huaweicloud-devkit 1.1.10-next.1 → 1.1.10-next.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.10-next.1",
+  "version": "1.1.10-next.2",
   "kooCliVersion": "7.3.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.10-next.1",
+  "version": "1.1.10-next.2",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.10-next.1",
+  "version": "1.1.10-next.2",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.10-next.1",
+  "version": "1.1.10-next.2",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.10-next.1",
+  "version": "1.1.10-next.2",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.10-next.1",
+  "version": "1.1.10-next.2",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.10-next.1",
+  "version": "1.1.10-next.2",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json

@@ -429,12 +429,6 @@
             "field": "text",
             "regex": "\\bfdisk\\b"
           }
-        ],
-        "none": [
-          {
-            "field": "text",
-            "regex": "\\bhcloud\\b"
-          }
         ]
       },
       "message": "The sandbox terminal command is destructively dangerous and could destroy the workspace.",

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -393,87 +393,6 @@ export function resolveCredentialsWithRuntime(options = {}) {
   return resolveCredentials(options);
 }
 
-export function resolveXAuthToken() {
-  const envToken = process.env.HW_X_AUTH_TOKEN;
-  if (present(envToken)) return envToken;
-
-  const parentCwd = getParentCwd();
-  const searchDirs = [process.env.CODEARTS_PROJECT_DIR, parentCwd, process.cwd(), homedir()];
-  for (const dir of searchDirs) {
-    if (!dir) continue;
-    const path = join(dir, '.codeartsdoer', 'mcp', 'mcp_settings.json');
-    try {
-      if (!existsSync(path)) continue;
-      const config = JSON.parse(readFileSync(path, 'utf8'));
-      const server = pickDevkitMcpServer(config?.mcpServers);
-      const token = server?.env?.HW_X_AUTH_TOKEN;
-      if (present(token)) return token;
-    } catch {}
-  }
-
-  const workPaths = [
-    join(homedir(), '.codearts', 'mcp', 'mcp_settings.json'),
-    join(homedir(), '.codeartswork', 'mcp', 'mcp_settings.json'),
-  ];
-  for (const path of workPaths) {
-    try {
-      if (!existsSync(path)) continue;
-      const config = JSON.parse(readFileSync(path, 'utf8'));
-      const server = pickDevkitMcpServer(config?.mcp);
-      const token = server?.environment?.HW_X_AUTH_TOKEN;
-      if (present(token)) return token;
-    } catch {}
-  }
-  return null;
-}
-
-export function resolveXAuthTokenExpiry() {
-  const v = process.env.HW_X_AUTH_TOKEN_EXPIRES_AT;
-  if (v && typeof v === 'string' && v.trim()) {
-    const asNum = Number(v.trim());
-    if (Number.isFinite(asNum) && asNum > 0) return asNum > 1e12 ? asNum : asNum * 1000;
-    const t = Date.parse(v.trim());
-    if (Number.isFinite(t)) return t;
-  }
-
-  // Fallback: 未注入 HW_X_AUTH_TOKEN_EXPIRES_AT 时，从 token 字符串自解析过期时间。
-  // X-Auth-Token 是 CMS/PKCS#7 SignedData(base64 DER),其 eContent 内嵌明文 JSON
-  // (含 token.expires_at);base64 解码 + 提取 {"token" JSON 即可读出,无需依赖注入方显式给过期时间。
-  const token = resolveXAuthToken();
-  if (!token) return null;
-  return parseXAuthTokenExpiry(token);
-}
-
-function parseXAuthTokenExpiry(token) {
-  try {
-    const pad = token + '='.repeat((4 - (token.length % 4)) % 4);
-    const text = Buffer.from(pad.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8');
-    const idx = text.indexOf('{"token"');
-    if (idx < 0) return null;
-    const tail = text.slice(idx);
-    let depth = 0;
-    let end = -1;
-    for (let i = 0; i < tail.length; i += 1) {
-      if (tail[i] === '{') depth += 1;
-      else if (tail[i] === '}') {
-        depth -= 1;
-        if (depth === 0) {
-          end = i + 1;
-          break;
-        }
-      }
-    }
-    if (end < 0) return null;
-    const obj = JSON.parse(tail.slice(0, end));
-    const expiresAt = obj?.token?.expires_at;
-    if (!expiresAt || typeof expiresAt !== 'string') return null;
-    const t = Date.parse(expiresAt);
-    return Number.isFinite(t) ? t : null;
-  } catch {
-    return null;
-  }
-}
-
 export function lastSyncPath() {
   return join(baseHome(), '.config', 'huaweicloud', '.last_sync');
 }

