huaweicloud-devkit 1.1.1-next.14 → 1.1.1-next.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.1-next.14",
+  "version": "1.1.1-next.15",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
   "files": [

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.1-next.14",
+  "version": "1.1.1-next.15",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.1-next.14",
+  "version": "1.1.1-next.15",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.1-next.14",
+  "version": "1.1.1-next.15",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.1-next.14",
+  "version": "1.1.1-next.15",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.1-next.14",
+  "version": "1.1.1-next.15",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.1-next.14",
+  "version": "1.1.1-next.15",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -70,9 +70,8 @@ Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `
 **NEVER let AK/SK enter shell history. This is the #1 credential leak vector.**
 
 - Create AK/SK in the Huawei Cloud console under `My Credentials -> Access Keys`.
-- **Unified credentials** (preferred): `npx huaweicloud-devkit auth init`. This is the DevKit's primary auth path; `hcloud configure init` only covers KooCLI.
-- **KooCLI only, interactive** (SAFE): `hcloud configure init` — prompts for AK/SK via terminal input. Values do NOT enter shell history.
-- **Non-interactive** (DANGEROUS — AK/SK in shell history): `hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>`. Only use in ephemeral CI/CD shells. User must execute outside agent chat.
+- **Configure credentials ONLY via `npx huaweicloud-devkit auth init`** — the single entry point. It writes the unified `~/.config/huaweicloud/credentials.json` and mirrors it to KooCLI (`~/.hcloud/config.json`) and OBS (`~/.obsutilconfig`), without AK/SK entering shell history.
+- Never configure KooCLI on its own: do not ask the user to run `hcloud configure init` or `hcloud configure set --cli-access-key=... --cli-secret-key=... --cli-region=...` (AK/SK would leak into shell history). If KooCLI lacks credentials, tell the user to run `npx huaweicloud-devkit auth init`.
 - If MCP is available, use `huaweicloud_show_profile_redacted` to check status without ever seeing credentials.
 - Never paste AK/SK, passwords, tokens, or profile files into the agent conversation.
 - KooCLI stores credentials in `~/.hcloud/config.json`, NOT environment variables. `HCLOUD_ACCESS_KEY` / `HCLOUD_SECRET_KEY` / `HCLOUD_REGION` env vars are NOT read by KooCLI 7.x.
@@ -125,15 +124,16 @@ hcloud <Service> <Op> --cli-debug=true
 
 Credentials are resolved in this order (highest priority first):
 
-| Priority | Source                   | Mechanism                                                                                              | Persistence                     |
-| -------- | ------------------------ | ------------------------------------------------------------------------------------------------------ | ------------------------------- |
-| 1        | Runtime credentials      | `huaweicloud_auth_init` tool                                                                           | Memory (cleared on MCP restart) |
-| 2        | Environment variables    | `HW_ACCESS_KEY` / `HW_SECRET_KEY`                                                                      | MCP process lifetime            |
-| 3        | CodeArts / CodeArts Work | `.codeartsdoer/mcp/mcp_settings.json` (project → user) or `.codeartswork/mcp/mcp_settings.json` (user) | File                            |
-| 4        | Global config file       | `~/.config/huaweicloud/credentials.json`                                                               | Permanent                       |
-| 5        | KooCLI profile           | `~/.hcloud/config.json` (KooCLI only)                                                                  | Permanent                       |
+| Priority | Source                                          | When active                                                                                | Persistence                 |
+| -------- | ----------------------------------------------- | ------------------------------------------------------------------------------------------ | --------------------------- |
+| 1        | Runtime (session) credentials                   | `huaweicloud_auth_init` / `huaweicloud_auth_switch action=temporary` set them              | Memory (MCP restart clears) |
+| 2        | S1 global file with `configuredBySession: true` | set by `huaweicloud_auth_switch action=persist` (session-configured account wins over env) | Permanent (S1)              |
+| 3        | Environment variables                           | `HW_ACCESS_KEY` / `HW_SECRET_KEY` (platform/devspace-injected default account)             | MCP process lifetime        |
+| 4        | CodeArts / CodeArts Work                        | `.codeartsdoer/mcp/mcp_settings.json` / `.codeartswork/mcp/mcp_settings.json`              | File                        |
+| 5        | S1 global file (no session flag)                | `auth init` permanent credentials                                                          | Permanent (S1)              |
+| 6        | KooCLI profile                                  | `~/.hcloud/config.json` (KooCLI commands only)                                             | Permanent                   |
 
-When switching accounts within the same Agent session, use `huaweicloud_auth_init` to set runtime credentials. This overrides all other sources for the current MCP process.
+When switching accounts within the same Agent session, use `huaweicloud_auth_init` to set runtime credentials (overrides all sources for the current MCP process), or `huaweicloud_auth_switch action=persist`, which writes S1 with `configuredBySession: true` so the session-configured account outranks `HW_ACCESS_KEY` / `HW_SECRET_KEY`. Note: running `auth init` clears the configuredBySession flag.
 
