huaweicloud-devkit 1.1.1-next.14 → 1.1.1-next.16

package/integrations/atomcode/hooks/huaweicloud-telemetry.js

@@ -0,0 +1,181 @@
+/**
+ * huaweicloud-telemetry.js — AtomCode PreToolUse Hook
+ *
+ * Captures Skill loading, hcloud CLI commands, and MCP tool invocations,
+ * writing structured events to hook-events.jsonl for the devkit telemetry
+ * module to ingest and report.
+ *
+ * Classification logic mirrors the existing four platform hooks exactly.
+ * This hook NEVER blocks execution — it always exits 0.
+ */
+
+import { appendFileSync, mkdirSync, existsSync, readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// ══════════════════════════════════════════════════════════════════
+// Debug
+// ══════════════════════════════════════════════════════════════════
+
+const DEBUG = process.env.HUAWEICLOUD_DEVKIT_DEBUG === 'true';
+
+function debugLog(msg) {
+  if (!DEBUG) return;
+  try {
+    const logPath = join(TELEMETRY_DIR, 'atomcode-debug.log');
+    appendFileSync(logPath, `${new Date().toISOString()} ${msg}\n`);
+  } catch (_) {
+    /* best-effort */
+  }
+}
+
+// ══════════════════════════════════════════════════════════════════
+// Paths — hook is installed at <plugin_dir>/hooks/
+// ══════════════════════════════════════════════════════════════════
+
+const __filename = fileURLToPath(import.meta.url);
+const HOOK_DIR = dirname(__filename);
+const PLUGIN_DIR = dirname(HOOK_DIR);
+const TELEMETRY_DIR = join(PLUGIN_DIR, 'telemetry');
+const HOOK_EVENTS_PATH = join(TELEMETRY_DIR, 'hook-events.jsonl');
+
+// ══════════════════════════════════════════════════════════════════
+// Helpers
+// ══════════════════════════════════════════════════════════════════
+
+function ensureDir(dirPath) {
+  if (!existsSync(dirPath)) mkdirSync(dirPath, { recursive: true });
+}
+
+function writeEvent(key, value, extra = {}) {
+  try {
+    ensureDir(TELEMETRY_DIR);
+    const line = JSON.stringify({ key, value, ...extra }) + '\n';
+    appendFileSync(HOOK_EVENTS_PATH, line, 'utf8');
+    debugLog(`writeEvent key=${key} value=${value}`);
+  } catch (error) {
+    debugLog(`writeEvent FAILED: ${error.message}`);
+  }
+}
+
+// ══════════════════════════════════════════════════════════════════
+// Skill identification
+// ══════════════════════════════════════════════════════════════════
+
+function isHuaweiCloudSkill(name) {
+  return typeof name === 'string' && /^huawei/i.test(name);
+}
+
+// ══════════════════════════════════════════════════════════════════
+// CLI command classification (matches skill-tracker.js exactly)
+// ══════════════════════════════════════════════════════════════════
+
+const HCLOUD_RE = /(?:^|[;&|]\s*)hcloud(?:\.exe)?\s+(.+)/i;
+const READ_VERBS = /\b(List|Show|Get|Describe|NovaList|NovaShow)\w*/i;
+const WRITE_VERBS =
+  /\b(Create|Delete|Update|Modify|Remove|Revoke|Grant|Attach|Detach|Enable|Disable|Set|Add|Bind|Unbind|Reset|Change|Activate|Deactivate|Register|Unregister|Import|Export|Download|Upload|Copy|Move|Convert|Migrate|Run|Execute|Invoke|Trigger|Deploy|Push|Start|Stop|Restart|Reboot|Suspend|Resume|Terminate|Release|Allocate)\w*/i;
+
+function classifyHcloud(text) {
+  const m = HCLOUD_RE.exec(text);
+  if (!m) return null;
+  const rest = m[1].trim();
+  const parts = rest.split(/\s+/).filter((p) => !p.startsWith('--'));
+  const cmd = parts.join(' ');
+  if (!cmd) return null;
+  if (READ_VERBS.test(cmd)) return { key: 'cli:read', value: `hcloud ${cmd}` };
+  if (WRITE_VERBS.test(cmd)) return { key: 'cli:write', value: `hcloud ${cmd}` };
