huaweicloud-devkit 1.1.1-next.1 → 1.1.1-next.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.1-next.1",
+  "version": "1.1.1-next.3",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
   "files": [

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.1-next.1",
+  "version": "1.1.1-next.3",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.1-next.1",
+  "version": "1.1.1-next.3",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.1-next.1",
+  "version": "1.1.1-next.3",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.1-next.1",
+  "version": "1.1.1-next.3",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.1-next.1",
+  "version": "1.1.1-next.3",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.1-next.1",
+  "version": "1.1.1-next.3",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json

@@ -214,7 +214,7 @@
           },
           {
             "field": "text",
-            "regex": "(\\s--force|\\s-f\\s|\\s--recursive|\\s-r\\s|delete_publicip\\s*[=:]\\s*true)"
+            "regex": "(\\s--force|\\s-f\\s|\\s--recursive|\\s-r\\s)"
           }
         ]
       },
@@ -242,6 +242,27 @@
       "message": "This hcloud command will delete, detach, or remove cloud resources. The operation may be irreversible.",
       "remediation": "List the resources to be affected first, confirm with the user, and require explicit approval before executing any destructive operation."
     },
+    {
+      "id": "hwc-destructive-delete-cascade",
+      "title": "Cascading cloud resource deletion",
+      "category": "destructive",
+      "severity": "warn",
+      "stages": ["command"],
+      "match": {
+        "all": [
+          {
+            "field": "text",
+            "regex": "(Delete|BatchDelete|Remove|\\brm\\b|delete)"
+          },
+          {
+            "field": "text",
+            "regex": "(delete_publicip\\s*[=:]\\s*true|delete_volume\\s*[=:]\\s*true)"
+          }
+        ]
+      },
+      "message": "This delete command will also remove associated resources (EIP, volume). Check that these should be deleted together.",
+      "remediation": "Confirm with the user whether to delete the associated resources, or set delete_publicip/delete_volume to false to keep them."
+    },
     {
       "id": "hwc-sandbox-missing-ttl",
       "title": "Sandbox deployment missing cleanup metadata",

package/plugins/huaweicloud-core/skills/huawei-sandbox/references/framework-commands.md

@@ -2,6 +2,26 @@
 
 Maps web frameworks to install, build, serve commands and output directories for sandbox deployment.
 
+## Architecture Compatibility
+
+The sandbox runs **HCE OS on aarch64**. Frameworks that depend on native binaries (e.g., `@swc/core`, `esbuild`, `sharp`, `prisma`) may fail to install or build inside the sandbox since prebuilt binaries target x86_64 by default.
+
+**Recommended strategy**: build locally (x86_64) then upload the dist output to the sandbox for serving.
+
+| Dependency       | Frameworks Affected      | Mitigation                            |
+| ---------------- | ------------------------ | ------------------------------------- |
+| `@swc/core`      | Taro, Next.js 13+        | Pre-build locally, upload dist        |
+| `esbuild`        | Vite, Nuxt, uni-app      | Usually has aarch64 binary; try build |
+| `sharp`          | Gatsby, Next.js images   | Pre-build locally, upload dist        |
+| `prisma`         | Next.js, Nuxt (database) | Use `binaryTargets = ["linux-arm64"]` |
+| `node-gyp` (C++) | node-sass, bcrypt        | `build-essential` is pre-installed    |
+
+**Pre-build workflow**:
+
+1. Build on local machine (x86_64): `npm install && npm run build`
+2. Use `huaweicloud_sandbox_connect` with git config (auto-transfers code) or `huaweicloud_sandbox_upload_project` to upload dist
+3. Deploy with nginx static/SPA template — no native deps needed at runtime
+
 ## SSR Frameworks
 
 | Framework | Install       | Build           | Serve                                                       | Output Dir | Port | Nginx |

package/plugins/huaweicloud-core/skills/huawei-sandbox/references/nginx-templates.md