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -7,13 +7,7 @@ import { dirname, join } from 'node:path';
 import { classifyHcloudArgs, redactSecrets, assertAllowed } from './safety-policy.mjs';
 import { getProxySettings } from './proxy/proxy-config.mjs';
 import { resolveHcloudCommand } from './hcloud-probe.mjs';
-import {
-  parseStsExpiry,
-  resolveCredentialsWithRuntime,
-  resolveXAuthToken,
-  resolveXAuthTokenExpiry,
-} from './auth/credentials.mjs';
-import { getTokenCredentials } from './auth/token-exchange.mjs';
+import { parseStsExpiry, resolveCredentialsWithRuntime } from './auth/credentials.mjs';
 
 const DEFAULT_TIMEOUT_MS = 60_000;
 const DEFAULT_FORCE_KILL_AFTER_MS = 2_000;
@@ -303,7 +297,7 @@ export function redactArgsWithObs(rawArgs) {
   return redactSecrets(out);
 }
 
-export async function resolveStsInjectArgs(rawArgs) {
+export function resolveStsInjectArgs(rawArgs) {
   const normalized = Array.isArray(rawArgs) ? rawArgs.map(String) : [];
   if (normalized.length === 0) return [];
   const flat = normalized.map(String);
@@ -356,25 +350,7 @@ export async function resolveStsInjectArgs(rawArgs) {
   } catch {
     return [];
   }
-  if (!creds || !creds.ak || !creds.sk) {
-    const token = resolveXAuthToken();
-    if (token) {
-      const expiry = resolveXAuthTokenExpiry();
-      if (expiry !== null && expiry - 60000 <= Date.now()) {
-        const err = new Error('X-Auth-Token 已过期，请重启进程重新注入凭证。');
-        err.code = 'TOKEN_EXPIRED';
-        throw err;
-      }
-      const temp = await getTokenCredentials(token);
-      return [
-        '--cli-access-key=' + temp.ak,
-        '--cli-secret-key=' + temp.sk,
-        '--cli-security-token=' + temp.securityToken,
-      ];
-    }
-    return [];
-  }
-  if (!creds.securityToken) return [];
+  if (!creds || !creds.ak || !creds.sk || !creds.securityToken) return [];
 
   // R3: if we can derive an expiry and the token is already at/within 60s of
   // expiring, skip injection — using a dead token would make a doomed IAM round
@@ -492,22 +468,7 @@ export async function runHcloud(args, options = {}) {
   // and R3 forbids writing them to disk). Inject per-command so hcloud actually
   // authenticates with the platform-provided STS. Injection args are appended to
   // the EXECUTED args only; classification/approval used the original args.
-  let stsInject;
-  try {
-    stsInject = await resolveStsInjectArgs(normalizedArgs);
-  } catch (error) {
-    if (error?.code === 'TOKEN_INVALID' || error?.code === 'TOKEN_EXCHANGE_FAILED' || error?.code === 'TOKEN_EXPIRED') {
-      return {
-        ok: false,
-        code: error.code,
-        error: error.message,
-        stderr: '',
-        stdout: '',
-        plan,
-      };
-    }
-    throw error;
-  }
+  const stsInject = resolveStsInjectArgs(normalizedArgs);
   if (stsInject.length > 0) {
     plan.rawArgs = [...plan.rawArgs, ...stsInject];
   }

package/plugins/huaweicloud-core/src/mcp-config-merge.mjs

@@ -3,7 +3,7 @@
 // Program-owned fields (the node executable + mcp-server.mjs path, required env
 // keys) are corrected by the installer; everything else belongs to the user.
 
-export function isPlainObject(value) {
+function isPlainObject(value) {
   return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
 

package/plugins/huaweicloud-core/src/risk-rule-engine.mjs

@@ -19,7 +19,7 @@ export function loadRiskRules(options = {}) {
 function redactEvidence(text) {
   return String(text)
     .replace(
-      /((?:access[_-]?key|secret[_-]?key|secret|security[_-]?token|x[_-]?auth[_-]?token|x[_-]?subject[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
+      /((?:access[_-]?key|secret[_-]?key|secret|security[_-]?token|x[_-]?auth[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
       '$1<redacted>',
     )
     .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>');

package/plugins/huaweicloud-core/src/safety-policy.mjs

@@ -39,7 +39,7 @@ function redactString(text) {
       // Redact the ENTIRE value of this arg — not just the first whitespace token.
       .replace(/((?:user[_-]?data|metadata|private[_-]?key)\s*[:=]\s*).*/gi, '$1<redacted>')
       .replace(
-        /((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|x[_-]?subject[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
+        /((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
         '$1<redacted>',
       )
       .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>')

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -44,7 +44,6 @@ import {
   applyUserDelta,
   inheritPeerUserEnv,
   detectOpenCodeEra,
-  isPlainObject,
   mergeOpenCodeEntry,
 } from './mcp-config-merge.mjs';
 import { readAgentDelta, saveAgentDelta, takeAgentDelta, purgeBackup } from './mcp-config-backup.mjs';
@@ -704,7 +703,7 @@ function resolveOpenCodeEra() {
   return (resolvedOpenCodeEra = 'v2');
 }
 
-function updateOpenCodeConfig(pluginDir, { nativePluginInstalled = false } = {}) {
+function updateOpenCodeConfig(pluginDir) {
   const configPath = opencodeConfigFile();
   const mcpPath = join(pluginDir, 'src', 'mcp-server.mjs').replace(/\\/g, '/');
   const era = resolveOpenCodeEra();
@@ -723,25 +722,6 @@ function updateOpenCodeConfig(pluginDir, { nativePluginInstalled = false } = {})
 
   const { config: next, existing, changed } = mergeOpenCodeEntry(config, { mcpPath, era });
 
-  // Native-plugin mode: the in-process plugin already bridges all 42 tools with
-  // the shared callTool layer (names, approval gate, telemetry unchanged). Keep
-  // the MCP entry for manual fallback but leave it disabled so OpenCode does
-  // not register 42 duplicate `huaweicloud-devkit_*` copies (#940 follow-up).
-  let mcpDisabled = false;
-  if (nativePluginInstalled) {
-    const key = 'huaweicloud-devkit';
-    if (era === 'v2') {
-      const servers = isPlainObject(next.mcp?.servers) ? next.mcp.servers : null;
-      if (servers && servers[key] && servers[key].disabled !== true) {
-        servers[key] = { ...servers[key], disabled: true };
-        mcpDisabled = true;
-      }
-    } else if (next.mcp?.[key] && next.mcp[key].enabled !== false) {
-      next.mcp[key] = { ...next.mcp[key], enabled: false };
-      mcpDisabled = true;
-    }
-  }
-
   // Restore user fields saved by a previous uninstall (issue #615), on fresh install only.
   if (!existing) {
     const delta = takeAgentDelta('opencode');
@@ -754,15 +734,12 @@ function updateOpenCodeConfig(pluginDir, { nativePluginInstalled = false } = {})
     }
   }
 
