huaweicloud-devkit 1.1.2-next.0 → 1.1.2-next.2

package/plugins/huaweicloud-core/skills/huawei-sandbox/references/framework-commands.md

@@ -0,0 +1,84 @@
+# Framework Command Mapping
+
+Maps web frameworks to install, build, serve commands and output directories for sandbox deployment.
+
+## Architecture Compatibility
+
+The sandbox runs **HCE OS on aarch64**. Frameworks that depend on native binaries (e.g., `@swc/core`, `esbuild`, `sharp`, `prisma`) may fail to install or build inside the sandbox since prebuilt binaries target x86_64 by default.
+
+**Recommended strategy**: build locally (x86_64) then upload the dist output to the sandbox for serving.
+
+| Dependency       | Frameworks Affected      | Mitigation                            |
+| ---------------- | ------------------------ | ------------------------------------- |
+| `@swc/core`      | Taro, Next.js 13+        | Pre-build locally, upload dist        |
+| `esbuild`        | Vite, Nuxt, uni-app      | Usually has aarch64 binary; try build |
+| `sharp`          | Gatsby, Next.js images   | Pre-build locally, upload dist        |
+| `prisma`         | Next.js, Nuxt (database) | Use `binaryTargets = ["linux-arm64"]` |
+| `node-gyp` (C++) | node-sass, bcrypt        | `build-essential` is pre-installed    |
+
+**Pre-build workflow**:
+
+1. Build on local machine (x86_64): `npm install && npm run build`
+2. Use `huaweicloud_sandbox_connect` with git config (auto-transfers code) or `huaweicloud_sandbox_upload_project` to upload dist
+3. Deploy with nginx static/SPA template — no native deps needed at runtime
+
+## SSR Frameworks
+
+| Framework | Install       | Build           | Serve                                                       | Output Dir | Port | Nginx |
+| --------- | ------------- | --------------- | ----------------------------------------------------------- | ---------- | ---- | ----- |
+| Next.js   | `npm install` | `npm run build` | `nohup npm start > /tmp/app.log 2>&1 &`                     | `.next`    | 3000 | proxy |
+| Nuxt      | `npm install` | `npm run build` | `nohup node .output/server/index.mjs > /tmp/app.log 2>&1 &` | `.output`  | 3000 | proxy |
+
+## Static Site Generators (SSG)
+
+| Framework  | Install           | Build                | Serve        | Output Dir        | Port | Nginx  |
+| ---------- | ----------------- | -------------------- | ------------ | ----------------- | ---- | ------ |
+| VitePress  | `npm install`     | `npm run docs:build` | nginx static | `.vitepress/dist` | 8080 | spa    |
+| Docusaurus | `npm install`     | `npm run build`      | nginx static | `build`           | 8080 | spa    |
+| Hugo       | (download binary) | `hugo`               | nginx static | `public`          | 8080 | static |
+| Hexo       | `npm install`     | `npm run build`      | nginx static | `public`          | 8080 | static |
+
+## SPA Frameworks
+
+| Framework                     | Install       | Build           | Serve     | Output Dir       | Port | Nginx |
+| ----------------------------- | ------------- | --------------- | --------- | ---------------- | ---- | ----- |
+| Vite (React/Vue/Svelte/Solid) | `npm install` | `npm run build` | nginx SPA | `dist`           | 8080 | spa   |
+| Create React App              | `npm install` | `npm run build` | nginx SPA | `build`          | 8080 | spa   |
+| Vue CLI                       | `npm install` | `npm run build` | nginx SPA | `dist`           | 8080 | spa   |
+| Angular                       | `npm install` | `npm run build` | nginx SPA | `dist/<project>` | 8080 | spa   |
+
+## Cross-Platform Frameworks (H5)
+
+| Framework | Install       | Build              | Serve     | Output Dir      | Port | Nginx |
+| --------- | ------------- | ------------------ | --------- | --------------- | ---- | ----- |
+| Taro      | `npm install` | `npm run build:h5` | nginx SPA | `dist`          | 8080 | spa   |
+| uni-app   | `npm install` | `npm run build:h5` | nginx SPA | `dist/build/h5` | 8080 | spa   |
+
+## Runtime Dependencies
+
+### Sandbox Pre-installed (expected)
+
+These tools should be available in the sandbox image. Verify with the pre-flight check in SKILL.md Step 3.
+
+| Tool            | Min Version | Purpose                       |
+| --------------- | ----------- | ----------------------------- |
+| Node.js         | 22.x        | All npm-based workflows       |
+| npm             | 10.x        | Package manager (fallback)    |
+| nginx           | 1.26.x      | Primary static/SSR serving    |
+| python3         | 3.12+       | HTTP server fallback          |
+| git             | 2.45.x      | Code checkout                 |
+| curl            | 8.x         | Tool downloads, health checks |
+| build-essential | -           | Native module compilation     |
+| pnpm            | 10.x        | Monorepo / workspace installs |
+
+### Install on Demand
+
+Tools that may need installation in the sandbox before building:
+
+| Tool      | Trigger                              | Install Command                                                                      |
+| --------- | ------------------------------------ | ------------------------------------------------------------------------------------ |
+| yarn      | `yarn.lock` detected                 | `npm i -g yarn`                                                                      |
+| Hugo      | `hugo.toml` / `config.toml` detected | Download Hugo extended binary (see below)                                            |
+| DevBridge | Tunnel exposure step                 | `curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh \| bash` |
+
+> Hugo download: `curl -fsSL https://github.com/gohugoio/hugo/releases/download/v0.140.0/hugo_extended_0.140.0_linux-amd64.tar.gz -o /tmp/hugo.tar.gz && sudo tar -xzf /tmp/hugo.tar.gz -C /usr/local/bin hugo && rm /tmp/hugo.tar.gz`