 ## Preferred Toolkit Tools
 

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -1,4 +1,13 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, readlinkSync, statSync, writeFileSync } from 'node:fs';
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readlinkSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 
@@ -55,12 +64,21 @@ export function writeGlobalCredentials(credentials = {}) {
     sk: String(credentials.sk || ''),
     securityToken: String(credentials.securityToken || ''),
     region: String(credentials.region || ''),
+    ...(credentials.configuredBySession === undefined
+      ? {}
+      : { configuredBySession: Boolean(credentials.configuredBySession) }),
   };
   writeFileSync(path, JSON.stringify(payload, null, 2), { encoding: 'utf8', mode: 0o600 });
   ensurePrivateMode(path);
   return path;
 }
 
+export function setConfiguredBySession(flag) {
+  const stored = readGlobalCredentials();
+  const next = { ...(stored || {}), configuredBySession: Boolean(flag) };
+  writeGlobalCredentials(next);
+}
+
 export function writeObsConfig(credentials = {}) {
   const region = String(credentials.region || '');
   const ak = String(credentials.ak || '');
@@ -99,6 +117,16 @@ export function resolveCredentials(options = {}) {
     if (!region && stored.region) region = stored.region;
   }
 
+  // R9: S1 written by `auth_switch persist` (configuredBySession) is the session's
+  // source of truth and wins over env-injected defaults. Plain S1 (`auth init`)
+  // still yields to env so devspace-style env injection keeps working.
+  if (stored && stored.configuredBySession === true && stored.ak && stored.sk) {
+    ak = stored.ak;
+    sk = stored.sk;
+    if (!securityToken) securityToken = stored.securityToken || '';
+    if (!region) region = stored.region || '';
+  }
+
   // Sandbox/platform-injected temporary STS credentials (env vars carrying a
   // security token) must not shadow the user's explicit permanent credentials
   // from `auth init`. Prefer the stored file when both exist.
@@ -147,7 +175,7 @@ function isCodeArtsContext() {
   );
 }
 
-function readCodeArtsCredentials() {
+export function readCodeArtsCredentials() {
   const parentCwd = getParentCwd();
   const searchDirs = [process.env.CODEARTS_PROJECT_DIR, parentCwd, process.cwd(), homedir()];
 
@@ -213,6 +241,10 @@ export function clearRuntimeCredentials() {
   runtimeCredentials = null;
 }
 
+export function hasRuntimeCredentials() {
+  return runtimeCredentials !== null;
+}
+
 export function resolveCredentialsWithRuntime(options = {}) {
   if (runtimeCredentials) {
     return {
@@ -225,3 +257,51 @@ export function resolveCredentialsWithRuntime(options = {}) {
 
   return resolveCredentials(options);
 }
+
+export function lastSyncPath() {
+  return join(baseHome(), '.config', 'huaweicloud', '.last_sync');
+}
+
+export function readLastSync() {
+  const path = lastSyncPath();
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export function writeLastSync() {
+  const path = lastSyncPath();
+  mkdirSync(dirname(path), { recursive: true });
+  const payload = { ts: Date.now() };
+  writeFileSync(path, JSON.stringify(payload), { encoding: 'utf8', mode: 0o600 });
+  ensurePrivateMode(path);
+}
+
+export function backupGlobalCredentials() {
+  const path = globalCredentialsPath();
+  if (!existsSync(path)) return null;
+  const bakPath = `${path}.bak`;
+  try {
+    copyFileSync(path, bakPath);
+    ensurePrivateMode(bakPath);
+    return bakPath;
+  } catch {
+    return null;
+  }
+}
+
+export function restoreGlobalCredentialsBackup() {
+  const path = globalCredentialsPath();
+  const bakPath = `${path}.bak`;
+  if (!existsSync(bakPath)) return false;
+  try {
+    copyFileSync(bakPath, path);
+    ensurePrivateMode(path);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/plugins/huaweicloud-core/src/auth/reconcile.mjs

