huaweicloud-devkit 1.1.10-next.4 → 1.1.11

package/plugins/huaweicloud-core/skills/huawei-sandbox/references/fullstack-postgrest.md

@@ -0,0 +1,149 @@
+# Full-Stack on the Sandbox: PostgreSQL 16 + PostgREST + Nginx
+
+A REST API over a real database, fully inside the sandbox: PostgREST generates
+a RESTful API from the PostgreSQL schema; nginx serves a frontend and
+reverse-proxies `/api` to PostgREST on a single origin (no CORS needed).
+All values below are **measured** on HCE 2.0 (aarch64, no systemd, dnf) in the
+2026-10 test. Nginx templates: see `nginx-templates.md`. Tunnel exposure:
+see `tunnel-persistence.md`.
+
+## Architecture
+
+```
+browser → tunnel URL → nginx :8080
+                        ├─ /       → static frontend (index.html)
+                        └─ /api/   → proxy_pass http://127.0.0.1:3000 (PostgREST)
+                                       └─ PostgreSQL 16 :5432 → schema api
+```
+
+## Step 1: PostgreSQL 16 on HCE 2.0 (the hard part)
+
+The OS repo only ships PostgreSQL 13, but PostgREST 16.x **requires PG ≥ 14**
+(it refuses with "Cannot run in this PostgreSQL version, PostgREST needs at
+least 14.0"). PGDG is the source for PG 16 — but HCE is NOT el8-lib-compatible:
+
+```bash
+# PGDG repo RPM fails on HCE ("nothing provides /etc/redhat-release") — write the repo file by hand.
+# The el8 path is rhel-8-aarch64 WITH A HYPHEN: rhel8-aarch64 (no hyphen) 404s.
+cat > /etc/yum.repos.d/pgdg16.repo << 'PGDG_EOF'
+[pgdg16]
+name=PostgreSQL 16 for RHEL8 aarch64
+baseurl=https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-8-aarch64/
+enabled=1
+gpgcheck=0
+PGDG_EOF
+```
+
+The PGDG el8 RPMs need RHEL-8-era libraries HCE does not have. el9 RPMs fail
+differently (they want `libldap-2.5.so.0`). Install the el8 RPMs with
+`--nodeps` and shim the sonames:
+
+```bash
+BASE="https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-8-aarch64"
+# Download with resume (--max-time + -C -): GitHub/pgdn downloads from the CN
+# region stall; a partial RPM fails rpm verification and ABORTS the whole transaction,
+# silently skipping the other RPMs in the same rpm -ivh call. Install one RPM per call.
+curl -fsSL --http1.1 --max-time 240 -C - "$BASE/postgresql16-libs-16.15-1PGDG.rhel8.10.aarch64.rpm" -o /tmp/pg16-libs.rpm
+rpm -ivh --nodeps /tmp/pg16-libs.rpm
+curl -fsSL --http1.1 --max-time 240 -C - "$BASE/postgresql16-16.15-1PGDG.rhel8.10.aarch64.rpm" -o /tmp/pg16.rpm
+rpm -ivh --nodeps /tmp/pg16.rpm
+curl -fsSL --http1.1 --max-time 240 -C - "$BASE/postgresql16-server-16.15-1PGDG.rhel8.10.aarch64.rpm" -o /tmp/pg16-server.rpm
+rpm -ivh --nodeps /tmp/pg16-server.rpm
+```
+
+Soname shims (measured 2026-10):
+
+```bash
+# ICU: versioned symbols (u_strToLower_60) make symlinks IMPOSSIBLE — a
+# libicu.so.60 -> .69 symlink loads but crashes with "undefined symbol".
+# Install the REAL el8 libicu60 (different sonames, coexists with HCE's icu69):
+curl -fsSL --http1.1 --max-time 240 -C - \
+  "https://repo.almalinux.org/almalinux/8/BaseOS/aarch64/os/Packages/libicu-60.3-2.el8_1.aarch64.rpm" -o /tmp/libicu60.rpm
+rpm -ivh --nodeps --force /tmp/libicu60.rpm   # --force: license file conflicts with icu69
+
+# LDAP: postgres only uses it for LDAP auth (not needed here) — symlinks suffice.
+ln -sf /usr/lib64/libldap.so.2.0.200 /usr/lib64/libldap-2.4.so.2
+ln -sf /usr/lib64/libldap.so.2.0.200 /usr/lib64/libldap_r-2.4.so.2   # initdb needs the _r soname
+ln -sf /usr/lib64/liblber.so.2.0.200  /usr/lib64/liblber-2.4.so.2