-  if (existing && !changed && !mcpDisabled) {
+  if (existing && !changed) {
     console.log(`  OpenCode MCP config unchanged: ${configPath}`);
     return;
   }
 
   writeMcpSettingsFile(configPath, next);
-  if (mcpDisabled) {
-    console.log(`  OpenCode MCP entry disabled (native plugin active — no duplicate tools) -> ${configPath}`);
-  }
   console.log(
     existing
       ? `  OpenCode MCP config merged (user fields preserved, ${era}): ${configPath}`
@@ -984,24 +961,7 @@ async function installOpenCode() {
   mkdirSync(opcPlugins, { recursive: true });
   copyFileSync(pluginSrc, join(opcPlugins, 'skill-tracker.js'));
   console.log(`  Plugin -> ${opcPlugins}`);
-  // OpenCode native plugin (#905 OpenCode performance): bridges all 42 MCP tools
-  // into OpenCode in-process custom tools (zod schemas + callTool), plus safety
-  // gate and telemetry. Local plugins are auto-loaded from this directory.
-  const nativePluginSrc = join(PACKAGE_ROOT, 'integrations', 'opencode', 'plugins', 'huaweicloud-devkit.js');
-  let nativePluginInstalled = false;
-  if (existsSync(nativePluginSrc)) {
-    copyFileSync(nativePluginSrc, join(opcPlugins, 'huaweicloud-devkit.js'));
-    // Deps for the native plugin (zod) live next to the OpenCode config so the
-    // plugin can require them at load time.
-    const nativePkgSrc = join(PACKAGE_ROOT, 'integrations', 'opencode', 'package.json');
-    const nativePkgDst = join(configRoot('opencode'), 'package.json');
-    if (existsSync(nativePkgSrc) && !existsSync(nativePkgDst)) {
-      copyFileSync(nativePkgSrc, nativePkgDst);
-    }
-    nativePluginInstalled = true;
-    console.log(`  Native plugin -> ${join(opcPlugins, 'huaweicloud-devkit.js')}`);
-  }
-  updateOpenCodeConfig(pluginDest, { nativePluginInstalled });
+  updateOpenCodeConfig(pluginDest);
   installRuntimeDeps(pluginDest);
 }
 
@@ -1034,11 +994,6 @@ function uninstallOpenCode() {
     removeIfExists(pluginFile);
     console.log('  Removed plugin');
   }
-  const nativePluginFile = join(configRoot('opencode'), 'plugins', 'huaweicloud-devkit.js');
-  if (existsSync(nativePluginFile)) {
-    removeIfExists(nativePluginFile);
-    console.log('  Removed native plugin');
-  }
 
   if (removeIfExists(opencodePluginsDir())) {
     console.log('  Removed MCP server and safety policy');
@@ -1086,20 +1041,7 @@ async function updateOpenCode() {
   mkdirSync(opcPlugins, { recursive: true });
   copyFileSync(pluginSrc, join(opcPlugins, 'skill-tracker.js'));
   console.log(`  Plugin updated -> ${opcPlugins}`);
-  // Native plugin refresh (#905 OpenCode performance) — overwrite in place.
-  const nativePluginSrc = join(PACKAGE_ROOT, 'integrations', 'opencode', 'plugins', 'huaweicloud-devkit.js');
-  let nativePluginInstalled = false;
-  if (existsSync(nativePluginSrc)) {
-    copyFileSync(nativePluginSrc, join(opcPlugins, 'huaweicloud-devkit.js'));
-    const nativePkgSrc = join(PACKAGE_ROOT, 'integrations', 'opencode', 'package.json');
-    const nativePkgDst = join(configRoot('opencode'), 'package.json');
-    if (existsSync(nativePkgSrc) && !existsSync(nativePkgDst)) {
-      copyFileSync(nativePkgSrc, nativePkgDst);
-    }
-    nativePluginInstalled = true;
-    console.log(`  Native plugin updated -> ${join(opcPlugins, 'huaweicloud-devkit.js')}`);
-  }
-  updateOpenCodeConfig(pluginDest, { nativePluginInstalled });
+  updateOpenCodeConfig(pluginDest);
   mkdirSync(pluginDest, { recursive: true });
   writeFileSync(join(pluginDest, '.installed'), new Date().toISOString());
   installRuntimeDeps(pluginDest);

package/integrations/opencode/package-lock.json

@@ -1,24 +0,0 @@
-{
-  "name": "@huaweicloud-devkit/opencode-integration",
-  "version": "0.0.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "@huaweicloud-devkit/opencode-integration",
-      "version": "0.0.0",
-      "dependencies": {
-        "zod": "^3.11.0"
-      }
-    },
-    "node_modules/zod": {
-      "version": "3.25.76",
-      "resolved": "https://repo.huaweicloud.com/repository/npm/zod/-/zod-3.25.76.tgz",
-      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    }
-  }
-}

package/integrations/opencode/package.json

@@ -1,10 +0,0 @@
-{
-  "name": "@huaweicloud-devkit/opencode-integration",
-  "version": "0.0.0",
-  "private": true,
-  "type": "module",
-  "description": "Local deps for the huaweicloud-devkit OpenCode plugin (zod for tool schema conversion). Installed into ~/.config/opencode by 'npx huaweicloud-devkit install --target opencode'.",
-  "dependencies": {
-    "zod": "^3.11.0"
-  }
-}

package/integrations/opencode/plugins/huaweicloud-devkit.js

@@ -1,194 +0,0 @@
-// huaweicloud-devkit OpenCode native plugin
-//
-// Bridges all 42 MCP tools into OpenCode in-process custom tools via the shared
-// callTool() business layer, plus:
-//   - tool.execute.before safety gate (classifyHcloudArgs / classifyTextCommand)
-//   - skill-tracker telemetry (superset of the legacy skill-tracker.js plugin)
-//   - STS command-level injection is inherited from callTool -> runHcloud chain
-//
-// Install: npm i -g huaweicloud-devkit && npx huaweicloud-devkit install --target opencode
-// (this file is copied to ~/.config/opencode/plugins/huaweicloud-devkit.js and
-//  auto-loaded by OpenCode at startup — local plugins need no config entry)
-//
-// Compatibility contract (unchanged from MCP mode):
-//   - tool names stay `huaweicloud_*` (skills/hook matchers keep working)
-//   - approval gate: run_approved_command still requires args+approvalToken+approvedByUser
-//   - credentials: resolveCredentials reads env (HW_*) then S1 — same priority as MCP
-
-import { appendFileSync, mkdirSync, existsSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const z = require('zod');
-
-// devkit core — resolved from the installed plugin tree next to this file
-const selfDir = dirname(fileURLToPath(import.meta.url));
-const DEVKIT_SRC = join(selfDir, '..', 'huaweicloud-plugins', 'src');
-
-let devkit = null;
-let loadError = null;
-try {
-  devkit = await import(`file://${join(DEVKIT_SRC, 'tools.mjs')}`);
-} catch (error) {
-  loadError = error;
-}
-
-// ── telemetry (superset of legacy skill-tracker.js) ─────────────────────────
-
-const TELEMETRY_DIR = join(DEVKIT_SRC, '..', 'telemetry');
-function writeEvent(key, value, extra = {}) {
-  try {
-    if (!existsSync(TELEMETRY_DIR)) mkdirSync(TELEMETRY_DIR, { recursive: true });
-    appendFileSync(join(TELEMETRY_DIR, 'hook-events.jsonl'), JSON.stringify({ key, value, ...extra }) + '\n');
-  } catch {
-    /* telemetry must never break the host */
-  }
-}
-
-function isHuaweiCloudSkill(name) {
-  return typeof name === 'string' && /^huawei/i.test(name);
-}
-
-// ── JSON Schema -> Zod converter (covers the devkit inputSchema subset) ─────
-
-function jsonSchemaToZod(schema) {
-  // schema is { type:'object', properties:{...}, required:[...] }
-  const shape = {};
-  const required = new Set(schema?.required || []);
-  for (const [name, prop] of Object.entries(schema?.properties || {})) {
-    let node;
-    switch (prop?.type) {
-      case 'string':
-        node = z.string();
-        if (prop.enum) {
-          const vals = prop.enum.filter((v) => typeof v === 'string');
-          if (vals.length > 0) node = z.enum(vals);
-        }
-        break;
-      case 'number':
-      case 'integer':
-        node = z.number();
-        break;
-      case 'boolean':
-        node = z.boolean();
-        break;
-      case 'array':
-        node = z.array(z.any());
-        break;
-      case 'object':
-      default:
-        node = z.any(); // nested objects (e.g. git{repo_url}) stay permissive
-    }
-    if (prop?.description) node = node.describe(prop.description);
-    shape[name] = required.has(name) ? node : node.optional();
-  }
-  return shape;
-}
-
-// ── safety gate (mirrors the MCP/hook deny semantics) ──────────────────────
-
-const DENY_TOOLS = new Set([