@@ -64,7 +64,7 @@ NGINX_EOF
 sudo nginx -s reload 2>/dev/null || sudo nginx
 ```
 
-## Template 3: Static Site (no SPA routing)
+## Template 3: Static Site (with clean URL support)
 
 Use for: Hugo, Hexo, plain static HTML
 
@@ -76,6 +76,7 @@ server {
     index index.html;
 
     location / {
+        try_files $uri $uri.html $uri/ =404;
         autoindex off;
     }
 

package/plugins/huaweicloud-core/src/auth/agent-registration.mjs

@@ -82,7 +82,7 @@ function codeartsRegistered() {
 function codeartsWorkRegistered() {
   const path = join(baseHome(), '.codeartswork', 'mcp', 'mcp_settings.json');
   const cfg = readJsonSafe(path);
-  return Boolean(cfg?.mcpServers?.['huaweicloud-devkit']);
+  return Boolean(cfg?.mcp?.['huaweicloud-devkit']);
 }
 
 function workbuddyRegistered() {

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -164,16 +164,16 @@ function readCodeArtsCredentials() {
     try {
       if (existsSync(path)) {
         const config = JSON.parse(readFileSync(path, 'utf8'));
-        const server = config?.mcpServers?.['huaweicloud-devkit'];
-        if (server?.env) {
-          const ak = server.env.HW_ACCESS_KEY;
-          const sk = server.env.HW_SECRET_KEY;
+        const server = config?.mcp?.['huaweicloud-devkit'];
+        if (server?.environment) {
+          const ak = server.environment.HW_ACCESS_KEY;
+          const sk = server.environment.HW_SECRET_KEY;
           if (ak && sk) {
             return {
               ak,
               sk,
-              securityToken: server.env.HW_SECURITY_TOKEN || '',
-              region: server.env.HW_REGION || server.env.HUAWEICLOUD_REGION || '',
+              securityToken: server.environment.HW_SECURITY_TOKEN || '',
+              region: server.environment.HW_REGION || server.environment.HUAWEICLOUD_REGION || '',
             };
           }
         }

package/plugins/huaweicloud-core/src/detect-framework.mjs

@@ -244,7 +244,7 @@ function readVitepressOutDir(projectPath) {
     if (!existsSync(configPath)) continue;
     try {
       const content = readFileSync(configPath, 'utf8');
-      const match = content.match(/outDir\s*:\s*['"]([^'"]+)['"]/);
+      const match = content.match(/outDir\s*:\s*['"`]?([^'"`\s,}]+)['"`]?/);
       if (match) return match[1];
     } catch {}
   }

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -1,4 +1,4 @@
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -51,11 +51,92 @@ function saveLargeOutput(rawStdout) {
   }
 }
 
+function preflightSecurityGroupCheck(normalizedArgs) {
+  const service = normalizedArgs[0];
+  const operation = normalizedArgs[1];
+  if (service !== 'ECS' || !/CreateServers|RunInstances/i.test(operation)) return [];
+
+  const sgIds = [];
+  for (const arg of normalizedArgs) {
+    const m = arg.match(/^--security_group_id(\.\d+)?=(.+)/);
+    if (m) sgIds.push(m[2]);
+  }
+  if (sgIds.length === 0) return [];
+
+  const findings = [];
+  for (const sgId of sgIds) {
+    try {
+      const hcloudBin = process.env.HCLOUD_BIN || 'hcloud';
+      const r = spawnSync(hcloudBin, ['VPC', 'ListSecurityGroupRules', `--security_group_id=${sgId}`], {
+        shell: false,
+        windowsHide: true,
+        stdio: 'pipe',
+        timeout: 20000,
+      });
+      const stdout = (r.stdout || '').toString();
+      if (r.status !== 0 || !stdout.includes('security_group_rules')) continue;
+
+      const bracketIdx = stdout.indexOf('{');
+      const jsonText = bracketIdx >= 0 ? stdout.slice(bracketIdx) : stdout;
+      const data = JSON.parse(jsonText);
+      const rules = data?.security_group_rules || [];
+
+      for (const rule of rules) {
+        const direction = rule.direction || '';
+        const remoteIp = rule.remote_ip_prefix || rule.remote_address_group_id || '';
+        const portMin = String(rule.port_range_min || rule.multiport || '');
+        const portMax = String(rule.port_range_max || rule.multiport || '');
+        const protocol = (rule.protocol || '').toLowerCase();
