huaweicloud-devkit 1.1.0 → 1.1.1-next.0

package/README.zh-CN.md

@@ -3,6 +3,7 @@
 [![参与讨论](https://img.shields.io/badge/参与讨论-Join%20the%20discussion-blue)](https://github.com/huaweicloud/huaweicloud-devkit/discussions)
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
+[![Beta](https://img.shields.io/badge/beta-v1.1.0-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 
 **中文 | [English](README.md)**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.0",
+  "version": "1.1.1-next.0",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
   "files": [

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.0",
+  "version": "1.1.1-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.0",
+  "version": "1.1.1-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.0",
+  "version": "1.1.1-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.0",
+  "version": "1.1.1-next.0",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.0",
+  "version": "1.1.1-next.0",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.0",
+  "version": "1.1.1-next.0",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md

@@ -28,13 +28,14 @@ If these do not exist, load the `huawei-vpc` skill first and create them before
 
 ## Critical Warnings
 
-| Trap                          | Why                                                                         |
-| ----------------------------- | --------------------------------------------------------------------------- |
-| Flavor not in region          | Not all flavors available everywhere. Check with ECS ListFlavors first      |
-| Security group denies all     | New SGs deny ALL inbound. Must explicitly add rules                         |
-| EIP bills when idle           | Unattached EIP still incurs charges                                         |
-| Stopped instance still bills  | Pay-per-use instances bill when stopped (unless shutdown-no-billing flavor) |
-| Disk survives instance delete | Deleting instance does NOT delete system disk by default                    |
+| Trap                            | Why                                                                                                                                              |
+| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Flavor not in region            | Not all flavors available everywhere. Check with ECS ListFlavors first                                                                           |
+| Security group denies all       | New SGs deny ALL inbound. Must explicitly add rules                                                                                              |
+| Reusing existing security group | Existing SGs may have 0.0.0.0/0 rules. Before referencing, run hcloud VPC ListSecurityGroupRules --security_group_id=<id> to audit inbound rules |
+| EIP bills when idle             | Unattached EIP still incurs charges                                                                                                              |
+| Stopped instance still bills    | Pay-per-use instances bill when stopped (unless shutdown-no-billing flavor)                                                                      |
+| Disk survives instance delete   | Deleting instance does NOT delete system disk by default                                                                                         |
 
 ## Flavor Selection Guide
 

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -95,7 +95,7 @@ Setup is a **plugin-side preflight** — the developer should be asked a questio
 2. **Real-name verification only** (`HDKIT_NOT_REALNAME`): tell the developer once, "Huawei Cloud requires real-name verification before using the sandbox — please complete it in the Huawei Cloud console (实名认证)." and stop — do not retry `connect` in a loop
 3. **Sign agreement only** (`HDKIT_NOT_AGREEMENT`): **STOP and do NOT sign on your own.** Ask the developer: "Huawei Cloud sandbox requires signing the latest developer service agreement. May I sign it for you?" Then **wait for the developer to explicitly agree** (e.g. "签署" / "确认" / "sign it"). Only after explicit consent call `huaweicloud_sandbox_sign_agreement` and return its result (`signed`/`signedCount`) to the developer. **Never sign a legal agreement on the developer's behalf without their explicit, unambiguous consent.** Do not expose the underlying sandbox/DevBridge service as a separate entity the developer must understand or sign up for
 4. **Both missing** (`HDKIT_NOT_REALNAME_AND_AGREEMENT`): present **both** requirements together in one message — the real-name verification steps (console, step 2) **and** the agreement-signing request (step 3, wait for explicit consent) — so the developer can complete both at once
-5. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`. The `source` parameter identifies the calling agent (valid values: `CLI`, `WEB`, `VSCODE`, `WEBVNC`, `WEBPTY`, `WEBIDE`, `CURSOR`, etc. — case-sensitive, all uppercase). The `git` parameter (with `repo_url`, `repo_name`, `target_path`) is accepted but does NOT auto-clone the repository — always clone manually.
+5. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`. The `source` parameter identifies the calling agent (valid values: `CLI`, `WEB`, `VSCODE`, `WEBVNC`, `WEBPTY`, `WEBIDE`, `CURSOR`, etc. — case-sensitive, all uppercase). When the `git` parameter is provided (with `repo_url`, `target_path`, optional `repo_branch`), code is automatically transferred to the sandbox: local `git clone` followed by `uploadProject` (falls back to direct sandbox clone when local git is unavailable). Check `_repoStatus` in the response: `uploaded_from_local`, `cloned_in_sandbox`, or `already_exists` (reconnect).
 6. **Cleanup previous deployments** (after first connect to a sandbox): nginx configs, DevBridge tunnels, and stale web processes from previous deployments can cause port conflicts and quota errors. Run cleanup immediately after connect:
 