+
+# readline: psql links libreadline.so.7 (el8); HCE has .8 — API-compatible, symlink fine.
+ln -sf /usr/lib64/libreadline.so.8 /usr/lib64/libreadline.so.7
+
+ldconfig   # registers /usr/pgsql-16/lib (libpq.so.5)
+```
+
+Init and start (PG refuses root; no systemd on HCE):
+
+```bash
+mkdir -p /var/lib/pgsql/16/data && chown postgres:postgres /var/lib/pgsql/16/data
+su - postgres -c "/usr/pgsql-16/bin/initdb -D /var/lib/pgsql/16/data"
+su - postgres -c "/usr/pgsql-16/bin/pg_ctl -D /var/lib/pgsql/16/data -l /var/lib/pgsql/16/logfile start"
+```
+
+## Step 2: PostgREST (static build) + schema
+
+PostgREST 16.4 `linux-static-aarch64` runs on HCE out of the box (musl
+static). **Dynamic Ubuntu builds do NOT work** — HCE glibc 2.34 is older than
+Ubuntu 22.04's 2.35 and the binaries fail on load.
+
+```bash
+# https://github.com/PostgREST/postgrest/releases → postgrest-v16.4.0-linux-static-aarch64.tar.xz
+mkdir -p /opt/postgrest && tar -xJf postgrest-*.tar.xz -C /opt/postgrest
+
+cat > /opt/postgrest/pgrst.conf << 'PGRST_EOF'
+db-uri = "postgres://api_user:<db-password>@localhost:5432/postgres"
+db-schemas = "api"
+db-anon-role = "api_user"
+server-host = "127.0.0.1"
+server-port = 3000
+PGRST_EOF
+
+# Schema + read-only API role (the anon role gates all writes)
+su - postgres -c "/usr/pgsql-16/bin/psql -c \"CREATE SCHEMA api; CREATE TABLE api.todos (id serial primary key, done boolean not null default false, task text not null); CREATE ROLE api_user LOGIN PASSWORD '<db-password>'; GRANT USAGE ON SCHEMA api TO api_user; GRANT SELECT ON ALL TABLES IN SCHEMA api TO api_user;\""
+
+setsid nohup /opt/postgrest/postgrest /opt/postgrest/pgrst.conf > /tmp/pgrst.log 2>&1 < /dev/null &
+disown
+curl -s http://127.0.0.1:3000/todos          # [{"id":1,...}]
+curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:3000/   # OpenAPI root, 200
+```
+
+PostgREST allows all CORS origins by default (`Access-Control-Allow-Origin: *`).
+
+## Step 3: Nginx single-origin (frontend + /api)
+
+```bash
+cat > /etc/nginx/conf.d/app.conf << 'NGINX_EOF'
+server {
+    listen <port>;
+    root /var/www/<app>;
+    index index.html;
+    location /api/ {
+        proxy_pass http://127.0.0.1:3000/;   # trailing slashes strip the /api prefix
+        proxy_set_header Host $host;
+    }
+}
+NGINX_EOF
+nginx -t && nginx -s reload 2>/dev/null || nginx
+```
+
+TRAP (measured 2026-10): nginx runs as the `nginx` user but the frontend dir is
+root-owned — `/` returns **403** until the traverse bit is set on the whole
+path chain: `chmod o+x /var/www /var/www/<app>` (and `o+r` on the files).
+This mirrors the deploy_nginx project-path permission fix.
+
+Frontend pages fetch backend data same-origin: `fetch('/api/todos?order=id.asc')`
+— no CORS, no absolute URLs, no CDN dependencies (keep pages self-contained;
+CN-region CDNs stall sandbox egress).
+
+## Step 4: Expose + keep alive
+
+```bash
+# Port on the tunnel must be the ACTUAL nginx port
+devbridge host -p <port> -e 720
+# Then install the watchdog (renewal + host re-attach + health check)
+# → huaweicloud_sandbox_keepalive_watchdog / references/tunnel-persistence.md
+```
+
+Verify end-to-end through the public URL: `GET /` (page, 200), `GET /api/todos`
+(data, 200), `POST /api/todos` (401 — the anon role has SELECT only; if a write
+API is wanted, grant INSERT/UPDATE on the specific table, never to anon broadly).

package/plugins/huaweicloud-core/skills/huawei-sandbox/references/tunnel-persistence.md