+  return { key: 'cli:invoke', value: `hcloud ${cmd}` };
+}
+
+// ══════════════════════════════════════════════════════════════════
+// Input parsing — stdin JSON, with env-var fallback
+// ══════════════════════════════════════════════════════════════════
+
+function parseInput() {
+  // Primary: AtomCode passes data via env vars
+  const toolName = process.env.ATOMCODE_TOOL_NAME || '';
+  const context = process.env.ATOMCODE_HOOK_CONTEXT || '';
+  if (toolName || context) {
+    const input = { tool_name: toolName };
+    if (context) {
+      try {
+        input.tool_input = JSON.parse(context);
+      } catch (_) {
+        input.tool_input = { command: context };
+      }
+    } else {
+      input.tool_input = {};
+    }
+    return input;
+  }
+
+  // Fallback: stdin JSON (piped for manual testing)
+  try {
+    const data = readFileSync(0, 'utf8').trim();
+    if (data) return JSON.parse(data);
+  } catch (_) {
+    /* stdin unavailable */
+  }
+
+  return { tool_name: '', tool_input: {} };
+}
+
+function extractCommand(toolInput) {
+  if (typeof toolInput === 'string') return toolInput;
+  if (toolInput && typeof toolInput === 'object') {
+    return toolInput.command || toolInput.arguments?.command || '';
+  }
+  return '';
+}
+
+function extractSkillName(toolInput) {
+  if (typeof toolInput === 'string') return toolInput;
+  if (toolInput && typeof toolInput === 'object') {
+    return toolInput.name || toolInput.command || '';
+  }
+  return '';
+}
+
+// ══════════════════════════════════════════════════════════════════
+// Main
+// ══════════════════════════════════════════════════════════════════
+
+try {
+  const input = parseInput();
+  const toolName = input.tool_name || input.tool || '';
+  const toolInput = input.tool_input || input.arguments || {};
+
+  debugLog(`tool=${toolName}`);
+
+  // ── Category 1: Skill tool calls ──
+  if (toolName === 'skill' || toolName === 'use_skill') {
+    const skillName = extractSkillName(toolInput);
+    debugLog(`skill name=${skillName}`);
+    if (isHuaweiCloudSkill(skillName)) {
+      writeEvent('skill:retrieve', skillName);
+    }
+  }
+
+  // ── Category 2: Bash/pwsh with hcloud commands ──
+  if (toolName === 'bash' || toolName === 'pwsh') {
+    const command = extractCommand(toolInput);
+    if (command && HCLOUD_RE.test(command)) {
+      debugLog(`hcloud command: ${command.slice(0, 120)}`);
+      const classified = classifyHcloud(command);
+      if (classified) {
+        writeEvent(classified.key, classified.value, { capability: 'cli' });
+      }
+    }
+  }
+
+  // ── Category 3: MCP Huawei Cloud tools ──
+  if (toolName.startsWith('mcp__huaweicloud')) {
+    writeEvent(`tool:${toolName}`, '1', { capability: 'mcp' });
+    debugLog(`MCP tool: ${toolName}`);
+  }
+} catch (error) {
+  debugLog(`FATAL: ${error?.message || error}`);
+}
+
+// Always allow — telemetry hook never blocks; the process exits 0 naturally
+// since all I/O is synchronous and nothing holds the event loop open.

package/integrations/atomcode/hooks.json

@@ -0,0 +1,9 @@
+{
+  "hooks": {
+    "hw-telemetry": {
+      "event": "pre_tool_use",
+      "command": "<node_path> <plugin_dir>/hooks/huaweicloud-telemetry.js",
+      "timeout_ms": 2000
+    }
+  }
+}

package/integrations/dsh/hook-plugin.mjs

@@ -0,0 +1,148 @@
+// hook-plugin.mjs — DSH Cordis Hook Plugin
+// Intercepts Huawei Cloud skill calls and hcloud CLI commands,
+// writes events to hook-events.jsonl for the telemetry module to consume.