package/plugins/huaweicloud-core/skills/huawei-sandbox/references/nginx-templates.md

@@ -0,0 +1,100 @@
+# Nginx Configuration Templates
+
+Nginx is the primary serving mechanism for web apps deployed to the sandbox. Python `http.server` is a fallback when nginx is unavailable.
+
+## Nginx Setup (sandbox)
+
+```bash
+sudo apt-get update -qq && sudo apt-get install -y -qq nginx 2>/dev/null || true
+sudo mkdir -p /etc/nginx/conf.d
+```
+
+## Template 1: SPA (with try_files fallback)
+
+Use for: Vite, CRA, Vue CLI, Angular, VitePress, Docusaurus, Taro H5, uni-app H5
+
+```bash
+sudo tee /etc/nginx/conf.d/app.conf > /dev/null << 'NGINX_EOF'
+server {
+    listen <port>;
+    root /workspace/<project>/<outputDir>;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        expires 1h;
+        add_header Cache-Control "public, immutable";
+    }
+}
+NGINX_EOF
+sudo nginx -s reload 2>/dev/null || sudo nginx
+```
+
+## Template 2: SSR Reverse Proxy
+
+Use for: Next.js, Nuxt
+
+```bash
+sudo tee /etc/nginx/conf.d/app.conf > /dev/null << 'NGINX_EOF'
+server {
+    listen <publicPort>;
+    server_name _;
+    large_client_header_buffers 4 32k;
+
+    location / {
+        proxy_pass http://127.0.0.1:<nodePort>;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_cache_bypass $http_upgrade;
+        proxy_read_timeout 60s;
+        proxy_buffer_size 128k;
+        proxy_buffers 4 256k;
+        proxy_busy_buffers_size 256k;
+    }
+}
+NGINX_EOF
+sudo nginx -s reload 2>/dev/null || sudo nginx
+```
+
+## Template 3: Static Site (with clean URL support)
+
+Use for: Hugo, Hexo, plain static HTML
+
+```bash
+sudo tee /etc/nginx/conf.d/app.conf > /dev/null << 'NGINX_EOF'
+server {
+    listen <port>;
+    root /workspace/<project>/<outputDir>;
+    index index.html;
+
+    location / {
+        try_files $uri $uri.html $uri/ =404;
+        autoindex off;
+    }
+
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        expires 1h;
+        add_header Cache-Control "public, immutable";
+    }
+}
+NGINX_EOF
+sudo nginx -s reload 2>/dev/null || sudo nginx
+```
+
+## Fallback: Python HTTP Server
+
+When nginx fails to install or start:
+
+```bash
+cd /workspace/<project>/<outputDir> && nohup python3 -m http.server <port> > /tmp/http.log 2>&1 &
+```
+
+> This does **not** support SPA client-side routing. Use only for static sites or when nginx is truly unavailable.

