huaweicloud-devkit 1.1.1-next.2 → 1.1.1-next.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.1-next.2",
+  "version": "1.1.1-next.3",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
   "files": [

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.1-next.2",
+  "version": "1.1.1-next.3",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.1-next.2",
+  "version": "1.1.1-next.3",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.1-next.2",
+  "version": "1.1.1-next.3",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.1-next.2",
+  "version": "1.1.1-next.3",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.1-next.2",
+  "version": "1.1.1-next.3",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.1-next.2",
+  "version": "1.1.1-next.3",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/src/auth/agent-registration.mjs

@@ -82,7 +82,7 @@ function codeartsRegistered() {
 function codeartsWorkRegistered() {
   const path = join(baseHome(), '.codeartswork', 'mcp', 'mcp_settings.json');
   const cfg = readJsonSafe(path);
-  return Boolean(cfg?.mcpServers?.['huaweicloud-devkit']);
+  return Boolean(cfg?.mcp?.['huaweicloud-devkit']);
 }
 
 function workbuddyRegistered() {

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -164,16 +164,16 @@ function readCodeArtsCredentials() {
     try {
       if (existsSync(path)) {
         const config = JSON.parse(readFileSync(path, 'utf8'));
-        const server = config?.mcpServers?.['huaweicloud-devkit'];
-        if (server?.env) {
-          const ak = server.env.HW_ACCESS_KEY;
-          const sk = server.env.HW_SECRET_KEY;
+        const server = config?.mcp?.['huaweicloud-devkit'];
+        if (server?.environment) {
+          const ak = server.environment.HW_ACCESS_KEY;
+          const sk = server.environment.HW_SECRET_KEY;
           if (ak && sk) {
             return {
               ak,
               sk,
-              securityToken: server.env.HW_SECURITY_TOKEN || '',
-              region: server.env.HW_REGION || server.env.HUAWEICLOUD_REGION || '',
+              securityToken: server.environment.HW_SECURITY_TOKEN || '',
+              region: server.environment.HW_REGION || server.environment.HUAWEICLOUD_REGION || '',
             };
           }
         }

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -1,4 +1,4 @@
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -51,11 +51,92 @@ function saveLargeOutput(rawStdout) {
   }
 }
 
+function preflightSecurityGroupCheck(normalizedArgs) {
+  const service = normalizedArgs[0];
+  const operation = normalizedArgs[1];
+  if (service !== 'ECS' || !/CreateServers|RunInstances/i.test(operation)) return [];
+
+  const sgIds = [];
+  for (const arg of normalizedArgs) {
+    const m = arg.match(/^--security_group_id(\.\d+)?=(.+)/);
+    if (m) sgIds.push(m[2]);
+  }
+  if (sgIds.length === 0) return [];
+
+  const findings = [];
+  for (const sgId of sgIds) {
+    try {
+      const hcloudBin = process.env.HCLOUD_BIN || 'hcloud';
+      const r = spawnSync(hcloudBin, ['VPC', 'ListSecurityGroupRules', `--security_group_id=${sgId}`], {
+        shell: false,
+        windowsHide: true,
+        stdio: 'pipe',
+        timeout: 20000,
+      });
+      const stdout = (r.stdout || '').toString();
+      if (r.status !== 0 || !stdout.includes('security_group_rules')) continue;
+
+      const bracketIdx = stdout.indexOf('{');
+      const jsonText = bracketIdx >= 0 ? stdout.slice(bracketIdx) : stdout;
+      const data = JSON.parse(jsonText);
+      const rules = data?.security_group_rules || [];
+
+      for (const rule of rules) {
+        const direction = rule.direction || '';
+        const remoteIp = rule.remote_ip_prefix || rule.remote_address_group_id || '';
+        const portMin = String(rule.port_range_min || rule.multiport || '');
+        const portMax = String(rule.port_range_max || rule.multiport || '');
+        const protocol = (rule.protocol || '').toLowerCase();
+        if (direction !== 'ingress') continue;
+        if (remoteIp !== '0.0.0.0/0' && remoteIp !== '::/0') continue;
+        if (protocol === 'icmp' || protocol === 'icmpv6') {
+          findings.push({
+            severity: 'warn',
+            title: `Security group ${sgId}: ICMP open to public`,
+            message: `安全组 ${sgId} 对公网开放了 ICMP (ping)，可能被用于探测。是否继续？`,
+          });
+          continue;
+        }
+        const sensitivePorts = ['22', '3389', '3306', '5432', '6379', '9200', '27017', '8080', '8443'];
+        const port = portMin || portMax;
+        if (port && sensitivePorts.includes(port)) {
+          findings.push({
+            severity: 'deny',
+            title: `Security group ${sgId}: port ${port} open to public`,
+            message: `安全组 ${sgId} 已对公网开放 ${port} 端口（${protocol || 'TCP'}）。确认继续创建 ECS？`,
+          });
+        }
+      }
+    } catch (error) {
+      // Preflight failed silently; don't block the plan
+    }
+  }
+  return findings;
+}
+
+function applyPreflightFindings(classification, sgFindings) {
+  if (!sgFindings || sgFindings.length === 0) return classification;
+  const hasDeny = sgFindings.some((f) => f.severity === 'deny');
+  if (hasDeny) {
+    return {
+      ...classification,
+      decision: 'deny',
+      risk: 'public_exposure',
+      reason: sgFindings[0].message,
+    };
+  }
+  return classification;
+}
+
 export function planHcloudCommand(args, options = {}) {
   const normalizedArgs = Array.isArray(args) ? args.map(String) : [];
   const classification = classifyHcloudArgs(normalizedArgs, options);
   const command = ['hcloud', ...normalizedArgs].map((arg) => quoteShellArg(arg)).join(' ');
   const warnings = planningWarnings(normalizedArgs);
+  const sgFindings = preflightSecurityGroupCheck(normalizedArgs);
+  if (sgFindings.length > 0) {
+    for (const f of sgFindings) warnings.push(f);
+  }
   const paramValidation = validateRequiredParams(normalizedArgs);
   if (paramValidation.missing.length > 0) {
     warnings.push('Missing required parameters: ' + paramValidation.missing.join(', '));
@@ -69,7 +150,8 @@ export function planHcloudCommand(args, options = {}) {
     command: redactOutput(command),
     executableBlock: redactOutput(command),
     warnings,
-    classification,
+    classification: applyPreflightFindings(classification, sgFindings),
+    sgFindings,
     approvalToken: createApprovalToken(normalizedArgs),
     safeToRun: classification.decision === 'allow',
   };