-  'huaweicloud_run_approved_command', // has its own in-tool approval gate (token check)
-]);
-
-async function safetyGate(toolName, args) {
-  if (!devkit) return; // devkit failed to load -> tools absent, nothing to gate
-  // read-only and planning tools pass through: callTool re-runs the full policy
-  // layer anyway (classifyHcloudArgs inside plan/read paths). The gate below is
-  // a fast pre-check for the raw hcloud-ish tools only.
-  if (DENY_TOOLS.has(toolName)) return;
-}
-
-// ── tool bridging ───────────────────────────────────────────────────────────
-
-function buildBridgedTools() {
-  if (!devkit) return {};
-  const tools = {};
-  const definitions = devkit.TOOL_DEFINITIONS || [];
-  for (const def of definitions) {
-    tools[def.name] = {
-      description: def.description,
-      args: jsonSchemaToZod(def.inputSchema || { type: 'object', properties: {} }),
-      async execute(args, context) {
-        const started = Date.now();
-        try {
-          await safetyGate(def.name, args);
-          const result = await devkit.callTool(def.name, args, { cwd: context?.directory });
-          writeEvent('tool:invoke', def.name, { durationMs: Date.now() - started });
-          return typeof result === 'string' ? result : { output: JSON.stringify(result, null, 2) };
-        } catch (error) {
-          // crash containment: never take the host down with a tool error
-          const payload = {
-            error: error?.message || String(error),
-            code: error?.code,
-            action: error?.action || error?.nextStep,
-          };
-          writeEvent('tool:error', def.name, { message: payload.error });
-          return { output: JSON.stringify(payload, null, 2) };
-        }
-      },
-    };
-  }
-  return tools;
-}
-
-// ── plugin export (v1 Hooks contract, IDE + CLI dual form) ─────────────────
-
-function getHooks() {
-  return {
-    'tool.execute.before': function (input, output) {
-      try {
-        if (input?.tool === 'skill') {
-          const name = output?.args?.name;
-          if (isHuaweiCloudSkill(name)) writeEvent('skill:retrieve', name);
-          return;
-        }
-        if (input?.tool === 'bash') {
-          const cmd = output?.args?.command || '';
-          if (!cmd) return;
-          // CLI read/write classification (legacy skill-tracker behavior)
-          const isHcloud = /(?:^|[;&|]\s*)hcloud(?:\.exe)?\s+/i.test(cmd);
-          if (isHcloud) {
-            const isRead = /\b(List|Show|Get|Describe|NovaList|NovaShow)\w*/i.test(cmd);
-            writeEvent(isRead ? 'cli:read' : 'cli:write', cmd.slice(0, 120), { capability: 'cli' });
-          }
-        }
-      } catch {
-        /* hooks must never throw */
-      }
-    },
-    event: function ({ event }) {
-      try {
-        if (event?.type === 'message.part.updated') {
-          const text = event?.properties?.part?.text;
-          if (typeof text === 'string') {
-            const m = text.match(/Base directory for this skill:\s*.*?skills[/\\]([a-z0-9-]+)/i);
-            if (m && isHuaweiCloudSkill(m[1])) writeEvent('skill:retrieve', m[1]);
-          }
-        }
-      } catch {
-        /* ignore */
-      }
-    },
-  };
-}
-
-function plugin() {
-  const hooks = getHooks();
-  if (loadError) {
-    // Surface a single actionable line instead of breaking startup
-    console.error(`[huaweicloud-devkit] core failed to load: ${loadError.message}`);
-    console.error(`[huaweicloud-devkit] expected devkit src at ${DEVKIT_SRC}`);
-    console.error(`[huaweicloud-devkit] run: npx huaweicloud-devkit install --target opencode`);
-    return hooks; // telemetry still works; tools absent until install is re-run
-  }
-  hooks.tool = buildBridgedTools();
-  return hooks;
-}
-
-plugin.id = 'huaweicloud-devkit';
-plugin.server = async () => plugin();
-
-export default plugin;