package/plugins/huaweicloud-core/skills/huawei-smn-dms/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-smn-dms
-description: "Use when creating or managing SMN topics/subscriptions/messages or DMS Kafka/RabbitMQ/RocketMQ queues on Huawei Cloud. Triggers: SMN, DMS, notification, message queue, Kafka, RabbitMQ, RocketMQ, topic, subscription. NOT for: APIG (use huawei-apig), FunctionGraph triggers (use huawei-functiongraph)."
+description: 'Use when creating or managing SMN topics/subscriptions/messages or DMS Kafka/RabbitMQ/RocketMQ queues on Huawei Cloud. Triggers: SMN, DMS, notification, message queue, Kafka, RabbitMQ, RocketMQ, topic, subscription. NOT for: APIG (use huawei-apig), FunctionGraph triggers (use huawei-functiongraph).'
 version: 1
 ---
 
@@ -8,7 +8,7 @@ version: 1
 
 **STOP - Do not answer from general knowledge.** Follow the procedure below.
 
-Always run `hcloud SMN <Operation> --help` or `hcloud DMS <Operation> --help` before constructing commands.
+Always run `hcloud SMN <Operation> --help`, `hcloud Kafka <Operation> --help`, `hcloud RabbitMQ <Operation> --help`, or `hcloud RocketMQ <Operation> --help` before constructing commands.
 
 ## Overview
 
@@ -18,50 +18,57 @@ Domain expertise for SMN (Simple Message Notification) and DMS (Distributed Mess
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
+| Trap                      | Why                                                           |
+| ------------------------- | ------------------------------------------------------------- |
 | Subscription confirmation | HTTP/HTTPS subscriptions need endpoint ping-back confirmation |
-| Email subscription delay | Email subscriptions require user to click confirmation link |
-| SMS charge per message | Template SMS incurs per-delivery charges |
+| Email subscription delay  | Email subscriptions require user to click confirmation link   |
+| SMS charge per message    | Template SMS incurs per-delivery charges                      |
 
 ### Common Workflows
 
-| Task | Operation |
-|------|-----------|
-| List topics | `ListTopics --cli-region=<r> --project_id=<p>` |
-| Create topic | `CreateTopic --cli-region=<r> --project_id=<p>` |
-| Add subscription | `AddSubscription --cli-region=<r> --project_id=<p>` |
-| List subscriptions | `ListSubscriptions --cli-region=<r> --project_id=<p>` |
+| Task                    | Operation                                                 |
+| ----------------------- | --------------------------------------------------------- |
+| List topics             | `ListTopics --cli-region=<r> --project_id=<p>`            |
+| Create topic            | `CreateTopic --cli-region=<r> --project_id=<p>`           |
+| Add subscription        | `AddSubscription --cli-region=<r> --project_id=<p>`       |
+| List subscriptions      | `ListSubscriptions --cli-region=<r> --project_id=<p>`     |
 | Create message template | `CreateMessageTemplate --cli-region=<r> --project_id=<p>` |
-| Publish message | `PublishMessage --cli-region=<r> --project_id=<p>` |
-| Delete topic | `DeleteTopic --cli-region=<r> --project_id=<p>` |
+| Publish message         | `PublishMessage --cli-region=<r> --project_id=<p>`        |
+| Delete topic            | `DeleteTopic --cli-region=<r> --project_id=<p>`           |
 
 ## DMS
 
-### Service Types
+> **DMS 是产品统一品牌**，涵盖 Kafka、RabbitMQ、RocketMQ 三种引擎。在 KooCLI 中，三种引擎被拆分为独立服务，**不存在 `hcloud DMS` 命令**。
 
-| Type | KooCLI Service |
-|------|---------------|
-| Kafka | `hcloud DMS` |
-| RabbitMQ | `hcloud DMS` |
-| RocketMQ | `hcloud DMS` |
+### Engine → KooCLI Service Mapping
+
+| Engine   | KooCLI Service    | Description          |
+| -------- | ----------------- | -------------------- |
+| Kafka    | `hcloud Kafka`    | 高吞吐分布式消息队列 |
+| RabbitMQ | `hcloud RabbitMQ` | AMQP 消息代理        |
+| RocketMQ | `hcloud RocketMQ` | 低延迟金融级消息队列 |
 