@@ -0,0 +1,121 @@
+# Tunnel Persistence: Renewal, Re-attach, and the Keepalive Watchdog
+
+DevBridge tunnel URLs are bound to the tunnel ID, not to the host process. The
+URL `https://<tunnel-id>-<port>.devbridge-s2.hwtunnel.com` keeps working as long
+as (a) the tunnel has lifetime left and (b) a `devbridge host` process is
+attached. Persistence is therefore about **preventing expiry, not recovering
+URLs** — a tunnel whose record is lost cannot be recovered with the same URL.
+
+All values below are **measured** (2026-10 tunnel-persistence test), not
+inferred. Plugin automation: `huaweicloud_sandbox_renew_tunnel` and
+`huaweicloud_sandbox_keepalive_watchdog`.
+
+## Rolling-window expiry (measured)
+
+The `-e <hours>` expiry is a **rolling window**: renewal sets
+`expiration = now + hours` regardless of remaining time.
+
+```bash
+# 14:15Z: create with a 1-hour window
+devbridge host -p 8080 -e 1          # Tunnel URL: https://nv2dvv6w-8080...
+# 14:25Z: renew 10 minutes later
+devbridge update nv2dvv6w -e 1
+# expiration = 15:25Z = renewal time + 1h (NOT original expiry + 1h)
+```
+
+Consequences:
+
+- Renewing **before** expiry keeps the same URL alive indefinitely — the
+  "permanent link" pattern is daily renewal, never URL recovery.
+- `-e` accepts **1..720** hours (720 = 30 days, exact `+2592001s`). Larger
+  values are rejected.
+
+## Reading the absolute expiration
+
+Non-verbose `show` prints a relative value only; `-v` surfaces the Unix
+timestamp:
+
+```bash
+devbridge show nv2dvv6w -v | grep -oE 'tunnelExpiration[^0-9]+[0-9]+'
+# tunnelExpiration":1795022391  (UTC seconds; ~30 days after a 720h renew)
+```
+
+## Host re-attach: same tunnel, same URL
+
+If the host process dies (sandbox restart, session teardown), re-attach with the
+tunnel ID — the URL does **not** change:
+
+```bash
+devbridge host <tunnel-id>
+```
+
+Always launch in the session-detached form so the host survives the exec
+session: `setsid nohup devbridge host <id> ... < /dev/null &` + `disown`
+(see the expose flow for why all three matter).
+
+## Three-layer keepalive watchdog (the proven pattern)
+
+Layer 1 keeps the host process alive, layer 2 keeps the lifetime topped up
+daily (29 days of tolerance if renewal ever stops firing), layer 3 detects a
+dead URL within 5 minutes. Install via
+`huaweicloud_sandbox_keepalive_watchdog`, or by hand:
+
+```bash
+cat > /tmp/tunnel-keepalive.sh << 'KEEPALIVE_EOF'
+#!/bin/bash
+# /workspace/.local/bin FIRST — it survives sandbox reboots; ~/.huawei/bin is
+# on the system disk and is wiped back to the image state on reboot (#999).
+export PATH="/workspace/.local/bin:$HOME/.huawei/bin:$PATH"
+# entries: tunnelId:url — URLs HARDCODED, never derived from port list (see trap 2)
+TUNNELS="<tunnel-id>:https://<tunnel-id>-<port>.devbridge-s2.hwtunnel.com"
+declare -A LAST_RENEW
+while true; do
+  NOW=$(date -u +%s); TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  for entry in $TUNNELS; do
+    ID="${entry%%:*}"; URL="${entry#*:}"
+    # Layer 1: host watchdog — re-attach keeps the URL (bound to tunnel ID)
+    if ! pgrep -f "devbridge host $ID" > /dev/null 2>&1; then
+      setsid nohup devbridge host "$ID" > "/tmp/host-$ID.log" 2>&1 < /dev/null &
+      echo "$TS host $ID restarted" >> /tmp/tunnel-keepalive.log; sleep 8
+    fi
+    # Layer 2: daily renewal (86400s) — rolling window keeps the URL alive
+    if [ $((${LAST_RENEW[$ID]:-0})) -eq 0 ] || [ $((NOW - ${LAST_RENEW[$ID]})) -ge 86400 ]; then
+      devbridge update "$ID" -e 720 >> /tmp/tunnel-keepalive.log 2>&1 \
+        && echo "$TS renew $ID ok (720h)" >> /tmp/tunnel-keepalive.log \
+        || echo "$TS renew $ID FAILED" >> /tmp/tunnel-keepalive.log
+      LAST_RENEW[$ID]=$NOW
+    fi
+    # Layer 3: health check every 5 min (loop sleep), log on non-200/304
+    HC=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "$URL/" 2>/dev/null || echo "000")
+    [ "$HC" != "200" ] && [ "$HC" != "304" ] \
+      && echo "$TS health $ID WARN http=$HC" >> /tmp/tunnel-keepalive.log
+  done
+  sleep 300
+done
+KEEPALIVE_EOF
+chmod +x /tmp/tunnel-keepalive.sh
+setsid nohup /tmp/tunnel-keepalive.sh > /dev/null 2>&1 < /dev/null &
+disown
+```
+
+The pgrep pattern MUST be tunnel-specific (`devbridge host $ID`) — a bare
+`pgrep -f "devbridge host"` matches _any_ tunnel's host and silently skips
+re-attaching the dead one (measured 2026-10).
+
+## Traps (all measured)
+
+1. **Health-check URL must match the served content.** The watchdog checks
+   `$URL/` — checking `$URL/todos` against a static page server logs a false
+   404 WARN on every tick. Use the path that actually returns 200/304.
+2. **Never build the health URL from `devbridge port list` output.** The table
+   lines are wrapped in OSC escape sequences, so anchored greps
+   (`^\S+ \K[0-9]+`) silently fail and the constructed URL 404s. Hardcode the
+   URL per tunnel — tunnel IDs never change, so the URL is stable.
+3. **The management plane can lose a tunnel record while the data plane still
+   serves.** `devbridge show <id>` / `devbridge update <id>` return
+   `10002 tunnel not found` even though the URL keeps working (host attached).
+   The tunnel then cannot be renewed or inspected — treat it as disposable and
+   create a fresh tunnel for anything that must survive.
+4. **Renewal success = exit 0 AND absolute expiration visible.** A bare exit
+   code from a still-running host process says nothing about the management
+   record. Verify with `show <id> -v` (see `huaweicloud_sandbox_renew_tunnel`).