+
+import { appendFileSync, existsSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// ══════════════════════════════════════════════════════════════════
+// Cordis plugin identity (required by DSH loader)
+// ══════════════════════════════════════════════════════════════════
+export const name = 'huaweicloud-devkit-hook';
+export const inject = ['tools'];
+
+// ══════════════════════════════════════════════════════════════════
+// Paths — this file lives in $DSH_HOME/huaweicloud-plugins/
+// ══════════════════════════════════════════════════════════════════
+const __filename = fileURLToPath(import.meta.url);
+const PLUGIN_DIR = dirname(__filename);
+// telemetry/ dir is the single shared location for event files
+const TELEMETRY_DIR = join(PLUGIN_DIR, 'telemetry');
+const HOOK_EVENTS_PATH = join(TELEMETRY_DIR, 'hook-events.jsonl');
+
+const DEBUG = process.env.HUAWEICLOUD_DEVKIT_DEBUG === 'true';
+
+// ══════════════════════════════════════════════════════════════════
+// Helpers
+// ══════════════════════════════════════════════════════════════════
+
+function ensureDir(dirPath) {
+  if (!existsSync(dirPath)) mkdirSync(dirPath, { recursive: true });
+}
+
+function debugLog(msg) {
+  if (!DEBUG) return;
+  try {
+    const logPath = join(TELEMETRY_DIR, 'telemetry-debug.log');
+    ensureDir(TELEMETRY_DIR);
+    appendFileSync(logPath, `${new Date().toISOString()} [hook] ${msg}\n`, 'utf8');
+  } catch {
+    // debug log is best-effort; never fail the plugin
+  }
+}
+
+function writeEvent(key, value, extra = {}) {
+  try {
+    ensureDir(TELEMETRY_DIR);
+    const line = JSON.stringify({ key, value, ...extra }) + '\n';
+    appendFileSync(HOOK_EVENTS_PATH, line, 'utf8');
+    debugLog(`writeEvent key=${key} value=${value}`);
+  } catch (error) {
+    debugLog(`writeEvent FAILED: ${error.message}`);
+  }
+}
+
+// ══════════════════════════════════════════════════════════════════
+// Huawei Cloud identification
+// ══════════════════════════════════════════════════════════════════
+
+function isHuaweiCloudSkill(name) {
+  return typeof name === 'string' && /^huawei/i.test(name);
+}
+
+// ══════════════════════════════════════════════════════════════════
+// hcloud command classification (mirrors skill-tracker.js)
+// ══════════════════════════════════════════════════════════════════
+
+const HCLOUD_RE = /(?:^|[;&|]\s*)hcloud(?:\.exe)?\s+(.+)/i;
+const READ_VERBS = /\b(List|Show|Get|Describe|NovaList|NovaShow)\w*/i;
+const WRITE_VERBS =
+  /\b(Create|Delete|Update|Modify|Remove|Revoke|Grant|Attach|Detach|Enable|Disable|Set|Add|Bind|Unbind|Reset|Change|Activate|Deactivate|Register|Unregister|Import|Export|Download|Upload|Copy|Move|Convert|Migrate|Run|Execute|Invoke|Trigger|Deploy|Push|Start|Stop|Restart|Reboot|Suspend|Resume|Terminate|Release|Allocate)\w*/i;
+
+function classifyHcloud(text) {
+  const m = HCLOUD_RE.exec(text);
+  if (!m) return null;
+  const rest = m[1].trim();
+  const parts = rest.split(/\s+/).filter((p) => !p.startsWith('--'));
+  const cmd = parts.join(' ');
+  if (!cmd) return null;
+  if (READ_VERBS.test(cmd)) return { key: 'cli:read', value: `hcloud ${cmd}`, capability: 'cli' };
+  if (WRITE_VERBS.test(cmd)) return { key: 'cli:write', value: `hcloud ${cmd}`, capability: 'cli' };
+  return { key: 'cli:invoke', value: `hcloud ${cmd}`, capability: 'cli' };
+}
+
+// ══════════════════════════════════════════════════════════════════
+// apply() — Cordis plugin entry point
+// ══════════════════════════════════════════════════════════════════
+
+export function apply(ctx) {
+  debugLog('=== PLUGIN LOADED ===');
+
+  // ── Layer 1: tools/pre-execute waterfall ──────────────────────
+  ctx.on('tools/pre-execute', async (exec, next) => {
+    try {
+      debugLog(`pre-execute tool=${exec.name}`);
+
+      // ── Intercept 1: skill tool calls ──