 ### Common Workflows
 
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| Create Kafka instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
-| List Kafka topics | `ListTopics --cli-region=<r> --project_id=<p>` |
+| Task                     | Service    | Operation                                                          |
+| ------------------------ | ---------- | ------------------------------------------------------------------ |
+| List Kafka instances     | `Kafka`    | `ListInstances --cli-region=<r> --project_id=<p>`                  |
+| List RabbitMQ instances  | `RabbitMQ` | `ListInstancesDetails --cli-region=<r> --project_id=<p>`           |
+| List RocketMQ instances  | `RocketMQ` | `ListInstances --cli-region=<r> --project_id=<p>`                  |
+| Create Kafka instance    | `Kafka`    | `CreatePostPaidKafkaInstance --cli-region=<r> --project_id=<p>`    |
+| Create RabbitMQ instance | `RabbitMQ` | `CreatePostPaidInstanceByEngine --cli-region=<r> --project_id=<p>` |
+| Create RocketMQ instance | `RocketMQ` | `CreateInstanceByEngine --cli-region=<r> --project_id=<p>`         |
+| List Kafka topics        | `Kafka`    | `ListInstanceTopics --cli-region=<r> --project_id=<p>`             |
+| List RocketMQ topics     | `RocketMQ` | `ListRocketInstanceTopics --cli-region=<r> --project_id=<p>`       |
 
 Discover exact parameters with `--help` before executing any command.
 
 ## Troubleshooting
 
-| Error | Fix |
-|-------|-----|
-| Subscription not confirmed | SMN subscriptions need endpoint/user confirmation |
-| DMS instance creation fails | Check VPC/subnet availability and engine version |
+| Error                       | Fix                                               |
+| --------------------------- | ------------------------------------------------- |
+| Subscription not confirmed  | SMN subscriptions need endpoint/user confirmation |
+| DMS instance creation fails | Check VPC/subnet availability and engine version  |
 
 ## Cross-Skill References
 

package/plugins/huaweicloud-core/skills/huawei-voucher/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: huawei-voucher
+description: '查询和领取华为云激励代金券（一人一次）。当用户首次使用、开始会话、询问插件能力，或提到"领券/代金券/优惠券/激励金/领取/福利"等话题时，先调 voucher_status 查领取状态：未领取（claimed=false）则主动提示可领取一张代金券并询问是否领取；已领取（claimed=true）或状态不明确则静默不打扰。Triggers: 首次使用, 会话开始, voucher, coupon, incentive, 领券, 代金券, 优惠券, 激励金, 领取, 福利. NOT for: 账单/费用查询（用 huawei-billing）。'
+version: 1
+---
+
+# 华为云激励代金券
+
+## 主动提示准则（核心）
+
+此能力仅在用户尚未领取时才有价值，需避免已领取用户被反复打扰。以下场景默认执行"先查后提示"：会话开始、能力导读、首次对话、提到福利领取类话题。
+
+1. 生产环境直接调用 `huaweicloud_voucher_status`（**不传** `domain_id`，后端从 IAM 自动解析账号）。
+2. 按返回严格判定：
+   - `claimed=true` → 静默处理，不再提及代金券，不打扰用户
+   - `claimed=false` 且 `message="未领取"` → **主动提示**，用下方话术并询问是否领取
+   - 其余情况（如 `message="查询失败"`、状态不明确、调用异常）→ **严格不提示**
+3. 提示话术（可直接使用）：
+   > "你还可以领取一张华为云激励代金券（一人一次），需要我现在帮你领取吗？"
+4. 能力导读时，若判定未领取，将代金券作为**独立、靠前**的提示项，而非埋在能力清单底部。
+
+## 流程
+
+### 1. 查询状态
+
+调用 `huaweicloud_voucher_status`（生产环境无需 `domain_id`，测试环境需传 `domain_id`）。
+
+返回 `{ claimed, message }`：
+
+- `claimed=true` + `message="已领取"` → 已领取，告知结果即可，不再引导
+- `claimed=false` + `message="未领取"` → 未领取，可引导领取
+
+### 2. 领取代金券
+
+调用 `huaweicloud_voucher_claim`（生产环境无需 `domain_id`）。
+
+返回 `{ claimed, voucherId, amount, message }`。
+
+### 3. 结果解读（错误码 UX）
+
+| 返回 message 关键特征                        | 含义                        | 对用户表述           |
+| -------------------------------------------- | --------------------------- | -------------------- |
+| `领取成功`                                   | 发券成功                    | 告知券已到账         |
+| `已领取过` / `已领取`                        | 该账号已领过                | 告知已领取，不打扰   |
+| `本月代金券总额度已用完，所有账号均无法领取` | 全局额度用尽（HD.60630042） | 告知下月再试         |
+| `请先完成实名认证`                           | 账号未实名（HD.60630022）   | 引导去控制台实名认证 |
+| `发券失败: <原文>`                           | 其他错误                    | 原样转达，不展开     |
+
+## 环境注意
+
+- 生产环境：`voucher_status` / `voucher_claim` 无需传 `domain_id`，后端从 IAM 自动解析账号。
+- 测试环境：需传 `domain_id`（华为云账号 ID）；未传时返回 `测试环境需提供 domain_id`，此时可用 `hcloud IAM KeystoneListAuthDomains` 查询账号 ID 后补传。
+
+## 注意事项
+
+- 每个账号（domain_id）仅可领取一次，重复调用返回已领取。
+- 领取结果以激励服务返回为准，不要凭本地认知猜测。

