huaweicloud-devkit 1.1.10-next.4 → 1.1.10-next.6

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.10-next.4",
+  "version": "1.1.10-next.6",
   "kooCliVersion": "7.3.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.10-next.4",
+  "version": "1.1.10-next.6",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.10-next.4",
+  "version": "1.1.10-next.6",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.10-next.4",
+  "version": "1.1.10-next.6",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.10-next.4",
+  "version": "1.1.10-next.6",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.10-next.4",
+  "version": "1.1.10-next.6",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.10-next.4",
+  "version": "1.1.10-next.6",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -85,7 +85,8 @@ export function computeOnboarding({ credentials, reconciled } = {}) {
     // devkit exchanges it for temporary AK/SK on demand, so no manual setup.
     scenario = 0;
     reason = 'token-auth';
-    message = '已使用 X-Auth-Token 认证,MCP 工具可直接使用,无需配置 AK/SK。';
+    message =
+      '已使用 X-Auth-Token 认证。管理面与数据面(沙箱部署/exec)都会在需要时用 token 自动换取临时 AK/SK;请确保可访问 IAM 端点。';
     return { needsSetup: false, scenario, reason, message, steps: [], accountHint };
   }
   if (s1Has && !envHasCreds) {

package/plugins/huaweicloud-core/src/hcloud-probe.mjs

@@ -111,6 +111,18 @@ export function classifyHcloudProbe(result, requiredVersion = getKooCliVersion()
     };
   }
 
+  // Probe timed out / was signal-killed: we can't tell whether hcloud is truly
+  // broken or just slow on this box — report unknown instead of unavailable so
+  // the caller doesn't falsely conclude "CLI not installed" (#P0-2).
+  if (result.signal || result.status === null || result.error?.code === 'ETIMEDOUT') {
+    return {
+      status: 'unknown',
+      installed: false,
+      ok: false,
+      errorCode: 'HCLOUD_UNKNOWN',
+    };
+  }
+
   return {
     status: 'unavailable',
     installed: false,

package/plugins/huaweicloud-core/src/koocli-install.mjs

@@ -0,0 +1,57 @@
+import { spawnSync } from 'node:child_process';
+import { chmodSync, existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+import { getKooCliVersion, kooCliDownloadBase } from './koocli-version.mjs';
+
+// Programmatic KooCLI (hcloud) install — downloadable from inside the MCP server
+// process via Node (fetch + tar via child_process), so it does NOT depend on the
+// agent's bash tool (which is unavailable in CodeArts with OPENCODE_CONFIG
+// unset — experience-report #3.5). Returns a structured result for the
+// `huaweicloud_install_hcloud` MCP tool.
+export async function installKooCli(options = {}) {
+  const os = process.platform;
+  const arch = process.arch;
+
+  // Windows auto-install needs PowerShell specifics — keep it on the CLI path.
+  if (os === 'win32') {
+    return { ok: false, error: 'Windows 环境请使用 CLI: npx huaweicloud-devkit install-hcloud' };
+  }
+  if (os !== 'linux' && os !== 'darwin') {
+    return { ok: false, error: `不支持的操作系统: ${os}` };
+  }
+
+  const installDir = options.binDir || (os === 'linux' ? join(homedir(), '.local', 'bin') : '/usr/local/bin');
+  const pkg =
+    os === 'linux' ? (arch === 'arm64' ? 'linux-arm64' : 'linux-amd64') : arch === 'arm64' ? 'mac-arm64' : 'mac-amd64';
+  const url = `${kooCliDownloadBase()}/huaweicloud-cli-${pkg}.tar.gz`;
+  const binPath = join(installDir, 'hcloud');
+
+  try {
+    mkdirSync(installDir, { recursive: true });
+
+    const tmpTar = join(installDir, `huaweicloud-cli-${pkg}.tar.gz`);
+    const resp = await fetch(url);
+    if (!resp.ok) {
+      return { ok: false, error: `下载失败 (HTTP ${resp.status}): ${url}` };
+    }
+    const buf = Buffer.from(await resp.arrayBuffer());
+    writeFileSync(tmpTar, buf);
+
+    const ex = spawnSync('tar', ['-xzf', tmpTar, '-C', installDir], { stdio: 'pipe', timeout: 60000 });
+    rmSync(tmpTar, { force: true });
+    if (ex.status !== 0) {
+      return { ok: false, error: `解压失败 (tar exit ${ex.status}): ${(ex.stderr || '').toString().slice(0, 200)}` };
+    }
+
+    if (!existsSync(binPath)) {
+      return { ok: false, error: `hcloud 二进制未生成于 ${binPath}` };
+    }
+    chmodSync(binPath, 0o755);
+
+    return { ok: true, binPath, version: getKooCliVersion() };
+  } catch (error) {
+    return { ok: false, error: error?.message || String(error) };
+  }
+}