package/plugins/huaweicloud-core/skills/huawei-voucher/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: huawei-voucher
 description: '查询和领取华为云激励代金券（一人一次）；领取华为开发者大赛·小红书skill创新赛专属代金券（需已完成赛事报名）。激励代金券：当用户首次使用、开始会话、询问插件能力，或提到"领券/代金券/优惠券/激励金/领取/福利"等话题时，先调 voucher_status 查领取状态：未领取（claimed=false）则主动提示可领取一张代金券并询问是否领取；已领取（claimed=true）或状态不明确则静默不打扰。赛事代金券：仅在用户明确要求领取大赛代金券时调用 competition_voucher_claim，不要主动提示。Triggers: 首次使用, 会话开始, voucher, coupon, incentive, 领券, 代金券, 优惠券, 激励金, 领取, 福利, 华为开发者大赛, 小红书, skill创新赛, 赛事代金券, 大赛代金券, 比赛领券. NOT for: 账单/费用查询（用 huawei-billing）。'
-version: 2
+version: 3
 ---
 
 # 华为云代金券
@@ -43,14 +43,16 @@ version: 2
 
 ### 3. 结果解读（错误码 UX）
 
-| 返回 message 关键特征                                                   | 含义                        | 对用户表述               |
-| ----------------------------------------------------------------------- | --------------------------- | ------------------------ |
-| `领取成功`                                                              | 发券成功                    | 告知券已到账             |
-| `已领取过` / `已领取`                                                   | 该账号已领过                | 告知已领取，不打扰       |
-| `本月代金券总额度已用完，所有账号均无法领取`                            | 全局额度用尽（HD.60630042） | 告知下月再试             |
-| `请先完成实名认证`                                                      | 账号未实名（HD.60630022）   | 引导去控制台实名认证     |
-| `发券失败: <原文>`                                                      | 其他错误                    | 原样转达，不展开         |
-| `code=HDKIT_CRED_*` / 含「未配置 / not configured / AK/SK 无效 / 限额」 | 凭证未配置、无效或达限额    | 引导用户检查并配置 AK/SK |
+| 返回 message 关键特征                                                   | 含义                        | 对用户表述                   |
+| ----------------------------------------------------------------------- | --------------------------- | ---------------------------- |
+| `领取成功`                                                              | 发券成功                    | 告知券已到账                 |
+| `已领取过` / `已领取`                                                   | 该账号已领过                | 告知已领取，不打扰           |
+| `code=HDKIT_VOUCHER_NOT_CONFIGURED`（代金券服务配置缺失…）              | 服务端未配置有效期天数      | 告知代金券暂不可用，稍后再试 |
+| `code=HDKIT_VOUCHER_EXPIRE_INVALID`（代金券失效时间配置异常…）          | 失效时间配置非法            | 告知代金券暂不可用，稍后再试 |
+| `本月代金券总额度已用完，所有账号均无法领取`                            | 全局额度用尽（HD.60630042） | 告知下月再试                 |
+| `请先完成实名认证`                                                      | 账号未实名（HD.60630022）   | 引导去控制台实名认证         |
+| `发券失败: <原文>`                                                      | 其他错误                    | 原样转达，不展开             |
+| `code=HDKIT_CRED_*` / 含「未配置 / not configured / AK/SK 无效 / 限额」 | 凭证未配置、无效或达限额    | 引导用户检查并配置 AK/SK     |
 