package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-vpc
-description: "Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration."
+description: 'Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration.'
 version: 1
 ---
 
@@ -18,50 +18,50 @@ Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| VPC CIDR cannot change | Once set, VPC CIDR block is immutable |
-| Security group stateful | SG rules are stateful. Return traffic auto-allowed |
-| Network ACL stateless | ACL rules must allow both inbound AND outbound |
-| EIP bills when idle | Unbound EIP still charges. Release when unused |
-| Subnet AZ binding | Subnet tied to single AZ. Cross-AZ needs multiple subnets |
-| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required |
-| **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |
-| **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |
-| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS IPs: cn-north-4 (100.125.1.250 / 100.125.1.251), cn-north-1 (100.125.1.250 / 100.125.129.250), cn-east-3 (100.125.1.250 / 100.125.129.250), ap-southeast-3 (100.125.1.250 / 100.125.128.250) |
-| SCP blocks 0.0.0.0/0 SG rules | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead |
-| **VPC tags use `*` separator** | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value` |
+| Trap                                  | Why                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| VPC CIDR cannot change                | Once set, VPC CIDR block is immutable                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| Security group stateful               | SG rules are stateful. Return traffic auto-allowed                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| Network ACL stateless                 | ACL rules must allow both inbound AND outbound                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| EIP bills when idle                   | Unbound EIP still charges. Release when unused                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| Subnet AZ binding                     | Subnet tied to single AZ. Cross-AZ needs multiple subnets                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| **VPC params need nested prefix**     | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx`                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| **Security group needs no vpc_id**    | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| Subnet DNS empty → ECS no DNS         | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS (primary / secondary): cn-north-4 (100.125.1.250 / 100.125.129.250), cn-north-1 (100.125.1.250 / 100.125.21.250), cn-east-3 (100.125.1.250 / 100.125.64.250), cn-south-1 (100.125.1.250 / 100.125.136.29), ap-southeast-3 (100.125.1.250 / 100.125.128.250). Authoritative per region: `hcloud DNS ListNameServers --type=private --region=<r>` |
+| SCP blocks 0.0.0.0/0 SG rules         | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead                                                                                                                                                                                                                                                                                                                                            |
+| **VPC tags use `*` separator**        | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value`                                                                                                                                                                                                                                                                                                                                                                            |
 
