huaweicloud-devkit 1.1.10-next.5 → 1.1.10-next.6

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.10-next.5",
+  "version": "1.1.10-next.6",
   "kooCliVersion": "7.3.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.10-next.5",
+  "version": "1.1.10-next.6",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.10-next.5",
+  "version": "1.1.10-next.6",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.10-next.5",
+  "version": "1.1.10-next.6",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.10-next.5",
+  "version": "1.1.10-next.6",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.10-next.5",
+  "version": "1.1.10-next.6",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.10-next.5",
+  "version": "1.1.10-next.6",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/src/hcloud-probe.mjs

@@ -111,6 +111,18 @@ export function classifyHcloudProbe(result, requiredVersion = getKooCliVersion()
     };
   }
 
+  // Probe timed out / was signal-killed: we can't tell whether hcloud is truly
+  // broken or just slow on this box — report unknown instead of unavailable so
+  // the caller doesn't falsely conclude "CLI not installed" (#P0-2).
+  if (result.signal || result.status === null || result.error?.code === 'ETIMEDOUT') {
+    return {
+      status: 'unknown',
+      installed: false,
+      ok: false,
+      errorCode: 'HCLOUD_UNKNOWN',
+    };
+  }
+
   return {
     status: 'unavailable',
     installed: false,

package/plugins/huaweicloud-core/src/sandbox/hwlink-api.mjs

@@ -87,17 +87,23 @@ export function getCredentials() {
 // Data-plane (sandbox exec/upload/tunnel) credentials: prefer AK/SK, else fall
 // back to X-Auth-Token → temporary AK/SK, so token-auth users can drive the data
 // plane without a permanent AK/SK (experience-report #3.3/#3.7 dead-loop fix).
+// NOTE: returns `securitytoken` (lowercase t) — the call sites (session-manager,
+// tools.mjs) destructure that exact spelling; returning `securityToken` here
+// silently drops the STS token from the hwlink signature (APIGW.0301).
 export async function resolveBackendCredentials() {
   try {
     const creds = resolveCredentialsWithRuntime({ allowMissing: true });
-    if (creds && creds.ak && creds.sk) return creds;
+    if (creds && creds.ak && creds.sk) {
+      return { ak: creds.ak, sk: creds.sk, securitytoken: creds.securityToken || '' };
+    }
   } catch {
     // no AK/SK — fall through to token
   }
   const token = resolveXAuthToken();
   if (token) {
     try {
-      return await getTokenCredentials(token);
+      const temp = await getTokenCredentials(token);
+      return { ak: temp.ak, sk: temp.sk, securitytoken: temp.securityToken || '' };
     } catch (error) {
       // Distinguish "token exchange failed" from "no credential at all" (#3.4).
       const err = makeError('HDKIT_CRED_MISSING');

package/plugins/huaweicloud-core/src/tools.mjs

@@ -1073,7 +1073,9 @@ function readImportFile() {
   const path = join(dirname(globalCredentialsPath()), 'creds-import.json');
   try {
     if (!existsSync(path)) return null;
-    const data = JSON.parse(readFileSync(path, 'utf8'));
+    // Strip a leading UTF-8 BOM: PowerShell `Set-Content -Encoding UTF8` writes
+    // one, which plain JSON.parse rejects (#devkit-体验报告 P1-4).
+    const data = JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''));
     return {
       ak: String(data.ak || ''),
       sk: String(data.sk || ''),
@@ -1295,6 +1297,11 @@ export async function callTool(name, rawArgs = {}, opts = {}) {
       }
 
       if (!ak || !sk) {
+        if (sourceChannel === 'import') {
+          throw new Error(
+            'ak and sk are required. creds-import.json 缺失或无法解析（可能带 UTF-8 BOM 或非法 JSON），解析失败时文件已被清除。请用无 BOM 的 UTF-8 JSON 重新写入后重试 mode=import（PowerShell 推荐 [IO.File]::WriteAllText 配 UTF8Encoding($false)）。',
+          );
+        }
         throw new Error('ak and sk are required (or provide creds-import.json for mode=import).');
       }