package/plugins/huaweicloud-core/src/sandbox/hwlink-api.mjs

@@ -1,6 +1,8 @@
 import crypto from 'node:crypto';
 
-import { resolveCredentialsWithRuntime } from '../auth/credentials.mjs';
+import { resolveCredentialsWithRuntime, resolveXAuthToken } from '../auth/credentials.mjs';
+import { getTokenCredentials } from '../auth/token-exchange.mjs';
+import { makeError } from '../auth/guidance.mjs';
 import { getProxyDispatcher } from '../proxy/proxy-agent.mjs';
 
 const BASE_URL = process.env.HWLINK_ENDPOINT || 'https://devstation.myhuaweicloud.com';
@@ -82,6 +84,39 @@ export function getCredentials() {
   return { ak: credentials.ak, sk: credentials.sk, securitytoken: credentials.securityToken };
 }
 
+// Data-plane (sandbox exec/upload/tunnel) credentials: prefer AK/SK, else fall
+// back to X-Auth-Token → temporary AK/SK, so token-auth users can drive the data
+// plane without a permanent AK/SK (experience-report #3.3/#3.7 dead-loop fix).
+// NOTE: returns `securitytoken` (lowercase t) — the call sites (session-manager,
+// tools.mjs) destructure that exact spelling; returning `securityToken` here
+// silently drops the STS token from the hwlink signature (APIGW.0301).
+export async function resolveBackendCredentials() {
+  try {
+    const creds = resolveCredentialsWithRuntime({ allowMissing: true });
+    if (creds && creds.ak && creds.sk) {
+      return { ak: creds.ak, sk: creds.sk, securitytoken: creds.securityToken || '' };
+    }
+  } catch {
+    // no AK/SK — fall through to token
+  }
+  const token = resolveXAuthToken();
+  if (token) {
+    try {
+      const temp = await getTokenCredentials(token);
+      return { ak: temp.ak, sk: temp.sk, securitytoken: temp.securityToken || '' };
+    } catch (error) {
+      // Distinguish "token exchange failed" from "no credential at all" (#3.4).
+      const err = makeError('HDKIT_CRED_MISSING');
+      err.code = error?.code || 'TOKEN_EXCHANGE_FAILED';
+      err.messageZh =
+        `X-Auth-Token 换取临时 AK/SK 失败(${err.code}):` +
+        `${error?.message || '网络异常或 token 无效'},请检查网络连通性与 token 有效性。`;
+      throw err;
+    }
+  }
+  throw makeError('HDKIT_CRED_MISSING');
+}
+
 async function apiGet(path, query, ak, sk, securitytoken) {
   query = query || {};
   const qs = sortedQs(query);

package/plugins/huaweicloud-core/src/sandbox/session-manager.mjs

@@ -16,7 +16,7 @@ import { join, dirname, basename } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
-import { createConnection, getCredentials } from './hwlink-api.mjs';
+import { createConnection, resolveBackendCredentials } from './hwlink-api.mjs';
 import { getWebSocketImpl } from '../proxy/proxy-agent.mjs';
 import { trackSandboxConnect, trackSandboxDisconnect } from '../telemetry/telemetry.mjs';
 