 ## Common Workflows
 
-| Task | Command | Steps |
-|------|---------|-------|
-| Create VPC | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr> | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first |
-| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
-| Update subnet | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2> | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes |
-| Security group | hcloud VPC CreateSecurityGroup --security_group.name=<name> | references/security-group.md |
-| SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |
-| Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |
-| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
-| Unbind EIP | hcloud EIP DisassociatePublicip --publicip_id=<id> | references/eip.md |
-| Delete EIP | hcloud EIP DeletePublicip --publicip_id=<id> | references/eip.md |
-| List EIPs | hcloud EIP ListPublicips | |
-| NAT gateway | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id> | Run `hcloud NAT CreateNatGateway --help` for available spec values |
+| Task            | Command                                                                                                                                                                                                                                                    | Steps                                                                                                                |
+| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
+| Create VPC      | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr>                                                                                                                                                                                                   | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first                                           |
+| Create subnet   | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az>                                                  | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
+| Update subnet   | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2>                                                                                                                                                               | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes                             |
+| Security group  | hcloud VPC CreateSecurityGroup --security_group.name=<name>                                                                                                                                                                                                | references/security-group.md                                                                                         |
+| SG rule         | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md                                                                                         |
+| Create EIP      | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>                                                                                                                       | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region                                       |
+| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT                                                                                                                        | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id`                             |
+| Unbind EIP      | hcloud EIP DisassociatePublicips --publicip_id=<id>                                                                                                                                                                                                        | references/eip.md                                                                                                    |
+| Delete EIP      | hcloud EIP DeletePublicip --publicip_id=<id>                                                                                                                                                                                                               | references/eip.md                                                                                                    |
+| List EIPs       | hcloud EIP ListPublicips                                                                                                                                                                                                                                   |                                                                                                                      |
+| NAT gateway     | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id>                                                                                                                                     | Run `hcloud NAT CreateNatGateway --help` for available spec values                                                   |
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Cannot reach instance | SG missing rule or no EIP -> Add SG rule / Bind EIP |
-| Subnet CIDR conflict | Overlapping with existing subnets -> Choose non-overlapping CIDR |
-| NAT gateway no internet | Route table missing default route -> Add 0.0.0.0/0 via NAT |
-| EIP quota exceeded | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10) |
-| EIP.7905 | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage |
-| VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |
-| EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
-| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help` |
-| VPC.0209: Subnet still used | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet |
-| SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |
+| Error                                              | Root Cause -> Fix                                                                                                                                                                                                                                               |
+| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Cannot reach instance                              | SG missing rule or no EIP -> Add SG rule / Bind EIP                                                                                                                                                                                                             |
+| Subnet CIDR conflict                               | Overlapping with existing subnets -> Choose non-overlapping CIDR                                                                                                                                                                                                |
+| NAT gateway no internet                            | Route table missing default route -> Add 0.0.0.0/0 via NAT                                                                                                                                                                                                      |
+| EIP quota exceeded                                 | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10)                                                                                                                                |
+| EIP.7905                                           | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage                                                                                                                                                                                    |
+| VPC.0301: Bandwidth name invalid                   | PER type requires `--bandwidth.name`, even though `--help` marks it optional                                                                                                                                                                                    |
+| EIP has no public IP after binding                 | May need AddIngressEipV2 for ELB-type resources (see huawei-apig)                                                                                                                                                                                               |
+| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud DNS ListNameServers --type=private --region=<r>` |
+| VPC.0209: Subnet still used                        | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet                                                                                                                                                                                  |
+| SYS.0403 / SCP deny                                | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed                    |
 
 ## Security Considerations
 

package/plugins/huaweicloud-core/skills/huawei-vpc/references/network.md

@@ -4,15 +4,22 @@
 
 Subnets without DNS configuration will fail cloud-init. Use these DNS addresses:
 
-| Region | Primary DNS | Secondary DNS |
-|--------|------------|---------------|
-| cn-north-1 | 100.125.1.250 | 100.125.129.250 |
-| cn-north-4 | 100.125.1.250 | 100.125.129.250 |
-| cn-east-3 | 100.125.1.250 | 100.125.129.250 |
-| cn-south-1 | 100.125.1.250 | 100.125.129.250 |
-| ap-southeast-3 | 100.125.1.250 | 100.125.129.250 |
+| Region         | Primary DNS   | Secondary DNS   |
+| -------------- | ------------- | --------------- |
+| cn-north-1     | 100.125.1.250 | 100.125.21.250  |
+| cn-north-4     | 100.125.1.250 | 100.125.129.250 |
+| cn-east-3      | 100.125.1.250 | 100.125.64.250  |
+| cn-south-1     | 100.125.1.250 | 100.125.136.29  |
+| ap-southeast-3 | 100.125.1.250 | 100.125.128.250 |
+
+Get the authoritative values for any region at runtime (preferred over this table):
+
+```bash
+hcloud DNS ListNameServers --type=private --region=<region>
+```
 
 **Subnet create with DNS**:
+
 ```bash
 hcloud VPC CreateSubnet \
   --subnet.name=<name> \
@@ -20,20 +27,20 @@ hcloud VPC CreateSubnet \
   --subnet.cidr=10.50.1.0/24 \
   --subnet.gateway_ip=10.50.1.1 \
   --subnet.availability_zone=<az> \
-  --subnet.dnsList.1=100.125.1.250 \
-  --subnet.dnsList.2=100.125.129.250
+  --subnet.dnsList.1=<dns1> \
+  --subnet.dnsList.2=<dns2>
 ```
 
 ## Nested Prefix Summary
 
 KooCLI 7.x VPC API requires nested prefixes:
 