@@ -0,0 +1,174 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { spawnSync } from 'node:child_process';
+
+import {
+  hasRuntimeCredentials,
+  obsConfigPath,
+  readGlobalCredentials,
+  readLastSync,
+  resolveCredentialsWithRuntime,
+} from './credentials.mjs';
+import { redactSecrets } from '../safety-policy.mjs';
+
+export { hasRuntimeCredentials };
+
+function baseHome() {
+  return process.env.HUAWEICLOUD_HOME || homedir();
+}
+
+export function fingerprint(ak, sk) {
+  if (!ak || !sk) return '';
+  return createHash('sha256').update(`${ak}${sk}`).digest('hex').slice(0, 8);
+}
+
+export function isManualModified(path) {
+  if (!existsSync(path)) return false;
+  const lastSync = readLastSync();
+  try {
+    const fts = statSync(path).mtimeMs;
+    if (!lastSync) return true; // no marker → treat as manual
+    return fts > lastSync.ts;
+  } catch {
+    return false;
+  }
+}
+
+export function readKooCliProfiles() {
+  const configPath = join(baseHome(), '.hcloud', 'config.json');
+  if (!existsSync(configPath)) return { error: 'KooCLI config not found' };
+  try {
+    const raw = JSON.parse(readFileSync(configPath, 'utf8'));
+    const current = String(raw.current || 'default');
+    const profiles = Array.isArray(raw.profiles) ? raw.profiles : [];
+    const mtimeMs = statSync(configPath).mtimeMs;
+    return {
+      current,
+      mtimeMs,
+      profiles: profiles.map((p) => ({
+        name: String(p.name || ''),
+        fingerprint: fingerprint(p.accessKeyId, p.secretAccessKey),
+        accessKeyId: p.accessKeyId || '',
+      })),
+    };
+  } catch {
+    return { error: 'KooCLI config parse failed' };
+  }
+}
+
+export function resolveManagedProfile() {
+  const res = readKooCliProfiles();
+  if (res.error) return null;
+  return res.current;
+}
+
+export function currentFingerprintFromHcloud(res) {
+  if (res.error) return null;
+  const cur = res.profiles.find((p) => p.name === res.current);
+  return cur ? cur.fingerprint : null;
+}
+
+export function scanState() {
+  const s1 = readGlobalCredentials() || {};
+  const envAk = process.env.HW_ACCESS_KEY || '';
+  const envSk = process.env.HW_SECRET_KEY || '';
+  const kooCli = readKooCliProfiles();
+  const currentFp = currentFingerprintFromHcloud(kooCli);
+  const inconsistencies = [];
+
+  const s1Fingerprint = fingerprint(s1.ak, s1.sk);
+  const envFingerprint = fingerprint(envAk, envSk);
+  const s3 = existsSync(obsConfigPath()) ? parseS3ObsConfig(obsConfigPath()) : null;
+  const s3Fingerprint = s3 ? fingerprint(s3.ak, s3.sk) : null;
+
+  let hasRuntime = false;
+  let runtimeFingerprint = null;
+  try {
+    const rt = resolveCredentialsWithRuntime();
+    hasRuntime = hasRuntimeCredentials();
+    if (hasRuntime) runtimeFingerprint = fingerprint(rt.ak, rt.sk);
+  } catch {
+    // nothing resolvable → runtime store inactive
+  }
+
+  if (s1Fingerprint && currentFp && s1Fingerprint !== currentFp) {
+    inconsistencies.push({
+      store: 'S2-current',
+      source: 'KooCLI current profile',
+      fingerprint: currentFp,
+      manualModified: isManualModified(join(baseHome(), '.hcloud', 'config.json')),
+    });
+  }
+  if (s1Fingerprint && s3Fingerprint && s1Fingerprint !== s3Fingerprint) {
+    inconsistencies.push({
+      store: 'S3',
+      source: 'obsutilconfig',
+      fingerprint: s3Fingerprint,
+      manualModified: isManualModified(obsConfigPath()),
+    });
+  }
+
+  return {
+    stores: {
+      s1Fingerprint,
+      envFingerprint,
+      currentFingerprint: currentFp,
+      s3Fingerprint,
+      runtimeFingerprint,
+    },
+    kooCliCurrent: kooCli.error ? null : kooCli.current,
+    inconsistencies,
+    hasRuntime,
+    runtimeFingerprint,
+  };
+}
+
+function parseS3ObsConfig(path) {
+  try {
+    const text = readFileSync(path, 'utf8');
+    const get = (k) => {
+      const m = text.match(new RegExp(`^${k}=(.+)$`, 'm'));
+      return m ? m[1].trim() : '';
+    };
+    return { ak: get('ak'), sk: get('sk'), region: inferRegion(text) };
+  } catch {
+    return null;
+  }
+}
+
+function inferRegion(text) {
+  const m = text.match(/endpoint=https:\/\/obs\.([^.]+)\./);
+  return m ? m[1] : '';
+}
+
+export function exportStateForStatus(_jailed) {
+  const scan = scanState();
+  return {
+    ...scan,
+    // fields below are consumed by getAuthStatus in service.mjs
+    inconsistent: scan.inconsistencies.length > 0,
+  };
+}
+
+export function runHcloudConfigure(profile, ak, sk, region) {
+  const bin = process.env.HCLOUD_BIN || 'hcloud';
+  const args = [
+    'configure',
+    'set',
+    `--cli-profile=${profile}`,
+    `--cli-access-key=${ak}`,
+    `--cli-secret-key=${sk}`,
+    `--cli-region=${region || ''}`,
+  ];
+  const r = spawnSync(bin, args, { shell: false, windowsHide: true, stdio: 'pipe', timeout: 30000 });
+  return {
+    ok: r.status === 0,
+    error: redactSecrets(
+      String(r.stderr || '')
+        .trim()
+        .slice(0, 240),
+    ),
+  };
+}