+      if (exec.name === 'skill') {
+        const skillName = exec.arguments?.name || '';
+        debugLog(`skill name=${skillName}`);
+        if (isHuaweiCloudSkill(skillName)) {
+          writeEvent('skill:retrieve', skillName);
+          ctx.logger.info(`[hw-hook] skill called: ${skillName}`);
+          debugLog(`SKILL TRACKED: ${skillName}`);
+        }
+      }
+
+      // ── Intercept 2: pwsh/bash with hcloud commands ──
+      if (exec.name === 'pwsh' || exec.name === 'bash') {
+        const command = exec.arguments?.command || '';
+        if (!command) return next();
+
+        if (HCLOUD_RE.test(command)) {
+          debugLog(`hcloud command: ${command.slice(0, 120)}`);
+
+          // Classify and write event
+          const classified = classifyHcloud(command);
+          if (classified) {
+            writeEvent(classified.key, classified.value, { capability: 'cli' });
+            debugLog(`CLI TRACKED: ${classified.key} ${classified.value}`);
+          }
+        }
+      }
+
+      // ── Intercept 3: MCP Huawei Cloud tools (record only) ──
+      if (exec.name.startsWith('mcp__huaweicloud__')) {
+        writeEvent(`tool:${exec.name}`, '1', { capability: 'mcp' });
+        debugLog(`MCP tool: ${exec.name}`);
+      }
+    } catch (error) {
+      debugLog(`pre-execute ERROR: ${error?.message || error}`);
+      ctx.logger.warn(`[hw-hook] pre-execute error: ${error.message}`);
+    }
+    return next();
+  });
+
+  // ── Layer 2: tools/result observe ─────────────────────────────
+  ctx.on('tools/result', (exec, result) => {
+    if (exec.name.startsWith('mcp__huaweicloud__') && result.isError) {
+      const msg = result.error?.message || 'unknown error';
+      debugLog(`tool error: ${exec.name}: ${msg}`);
+      ctx.logger.info(`[hw-hook] tool error: ${exec.name}: ${msg}`);
+    }
+  });
+
+  ctx.logger.info('[hw-hook] DSH Huawei Cloud hook plugin activated');
+  debugLog('=== PLUGIN INIT DONE ===');
+}

package/integrations/hermes/hooks/huaweicloud-telemetry.py

@@ -0,0 +1,238 @@
+#!/usr/bin/env python3
+"""Hermes pre_tool_call hook — Huawei Cloud telemetry data collection.
+
+Captures Skill loading and hcloud CLI commands, writing structured events
+to hook-events.jsonl for the devkit telemetry module to ingest and report.
+
+This hook NEVER blocks execution — it always returns exit code 0.
+Safety enforcement is handled by huaweicloud-safety.py.
+
+Data flow:
+  stdin JSON (pre_tool_call event) → classify → hook-events.jsonl
+  → MCP Server telemetry.mjs :: ingestHookEvents() → eventQueue → HTTP POST
+
+Classification logic mirrors the OpenCode skill-tracker.js exactly.
+"""
+
+import json
+import os
+import re
+import sys
+from pathlib import Path
+
+
+# ── Path resolution ─────────────────────────────────────────────────
+
+def _get_plugin_dir():
+    """Resolve the huaweicloud-core plugin directory.
+
+    Search order:
+      1. HUAWEICLOUD_PLUGIN_DIR env var         (explicit override)
+      2. Dev repo: hooks/ → ../plugins/...     (local dev)
+      3. ~/.hermes/huaweicloud-plugins/         (Hermes installed)
+    """
+    env_dir = os.environ.get("HUAWEICLOUD_PLUGIN_DIR")
+    if env_dir:
+        return Path(env_dir)
+
+    here = Path(__file__).resolve()
+
+    # Local dev: plugins/huaweicloud-core/hooks/huaweicloud-telemetry.py
+    # parents[1] = plugins/huaweicloud-core/
+    if (here.parents[1] / "skills").is_dir():
+        return here.parents[1]
+
+    # Local dev (from repo root): hooks/ → ../plugins/huaweicloud-core/
+    relative = here.parents[1] / "plugins" / "huaweicloud-core"
+    if relative.is_dir():
+        return relative
+
+    # Hermes installed: ~/AppData/Local/hermes/huaweicloud-plugins/
+    # hooks/ is directly under the plugin dir, so parents[1] IS the plugin dir.
+    if (here.parents[1] / "telemetry").is_dir() or (here.parents[1] / "src").is_dir():
+        return here.parents[1]
+
+    home = Path.home()
+
+    # Hermes installed plugin dir (legacy ~/.hermes/ path)
+    hermes_dir = home / ".hermes" / "huaweicloud-plugins"
+    if hermes_dir.is_dir():
+        return hermes_dir
+
+    raise FileNotFoundError("Cannot resolve huaweicloud-core plugin directory")
+
+
+def _get_telemetry_dir():
+    """Return the telemetry directory shared with all devkit platforms.
+
+    Always at <plugin_dir>/telemetry/, matching AGENT_TELEMETRY_DIR
+    in src/telemetry/telemetry.mjs.
+    """
+    plugin_dir = _get_plugin_dir()
+    telemetry_dir = plugin_dir / "telemetry"
+    telemetry_dir.mkdir(parents=True, exist_ok=True)
+    return telemetry_dir
+
+
+def _get_hook_events_path():
+    """Lazily resolve hook-events.jsonl path. Returns None if unresolvable."""
+    try:
+        return str(_get_telemetry_dir() / "hook-events.jsonl")
+    except Exception:
+        return None
+
+
+# ── Classifiers (match skill-tracker.js exactly) ────────────────────
+
+# hcloud command detection
+HCLOUD_RE = re.compile(r'(?:^|[;&|]\s*)hcloud(?:\.exe)?\s+(.+)', re.IGNORECASE)
+
+# Read operation verbs
+READ_VERBS = re.compile(
+    r'\b(List|Show|Get|Describe|NovaList|NovaShow)\w*', re.IGNORECASE
+)
+
+# Write operation verbs
+WRITE_VERBS = re.compile(
+    r'\b(Create|Delete|Update|Modify|Remove|Revoke|Grant|Attach|Detach|'
+    r'Enable|Disable|Set|Add|Bind|Unbind|Reset|Change|Activate|Deactivate|'
+    r'Register|Unregister|Import|Export|Download|Upload|Copy|Move|Convert|'
+    r'Migrate|Run|Execute|Invoke|Trigger|Deploy|Push|Start|Stop|Restart|'
+    r'Reboot|Suspend|Resume|Terminate|Release|Allocate)\w*', re.IGNORECASE
+)
+
+# Huawei Cloud skill name pattern
+HUAWEI_SKILL_RE = re.compile(r'^huawei', re.IGNORECASE)
+
+
+def classify_hcloud(text):
+    """Classify an hcloud CLI command as read / write / invoke.
+
+    Returns:
+        dict with 'key' and 'value', or None if not an hcloud command.
+        Matches the classifyHcloud() logic in skill-tracker.js.
+    """
+    m = HCLOUD_RE.search(text)
+    if not m:
+        return None
+
+    rest = m[1].strip()
+    # Extract command part, excluding flags/options
+    parts = rest.split()
+    cmd_parts = [p for p in parts if not p.startswith('--')]
+    cmd = ' '.join(cmd_parts).strip()
+
+    if not cmd:
+        return None
+
+    if READ_VERBS.search(cmd):
+        return {'key': 'cli:read', 'value': f'hcloud {cmd}'}
+    if WRITE_VERBS.search(cmd):
+        return {'key': 'cli:write', 'value': f'hcloud {cmd}'}
+    return {'key': 'cli:invoke', 'value': f'hcloud {cmd}'}
+
+
+def is_huawei_skill(name):
+    """Check if a skill name belongs to Huawei Cloud."""
+    return name and HUAWEI_SKILL_RE.search(name)
+
+
+# ── Event writer ────────────────────────────────────────────────────
+
+def write_event(key, value, extra=None):
+    """Append a telemetry event to hook-events.jsonl.
+
+    Format matches OpenCode/DSH/WorkBuddy output exactly:
+        {"key": "...", "value": "...", "capability": "..."}
+    """
+    path = _get_hook_events_path()
+    if not path:
+        return  # Best-effort: silently skip if path is unresolvable
+
+    event = {"key": key, "value": value}
+    if extra:
+        event.update(extra)
+    try:
+        with open(path, "a", encoding="utf-8") as f:
+            f.write(json.dumps(event, ensure_ascii=False) + "\n")
+    except Exception:
+        # Best-effort; never block the main tool execution
+        pass
+
+
+# ── Command text extraction ─────────────────────────────────────────
+
+def command_text(tool_input):
+    """Extract command text from various tool_input shapes."""
+    if isinstance(tool_input, str):
+        return tool_input
+    if isinstance(tool_input, dict):
+        for key in ("command", "cmd", "script", "args", "arguments"):
+            value = tool_input.get(key)
+            if isinstance(value, list):
+                return " ".join(str(item) for item in value)
+            if value is not None:
+                return str(value)
+        return json.dumps(tool_input)
+    return json.dumps(tool_input)
+
+
+# ── Skill name extraction ───────────────────────────────────────────
+
+def extract_skill_name(tool_name, tool_input):
+    """Extract skill name from tool_input for skill-related tools.
+
+    Hermes skill tools: skill_view, skills_list, skill_manage.
+    The skill name may be in 'name', 'skill', or 'args' field.
+    """
+    if not isinstance(tool_input, dict):
+        if isinstance(tool_input, str):
+            return tool_input
+        return ""
+
+    # Common field names across agent platforms
+    return (
+        tool_input.get("name", "")
+        or tool_input.get("skill", "")
+        or tool_input.get("command", "")
+        or ""
+    )
+
+
+# ── Main hook logic ─────────────────────────────────────────────────
+
+def main():
+    try:
+        data = json.load(sys.stdin)
+    except Exception:
+        # Cannot parse input → not our concern, allow execution
+        sys.exit(0)
+
+    tool_name = data.get("tool_name", "")
+    tool_input = data.get("tool_input", {})
+
+    # ── Category 1: Skill tool loading ──
+    # Hermes skill tools: skill_view, skills_list, skill_manage
+    if tool_name in ("skill_view", "skills_list", "skill_manage", "skill"):
+        skill_name = extract_skill_name(tool_name, tool_input)
+        if is_huawei_skill(skill_name):
+            write_event('skill:retrieve', skill_name)
+
+    # ── Category 2: Bash/terminal tool with hcloud commands ──
+    elif tool_name in ("Bash", "terminal", "bash", "pwsh"):
+        command = command_text(tool_input)
+        if command and HCLOUD_RE.search(command):
+            result = classify_hcloud(command)
+            if result:
+                write_event(result['key'], result['value'], {'capability': 'cli'})
+
+    # ── Category 3: MCP Huawei Cloud tool invocations ──
+    elif tool_name.startswith("mcp__huaweicloud") or tool_name.startswith("huaweicloud_"):
+        write_event(f"tool:{tool_name}", "1", {'capability': 'mcp'})
+
+    # Always allow — telemetry hook never blocks execution
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/integrations/hermes/manifest.yaml

@@ -0,0 +1,43 @@
+manifest_version: 1
+name: huaweicloud-devkit
+description: >
+  Huawei Cloud DevKit provides Skills, MCP tools, KooCLI guidance,
+  and safety guardrails for Huawei Cloud services within Hermes Agent.
+  Includes 27 skills covering ECS, OBS, VPC, RDS, CCE, ModelArts, and more.
+
+source: https://github.com/huaweicloud/huaweicloud-devkit
+
+transport:
+  type: stdio
+  command: 'node'
+  args: ['plugins/huaweicloud-core/src/mcp-server.mjs']
+  env:
+    HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local'
+
+install:
+  type: git
+  url: https://github.com/huaweicloud/huaweicloud-devkit
+  bootstrap:
+    - 'npm ci --omit=dev'
+    - 'node plugins/huaweicloud-core/src/setup-cli.mjs install --target hermes --skip-mcp-server'
+
+auth:
+  type: none
+
+tools:
+  default_enabled: []
+
+post_install: |
+  Huawei Cloud DevKit installed successfully!
+
+  What was set up:
+    • 27 skills (ECS, OBS, VPC, RDS, CCE, ModelArts, ...) → ~/.hermes/skills/
+    • MCP tools (33 tools for CLI, auth, sandbox, safety) → config.yaml
+    • Safety hooks (pre_tool_call terminal guard) → config.yaml
+    • Safety policy → ~/.hermes/huaweicloud-plugins/safety/
+
+  Next steps:
+    1. Configure credentials: npx huaweicloud-devkit auth init
+    2. Restart Hermes Agent session (MCP tools load on restart)
+    3. Verify: hermes doctor
+    4. Try: "Help me check my ECS instances" or "Deploy this website to OBS"