 ## 赛事代金券（华为开发者大赛·小红书skill创新赛）
 
@@ -75,6 +77,8 @@ version: 2
 | `已领取过` / `已领取`                                                   | 该账号已领过赛事券          | 告知已领取，不打扰                |
 | `code=HDKIT_COMPETITION_NOT_FOUND`（赛事不存在或已下线）                | 赛事配置异常                | 告知赛事暂不可用，稍后再试        |
 | `code=HDKIT_COMPETITION_NOT_CONFIGURED`（赛事代金券服务配置缺失…）      | 服务端活动参数未配置        | 告知赛事代金券暂未开放，稍后再试  |
+| `code=HDKIT_VOUCHER_NOT_CONFIGURED`（代金券服务配置缺失…）              | 服务端未配置有效期天数      | 告知代金券暂不可用，稍后再试      |
+| `code=HDKIT_VOUCHER_EXPIRE_INVALID`（代金券失效时间配置异常…）          | 失效时间配置非法            | 告知代金券暂不可用，稍后再试      |
 | `本月代金券总额度已用完，所有账号均无法领取`                            | 全局额度用尽（HD.60630042） | 告知下月再试                      |
 | `请先完成实名认证`                                                      | 账号未实名（HD.60630022）   | 引导去控制台实名认证              |
 | `code=HDKIT_CRED_*` / 含「未配置 / not configured / AK/SK 无效 / 限额」 | 凭证未配置、无效或达限额    | 引导用户检查并配置 AK/SK          |

package/plugins/huaweicloud-core/src/account-type.mjs

@@ -112,16 +112,7 @@ export async function checkAccountType({ region } = {}) {
   }
   const identity = parseCallerIdentity(identityResult.stdout);
   if (!identity.ok) {
-    // hcloud ran but stdout was not the expected JSON — usually a credentials
-    // problem surfacing as free-text error output, not a parser bug.
-    const snippet = String(identityResult.stdout || '')
-      .slice(0, 200)
-      .replace(/\s+/g, ' ');
-    return {
-      ok: false,
-      error: identity.error + (snippet ? ` (raw: ${snippet})` : ''),
-      hint: 'GetCallerIdentity 未返回 JSON，通常是凭据未就绪：请确认已运行 auth init、或平台已注入可用 STS（先用 huaweicloud_auth_status 查看 usableCredentials/credentialPanel）。',
-    };
+    return { ok: false, error: identity.error };
   }
 
   const domainsResult = await runHcloud(['IAM', 'KeystoneListAuthDomains'], {

package/plugins/huaweicloud-core/src/auth/agent-registration.mjs

@@ -31,7 +31,7 @@ function opencodeConfigFile() {
 function readJsonSafe(path) {
   if (!existsSync(path)) return null;
   try {
-    return JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''));
+    return JSON.parse(readFileSync(path, 'utf8'));
   } catch {
     return null;
   }

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -50,18 +50,11 @@ export function obsConfigPath() {
   return process.env.HCLOUD_OBS_CONFIG_PATH || join(homedir(), '.obsutilconfig');
 }
 