package/plugins/huaweicloud-core/src/auth/token-exchange.mjs

@@ -1,100 +0,0 @@
-import { fetchWithProxy } from '../proxy/proxy-agent.mjs';
-
-const DEFAULT_DURATION_SECONDS = 900;
-const DEFAULT_IAM_ENDPOINT = 'https://iam.myhuaweicloud.com';
-
-export async function exchangeTokenForCredentials(token, options = {}) {
-  const durationSeconds = options.durationSeconds ?? DEFAULT_DURATION_SECONDS;
-  const iamEndpoint = options.iamEndpoint || process.env.HW_TOKEN_IAM_ENDPOINT || DEFAULT_IAM_ENDPOINT;
-  const fetchImpl = options.fetchImpl;
-
-  const body = {
-    auth: {
-      identity: {
-        methods: ['token'],
-        token: { id: token, duration_seconds: durationSeconds },
-      },
-    },
-  };
-
-  const fetchOpts = {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json;charset=utf8' },
-    body: JSON.stringify(body),
-  };
-
-  const url = `${iamEndpoint}/v3.0/OS-CREDENTIAL/securitytokens`;
-
-  let resp;
-  try {
-    resp = fetchImpl ? await fetchImpl(url, fetchOpts) : await fetchWithProxy(url, fetchOpts);
-  } catch (error) {
-    const err = new Error(`Token exchange request failed: ${error.message}`);
-    err.code = 'TOKEN_EXCHANGE_FAILED';
-    throw err;
-  }
-
-  if (resp.status === 401 || resp.status === 403) {
-    const err = new Error('X-Auth-Token is invalid or expired.');
-    err.code = 'TOKEN_INVALID';
-    throw err;
-  }
-  if (resp.status !== 201) {
-    const err = new Error(`Token exchange returned unexpected status ${resp.status}.`);
-    err.code = 'TOKEN_EXCHANGE_FAILED';
-    throw err;
-  }
-
-  let data;
-  try {
-    data = await resp.json();
-  } catch (error) {
-    const err = new Error(`Token exchange returned malformed JSON: ${error.message}`);
-    err.code = 'TOKEN_EXCHANGE_FAILED';
-    throw err;
-  }
-  const cred = data?.credential;
-  if (!cred?.access || !cred?.secret || !cred?.securitytoken) {
-    const err = new Error('Token exchange response missing credential fields.');
-    err.code = 'TOKEN_EXCHANGE_FAILED';
-    throw err;
-  }
-  // IAM always returns expires_at; if it is absent (or unparseable) we store
-  // expiresAt:null, which never satisfies the `cached.expiresAt && …` guard in
-  // getTokenCredentials — so the cache is always a miss and we deliberately
-  // re-exchange on every call rather than risk caching credentials forever.
-  const expiresAt = cred.expires_at ? Date.parse(cred.expires_at) : NaN;
-  return {
-    ak: cred.access,
-    sk: cred.secret,
-    securityToken: cred.securitytoken,
-    expiresAt: Number.isFinite(expiresAt) ? expiresAt : null,
-  };
-}
-
-const GRACE_MS = 60 * 1000;
-
-let cached = null; // { ak, sk, securityToken, expiresAt }
-let inflight = null; // Promise 单飞
-
-export function __resetTokenCache() {
-  cached = null;
-  inflight = null;
-}
-
-export async function getTokenCredentials(token, options = {}) {
-  const now = Date.now();
-  if (cached && cached.expiresAt && cached.expiresAt - GRACE_MS > now) {
-    return cached;
-  }
-  if (inflight) return inflight;
-  inflight = (async () => {
-    try {
-      cached = await exchangeTokenForCredentials(token, options);
-      return cached;
-    } finally {
-      inflight = null;
-    }
-  })();
-  return inflight;
-}