-| Resource | Create Param Prefix | Example |
-|----------|---------------------|---------|
-| VPC | `--vpc.` | `--vpc.name=my-vpc --vpc.cidr=192.168.0.0/16` |
-| Subnet | `--subnet.` | `--subnet.name=web --subnet.vpc_id=<id> --subnet.cidr=192.168.1.0/24` |
-| Security Group | `--security_group.` | `--security_group.name=sg-web` |
-| SG Rule | `--security_group_rule.` | `--security_group_rule.direction=ingress` |
+| Resource       | Create Param Prefix      | Example                                                               |
+| -------------- | ------------------------ | --------------------------------------------------------------------- |
+| VPC            | `--vpc.`                 | `--vpc.name=my-vpc --vpc.cidr=192.168.0.0/16`                         |
+| Subnet         | `--subnet.`              | `--subnet.name=web --subnet.vpc_id=<id> --subnet.cidr=192.168.1.0/24` |
+| Security Group | `--security_group.`      | `--security_group.name=sg-web`                                        |
+| SG Rule        | `--security_group_rule.` | `--security_group_rule.direction=ingress`                             |
 
 ## EIP Management
 

package/plugins/huaweicloud-core/skills/huawei-vpc/references/security-group.md

@@ -19,6 +19,7 @@ Security group params use `--security_group.` prefix. Rules use `--security_grou
 ## Create Security Group Rule
 
 Complete example with nested prefix:
+
 ```bash
 hcloud VPC CreateSecurityGroupRule \
   --security_group_rule.security_group_id=<sg-id> \
@@ -32,28 +33,28 @@ hcloud VPC CreateSecurityGroupRule \
 
 ## Stateful vs Stateless
 
-| Feature | Security Group | Network ACL |
-|---------|---------------|-------------|
-| Stateful? | Yes — return traffic auto-allowed | No — must allow both directions |
-| Applied to | ECS instance NIC | Subnet |
-| Rules | Allow only | Allow and Deny |
-| Default | Deny all inbound, allow all outbound | Allow all |
+| Feature    | Security Group                       | Network ACL                     |
+| ---------- | ------------------------------------ | ------------------------------- |
+| Stateful?  | Yes — return traffic auto-allowed    | No — must allow both directions |
+| Applied to | ECS instance NIC                     | Subnet                          |
+| Rules      | Allow only                           | Allow and Deny                  |
+| Default    | Deny all inbound, allow all outbound | Allow all                       |
 
 ## Common Rules Reference
 
-| Direction | Protocol | Port | Source | Purpose |
-|-----------|----------|------|--------|---------|
-| Ingress | TCP | 22 | <office-ip>/32 | SSH |
-| Ingress | TCP | 80 | 0.0.0.0/0 | HTTP |
-| Ingress | TCP | 443 | 0.0.0.0/0 | HTTPS |
-| Ingress | TCP | 3306 | <sg-app-id> | MySQL from app |
-| Ingress | TCP | 6379 | <sg-app-id> | Redis from app |
-| Egress | ALL | ALL | 0.0.0.0/0 | Outbound default |
+| Direction | Protocol | Port | Source         | Purpose          |
+| --------- | -------- | ---- | -------------- | ---------------- |
+| Ingress   | TCP      | 22   | <office-ip>/32 | SSH              |
+| Ingress   | TCP      | 80   | 0.0.0.0/0      | HTTP             |
+| Ingress   | TCP      | 443  | 0.0.0.0/0      | HTTPS            |
+| Ingress   | TCP      | 3306 | <sg-app-id>    | MySQL from app   |
+| Ingress   | TCP      | 6379 | <sg-app-id>    | Redis from app   |
+| Egress    | ALL      | ALL  | 0.0.0.0/0      | Outbound default |
 
 ## Common Errors
 
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| Cannot SSH | Default SG denies all inbound. Add port 22 rule |
-| Rule not effective | SG assigned to wrong instance. Verify NIC attachment |
-| `[USE_ERROR]不正确的参数:vpc_id` | Security groups don't need vpc_id. Remove it |
+| Error                            | Root Cause -> Fix                                    |
+| -------------------------------- | ---------------------------------------------------- |
+| Cannot SSH                       | Default SG denies all inbound. Add port 22 rule      |
+| Rule not effective               | SG assigned to wrong instance. Verify NIC attachment |
+| `[USE_ERROR]不正确的参数:vpc_id` | Security groups don't need vpc_id. Remove it         |