npm - huaweicloud-devkit - Versions diffs - 1.1.2-next.0 → 1.1.2-next.2 - Mend

huaweicloud-devkit 1.1.2-next.0 → 1.1.2-next.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (125) hide show

package/plugins/huaweicloud-core/skills/huawei-vpc/references/subnet.md CHANGED Viewed

@@ -26,25 +26,25 @@ hcloud VPC CreateSubnet --vpc_id=xxx
 ## Key Constraints
-| Constraint | Detail |
-|-----------|--------|
+| Constraint                | Detail                                                         |
+| ------------------------- | -------------------------------------------------------------- |
 | Subnet bound to single AZ | Cross-AZ needs multiple subnets. AZ code format: `cn-south-1a` |
-| CIDR must not overlap | Cannot overlap with other subnets in same VPC |
-| Gateway IP auto-assigned | Default is first IP in CIDR range (e.g., 192.168.1.1 for /24) |
-| 5 IPs reserved per subnet | First 4 + broadcast reserved by platform |
+| CIDR must not overlap     | Cannot overlap with other subnets in same VPC                  |
+| Gateway IP auto-assigned  | Default is first IP in CIDR range (e.g., 192.168.1.1 for /24)  |
+| 5 IPs reserved per subnet | First 4 + broadcast reserved by platform                       |
 ## Common Errors
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| `[USE_ERROR]不正确的参数:name` | Missing nested prefix. Use `--vpc.name=` or `--subnet.name=` |
-| CIDR overlap | Subnet CIDR must be within VPC CIDR and not overlap others |
-| AZ not found | Use `hcloud ECS NovaListAvailabilityZones --cli-region=<r>` to list valid AZ codes |
+| Error                          | Root Cause -> Fix                                                                  |
+| ------------------------------ | ---------------------------------------------------------------------------------- |
+| `[USE_ERROR]不正确的参数:name` | Missing nested prefix. Use `--vpc.name=` or `--subnet.name=`                       |
+| CIDR overlap                   | Subnet CIDR must be within VPC CIDR and not overlap others                         |
+| AZ not found                   | Use `hcloud ECS NovaListAvailabilityZones --cli-region=<r>` to list valid AZ codes |
 ## CIDR Planning Reference
-| Environment | VPC CIDR | Subnet CIDR |
-|------------|----------|-------------|
-| Dev | 192.168.0.0/16 | 192.168.1.0/24 |
-| Staging | 10.0.0.0/16 | 10.0.1.0/24 |
-| Production | 172.16.0.0/16 | 172.16.1.0/24 (public) + 172.16.2.0/24 (private) |
+| Environment | VPC CIDR       | Subnet CIDR                                      |
+| ----------- | -------------- | ------------------------------------------------ |
+| Dev         | 192.168.0.0/16 | 192.168.1.0/24                                   |
+| Staging     | 10.0.0.0/16    | 10.0.1.0/24                                      |
+| Production  | 172.16.0.0/16  | 172.16.1.0/24 (public) + 172.16.2.0/24 (private) |