    ```bash

package/plugins/huaweicloud-core/src/sandbox/session-manager.mjs

@@ -827,7 +827,8 @@ fi`;
     `chmod -R o+rX "$REAL_PROJECT" 2>/dev/null || true`,
     `find "$REAL_PROJECT" -type d -exec chmod o+x {} \\; 2>/dev/null || true`,
     `find "$REAL_PROJECT" -type f -path "*/node_modules/.bin/*" -exec chmod +x {} \\; 2>/dev/null || true`,
-    `if pgrep -x nginx > /dev/null 2>&1; then sudo nginx -s reload 2>/dev/null || { sudo killall -9 nginx 2>/dev/null; sleep 1; sudo nginx; }; else sudo nginx; fi`,
+    `if pgrep -x nginx > /dev/null 2>&1; then sudo killall -9 nginx 2>/dev/null; sleep 1; fi
+    sudo nginx`,
   ].join('\n');
 
   const result = await execOneShot(workspaceId, cmd, username, timeoutMs);

package/plugins/huaweicloud-core/src/tools.mjs

@@ -1,8 +1,9 @@
-import { readFileSync, readdirSync, existsSync, writeFileSync } from 'node:fs';
-import { join, dirname } from 'node:path';
+import { readFileSync, readdirSync, existsSync, writeFileSync, rmSync, mkdirSync } from 'node:fs';
+import { join, dirname, basename } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { homedir } from 'node:os';
-import { spawnSync } from 'node:child_process';
+import { homedir, tmpdir } from 'node:os';
+import { spawnSync, execFile } from 'node:child_process';
+import { promisify } from 'node:util';
 
 import { evaluateArtifacts, evaluateCommandRisk, evaluateDeployPlan } from './risk-rule-engine.mjs';
 import { classifyTextCommand, redactSecrets } from './safety-policy.mjs';
@@ -759,6 +760,85 @@ export const TOOL_DEFINITIONS = [
   },
 ];
 
+const execFilePromise = promisify(execFile);
+
+async function isGitAvailable() {
+  try {
+    await execFilePromise('git', ['--version'], { timeout: 5000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function gitCloneToLocal(repoUrl, branch, targetBasename) {
+  const tempRoot = join(tmpdir(), `hw-sandbox-git-${Date.now()}`);
+  const cloneDir = join(tempRoot, targetBasename);
+  mkdirSync(tempRoot, { recursive: true });
+  const args = ['clone', '--depth', '1'];
+  if (branch) args.push('-b', branch);
+  args.push(repoUrl, cloneDir);
+  await execFilePromise('git', args, { timeout: 120000 });
+  return { cloneDir, tempRoot };
+}
+
+async function transferGitRepo(args, devStageId, connectResult) {
+  const git = args.git;
+  if (!git?.repo_url || !git?.target_path) return;
+
+  const { repo_url, repo_branch, target_path } = git;
+
+  try {
+    const existsCheck = await execOneShot(
+      devStageId,
+      `test -d "${target_path}/.git" && echo "EXISTS" || echo "NOT_EXISTS"`,
+      'root',
+      10000,
+    );
+    if (String(existsCheck.stdout || '').includes('EXISTS')) {
+      connectResult._repoStatus = 'already_exists';
+      return;
+    }
+  } catch {
+    /* 检查失败继续 */
+  }
+
+  const hasGit = await isGitAvailable();
+  if (hasGit) {
+    let tempRoot = null;
+    try {
+      const targetName = basename(target_path);
+      const { cloneDir, tempRoot: root } = await gitCloneToLocal(repo_url, repo_branch, targetName);
+      tempRoot = root;
+      await uploadProjectWithSession(devStageId, cloneDir, dirname(target_path), 'root', 300000, {
+        extract: true,
+        exclude: ['.git', 'node_modules'],
+      });
+      connectResult._repoStatus = 'uploaded_from_local';
+      return;
+    } catch {
+      /* 本地方式失败，进入兜底 */
+    } finally {
+      if (tempRoot) {
+        try {
+          rmSync(tempRoot, { recursive: true, force: true });
+        } catch {
+          /* 清理失败忽略 */
+        }
+      }
+    }
+  }
+
+  const branchFlag = repo_branch ? `-b ${repo_branch}` : '';
+  await execOneShot(
+    devStageId,
+    `mkdir -p $(dirname "${target_path}") && git clone --depth 1 ${branchFlag} "${repo_url}" "${target_path}"`,
+    'root',
+    120000,
+  );
+  connectResult._repoStatus = 'cloned_in_sandbox';
+}
+
 export async function callTool(name, args = {}) {
   switch (name) {
     case 'huaweicloud_check_cli':
@@ -974,6 +1054,7 @@ export async function callTool(name, args = {}) {
         try {
           await execOneShot(devStageId, 'devbridge delete-all 2>/dev/null || true', 'root', 15000);
         } catch {}
+        await transferGitRepo(args, devStageId, connectResult);
       }
       return connectResult;
     }
@@ -999,6 +1080,7 @@ export async function callTool(name, args = {}) {
             'root',
             15000,
           );
+          await execWithSession(sandboxWsIdCred, `source ${credsFile} && echo "CREDS_SOURCED"`, 'root', 15000);
         } catch {}
       }
       return credResult;