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -2,7 +2,19 @@ import { existsSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 
 import { getAgentRegistrationStatuses } from './agent-registration.mjs';
-import { globalCredentialsPath, obsConfigPath, readGlobalCredentials, writeObsConfig } from './credentials.mjs';
+import {
+  globalCredentialsPath,
+  obsConfigPath,
+  readGlobalCredentials,
+  writeLastSync,
+  writeObsConfig,
+} from './credentials.mjs';
+import {
+  exportStateForStatus,
+  hasRuntimeCredentials,
+  resolveManagedProfile,
+  runHcloudConfigure,
+} from './reconcile.mjs';
 
 function hcloudInstalled() {
   const bin = process.env.HCLOUD_BIN || 'hcloud';
@@ -22,6 +34,7 @@ function hcloudInstalled() {
 
 export function getAuthStatus(target = 'all') {
   const credentials = readGlobalCredentials();
+  const reconciled = { ...exportStateForStatus(), runtimeActive: hasRuntimeCredentials() };
   return {
     target,
     credentialsConfigured: Boolean(credentials?.ak && credentials?.sk),
@@ -29,6 +42,7 @@ export function getAuthStatus(target = 'all') {
     obsConfigured: existsSync(obsConfigPath()),
     obsConfigPath: obsConfigPath(),
     kooCliInstalled: hcloudInstalled(),
+    reconciled,
     agents: getAgentRegistrationStatuses(target).agents,
   };
 }
@@ -42,6 +56,13 @@ export function syncAuth(target = 'all') {
       nextStep: 'Run "npx huaweicloud-devkit auth init" first.',
     };
   }
+  if (hasRuntimeCredentials()) {
+    return {
+      ok: false,
+      error: 'Runtime credentials are active; auto-sync suppressed (R10).',
+      nextStep: 'Run huaweicloud_auth_switch action=clear or action=persist first.',
+    };
+  }
 
   let obs;
   try {
@@ -54,42 +75,42 @@ export function syncAuth(target = 'all') {
     };
   }
 
-  let hcloud = { ok: false, message: 'KooCLI not installed' };
-  if (hcloudInstalled()) {
-    const bin = process.env.HCLOUD_BIN || 'hcloud';
-    const r = spawnSync(
-      bin,
-      [
-        'configure',
-        'set',
-        `--cli-access-key=${credentials.ak}`,
-        `--cli-secret-key=${credentials.sk}`,
-        `--cli-region=${credentials.region || ''}`,
-      ],
-      {
-        shell: false,
-        windowsHide: true,
-        stdio: 'pipe',
-        timeout: 30000,
-      },
-    );
-    if (r.status === 0) {
-      hcloud = { ok: true, message: 'KooCLI config synced' };
-    } else {
-      hcloud = {
-        ok: false,
-        message: 'KooCLI config sync failed',
-        error: String(r.stderr || '')
-          .trim()
-          .slice(0, 240),
-      };
-    }
+  const profile = resolveManagedProfile();
+  if (!profile) {
+    return {
+      ok: false,
+      error: 'KooCLI current profile unresolved; run "npx huaweicloud-devkit auth init" in a real terminal.',
+      nextStep: 'Run "npx huaweicloud-devkit auth init" in a real terminal to create the KooCLI current profile.',
+      obs: { configured: true, path: obs.path, endpoint: obs.endpoint },
+    };
+  }
+
+  if (!hcloudInstalled()) {
+    return {
+      ok: false,
+      error: 'KooCLI not installed.',
+      nextStep: 'Install KooCLI or point HCLOUD_BIN at the hcloud executable.',
+      obs: { configured: true, path: obs.path, endpoint: obs.endpoint },
+    };
   }
 