-// Read a JSON file, stripping a leading UTF-8 BOM (U+FEFF) if present. CodeArts
-// writes mcp_settings.json with a BOM on Windows; plain JSON.parse would throw.
-export function readJsonFile(path) {
-  const text = readFileSync(path, 'utf8');
-  return JSON.parse(text.replace(/^\uFEFF/, ''));
-}
-
 export function readGlobalCredentials() {
   const path = globalCredentialsPath();
   if (!existsSync(path)) return null;
   try {
-    return readJsonFile(path);
+    return JSON.parse(readFileSync(path, 'utf8'));
   } catch {
     return null;
   }
@@ -332,7 +325,7 @@ export function readCodeArtsCredentials() {
     const path = join(dir, '.codeartsdoer', 'mcp', 'mcp_settings.json');
     try {
       if (!existsSync(path)) continue;
-      const config = readJsonFile(path);
+      const config = JSON.parse(readFileSync(path, 'utf8'));
       const server = pickDevkitMcpServer(config?.mcpServers);
       if (!server?.env) continue;
 
@@ -362,7 +355,7 @@ export function readCodeArtsCredentials() {
   for (const path of workPaths) {
     try {
       if (!existsSync(path)) continue;
-      const config = readJsonFile(path);
+      const config = JSON.parse(readFileSync(path, 'utf8'));
       const entry = readWorkEnvironmentEntry(config);
       if (entry) return entry;
     } catch {
@@ -400,87 +393,6 @@ export function resolveCredentialsWithRuntime(options = {}) {
   return resolveCredentials(options);
 }
 
-export function resolveXAuthToken() {
-  const envToken = process.env.HW_X_AUTH_TOKEN;
-  if (present(envToken)) return envToken;
-
-  const parentCwd = getParentCwd();
-  const searchDirs = [process.env.CODEARTS_PROJECT_DIR, parentCwd, process.cwd(), homedir()];
-  for (const dir of searchDirs) {
-    if (!dir) continue;
-    const path = join(dir, '.codeartsdoer', 'mcp', 'mcp_settings.json');
-    try {
-      if (!existsSync(path)) continue;
-      const config = readJsonFile(path);
-      const server = pickDevkitMcpServer(config?.mcpServers);
-      const token = server?.env?.HW_X_AUTH_TOKEN;
-      if (present(token)) return token;
-    } catch {}
-  }
-
-  const workPaths = [
-    join(homedir(), '.codearts', 'mcp', 'mcp_settings.json'),
-    join(homedir(), '.codeartswork', 'mcp', 'mcp_settings.json'),
-  ];
-  for (const path of workPaths) {
-    try {
-      if (!existsSync(path)) continue;
-      const config = readJsonFile(path);
-      const server = pickDevkitMcpServer(config?.mcp);
-      const token = server?.environment?.HW_X_AUTH_TOKEN;
-      if (present(token)) return token;
-    } catch {}
-  }
-  return null;
-}
-
-export function resolveXAuthTokenExpiry() {
-  const v = process.env.HW_X_AUTH_TOKEN_EXPIRES_AT;
-  if (v && typeof v === 'string' && v.trim()) {
-    const asNum = Number(v.trim());
-    if (Number.isFinite(asNum) && asNum > 0) return asNum > 1e12 ? asNum : asNum * 1000;
-    const t = Date.parse(v.trim());
-    if (Number.isFinite(t)) return t;
-  }
-
-  // Fallback: 未注入 HW_X_AUTH_TOKEN_EXPIRES_AT 时，从 token 字符串自解析过期时间。
-  // X-Auth-Token 是 CMS/PKCS#7 SignedData(base64 DER),其 eContent 内嵌明文 JSON
-  // (含 token.expires_at);base64 解码 + 提取 {"token" JSON 即可读出,无需依赖注入方显式给过期时间。
-  const token = resolveXAuthToken();
-  if (!token) return null;
-  return parseXAuthTokenExpiry(token);
-}
-
-function parseXAuthTokenExpiry(token) {
-  try {
-    const pad = token + '='.repeat((4 - (token.length % 4)) % 4);
-    const text = Buffer.from(pad.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8');
-    const idx = text.indexOf('{"token"');
-    if (idx < 0) return null;
-    const tail = text.slice(idx);
-    let depth = 0;
-    let end = -1;
-    for (let i = 0; i < tail.length; i += 1) {
-      if (tail[i] === '{') depth += 1;
-      else if (tail[i] === '}') {
-        depth -= 1;
-        if (depth === 0) {
-          end = i + 1;
-          break;
-        }
-      }
-    }
-    if (end < 0) return null;
-    const obj = JSON.parse(tail.slice(0, end));
-    const expiresAt = obj?.token?.expires_at;
-    if (!expiresAt || typeof expiresAt !== 'string') return null;
-    const t = Date.parse(expiresAt);
-    return Number.isFinite(t) ? t : null;
-  } catch {
-    return null;
-  }
-}
-
 export function lastSyncPath() {
   return join(baseHome(), '.config', 'huaweicloud', '.last_sync');
 }
@@ -489,7 +401,7 @@ export function readLastSync() {
   const path = lastSyncPath();
   if (!existsSync(path)) return null;
   try {
-    return readJsonFile(path);
+    return JSON.parse(readFileSync(path, 'utf8'));
   } catch {
     return null;
   }

