safety', 'policy.json')) ||
+    existsSync(join(codeartsWorkPluginDir, 'safety', 'policy.json')) ||
     existsSync(join(workbuddyPluginDir, 'safety', 'policy.json')) ||
     existsSync(join(dshPluginDir, 'safety', 'policy.json')) ||
     existsSync(join(officeacePluginDir, 'safety', 'policy.json')) ||
@@ -2625,6 +3142,16 @@ async function cmdDoctor() {
       }
     } catch {}
   }
+  const codeartsWorkCfg = codeartsWorkMcpSettingsFile();
+  if (!mcpConfigured && existsSync(codeartsWorkCfg)) {
+    try {
+      const cfg = JSON.parse(readFileSync(codeartsWorkCfg, 'utf8'));
+      if (cfg.mcpServers && cfg.mcpServers['huaweicloud-devkit']) {
+        mcpConfigured = true;
+        mcpCfgTarget = 'CodeArts Work';
+      }
+    } catch {}
+  }
   const workbuddyCfg = workbuddyMcpConfigFile();
   if (!mcpConfigured && existsSync(workbuddyCfg)) {
     try {
@@ -2684,6 +3211,14 @@ async function cmdDoctor() {
     mcpCfgTarget ? `Found in ${mcpCfgTarget} config` : 'Run: npx huaweicloud-devkit install',
   );
 
+  // Hermes MCP Python SDK (only checked when Hermes config is found)
+  if (
+    mcpCfgTarget === 'Hermes Agent' ||
+    (existsSync(hermesConfigFile()) && readFileSync(hermesConfigFile(), 'utf8').includes('mcp_servers'))
+  ) {
+    check('Hermes MCP Python SDK', hermesMcpSdkOk(), 'Run: pip3 install mcp');
+  }
+
   // hcloud CLI
   const hcloudBin = findHcloudBin() || process.env.HCLOUD_BIN || 'hcloud';
   const hcloudCheck = spawnSync(`"${hcloudBin}" version`, [], {
@@ -2725,6 +3260,7 @@ async function cmdDoctor() {
     opencodeSkillsDir(),
     codexDesktopSkillsDir(),
     codeartsSkillsDir(),
+    codeartsWorkSkillsDir(),
     workbuddySkillsDir(),
     dshSkillsDir(),
     officeaceSkillsDir(),
@@ -2784,6 +3320,7 @@ async function cmdDoctor() {
     { path: join(codexDesktopPluginsDir(), '.installed'), name: 'Codex Desktop' },
     { path: join(workbuddyPluginsDir(), '.installed'), name: 'WorkBuddy' },
     { path: join(codeartsPluginsDir(), '.installed'), name: 'CodeArts' },
+    { path: join(codeartsWorkPluginsDir(), '.installed'), name: 'CodeArts Work' },
     { path: join(dshPluginsDir(), '.installed'), name: 'DSH' },
     { path: join(officeacePluginsDir(), '.installed'), name: 'OfficeAce' },
     { path: join(atomcodePluginsDir(), '.installed'), name: 'AtomCode' },
@@ -2856,6 +3393,18 @@ async function cmdUpdate() {
     return;
   }
 
+  if (target === 'codearts-work') {
+    if (!existsSync(join(codeartsWorkPluginsDir(), 'src', 'mcp-server.mjs'))) {
+      console.log('\x1b[33mNot installed. Use "install" command first.\x1b[0m');
+      return;
+    }
+    console.log('[CodeArts Work]');
+    await updateCodeArtsWork();
+    console.log(`\n\x1b[32mUpdate complete.\x1b[0m`);
+    console.log(`\x1b[33mMCP 工具在重启 CodeArts Work 会话后才生效。\x1b[0m`);
+    return;
+  }
+
   if (target === 'workbuddy') {
     if (!existsSync(join(workbuddyPluginsDir(), 'src', 'mcp-server.mjs'))) {
       console.log('\x1b[33mNot installed. Use "install" command first.\x1b[0m');
@@ -2945,6 +3494,11 @@ async function cmdUpdate() {
       await updateCodeArts();
       updatedAny = true;
     }
+    if (existsSync(join(codeartsWorkPluginsDir(), 'src', 'mcp-server.mjs'))) {
+      console.log('\n[CodeArts Work]');
+      await updateCodeArtsWork();
+      updatedAny = true;
+    }
     if (existsSync(join(workbuddyPluginsDir(), 'src', 'mcp-server.mjs'))) {
       console.log('\n[WorkBuddy]');
       await updateWorkBuddy();
@@ -3470,7 +4024,7 @@ async function main() {
     default:
       console.log(BANNER);
       console.log(
-        'Usage: npx huaweicloud-devkit <command> [--target <opencode|codex|codearts|workbuddy|dsh|officeace|hermes|openclaw|atomcode|all>]\n',
+        'Usage: npx huaweicloud-devkit <command> [--target <opencode|codex|codearts|codearts-work|workbuddy|dsh|officeace|hermes|openclaw|atomcode|all>]\n',
       );
       console.log('Commands:');
       console.log('  install      Install skills, MCP server, safety policy');
@@ -3485,12 +4039,13 @@ async function main() {
       console.log('  help         Show this help');
       console.log('\nOptions:');
       console.log(
-        '  --target     Target agent: opencode (default), codex, codearts, workbuddy, dsh, officeace, hermes, openclaw, atomcode, all',
+        '  --target     Target agent: opencode (default), codex, codearts, codearts-work, workbuddy, dsh, officeace, hermes, openclaw, atomcode, all',
       );
       console.log('\nExamples:');
       console.log('  npx huaweicloud-devkit install');
       console.log('  npx huaweicloud-devkit install --target codex');
       console.log('  npx huaweicloud-devkit install --target codearts');
+      console.log('  npx huaweicloud-devkit install --target codearts-work');
       console.log('  npx huaweicloud-devkit install --target workbuddy');
       console.log('  npx huaweicloud-devkit install --target dsh');
       console.log('  npx huaweicloud-devkit install --target officeace');