+  const { ok, error } = runHcloudConfigure(profile, credentials.ak, credentials.sk, credentials.region);
+  if (!ok) {
+    return {
+      ok: false,
+      error: error || 'KooCLI config sync failed',
+      nextStep: 'Run "npx huaweicloud-devkit auth init" in a real terminal to refresh the KooCLI config.',
+      obs: { configured: true, path: obs.path, endpoint: obs.endpoint },
+    };
+  }
+
+  writeLastSync();
+
   return {
     ok: true,
+    profile,
     obs: { configured: true, path: obs.path, endpoint: obs.endpoint },
-    hcloud,
+    hcloud: { ok: true, message: `KooCLI config synced to profile=${profile}` },
     credentialsConfigured: true,
     agents: getAgentRegistrationStatuses(target).agents,
     note: 'OBS credentials were synced from the global credential vault. Agent MCP registration is managed by "npx huaweicloud-devkit install --target <agent>".',

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -172,17 +172,38 @@ export async function runHcloud(args, options = {}) {
   for (let attempt = 0; attempt <= maxRetries; attempt += 1) {
     const result = await runHcloudOnce(plan, options);
     if (result.ok || attempt >= maxRetries || !isRetryableNetworkError(result)) {
-      return {
+      const merged = {
         ...result,
         retries: attempt,
         attempts: attempt + 1,
       };
+      if (merged.ok) {
+        const warning = await runtimeCurrentMismatchWarning();
+        return warning ? { ...merged, authWarning: warning } : merged;
+      }
+      return merged;
     }
     await wait((options.retryBaseDelayMs ?? 500) * 2 ** attempt);
   }
   throw new Error('Unreachable retry state.');
 }
 
+async function runtimeCurrentMismatchWarning() {
+  try {
+    const { hasRuntimeCredentials, scanState } = await import('./auth/reconcile.mjs');
+    if (!hasRuntimeCredentials()) return null;
+    const scan = scanState();
+    const { runtimeFingerprint, currentFingerprint } = scan.stores;
+    if (runtimeFingerprint && currentFingerprint && runtimeFingerprint !== currentFingerprint) {
+      return '会话内临时账号与 KooCLI current 档不一致：hcloud 命令仍使用 current 档账号。如需对齐请用 huaweicloud_auth_switch action=persist。';
+    }
+    return null;
+  } catch {
+    // reconcile unavailable → no warning, never block the command
+    return null;
+  }
+}
+
 function discoverHcloudPath() {
   if (process.env.HCLOUD_BIN && existsSync(process.env.HCLOUD_BIN)) return process.env.HCLOUD_BIN;
   const candidates =

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -18,10 +18,13 @@ import { createRequire } from 'node:module';
 
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
 import { SUPPORTED_AGENT_TARGETS } from './auth/agent-registration.mjs';
+import { resolveManagedProfile } from './auth/reconcile.mjs';
+import { redactSecrets } from './safety-policy.mjs';
 import {
   globalCredentialsPath,
   readGlobalCredentials,
   writeGlobalCredentials,
+  writeLastSync,
   writeObsConfig,
 } from './auth/credentials.mjs';
 import {
@@ -3836,7 +3839,6 @@ async function cmdInstallHcloud() {
   console.log('\nAfter install, set HCLOUD_BIN if hcloud is not on PATH.');
   console.log('\n\x1b[1m\x1b[33m=== Configure credentials SAFELY ===\x1b[0m');
   console.log('  Unified credentials (recommended): npx huaweicloud-devkit auth init');
-  console.log('  KooCLI only (alternative): hcloud configure init');
   console.log('  NEVER: hcloud configure set --cli-access-key=xxx  (AK/SK in shell history!)');
   console.log('\nThen run: npx huaweicloud-devkit doctor');
 }
@@ -3893,11 +3895,17 @@ async function readSecret(prompt) {
   });
 }
 
+function configuredProfileName() {
+  const name = resolveManagedProfile();
+  return name || 'default';
+}
+
 function configureHcloud(credentials) {
   const hcloudBin = findHcloudBin() || process.env.HCLOUD_BIN || 'hcloud';
   const args = [
     'configure',
     'set',
+    `--cli-profile=${configuredProfileName()}`,
     `--cli-access-key=${credentials.ak}`,
     `--cli-secret-key=${credentials.sk}`,
     `--cli-region=${credentials.region || ''}`,
@@ -3911,9 +3919,11 @@ function configureHcloud(credentials) {
   return {
     ok: r.status === 0,
     code: r.status,
-    error: String(r.stderr || '')
-      .trim()
-      .slice(0, 240),
+    error: redactSecrets(
+      String(r.stderr || '')
+        .trim()
+        .slice(0, 240),
+    ),
   };
 }
 
@@ -3992,6 +4002,56 @@ async function cmdAuthInit() {
   console.log('  Restart your agent sessions.');
 }
 
+async function cmdAuthReconcile() {
+  console.log(BANNER);
+  console.log('HuaweiCloud DevKit Credential Reconciliation\n');
+
+  const { scanState, runHcloudConfigure, resolveManagedProfile } = await import('./auth/reconcile.mjs');
+  const state = scanState();
+  if (state.inconsistencies.length === 0) {
+    console.log('All credential files are consistent. ✓');
+    return;
+  }
+
+  const interactive = process.stdin.isTTY && process.stdout.isTTY;
+  if (!interactive) {
+    console.error(
+      '\x1b[31mNon-interactive session. Cannot run interactive reconciliation. Use "npx huaweicloud-devkit auth sync" or run reconciliation in a real terminal.\x1b[0m',
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  for (const inc of state.inconsistencies) {
+    console.log(
+      `  [${inc.store}] fingerprint ${inc.fingerprint} differs from S1 ${state.stores.s1Fingerprint}${inc.manualModified ? ' (manual modified)' : ''}`,
+    );
+  }
+  const ask = await readLineQuestion('以 S1 为准同步到不一致文件? (y/N) ');
+  if (!['y', 'Y', 'yes'].includes(ask.trim())) {
+    console.log('Aborted.');
+    return;
+  }
+  const credentials = readGlobalCredentials();
+  if (!credentials?.ak || !credentials?.sk) {
+    console.error('No global credentials found after confirmation; aborting.');
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    writeObsConfig(credentials);
+  } catch (error) {
+    console.log(`OBS sync failed: ${error.message}`);
+  }
+  const profile = resolveManagedProfile();
+  if (profile) {
+    const r = runHcloudConfigure(profile, credentials.ak, credentials.sk, credentials.region);
+    console.log(`  KooCLI ${r.ok ? 'synced' : 'sync failed'}: profile=${profile} ${r.error || ''}`);
+  }
+  writeLastSync();
+  console.log('Done. .last_sync refreshed.');
+}
+
 async function cmdAuthSync() {
   const target = parseTarget();
   console.log(BANNER);
@@ -4023,6 +4083,7 @@ async function cmdAuth() {
   const sub = (process.argv[3] || 'status').toLowerCase();
   if (sub === 'init' || sub === 'setup') return cmdAuthInit();
   if (sub === 'sync' || sub === 'refresh') return cmdAuthSync();
+  if (sub === 'reconcile') return cmdAuthReconcile();
   return cmdAuthStatus();
 }
 
@@ -4209,7 +4270,7 @@ async function main() {
       console.log('  status       Show installation status');
       console.log('  doctor       Self-check: hcloud, MCP, skills, auth');
       console.log('  install-hcloud  Show KooCLI install commands for your OS');
-      console.log('  auth         Manage unified auth: init | sync | status');
+      console.log('  auth         Manage unified auth: init | sync | status | reconcile');
       console.log('  proxy        Manage proxy config: init | show | clear');
       console.log('  version      Print installed plugin version per agent');
       console.log('  help         Show this help');

package/plugins/huaweicloud-core/src/tools.mjs

@@ -34,10 +34,17 @@ import { getCredentials } from './sandbox/hwlink-api.mjs';
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
 import {
   readGlobalCredentials,
+  writeGlobalCredentials,
   writeObsConfig as writeObsConfigFile,
   setRuntimeCredentials,
   clearRuntimeCredentials,
+  setConfiguredBySession,
+  backupGlobalCredentials,
+  writeLastSync,
+  readCodeArtsCredentials,
+  globalCredentialsPath,
 } from './auth/credentials.mjs';
+import { fingerprint, runHcloudConfigure, resolveManagedProfile } from './auth/reconcile.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const SKILLS_ROOT_DEV = join(__dirname, '..', 'skills');
@@ -500,6 +507,34 @@ export const TOOL_DEFINITIONS = [
       },
     },
   },
+  {
+    name: 'huaweicloud_auth_switch',
+    description:
+      'Switch Huawei Cloud credentials within the current session. action=temporary keeps AK/SK in memory only (restart loses them; hcloud commands are unaffected and an A+C warning will be raised). action=persist writes S1 (single source of truth) with configuredBySession flag and propagates to S2 (KooCLI current profile) and S3 (OBS). action=clear resets runtime credentials. mode=import reads AK/SK from ~/.config/huaweicloud/creds-import.json then wipes it (SK never enters conversation). mode=memory passes AK/SK as tool arguments (SK is visible to model - prefer import). mode=mcp-config reads the injected mcp_settings environment.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        mode: { type: 'string', enum: ['import', 'memory', 'mcp-config'], description: 'Credential source channel' },
+        action: { type: 'string', enum: ['persist', 'temporary', 'clear'], description: 'Apply scope' },
+        ak: { type: 'string' },
+        sk: { type: 'string' },
+        securityToken: { type: 'string' },
+        region: { type: 'string' },
+      },
+    },
+  },
+  {
+    name: 'huaweicloud_auth_confirm',
+    description:
+      'Confirm a pending credential reconciliation choice returned by auth_switch persist when S1 already holds a different account (R2). decision=s1 keeps S1 as source of truth and propagates it; decision=newImported propagates the newly imported account into S1 and mirrors.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        token: { type: 'string', description: 'confirmation token from the needs_confirmation response' },
+        decision: { type: 'string', enum: ['s1', 'newImported'] },
+      },
+    },
+  },
   {
     name: 'huaweicloud_sandbox_exec_with_session',
     description:
@@ -840,6 +875,62 @@ async function transferGitRepo(args, devStageId, connectResult) {
   connectResult._repoStatus = 'cloned_in_sandbox';
 }
 
+const pendingConfirms = new Map();
+
+function readImportFile() {
+  const path = join(dirname(globalCredentialsPath()), 'creds-import.json');
+  try {
+    if (!existsSync(path)) return null;
+    const data = JSON.parse(readFileSync(path, 'utf8'));
+    return {
+      ak: String(data.ak || ''),
+      sk: String(data.sk || ''),
+      securityToken: String(data.securityToken || ''),
+      region: String(data.region || ''),
+    };
+  } catch {
+    return null;
+  } finally {
+    rmSync(path, { force: true });
+  }
+}
+
+function persistCredentials(ak, sk, securityToken, region) {
+  if (String(securityToken || '')) {
+    return {
+      status: 'error',
+      error: 'Temporary STS credentials cannot be persisted (R3). Use action=temporary.',
+      scope: 'rejected',
+    };
+  }
+  const before = backupGlobalCredentials();
+  writeGlobalCredentials({ ak, sk: String(sk), securityToken: '', region, configuredBySession: true });
+  setConfiguredBySession(true);
+  let obs;
+  try {
+    writeObsConfigFile({ ak, sk, securityToken, region });
+    obs = { ok: true };
+  } catch (error) {
+    obs = { ok: false, error: error.message };
+  }
+  const profile = resolveManagedProfile();
+  let hcloud;
+  if (!profile) {
+    hcloud = { ok: false, reason: 'KooCLI current profile unresolved' };
+  } else {
+    hcloud = runHcloudConfigure(profile, ak, sk, region);
+  }
+  writeLastSync();
+  return {
+    status: 'ok',
+    scope: 'persist',
+    backedUp: Boolean(before),
+    obs: obs.ok ? { configured: true } : { configured: false, error: obs.error },
+    hcloud,
+    note: 'S1 written with configuredBySession (R9), which now takes priority over env-injected credentials; S2(current profile) and S3 synced. Note: running `auth init` later clears the configuredBySession flag and env credentials regain priority.',
+  };
+}
+
 export async function callTool(name, args = {}) {
   switch (name) {
     case 'huaweicloud_check_cli':
@@ -906,6 +997,81 @@ export async function callTool(name, args = {}) {
       }
       setRuntimeCredentials(args.ak, args.sk, undefined, args.region);
       return { status: 'ok', message: 'Runtime credentials set for this MCP session.' };
+    case 'huaweicloud_auth_switch': {
+      const action = args.action || 'temporary';
+      if (action === 'clear') {
+        clearRuntimeCredentials();
+        return { status: 'cleared', message: 'Runtime credentials cleared. Fallback to env/file/S1.' };
+      }
+
+      let ak = args.ak || '';
+      let sk = args.sk || '';
+      let securityToken = args.securityToken || '';
+      let region = args.region || '';
+      const sourceChannel = args.mode || 'memory';
+
+      if (sourceChannel === 'import' && (!ak || !sk)) {
+        const imported = readImportFile();
+        if (imported) ({ ak, sk, securityToken, region } = imported);
+      }
+      if (sourceChannel === 'mcp-config' && (!ak || !sk)) {
+        const cc = readCodeArtsCredentials();
+        if (cc) {
+          ak = cc.ak;
+          sk = cc.sk;
+          securityToken = cc.securityToken || '';
+          region = cc.region || region;
+        }
+      }
+
+      if (!ak || !sk) {
+        throw new Error('ak and sk are required (or provide creds-import.json for mode=import).');
+      }
+
+      if (action === 'temporary') {
+        setRuntimeCredentials(ak, sk, securityToken || undefined, region);
+        return {
+          status: 'ok',
+          scope: 'temporary',
+          note: 'Runtime credentials active for this MCP process. hcloud commands still use the KooCLI current profile; use action=persist to align files.',
+        };
+      }
+
+      // action === 'persist'
+      const prev = readGlobalCredentials();
+      const conflict = prev?.ak && prev.ak !== ak;
+      if (conflict) {
+        backupGlobalCredentials();
+        const token = `switch-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        pendingConfirms.set(token, {
+          newAk: ak,
+          newSk: sk,
+          newSecurityToken: securityToken,
+          newRegion: region,
+          oldFingerprint: fingerprint(prev.ak, prev.sk),
+          newFingerprint: fingerprint(ak, sk),
+        });
+        return {
+          status: 'needs_confirmation',
+          confirmToken: token,
+          options: [
+            { key: 's1', label: '以 S1 现有账号为准（不切换，恢复 backup）' },
+            { key: 'newImported', label: `以新账号（${fingerprint(ak, sk)}）为准，覆盖 S1 并同步全部凭证文件` },
+          ],
+        };
+      }
+
+      return persistCredentials(ak, sk, securityToken, region);
+    }
+    case 'huaweicloud_auth_confirm': {
+      const pending = pendingConfirms.get(args.token);
+      if (!pending) throw new Error('confirmToken not found or expired.');
+      pendingConfirms.delete(args.token);
+      if (args.decision === 's1') {
+        return { status: 'ok', outcome: 'aborted', message: '保持 S1 现有账号，未覆盖。' };
+      }
+      return persistCredentials(pending.newAk, pending.newSk, pending.newSecurityToken, pending.newRegion);
+    }
     case 'huaweicloud_sandbox_exec_with_session': {
       const sandboxWsId2 = args.workspace_id || getCurrentWorkspaceId();
       if (!sandboxWsId2) {
@@ -1130,7 +1296,7 @@ export async function runVersionCheck(options = {}) {
         ? 'hcloud executable not found. Set HCLOUD_BIN to the full hcloud path, or install KooCLI: npx huaweicloud-devkit install-hcloud. Then restart the agent.'
         : 'Install Huawei Cloud KooCLI: npx huaweicloud-devkit install-hcloud. Configure credentials outside the agent conversation.',
     authHint:
-      'If hcloud is installed but commands fail with "配置文件中不存在配置项", run `hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>` outside agent chat to configure credentials.',
+      'If hcloud is installed but commands fail with "配置文件中不存在配置项", run `npx huaweicloud-devkit auth init` outside agent chat to configure credentials.',
   };
 }
 
@@ -1243,7 +1409,7 @@ async function setupObsConfigFromHcloud(profile) {
     return {
       ok: false,
       error: 'No region found in hcloud profile.',
-      nextStep: 'Run "hcloud configure set --cli-region=<region>" outside agent chat to set a default region.',
+      nextStep: 'Run "npx huaweicloud-devkit auth init" outside agent chat to configure credentials and region.',
     };
   }