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -11,7 +11,6 @@ import {
   readCodeArtsCredentials,
   readGlobalCredentials,
   resolveCredentialsWithRuntime,
-  resolveXAuthToken,
   writeLastSync,
   writeObsConfig,
 } from './credentials.mjs';
@@ -80,14 +79,6 @@ export function computeOnboarding({ credentials, reconciled } = {}) {
     message = '已从码道 MCP settings 读取到临时凭证,MCP 工具可直接使用。';
     return { needsSetup: false, scenario, reason, message, steps: [], accountHint };
   }
-  if (resolveXAuthToken() && !s1Has && !envHasCreds) {
-    // X-Auth-Token authentication: no AK/SK injected but a token is present —
-    // devkit exchanges it for temporary AK/SK on demand, so no manual setup.
-    scenario = 0;
-    reason = 'token-auth';
-    message = '已使用 X-Auth-Token 认证,MCP 工具可直接使用,无需配置 AK/SK。';
-    return { needsSetup: false, scenario, reason, message, steps: [], accountHint };
-  }
   if (s1Has && !envHasCreds) {
     scenario = 1;
     reason = 's1-only';
@@ -176,7 +167,6 @@ export function getAuthStatus(target = 'all') {
   const s4Creds = readCodeArtsCredentials();
   const onboarding = computeOnboarding({ credentials, reconciled });
   const stsExpiry = computeStsExpiry();
-  const tokenAuth = resolveXAuthToken();
   const credentialPanel = {
     sts: stsExpiry, // 临时 STS（MCP==沙箱同源）
     s1: {
@@ -184,23 +174,11 @@ export function getAuthStatus(target = 'all') {
       fingerprint: credentials?.ak ? fingerprint(credentials.ak, credentials.sk) : null,
       persistent: true, // 永久，无过期
     },
-    token: tokenAuth ? { active: true } : { active: false },
-    activeSource: stsExpiry ? 'temporary-sts' : credentials?.ak ? 's1-persistent' : tokenAuth ? 'x-auth-token' : 'none',
+    activeSource: stsExpiry ? 'temporary-sts' : credentials?.ak ? 's1-persistent' : 'none',
   };
   return {
     target,
-    // usableCredentials: any credential source that makes the MCP/backend path
-    // actually work right now (S1, CodeArts settings, platform STS triplet,
-    // X-Auth-Token, or runtime creds) — supersedes the misleading
-    // credentialsConfigured/onboarding split (#P4).
-    usableCredentials: Boolean(
-      (credentials?.ak && credentials?.sk) ||
-      (s4Creds?.ak && s4Creds?.sk) ||
-      envHasRealTriplet() ||
-      tokenAuth ||
-      hasRuntimeCredentials(),
-    ),
-    credentialsConfigured: Boolean(credentials?.ak && credentials?.sk) || Boolean(tokenAuth),
+    credentialsConfigured: Boolean(credentials?.ak && credentials?.sk),
     credentialsPath: globalCredentialsPath(),
     mcpSettingsConfigured: Boolean(s4Creds?.ak && s4Creds?.sk),
     mcpSettingsSource: s4Creds ? 'codearts' : null,

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -7,13 +7,7 @@ import { dirname, join } from 'node:path';
 import { classifyHcloudArgs, redactSecrets, assertAllowed } from './safety-policy.mjs';
 import { getProxySettings } from './proxy/proxy-config.mjs';
 import { resolveHcloudCommand } from './hcloud-probe.mjs';
-import {
-  parseStsExpiry,
-  resolveCredentialsWithRuntime,
-  resolveXAuthToken,
-  resolveXAuthTokenExpiry,
-} from './auth/credentials.mjs';
-import { getTokenCredentials } from './auth/token-exchange.mjs';
+import { parseStsExpiry, resolveCredentialsWithRuntime } from './auth/credentials.mjs';
 
 const DEFAULT_TIMEOUT_MS = 60_000;
 const DEFAULT_FORCE_KILL_AFTER_MS = 2_000;
@@ -303,7 +297,7 @@ export function redactArgsWithObs(rawArgs) {
   return redactSecrets(out);
 }
 