@@ -107,7 +107,7 @@ async function getSession(workspaceId, username, timeoutMs) {
   const key = `${workspaceId}:${username}`;
   if (sessions.has(key)) return sessions.get(key);
 
-  const { ak, sk, securitytoken } = getCredentials();
+  const { ak, sk, securitytoken } = await resolveBackendCredentials();
   const { wsUrl, source } = await createConnection(workspaceId, ak, sk, securitytoken);
 
   const WebSocketImpl = await getWebSocketImpl(wsUrl);
@@ -126,7 +126,7 @@ async function getSession(workspaceId, username, timeoutMs) {
 }
 
 async function createTunnelSession(workspaceId, username, timeoutMs = 30000) {
-  const { ak, sk, securitytoken } = getCredentials();
+  const { ak, sk, securitytoken } = await resolveBackendCredentials();
   const { wsUrl, source } = await createConnection(workspaceId, ak, sk, securitytoken);
   const WebSocketImpl = await getWebSocketImpl(wsUrl);
 
@@ -165,7 +165,7 @@ async function createTunnelSession(workspaceId, username, timeoutMs = 30000) {
 }
 
 export async function execOneShot(workspaceId, command, username, timeoutMs) {
-  const { ak, sk, securitytoken } = getCredentials();
+  const { ak, sk, securitytoken } = await resolveBackendCredentials();
   const { wsUrl, source } = await createConnection(workspaceId, ak, sk, securitytoken);
 
   const WebSocketImpl = await getWebSocketImpl(wsUrl);

package/plugins/huaweicloud-core/src/tools.mjs

@@ -13,6 +13,7 @@ import { checkAccountType } from './account-type.mjs';
 import { searchMarketplace } from './search-market.mjs';
 import { getServiceIcon } from './icon-library.mjs';
 import { detectFramework } from './detect-framework.mjs';
+import { installKooCli } from './koocli-install.mjs';
 import {
   execWithSession,
   execOneShot,
@@ -35,7 +36,7 @@ import {
   hdkitCompetitionVoucherClaim,
   hdkitGenerateUserHash,
 } from './sandbox/hdkitservice-api.mjs';
-import { getCredentials } from './sandbox/hwlink-api.mjs';
+import { resolveBackendCredentials } from './sandbox/hwlink-api.mjs';
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
 import { validateIamCredentials } from './auth/credential-validator.mjs';
 import {
@@ -199,6 +200,15 @@ export const TOOL_DEFINITIONS = [
       properties: {},
     },
   },
+  {
+    name: 'huaweicloud_install_hcloud',
+    description:
+      'Install KooCLI (hcloud) from inside the MCP server process via Node (no agent bash tool required). Downloads and extracts the pinned hcloud binary to ~/.local/bin/hcloud. Use when huaweicloud_check_cli reports HCLOUD_NOT_FOUND and the agent bash tool is unavailable (e.g. CodeArts with OPENCODE_CONFIG unset).',
+    inputSchema: {
+      type: 'object',
+      properties: {},
+    },
+  },
   {
     name: 'huaweicloud_plan_cli_command',
     description: 'Classify and plan a Huawei Cloud hcloud command without executing it.',
@@ -1063,7 +1073,9 @@ function readImportFile() {
   const path = join(dirname(globalCredentialsPath()), 'creds-import.json');
   try {
     if (!existsSync(path)) return null;
-    const data = JSON.parse(readFileSync(path, 'utf8'));
+    // Strip a leading UTF-8 BOM: PowerShell `Set-Content -Encoding UTF8` writes
+    // one, which plain JSON.parse rejects (#devkit-体验报告 P1-4).
+    const data = JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''));
     return {
       ak: String(data.ak || ''),
       sk: String(data.sk || ''),
@@ -1180,6 +1192,8 @@ export async function callTool(name, rawArgs = {}, opts = {}) {
   switch (name) {
     case 'huaweicloud_check_cli':
       return runVersionCheck();
+    case 'huaweicloud_install_hcloud':
+      return installKooCli();
     case 'huaweicloud_plan_cli_command':
       return planHcloudCommand(args.args || [], { allowWrites: args.allowWrites === true });
     case 'huaweicloud_run_readonly_command':
@@ -1283,6 +1297,11 @@ export async function callTool(name, rawArgs = {}, opts = {}) {
       }
 
