huaweicloud-devkit 1.1.10-next.3 → 1.1.10-next.4

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.10-next.3",
+  "version": "1.1.10-next.4",
   "kooCliVersion": "7.3.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.10-next.3",
+  "version": "1.1.10-next.4",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.10-next.3",
+  "version": "1.1.10-next.4",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.10-next.3",
+  "version": "1.1.10-next.4",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.10-next.3",
+  "version": "1.1.10-next.4",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.10-next.3",
+  "version": "1.1.10-next.4",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.10-next.3",
+  "version": "1.1.10-next.4",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/src/account-type.mjs

@@ -112,7 +112,16 @@ export async function checkAccountType({ region } = {}) {
   }
   const identity = parseCallerIdentity(identityResult.stdout);
   if (!identity.ok) {
-    return { ok: false, error: identity.error };
+    // hcloud ran but stdout was not the expected JSON — usually a credentials
+    // problem surfacing as free-text error output, not a parser bug.
+    const snippet = String(identityResult.stdout || '')
+      .slice(0, 200)
+      .replace(/\s+/g, ' ');
+    return {
+      ok: false,
+      error: identity.error + (snippet ? ` (raw: ${snippet})` : ''),
+      hint: 'GetCallerIdentity 未返回 JSON，通常是凭据未就绪：请确认已运行 auth init、或平台已注入可用 STS（先用 huaweicloud_auth_status 查看 usableCredentials/credentialPanel）。',
+    };
   }
 
   const domainsResult = await runHcloud(['IAM', 'KeystoneListAuthDomains'], {

package/plugins/huaweicloud-core/src/auth/agent-registration.mjs

@@ -31,7 +31,7 @@ function opencodeConfigFile() {
 function readJsonSafe(path) {
   if (!existsSync(path)) return null;
   try {
-    return JSON.parse(readFileSync(path, 'utf8'));
+    return JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''));
   } catch {
     return null;
   }

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -50,11 +50,18 @@ export function obsConfigPath() {
   return process.env.HCLOUD_OBS_CONFIG_PATH || join(homedir(), '.obsutilconfig');
 }
 
+// Read a JSON file, stripping a leading UTF-8 BOM (U+FEFF) if present. CodeArts
+// writes mcp_settings.json with a BOM on Windows; plain JSON.parse would throw.
+export function readJsonFile(path) {
+  const text = readFileSync(path, 'utf8');
+  return JSON.parse(text.replace(/^\uFEFF/, ''));
+}
+
 export function readGlobalCredentials() {
   const path = globalCredentialsPath();
   if (!existsSync(path)) return null;
   try {
-    return JSON.parse(readFileSync(path, 'utf8'));
+    return readJsonFile(path);
   } catch {
     return null;
   }
@@ -325,7 +332,7 @@ export function readCodeArtsCredentials() {
     const path = join(dir, '.codeartsdoer', 'mcp', 'mcp_settings.json');
     try {
       if (!existsSync(path)) continue;
-      const config = JSON.parse(readFileSync(path, 'utf8'));
+      const config = readJsonFile(path);
       const server = pickDevkitMcpServer(config?.mcpServers);
       if (!server?.env) continue;
 