+        if (direction !== 'ingress') continue;
+        if (remoteIp !== '0.0.0.0/0' && remoteIp !== '::/0') continue;
+        if (protocol === 'icmp' || protocol === 'icmpv6') {
+          findings.push({
+            severity: 'warn',
+            title: `Security group ${sgId}: ICMP open to public`,
+            message: `安全组 ${sgId} 对公网开放了 ICMP (ping)，可能被用于探测。是否继续？`,
+          });
+          continue;
+        }
+        const sensitivePorts = ['22', '3389', '3306', '5432', '6379', '9200', '27017', '8080', '8443'];
+        const port = portMin || portMax;
+        if (port && sensitivePorts.includes(port)) {
+          findings.push({
+            severity: 'deny',
+            title: `Security group ${sgId}: port ${port} open to public`,
+            message: `安全组 ${sgId} 已对公网开放 ${port} 端口（${protocol || 'TCP'}）。确认继续创建 ECS？`,
+          });
+        }
+      }
+    } catch (error) {
+      // Preflight failed silently; don't block the plan
+    }
+  }
+  return findings;
+}
+
+function applyPreflightFindings(classification, sgFindings) {
+  if (!sgFindings || sgFindings.length === 0) return classification;
+  const hasDeny = sgFindings.some((f) => f.severity === 'deny');
+  if (hasDeny) {
+    return {
+      ...classification,
+      decision: 'deny',
+      risk: 'public_exposure',
+      reason: sgFindings[0].message,
+    };
+  }
+  return classification;
+}
+
 export function planHcloudCommand(args, options = {}) {
   const normalizedArgs = Array.isArray(args) ? args.map(String) : [];
   const classification = classifyHcloudArgs(normalizedArgs, options);
   const command = ['hcloud', ...normalizedArgs].map((arg) => quoteShellArg(arg)).join(' ');
   const warnings = planningWarnings(normalizedArgs);
+  const sgFindings = preflightSecurityGroupCheck(normalizedArgs);
+  if (sgFindings.length > 0) {
+    for (const f of sgFindings) warnings.push(f);
+  }
   const paramValidation = validateRequiredParams(normalizedArgs);
   if (paramValidation.missing.length > 0) {
     warnings.push('Missing required parameters: ' + paramValidation.missing.join(', '));
@@ -69,7 +150,8 @@ export function planHcloudCommand(args, options = {}) {
     command: redactOutput(command),
     executableBlock: redactOutput(command),
     warnings,
-    classification,
+    classification: applyPreflightFindings(classification, sgFindings),
+    sgFindings,
     approvalToken: createApprovalToken(normalizedArgs),
     safeToRun: classification.decision === 'allow',
   };

package/plugins/huaweicloud-core/src/sandbox/session-manager.mjs

@@ -802,6 +802,7 @@ fi`;
     index index.html;
 
     location / {
+        try_files $uri $uri.html $uri/ =404;
         autoindex off;
     }
 

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -1272,36 +1272,37 @@ function codeartsStatus() {
 function registerCodeartsWorkMcp() {
   const configPath = codeartsWorkMcpSettingsFile();
   const mcpPath = join(codeartsWorkPluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
-  const env = { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' };
+  const environment = { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' };
   const hcloudBin = findHcloudBin();
-  if (hcloudBin) env.HCLOUD_BIN = hcloudBin.replace(/\\/g, '/');
+  if (hcloudBin) environment.HCLOUD_BIN = hcloudBin.replace(/\\/g, '/');
   let config = {};
   if (existsSync(configPath)) {
     try {
       config = JSON.parse(readFileSync(configPath, 'utf8'));
     } catch {
       console.log(
-        `  \x1b[33m[WARN]\x1b[0m Could not parse ${configPath}. Skipping MCP config write; ensure "mcpServers.huaweicloud-devkit" points to ${mcpPath}.`,
+        `  \x1b[33m[WARN]\x1b[0m Could not parse ${configPath}. Skipping MCP config write; ensure "mcp.huaweicloud-devkit" points to ${mcpPath}.`,
       );
       return;
     }
-    const existing = config.mcpServers?.['huaweicloud-devkit'];
+    const existing = config.mcp?.['huaweicloud-devkit'];
     if (
       existing &&
-      existing.command === 'node' &&