-export async function resolveStsInjectArgs(rawArgs) {
+export function resolveStsInjectArgs(rawArgs) {
   const normalized = Array.isArray(rawArgs) ? rawArgs.map(String) : [];
   if (normalized.length === 0) return [];
   const flat = normalized.map(String);
@@ -356,25 +350,7 @@ export async function resolveStsInjectArgs(rawArgs) {
   } catch {
     return [];
   }
-  if (!creds || !creds.ak || !creds.sk) {
-    const token = resolveXAuthToken();
-    if (token) {
-      const expiry = resolveXAuthTokenExpiry();
-      if (expiry !== null && expiry - 60000 <= Date.now()) {
-        const err = new Error('X-Auth-Token 已过期，请重启进程重新注入凭证。');
-        err.code = 'TOKEN_EXPIRED';
-        throw err;
-      }
-      const temp = await getTokenCredentials(token);
-      return [
-        '--cli-access-key=' + temp.ak,
-        '--cli-secret-key=' + temp.sk,
-        '--cli-security-token=' + temp.securityToken,
-      ];
-    }
-    return [];
-  }
-  if (!creds.securityToken) return [];
+  if (!creds || !creds.ak || !creds.sk || !creds.securityToken) return [];
 
   // R3: if we can derive an expiry and the token is already at/within 60s of
   // expiring, skip injection — using a dead token would make a doomed IAM round
@@ -492,22 +468,7 @@ export async function runHcloud(args, options = {}) {
   // and R3 forbids writing them to disk). Inject per-command so hcloud actually
   // authenticates with the platform-provided STS. Injection args are appended to
   // the EXECUTED args only; classification/approval used the original args.
-  let stsInject;
-  try {
-    stsInject = await resolveStsInjectArgs(normalizedArgs);
-  } catch (error) {
-    if (error?.code === 'TOKEN_INVALID' || error?.code === 'TOKEN_EXCHANGE_FAILED' || error?.code === 'TOKEN_EXPIRED') {
-      return {
-        ok: false,
-        code: error.code,
-        error: error.message,
-        stderr: '',
-        stdout: '',
-        plan,
-      };
-    }
-    throw error;
-  }
+  const stsInject = resolveStsInjectArgs(normalizedArgs);
   if (stsInject.length > 0) {
     plan.rawArgs = [...plan.rawArgs, ...stsInject];
   }

package/plugins/huaweicloud-core/src/mcp-config-merge.mjs

@@ -3,7 +3,7 @@
 // Program-owned fields (the node executable + mcp-server.mjs path, required env
 // keys) are corrected by the installer; everything else belongs to the user.
 
-export function isPlainObject(value) {
+function isPlainObject(value) {
   return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
 

package/plugins/huaweicloud-core/src/risk-rule-engine.mjs

@@ -19,7 +19,7 @@ export function loadRiskRules(options = {}) {
 function redactEvidence(text) {
   return String(text)
     .replace(
-      /((?:access[_-]?key|secret[_-]?key|secret|security[_-]?token|x[_-]?auth[_-]?token|x[_-]?subject[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
+      /((?:access[_-]?key|secret[_-]?key|secret|security[_-]?token|x[_-]?auth[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
       '$1<redacted>',
     )
     .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>');

package/plugins/huaweicloud-core/src/safety-policy.mjs

@@ -39,7 +39,7 @@ function redactString(text) {
       // Redact the ENTIRE value of this arg — not just the first whitespace token.
       .replace(/((?:user[_-]?data|metadata|private[_-]?key)\s*[:=]\s*).*/gi, '$1<redacted>')
       .replace(
-        /((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|x[_-]?subject[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
+        /((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
         '$1<redacted>',
       )
       .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>')
@@ -297,8 +297,12 @@ export function classifyHcloudArgs(args, options = {}) {
     'chattri',
     'bucketpolicy',
     'lifecycle',
-    'cors',
-    'website',
+    // #1001: 'cors' and 'website' were removed — KooCLI 7.x's OBS wrapper does
+    // NOT expose them (`hcloud OBS help cors` → "No such command"; same for
+    // website). A nonexistent command cannot produce a write side effect, so
+    // grading it as a write was safety based on a stale assumption. CORS/static-
+    // website config goes through the REST API (PUT /?cors) — see the
+    // huawei-obs skill common-pitfalls.md CORS chapter.
     'sign',
     'share-add',
     'share-update',