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -1272,36 +1272,37 @@ function codeartsStatus() {
 function registerCodeartsWorkMcp() {
   const configPath = codeartsWorkMcpSettingsFile();
   const mcpPath = join(codeartsWorkPluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
-  const env = { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' };
+  const environment = { HUAWEICLOUD_AGENT_TOOLKIT_MODE: 'local' };
   const hcloudBin = findHcloudBin();
-  if (hcloudBin) env.HCLOUD_BIN = hcloudBin.replace(/\\/g, '/');
+  if (hcloudBin) environment.HCLOUD_BIN = hcloudBin.replace(/\\/g, '/');
   let config = {};
   if (existsSync(configPath)) {
     try {
       config = JSON.parse(readFileSync(configPath, 'utf8'));
     } catch {
       console.log(
-        `  \x1b[33m[WARN]\x1b[0m Could not parse ${configPath}. Skipping MCP config write; ensure "mcpServers.huaweicloud-devkit" points to ${mcpPath}.`,
+        `  \x1b[33m[WARN]\x1b[0m Could not parse ${configPath}. Skipping MCP config write; ensure "mcp.huaweicloud-devkit" points to ${mcpPath}.`,
       );
       return;
     }
-    const existing = config.mcpServers?.['huaweicloud-devkit'];
+    const existing = config.mcp?.['huaweicloud-devkit'];
     if (
       existing &&
-      existing.command === 'node' &&
-      Array.isArray(existing.args) &&
-      existing.args[0] === mcpPath &&
+      existing.type === 'local' &&
+      Array.isArray(existing.command) &&
+      existing.command[0] === 'node' &&
+      existing.command[1] === mcpPath &&
       existing.timeout === 300000
     ) {
       console.log(`  MCP config unchanged: ${configPath}`);
       return;
     }
   }
-  config.mcpServers = config.mcpServers || {};
-  config.mcpServers['huaweicloud-devkit'] = {
-    command: 'node',
-    args: [mcpPath],
-    env,
+  config.mcp = config.mcp || {};
+  config.mcp['huaweicloud-devkit'] = {
+    type: 'local',
+    command: ['node', mcpPath],
+    environment,
     enabled: true,
     timeout: 300000,
   };
@@ -1369,9 +1370,9 @@ function uninstallCodeArtsWork() {
     try {
       config = JSON.parse(readFileSync(configPath, 'utf8'));
     } catch {}
-    if (config.mcpServers?.['huaweicloud-devkit']) {
-      delete config.mcpServers['huaweicloud-devkit'];
-      if (Object.keys(config.mcpServers).length === 0) delete config.mcpServers;
+    if (config.mcp?.['huaweicloud-devkit']) {
+      delete config.mcp['huaweicloud-devkit'];
+      if (Object.keys(config.mcp).length === 0) delete config.mcp;
       writeFileSync(configPath, JSON.stringify(config, null, 2));
       console.log(`  Config cleaned: ${configPath}`);
     }
@@ -1399,7 +1400,7 @@ function codeartsWorkStatus() {
     try {
       const config = JSON.parse(readFileSync(codeartsWorkMcpSettingsFile(), 'utf8'));
       console.log(
-        `  MCP config: ${config.mcpServers?.['huaweicloud-devkit'] ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`,
+        `  MCP config: ${config.mcp?.['huaweicloud-devkit'] ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`,
       );
     } catch {
       console.log(`  MCP config: \x1b[31mInvalid\x1b[0m`);
@@ -3146,7 +3147,7 @@ async function cmdDoctor() {
   if (!mcpConfigured && existsSync(codeartsWorkCfg)) {
     try {
       const cfg = JSON.parse(readFileSync(codeartsWorkCfg, 'utf8'));
-      if (cfg.mcpServers && cfg.mcpServers['huaweicloud-devkit']) {
+      if (cfg.mcp && cfg.mcp['huaweicloud-devkit']) {
         mcpConfigured = true;
         mcpCfgTarget = 'CodeArts Work';
       }