@@ -355,7 +362,7 @@ export function readCodeArtsCredentials() {
   for (const path of workPaths) {
     try {
       if (!existsSync(path)) continue;
-      const config = JSON.parse(readFileSync(path, 'utf8'));
+      const config = readJsonFile(path);
       const entry = readWorkEnvironmentEntry(config);
       if (entry) return entry;
     } catch {
@@ -404,7 +411,7 @@ export function resolveXAuthToken() {
     const path = join(dir, '.codeartsdoer', 'mcp', 'mcp_settings.json');
     try {
       if (!existsSync(path)) continue;
-      const config = JSON.parse(readFileSync(path, 'utf8'));
+      const config = readJsonFile(path);
       const server = pickDevkitMcpServer(config?.mcpServers);
       const token = server?.env?.HW_X_AUTH_TOKEN;
       if (present(token)) return token;
@@ -418,7 +425,7 @@ export function resolveXAuthToken() {
   for (const path of workPaths) {
     try {
       if (!existsSync(path)) continue;
-      const config = JSON.parse(readFileSync(path, 'utf8'));
+      const config = readJsonFile(path);
       const server = pickDevkitMcpServer(config?.mcp);
       const token = server?.environment?.HW_X_AUTH_TOKEN;
       if (present(token)) return token;
@@ -482,7 +489,7 @@ export function readLastSync() {
   const path = lastSyncPath();
   if (!existsSync(path)) return null;
   try {
-    return JSON.parse(readFileSync(path, 'utf8'));
+    return readJsonFile(path);
   } catch {
     return null;
   }

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -189,6 +189,17 @@ export function getAuthStatus(target = 'all') {
   };
   return {
     target,
+    // usableCredentials: any credential source that makes the MCP/backend path
+    // actually work right now (S1, CodeArts settings, platform STS triplet,
+    // X-Auth-Token, or runtime creds) — supersedes the misleading
+    // credentialsConfigured/onboarding split (#P4).
+    usableCredentials: Boolean(
+      (credentials?.ak && credentials?.sk) ||
+      (s4Creds?.ak && s4Creds?.sk) ||
+      envHasRealTriplet() ||
+      tokenAuth ||
+      hasRuntimeCredentials(),
+    ),
     credentialsConfigured: Boolean(credentials?.ak && credentials?.sk) || Boolean(tokenAuth),
     credentialsPath: globalCredentialsPath(),
     mcpSettingsConfigured: Boolean(s4Creds?.ak && s4Creds?.sk),

package/plugins/huaweicloud-core/src/sandbox/hdkitservice-api.mjs

@@ -1,20 +1,42 @@
-import { getCredentials } from './hwlink-api.mjs';
 import { getProxyDispatcher } from '../proxy/proxy-agent.mjs';
 import { cacheUserHash } from '../telemetry/telemetry.mjs';
 import { readInstalledVersion } from '../update-check.mjs';
+import { resolveCredentialsWithRuntime, resolveXAuthToken } from '../auth/credentials.mjs';
+import { getTokenCredentials } from '../auth/token-exchange.mjs';
+import { makeError } from '../auth/guidance.mjs';
 
 function getHdkitBaseUrl() {
   return process.env.HDKITSERVICE_ENDPOINT || 'https://devkit.huaweicloud.com/rest/developer/server/hdkitservice/';
 }
 
+// Backend (hdkitservice/voucher) credentials: prefer AK/SK, else fall back to
+// X-Auth-Token → temporary AK/SK exchange, so token-auth users are not blocked.
+async function resolveBackendCredentials() {
+  try {
+    const creds = resolveCredentialsWithRuntime({ allowMissing: true });
+    if (creds && creds.ak && creds.sk) return creds;
+  } catch {
+    // no AK/SK — fall through to token
+  }
+  const token = resolveXAuthToken();
+  if (!token) return null;
+  try {
+    return await getTokenCredentials(token);
+  } catch {
+    return null;
+  }
+}
+
 async function hdkitRequest(method, path, body, timeoutMs = 300000) {
-  const { ak, sk, securitytoken } = getCredentials();
+  const creds = await resolveBackendCredentials();
+  const ak = creds?.ak;
+  const sk = creds?.sk;
+  const securitytoken = creds?.securityToken || '';
 
   if (!ak || !sk) {
-    throw new Error(
-      'Huawei Cloud credentials are not configured. ' +
-        'Run "npx huaweicloud-devkit auth init" or set HW_ACCESS_KEY/HW_SECRET_KEY.',
-    );
+    const err = makeError('HDKIT_CRED_MISSING');
+    err.detail = 'Run "npx huaweicloud-devkit auth init" or set HW_ACCESS_KEY/HW_SECRET_KEY/HW_X_AUTH_TOKEN.';
+    throw err;
   }
   const headers = {
     'Content-Type': 'application/json',

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -25,6 +25,9 @@ import { redactSecrets } from './safety-policy.mjs';
 import {
   globalCredentialsPath,
   readGlobalCredentials,
+  readJsonFile,
+  resolveCredentialsWithRuntime,
+  resolveXAuthToken,
   writeGlobalCredentials,
   writeLastSync,
   writeObsConfig,
@@ -53,8 +56,6 @@ import { queryDistTagsFetch, determineTarget, semverCompare } from './update-che
 import { getKooCliVersion, compareVersion, kooCliDownloadBase, KOO_CLI_BASE } from './koocli-version.mjs';
 import { findHcloudBin, hcloudProbeNextStep, probeHcloud } from './hcloud-probe.mjs';
 
-const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
-
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PLUGIN_ROOT = resolve(__dirname, '..');
 const PACKAGE_ROOT = resolve(PLUGIN_ROOT, '..', '..');
@@ -244,6 +245,9 @@ function officeaceSqlitePath() {
 }
 
 function openOfficeaceDb() {
+  // Lazy-require node:sqlite (experimental on Node 22.x) so CLI commands that
+  // don't touch OfficeAce (version/doctor/install) run without the flag.
+  const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
   return new DatabaseSync(officeaceSqlitePath());
 }
 
@@ -1584,7 +1588,7 @@ function codeartsStatus() {
   );
   if (existsSync(codeartsMcpSettingsFile())) {
     try {
-      const config = JSON.parse(readFileSync(codeartsMcpSettingsFile(), 'utf8'));
+      const config = readJsonFile(codeartsMcpSettingsFile());
       console.log(
         `  MCP config: ${config.mcpServers?.['huaweicloud-devkit'] ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`,
       );
@@ -1745,7 +1749,7 @@ function codeartsWorkStatus() {
   );
   if (existsSync(codeartsWorkMcpSettingsFile())) {
     try {
-      const config = JSON.parse(readFileSync(codeartsWorkMcpSettingsFile(), 'utf8'));
+      const config = readJsonFile(codeartsWorkMcpSettingsFile());
       console.log(
         `  MCP config: ${config.mcp?.['huaweicloud-devkit'] ? '\x1b[32mConfigured\x1b[0m' : '\x1b[31mNot configured\x1b[0m'}`,
       );
@@ -4310,7 +4314,27 @@ async function cmdDoctor() {
       timeout: 5000,
     });
     const hasAuth = authCheck.status === 0 && /access.?key/i.test(authCheck.stdout.toString());
-    check('hcloud credentials configured', hasAuth, 'Run: npx huaweicloud-devkit auth init');
+    if (hasAuth) {
+      check('hcloud credentials configured', true, '');
+    } else {
+      // In CodeArts, platform-injected STS / X-Auth-Token reach only the MCP
+      // server process, not this bash tool process — so `hcloud configure list`
+      // shows no profile even though the backend API path is usable. Degrade to
+      // a warning instead of a hard fail in that case (#P3 of CodeArts test).
+      let platformCredsActive = false;
+      try {
+        const c = resolveCredentialsWithRuntime({ allowMissing: true });
+        platformCredsActive = Boolean((c && c.ak && c.sk && c.securityToken) || resolveXAuthToken());
+      } catch {}
+      if (platformCredsActive) {
+        console.log(
+          `  \x1b[33m[WARN]\x1b[0m hcloud credentials configured — KooCLI 无 profile，但检测到平台凭证(MCP 通道可用);仅 KooCLI 直接调用需 auth init`,
+        );
+        warn++;
+      } else {
+        check('hcloud credentials configured', false, 'Run: npx huaweicloud-devkit auth init');
+      }
+    }
   }
 
   // Skills