       if (!ak || !sk) {
+        if (sourceChannel === 'import') {
+          throw new Error(
+            'ak and sk are required. creds-import.json 缺失或无法解析（可能带 UTF-8 BOM 或非法 JSON），解析失败时文件已被清除。请用无 BOM 的 UTF-8 JSON 重新写入后重试 mode=import（PowerShell 推荐 [IO.File]::WriteAllText 配 UTF8Encoding($false)）。',
+          );
+        }
         throw new Error('ak and sk are required (or provide creds-import.json for mode=import).');
       }
 
@@ -1572,7 +1591,7 @@ export async function callTool(name, rawArgs = {}, opts = {}) {
       const apiKeyFile = '/tmp/hw_api_key';
       if (sandboxWsIdCred) {
         try {
-          const { ak, sk, securitytoken } = getCredentials();
+          const { ak, sk, securitytoken } = await resolveBackendCredentials();
           const credsScript = [
             `export HW_ACCESS_KEY='${ak}'`,
             `export HW_SECRET_KEY='${sk}'`,
@@ -2318,6 +2337,26 @@ function explainError({ service = 'unknown', errorCode = '', message = '', reque
   }
   const patternKey = SERVICE_ALIASES[svc] || resolvedService;
 
+  // devkit internal credential/environment error codes (experience-report #3.9)
+  // — these come from devkit's own guidance/credential layer, not Huawei Cloud API.
+  const devkitErrorPatterns = {
+    HDKIT_CRED_MISSING:
+      '未配置华为云凭证。运行 npx huaweicloud-devkit auth init 配置 AK/SK,或注入 HW_X_AUTH_TOKEN(devkit 会自动用 token 换取临时 AK/SK)。',
+    HDKIT_CRED_INVALID: '凭证已被华为云拒绝(AK/SK 无效或已过期)。重新生成 AK/SK 后 auth init。',
+    HDKIT_CRED_FORBIDDEN: '凭证有效但无权限列出项目。检查 IAM 授权(可用 huaweicloud_check_account_type 判断账号类型)。',
+    HDKIT_CRED_REGION_MISSING: '缺少 region 配置。运行 hcloud configure set --cli-region=<region>。',
+    HDKIT_KOOCLI_NOT_READY: 'KooCLI(hcloud)未安装或未就绪。运行 npx huaweicloud-devkit install-hcloud。',
+    HDKIT_PROJECT_ID_MISSING: '缺少 project_id。运行 npx huaweicloud-devkit auth init 自动配置。',
+    TOKEN_INVALID: 'X-Auth-Token 无效或已过期。重新注入有效的 HW_X_AUTH_TOKEN。',
+    TOKEN_EXPIRED: 'X-Auth-Token 已过期。重启进程重新注入凭证。',
+    TOKEN_EXCHANGE_FAILED:
+      'X-Auth-Token 换取临时 AK/SK 失败,通常是网络无法访问 IAM 端点。检查网络连通性与 token 有效性。',
+    HDKIT_SUB_ACCOUNT_RESTRICTED: '沙箱使用限制:当前子账号无法使用沙箱。切换主账号认证(auth_init)后重试。',
+  };
+  if (devkitErrorPatterns[errorCode]) {
+    suggestions.push(`${errorCode}: ${devkitErrorPatterns[errorCode]}`);
+  }
+
   const hwErrorPatterns = {
     OBS: {
       InvalidAccessKeyId: