huaweicloud-devkit 1.1.0-next.8 → 1.1.0

package/plugins/huaweicloud-core/src/tools.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from 'node:child_process';
 
 import { evaluateArtifacts, evaluateCommandRisk, evaluateDeployPlan } from './risk-rule-engine.mjs';
 import { classifyTextCommand, redactSecrets } from './safety-policy.mjs';
-import { planHcloudCommand, runHcloud } from './hcloud-cli.mjs';
+import { planHcloudCommand, runHcloud, consumeApprovalToken } from './hcloud-cli.mjs';
 import { searchMarketplace } from './search-market.mjs';
 import { getServiceIcon } from './icon-library.mjs';
 import { detectFramework } from './detect-framework.mjs';
@@ -16,6 +16,8 @@ import {
   closeSession,
   uploadFileWithSession,
   uploadProjectWithSession,
+  deployNginx,
+  deployCheck,
   getCurrentWorkspaceId,
   setWorkspaceId,
 } from './sandbox/session-manager.mjs';
@@ -27,6 +29,7 @@ import {
   hdkitVoucherStatus,
   hdkitVoucherClaim,
 } from './sandbox/hdkitservice-api.mjs';
+import { getCredentials } from './sandbox/hwlink-api.mjs';
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
 import {
   readGlobalCredentials,
@@ -45,6 +48,10 @@ function codeartsSkillsDir() {
   const home = homedir();
   return join(home, '.codeartsdoer', 'skills');
 }
+function codeartsWorkSkillsDir() {
+  const home = homedir();
+  return join(home, '.codeartswork', 'skills');
+}
 function workbuddySkillsDir() {
   const home = homedir();
   return join(home, '.workbuddy', 'skills');
@@ -99,6 +106,15 @@ function hermesSkillsDir() {
   return join(home, '.hermes', 'skills');
 }
 
+function atomcodeSkillsDir() {
+  const home = process.env.ATOMCODE_HOME || homedir();
+  return join(home, '.atomcode', 'skills');
+}
+
+function codexDesktopSkillsDir() {
+  return join(homedir(), '.agents', 'skills');
+}
+
 export function listSkillDirs(root) {
   if (!existsSync(root)) return [];
   try {
@@ -123,10 +139,13 @@ function resolveSkillsRoot() {
       SKILLS_ROOT_DEV,
       dshSkillsDir(),
       codeartsSkillsDir(),
+      codeartsWorkSkillsDir(),
       opencodeSkillsDir(),
       workbuddySkillsDir(),
       officeaceSkillsRoot(),
       hermesSkillsDir(),
+      atomcodeSkillsDir(),
+      codexDesktopSkillsDir(),
     ]) || SKILLS_ROOT_DEV
   );
 }
@@ -211,16 +230,16 @@ export const TOOL_DEFINITIONS = [
       'Run a write-capable hcloud command only after the exact command has been shown and explicitly approved by the user.',
     inputSchema: {
       type: 'object',
-      required: ['args', 'approvedCommand', 'approvedByUser'],
+      required: ['args', 'approvalToken', 'approvedByUser'],
       properties: {
         args: {
           type: 'array',
           items: { type: 'string' },
           description: 'hcloud arguments, excluding the hcloud executable.',
         },
-        approvedCommand: {
+        approvalToken: {
           type: 'string',
-          description: 'The exact command string previously shown to the user.',
+          description: 'The approvalToken returned by huaweicloud_plan_cli_command.',
         },
         approvedByUser: {
           type: 'boolean',
@@ -446,7 +465,7 @@ export const TOOL_DEFINITIONS = [
         target: {
           type: 'string',
           description:
-            'Agent target to check: opencode, codex, codex-desktop, codearts, workbuddy, dsh, officeace, hermes, openclaw, atomcode, or all (default).',
+            'Agent target to check: opencode, codex, codex-desktop, codearts, codearts-work, workbuddy, dsh, officeace, hermes, openclaw, atomcode, or all (default).',
         },
       },
     },
@@ -461,7 +480,7 @@ export const TOOL_DEFINITIONS = [
         target: {
           type: 'string',
           description:
-            'Agent target to report after sync: opencode, codex, codex-desktop, codearts, workbuddy, dsh, officeace, hermes, or all (default).',
+            'Agent target to report after sync: opencode, codex, codex-desktop, codearts, codearts-work, workbuddy, dsh, officeace, hermes, or all (default).',
         },
       },
     },
@@ -549,7 +568,7 @@ export const TOOL_DEFINITIONS = [
             'Workspace ID from huaweicloud_sandbox_connect return value. Required - must be passed explicitly when HW_WORKSPACE_ID is not set.',
         },
         username: { type: 'string', description: 'Login username (default: root)' },
-        timeout_ms: { type: 'number', description: 'Per-command execution timeout in milliseconds (default: 120000)' },
+        timeout_ms: { type: 'number', description: 'Execution timeout in milliseconds (default: 60000)' },
       },
     },
   },
@@ -586,6 +605,72 @@ export const TOOL_DEFINITIONS = [
       },
     },
   },
+  {
+    name: 'huaweicloud_sandbox_deploy_nginx',
+    description:
+      'Deploy an nginx configuration on the sandbox and reload. Takes nginxType, port, project, outputDir from framework detection and writes the correct template (SPA try_files, SSR reverse proxy, or static). Also fixes directory traverse permissions on the project path. Use this instead of manually constructing nginx config — it handles permissions, template selection, and reload in one call.',
+    inputSchema: {
+      type: 'object',
+      required: ['nginx_type', 'port', 'project', 'output_dir'],
+      properties: {
+        nginx_type: {
+          type: 'string',
+          description:
+            'Nginx config type from framework detection: spa (try_files fallback for SPA/SSG/cross-platform), proxy (reverse proxy for SSR), or static (plain root for Hugo/Hexo).',
+          enum: ['spa', 'proxy', 'static'],
+        },
+        port: { type: 'number', description: 'Listen port (from framework detection).' },
+        project: { type: 'string', description: 'Project directory name under /workspace, e.g. movie-ticket.' },
+        output_dir: {
+          type: 'string',
+          description: 'Build output directory relative to /workspace/<project>, e.g. dist/build/h5.',
+        },
+        node_port: { type: 'number', description: 'Node.js app port for SSR (required when nginx_type=proxy).' },
+        public_port: { type: 'number', description: 'Public listen port for SSR proxy (optional, defaults to port).' },
+        config_name: {
+          type: 'string',
+          description:
+            'Config file name (without .conf suffix). Defaults to the project name, ensuring each project gets its own config. Override with distinct names (e.g. admin, docs) for sub-app deployments.',
+        },
+        workspace_id: {
+          type: 'string',
+          description:
+            'Workspace ID from huaweicloud_sandbox_connect return value. Required - must be passed explicitly when HW_WORKSPACE_ID is not set.',
+        },
+        username: { type: 'string', description: 'Login username (default: root)' },
+        timeout_ms: { type: 'number', description: 'Execution timeout in milliseconds (default: 30000)' },
+      },
+    },
+  },
+  {
+    name: 'huaweicloud_sandbox_deploy_check',
+    description:
+      'Run a deployment completeness check on the sandbox. Verifies nginx is serving, output directory exists, DevBridge tunnel is active and accessible, and QR code exists (cross-platform). Returns a score and nextStep to fix any missing items. Call this at the end of a deployment workflow to confirm everything is working before reporting success.',
+    inputSchema: {
+      type: 'object',
+      required: ['port', 'project', 'output_dir'],
+      properties: {
+        port: { type: 'number', description: 'App listen port (from framework detection).' },
+        project: { type: 'string', description: 'Project directory name under /workspace.' },
+        output_dir: {
+          type: 'string',
+          description: 'Build output directory relative to /workspace/<project>, e.g. dist/build/h5.',
+        },
+        framework_type: {
+          type: 'string',
+          description: 'Framework type from detect_framework. Set to cross-platform for QR code check.',
+          enum: ['spa', 'ssr', 'ssg', 'cross-platform', 'monorepo', 'static'],
+        },
+        workspace_id: {
+          type: 'string',
+          description:
+            'Workspace ID from huaweicloud_sandbox_connect return value. Required - must be passed explicitly when HW_WORKSPACE_ID is not set.',
+        },
+        username: { type: 'string', description: 'Login username (default: root)' },
+        timeout_ms: { type: 'number', description: 'Execution timeout in milliseconds (default: 30000)' },
+      },
+    },
+  },
   {
     name: 'huaweicloud_sandbox_check_user',
     description:
@@ -824,6 +909,59 @@ export async function callTool(name, args = {}) {
         },
       );
     }
+    case 'huaweicloud_sandbox_deploy_nginx': {
+      if (!args.nginx_type || !args.port || !args.project || !args.output_dir) {
+        throw new Error('nginx_type, port, project, and output_dir are required.');
+      }
+      const sandboxWsId7 = args.workspace_id || getCurrentWorkspaceId();
+      if (!sandboxWsId7) {
+        throw new Error(
+          'workspace_id is required. No sandbox connected — call huaweicloud_sandbox_connect first, ' +
+            'or set HW_WORKSPACE_ID environment variable before starting the agent.',
+        );
+      }
+      const sandboxUser7 = args.username || 'root';
+      const sandboxTimeout7 = args.timeout_ms || 60000;
+      return await deployNginx(
+        sandboxWsId7,
+        {
+          nginxType: args.nginx_type,
+          port: args.port,
+          project: args.project,
+          outputDir: args.output_dir,
+          nodePort: args.node_port,
+          publicPort: args.public_port,
+          configName: args.config_name,
+        },
+        sandboxUser7,
+        sandboxTimeout7,
+      );
+    }
+    case 'huaweicloud_sandbox_deploy_check': {
+      if (!args.port || !args.project || !args.output_dir) {
+        throw new Error('port, project, and output_dir are required.');
+      }
+      const sandboxWsId8 = args.workspace_id || getCurrentWorkspaceId();
+      if (!sandboxWsId8) {
+        throw new Error(
+          'workspace_id is required. No sandbox connected — call huaweicloud_sandbox_connect first, ' +
+            'or set HW_WORKSPACE_ID environment variable before starting the agent.',
+        );
+      }
+      const sandboxUser8 = args.username || 'root';
+      const sandboxTimeout8 = args.timeout_ms || 30000;
+      return await deployCheck(
+        sandboxWsId8,
+        {
+          port: args.port,
+          project: args.project,
+          outputDir: args.output_dir,
+          frameworkType: args.framework_type,
+        },
+        sandboxUser8,
+        sandboxTimeout8,
+      );
+    }
     case 'huaweicloud_sandbox_check_user':
       return await hdkitCheckUser();
     case 'huaweicloud_sandbox_sign_agreement':
@@ -833,11 +971,38 @@ export async function callTool(name, args = {}) {
       const devStageId = connectResult?.dev_stage_id || connectResult?.devStageId;
       if (devStageId) {
         setWorkspaceId(devStageId);
+        try {
+          await execOneShot(devStageId, 'devbridge delete-all 2>/dev/null || true', 'root', 15000);
+        } catch {}
       }
       return connectResult;
     }
-    case 'huaweicloud_sandbox_credentials':
-      return await hdkitCredentials(args.session_id, args.dev_stage_id, args.enable_sts !== false);
+    case 'huaweicloud_sandbox_credentials': {
+      const devStageId = args.dev_stage_id || getCurrentWorkspaceId();
+      const credResult = await hdkitCredentials(args.session_id, devStageId, args.enable_sts !== false);
+      const sandboxWsIdCred = args.dev_stage_id || getCurrentWorkspaceId();
+      if (sandboxWsIdCred) {
+        try {
+          const { ak, sk, securitytoken } = getCredentials();
+          const credsScript = [
+            `export HW_ACCESS_KEY='${ak}'`,
+            `export HW_SECRET_KEY='${sk}'`,
+            securitytoken ? `export HW_SECURITY_TOKEN='${securitytoken}'` : '',
+            securitytoken ? `export X_HW_SECURITY_TOKEN='${securitytoken}'` : '',
+          ]
+            .filter(Boolean)
+            .join('\n');
+          const credsFile = '/tmp/hw_creds.sh';
+          await execOneShot(
+            sandboxWsIdCred,
+            `cat > ${credsFile} << 'HWCREDS_EOF'\n${credsScript}\nHWCREDS_EOF\nchmod 600 ${credsFile}`,
+            'root',
+            15000,
+          );
+        } catch {}
+      }
+      return credResult;
+    }
     case 'huaweicloud_voucher_status':
       return await hdkitVoucherStatus(args.domain_id);
     case 'huaweicloud_voucher_claim':
@@ -1072,12 +1237,17 @@ async function runApprovedCommand(args = {}) {
   if (args.approvedByUser !== true) {
     throw new Error('approvedByUser must be true after explicit user approval for this exact command.');
   }
-  const strictPlan = planHcloudCommand(args.args || [], { allowWrites: false });
-  const plan = planHcloudCommand(args.args || [], { allowWrites: true });
-  if (String(args.approvedCommand || '') !== plan.command) {
-    throw new Error('approvedCommand must exactly match the planned hcloud command.');
+  const token = String(args.approvalToken || '');
+  const storedArgs = consumeApprovalToken(token);
+  if (!storedArgs || storedArgs.length === 0) {
+    throw new Error('Invalid or expired approval token. Please re-plan the command.');
+  }
+  const providedArgs = Array.isArray(args.args) ? args.args.map(String) : [];
+  if (JSON.stringify(storedArgs) !== JSON.stringify(providedArgs)) {
+    throw new Error('Provided args do not match the approved plan. Use the exact args from the plan.');
   }
-  const result = await runHcloud(args.args || [], {
+  const strictPlan = planHcloudCommand(providedArgs, { allowWrites: false });
+  const result = await runHcloud(providedArgs, {
     allowWrites: true,
     timeoutMs: args.timeoutMs,
     maxRetries: args.maxRetries,