-      Array.isArray(existing.args) &&
-      existing.args[0] === mcpPath &&
+      existing.type === 'local' &&
+      Array.isArray(existing.command) &&
+      existing.command[0] === 'node' &&
+      existing.command[1] === mcpPath &&
       existing.timeout === 300000
     ) {
       console.log(`  MCP config unchanged: ${configPath}`);
       return;
     }
   }
-  config.mcpServers = config.mcpServers || {};
-  config.mcpServers['huaweicloud-devkit'] = {
-    command: 'node',
-    args: [mcpPath],
-    env,
+  config.mcp = config.mcp || {};
+  config.mcp['huaweicloud-devkit'] = {
+    type: 'local',
+    command: ['node', mcpPath],
+    environment,
     enabled: true,
     timeout: 300000,
   };
@@ -1369,9 +1370,9 @@ function uninstallCodeArtsWork() {
     try {
       config = JSON.parse(readFileSync(configPath, 'utf8'));
     } catch {}
-    if (config.mcpServers?.['huaweicloud-devkit']) {
-      delete config.mcpServers['huaweicloud-devkit'];
-      if (Object.keys(config.mcpServers).length === 0) delete config.mcpServers;
+    if (config.mcp?.['huaweicloud-devkit']) {
+      delete config.mcp['huaweicloud-devkit'];
+      if (Object.keys(config.mcp).length === 0) delete config.mcp;
       writeFileSync(configPath, JSON.stringify(config, null, 2));
       console.log(`  Config cleaned: ${configPath}`);
     }
@@ -1399,7 +1400,7 @@ function codeartsWorkStatus() {
     try {
       const config = JSON.parse(readFileSync(codeartsWorkMcpSettingsFile(), 'utf8'));
       console.log(
-        `  MCP config: ${config.mcpServers?.['huaweicloud-devkit'] ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`,
+        `  MCP config: ${config.mcp?.['huaweicloud-devkit'] ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`,
       );
     } catch {
       console.log(`  MCP config: \x1b[31mInvalid\x1b[0m`);
@@ -3146,7 +3147,7 @@ async function cmdDoctor() {
   if (!mcpConfigured && existsSync(codeartsWorkCfg)) {
     try {
       const cfg = JSON.parse(readFileSync(codeartsWorkCfg, 'utf8'));
-      if (cfg.mcpServers && cfg.mcpServers['huaweicloud-devkit']) {
+      if (cfg.mcp && cfg.mcp['huaweicloud-devkit']) {
         mcpConfigured = true;
         mcpCfgTarget = 'CodeArts Work';
       }

package/plugins/huaweicloud-core/src/tools.mjs

@@ -734,7 +734,8 @@ export const TOOL_DEFINITIONS = [
   },
   {
     name: 'huaweicloud_voucher_status',
-    description: '查询代金券领取状态。',
+    description:
+      '查询代金券领取状态。用户首次使用、开始会话或询问插件能力时，应主动调用本工具检查：未领取（claimed=false）则主动提示可领取一张代金券；已领取（claimed=true）则不提示、不打扰。',
     inputSchema: {
       type: 'object',
       properties: {
@@ -1054,6 +1055,9 @@ export async function callTool(name, args = {}) {
         try {
           await execOneShot(devStageId, 'devbridge delete-all 2>/dev/null || true', 'root', 15000);
         } catch {}
+        try {
+          await execWithSession(devStageId, 'export PATH=$HOME/.huawei/bin${PATH:+:$PATH}', 'root', 10000);
+        } catch {}
         await transferGitRepo(args, devStageId, connectResult);
       }
       return connectResult;
@@ -1326,7 +1330,14 @@ async function runApprovedCommand(args = {}) {
   }
   const providedArgs = Array.isArray(args.args) ? args.args.map(String) : [];
   if (JSON.stringify(storedArgs) !== JSON.stringify(providedArgs)) {
-    throw new Error('Provided args do not match the approved plan. Use the exact args from the plan.');
+    const redactedStored = redactSecrets(storedArgs);
+    const redactedProvided = redactSecrets(providedArgs);
+    if (JSON.stringify(redactedStored) !== JSON.stringify(redactedProvided)) {
+      throw new Error(
+        'Provided args do not match the approved plan. Use the exact args from the plan. ' +
+          'If the plan shows <redacted> for passwords or secrets, replace <redacted> with the actual values in approvedCommand.',
+      );
+    }
   }
   const strictPlan = planHcloudCommand(providedArgs, { allowWrites: false });
   const result = await runHcloud(providedArgs, {