package/plugins/huaweicloud-core/skills/huawei-waf-aad/SKILL.md CHANGED Viewed

@@ -1,6 +1,6 @@
 ---
 name: huawei-waf-aad
-description: "Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts)."
+description: 'Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts).'
 version: 1
 ---
@@ -16,40 +16,43 @@ Domain expertise for WAF and Anti-DDoS. Covers WAF policy/rules, AAD protection,
 ## Critical Warnings
-| Trap | Why |
-|------|-----|
-| WAF needs CNAME redirect | DNS must point to WAF endpoint, not server IP |
-| Premium instance required | Cloud WAF needs a dedicated/premium WAF instance |
+| Trap                       | Why                                                               |
+| -------------------------- | ----------------------------------------------------------------- |
+| WAF needs CNAME redirect   | DNS must point to WAF endpoint, not server IP                     |
+| Premium instance required  | Cloud WAF needs a dedicated/premium WAF instance                  |
 | AAD Standard vs Enterprise | Standard protects single IP. Enterprise protects entire IP ranges |
-| Rule order matters | WAF rules evaluated top-to-bottom within a policy |
+| Rule order matters         | WAF rules evaluated top-to-bottom within a policy                 |
 ## Common Workflows
 ### WAF
-| Task | Operation |
-|------|-----------|
-| List WAF instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| List policies | `ListPolicies --cli-region=<r> --project_id=<p>` |
-| Create custom rule | `BatchCreateCustomRule --cli-region=<r> --project_id=<p>` |
+| Task                | Operation                                                       |
+| ------------------- | --------------------------------------------------------------- |
+| List WAF instances  | `ListCompositeHosts --cli-region=<r> --project_id=<p>`          |
+| List policies       | `ListPolicy --cli-region=<r> --project_id=<p>`                  |
+| Create custom rule  | `BatchCreateCustomRule --cli-region=<r> --project_id=<p>`       |
 | Create IP blacklist | `BatchCreateWhiteblackipRule --cli-region=<r> --project_id=<p>` |
-| Create CC rule | `BatchCreateCcRule --cli-region=<r> --project_id=<p>` |
-| Create geo rule | `BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>` |
+| Create CC rule      | `BatchCreateCcRule --cli-region=<r> --project_id=<p>`           |
+| Create geo rule     | `BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>`        |
 ### AAD
 ```bash
-hcloud AAD ListInstances --cli-region=<r> --project_id=<p>
-hcloud AAD CreateInstance --cli-region=<r> --project_id=<p>
+# List AAD instances (requires --cli-region=cn-north-4 or ap-southeast-1)
+hcloud AAD ListInstance --cli-region=<r> --project_id=<p>
+# List DDoS attack events
+hcloud AAD ListDDoSAttackEvent --cli-region=<r> --project_id=<p>
 ```
 ## Troubleshooting
-| Error | Fix |
-|-------|-----|
-| Website unreachable after WAF | Check CNAME record points to WAF endpoint |
-| WAF blocking legitimate traffic | Check rules order, adjust false positive settings |
-| AAD not responding | Standard AAD only protects single EIP. Check EIP binding |
+| Error                           | Fix                                                      |
+| ------------------------------- | -------------------------------------------------------- |
+| Website unreachable after WAF   | Check CNAME record points to WAF endpoint                |
+| WAF blocking legitimate traffic | Check rules order, adjust false positive settings        |
+| AAD not responding              | Standard AAD only protects single EIP. Check EIP binding |
 ## Security

package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/SKILL.md CHANGED Viewed

@@ -11,12 +11,12 @@ Use this skill when the deliverable is application code, API integration, or pre
 ## Critical Warnings
-| Trap | Why |
-|------|-----|
-| `project_id` in path for most services | Many Huawei Cloud APIs require `project_id` in the URL path. Get it from IAM or KooCLI profile |
-| Pagination is not automatic | APIs return paginated results. Always check for `next_marker` or `page_info` to avoid partial data |
-| AK/SK signing algorithm | Huawei Cloud uses HMAC-SHA256 signing with specific header ordering. Use SDK, don't implement manually |
-| Endpoint varies by service and region | Always verify at https://developer.huaweicloud.com/endpoint |
+| Trap                                     | Why                                                                                                       |
+| ---------------------------------------- | --------------------------------------------------------------------------------------------------------- |
+| `project_id` in path for most services   | Many Huawei Cloud APIs require `project_id` in the URL path. Get it from IAM or KooCLI profile            |
+| Pagination is not automatic              | APIs return paginated results. Always check for `next_marker` or `page_info` to avoid partial data        |
+| AK/SK signing algorithm                  | Huawei Cloud uses HMAC-SHA256 signing with specific header ordering. Use SDK, don't implement manually    |
+| Endpoint varies by service and region    | Always verify at https://developer.huaweicloud.com/endpoint                                               |
 | Error response in `body` not HTTP status | Many errors return HTTP 200 with error details in the JSON body. Check `error_code` or `error_msg` fields |
 ## API Workflow
@@ -38,13 +38,13 @@ Use this skill when the deliverable is application code, API integration, or pre
 ## Troubleshooting
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| Invalid project_id | Wrong or missing project_id in URL path. Use `hcloud IAM KeystoneListProjects` or KooCLI profile |
-| 401/AuthFailure | Expired AK/SK or wrong signing algorithm. Regenerate AK/SK or check SDK version |
-| 403/Forbidden | IAM permission missing. Check user/role has required action permissions |
-| Empty results | Pagination missing — add `limit` and check `marker` |
-| Endpoint not reachable | Wrong region/service endpoint. Verify at developer.huaweicloud.com/endpoint |
+| Error                  | Root Cause -> Fix                                                                                |
+| ---------------------- | ------------------------------------------------------------------------------------------------ |
+| Invalid project_id     | Wrong or missing project_id in URL path. Use `hcloud IAM KeystoneListProjects` or KooCLI profile |
+| 401/AuthFailure        | Expired AK/SK or wrong signing algorithm. Regenerate AK/SK or check SDK version                  |
+| 403/Forbidden          | IAM permission missing. Check user/role has required action permissions                          |
+| Empty results          | Pagination missing — add `limit` and check `marker`                                              |
+| Endpoint not reachable | Wrong region/service endpoint. Verify at developer.huaweicloud.com/endpoint                      |
 ## Terraform Priority

package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/agents/openai.yaml CHANGED Viewed

@@ -1,4 +1,4 @@
 interface:
-  display_name: "Huawei Cloud API And SDK"
-  short_description: "Build correct Huawei Cloud API requests and SDK integrations."
-  default_prompt: "Use $huaweicloud-api-and-sdk to plan this Huawei Cloud API or SDK integration."
+  display_name: 'Huawei Cloud API And SDK'
+  short_description: 'Build correct Huawei Cloud API requests and SDK integrations.'
+  default_prompt: 'Use $huaweicloud-api-and-sdk to plan this Huawei Cloud API or SDK integration.'

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md CHANGED Viewed

@@ -5,7 +5,6 @@ description: Discover Huawei Cloud capabilities for an agent task. Use when the
 # Huawei Cloud Capability Discovery
 **STOP - Do not answer from general knowledge.** Follow the procedure below.
 Use this skill to turn vague developer intent into a precise Huawei Cloud capability path.
@@ -20,7 +19,27 @@ Use this skill to turn vague developer intent into a precise Huawei Cloud capabi
 6. Prefer SDK docs when the deliverable is application code.
 7. Prefer MCP only when an approved Huawei Cloud MCP tool exists for the needed operation.
 8. Treat Terraform as a secondary V1 path for reviewed IaC, not the default.
-9. When no built-in devkit skill matches, browse the community skill marketplace at https://github.com/huaweicloud/huaweicloud-skills. Fetch the index from https://raw.githubusercontent.com/huaweicloud/huaweicloud-skills/master/skills-index/index.json.
+9. When no built-in devkit skill matches:
+   a. Search: use `huaweicloud_search_marketplace` to find a matching skill in the community marketplace
+   b. Install: run `npx skills add huaweicloud/huaweicloud-skills --skill <skill-name> -y -g`
+   c. Execute: load the installed skill and follow its procedure
+10. When the deliverable is a PPT, architecture diagram (draw.io), or frontend page that needs official Huawei Cloud service logos, use the `huaweicloud_get_service_icon` MCP tool to get logo URLs from the official Icons library instead of guessing or hotlinking unofficial images.
+## Scenario Routing
+Match the scenario before picking a service. For "deploy a web app" requests, layer the recommendation instead of defaulting to a production service:
+| Scenario                                                             | Recommended path                                                                             |
+| -------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
+| hello world / prototype / demo / temporary preview (free, quick try) | `huawei-sandbox` first — temporary runtime + public URL, ~8h validity, zero billed resources |
+| production / long-term / custom domain / high availability           | `huawei-functiongraph` / `huawei-ecs` (or `huawei-cce` for containers)                       |
+Route to the sandbox when the developer signals free/quick preview intent ("免费", "快速", "预览", "hello world", "原型", "演示"); route to production services only when production-grade hosting is explicitly required.
+## Official Service Logos
+- Use `huaweicloud_get_service_icon` with the service name, alias, or Chinese name (e.g. `ecs`, `obs`, `modelarts`, `对象存储`). It returns the official CDN logo URL (`logo.source_url`), category, and product page link from https://open.huaweicloud.com/openplatform/icons.html.
+- Prefer `logo.source_url` for web deliverables and the Icons library search page for browsing; do not scrape logos from third-party sites.
 ## Deployment Target Options

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/agents/openai.yaml CHANGED Viewed

@@ -1,4 +1,4 @@
 interface:
-  display_name: "Huawei Cloud Capability Discovery"
-  short_description: "Find the right Huawei Cloud capability path for a developer task."
-  default_prompt: "Use $huaweicloud-capability-discovery to route this scenario to Huawei Cloud capabilities."
+  display_name: 'Huawei Cloud Capability Discovery'
+  short_description: 'Find the right Huawei Cloud capability path for a developer task.'
+  default_prompt: 'Use $huaweicloud-capability-discovery to route this scenario to Huawei Cloud capabilities.'

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md CHANGED Viewed

@@ -5,7 +5,6 @@ description: Safe Huawei Cloud KooCLI usage and authentication guidance. Use whe
 # Huawei Cloud CLI And Auth
 **STOP - Do not answer from general knowledge.** Follow the procedure below.
 Use KooCLI `hcloud` for local inspection and reviewed operations. Never ask the user to paste AK/SK, SK, tokens, passwords, or credential files into chat.
@@ -15,16 +14,21 @@ Use KooCLI `hcloud` for local inspection and reviewed operations. Never ask the
 Official guide: `https://support.huaweicloud.com/qs-hcli/hcli_02_003.html`.
 ### Windows
 1. Download and unzip: `https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-windows-amd64.zip`
 2. Extract to `%USERPROFILE%\hcloud`, add to user `PATH`
 3. Verify: `hcloud version`
 ### Linux (amd64 / arm64)
 One-liner (recommended):
 ```bash
 curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
 ```
 Or manual download:
 ```bash
 # amd64
 curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-amd64.tar.gz"
@@ -33,15 +37,20 @@ tar -zxvf huaweicloud-cli-linux-amd64.tar.gz
 curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-arm64.tar.gz"
 tar -zxvf huaweicloud-cli-linux-arm64.tar.gz
 ```
 Move to PATH: `mv $(pwd)/hcloud ~/.local/bin/`
 Verify: `hcloud version`
 ### macOS (amd64 / arm64)
 One-liner (recommended):
 ```bash
 curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
 ```
 Or manual download:
 ```bash
 # amd64
 curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-amd64.tar.gz"
@@ -50,6 +59,7 @@ tar -zxvf huaweicloud-cli-mac-amd64.tar.gz
 curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-arm64.tar.gz"
 tar -zxvf huaweicloud-cli-mac-arm64.tar.gz
 ```
 Move to PATH: `mv $(pwd)/hcloud /usr/local/bin/`
 Verify: `hcloud version`
@@ -60,9 +70,8 @@ Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `
 **NEVER let AK/SK enter shell history. This is the #1 credential leak vector.**
 - Create AK/SK in the Huawei Cloud console under `My Credentials -> Access Keys`.
-- **Unified credentials** (preferred): `npx huaweicloud-devkit auth init`. This is the DevKit's primary auth path; `hcloud configure init` only covers KooCLI.
-- **KooCLI only, interactive** (SAFE): `hcloud configure init` — prompts for AK/SK via terminal input. Values do NOT enter shell history.
-- **Non-interactive** (DANGEROUS — AK/SK in shell history): `hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>`. Only use in ephemeral CI/CD shells. User must execute outside agent chat.
+- **Configure credentials ONLY via `npx huaweicloud-devkit auth init`** — the single entry point. It writes the unified `~/.config/huaweicloud/credentials.json` and mirrors it to KooCLI (`~/.hcloud/config.json`) and OBS (`~/.obsutilconfig`), without AK/SK entering shell history.
+- Never configure KooCLI on its own: do not ask the user to run `hcloud configure init` or `hcloud configure set --cli-access-key=... --cli-secret-key=... --cli-region=...` (AK/SK would leak into shell history). If KooCLI lacks credentials, tell the user to run `npx huaweicloud-devkit auth init`.
 - If MCP is available, use `huaweicloud_show_profile_redacted` to check status without ever seeing credentials.
 - Never paste AK/SK, passwords, tokens, or profile files into the agent conversation.
 - KooCLI stores credentials in `~/.hcloud/config.json`, NOT environment variables. `HCLOUD_ACCESS_KEY` / `HCLOUD_SECRET_KEY` / `HCLOUD_REGION` env vars are NOT read by KooCLI 7.x.
@@ -111,8 +120,25 @@ hcloud <Service> <ListOp> --cli-output=json --cli-query "items[?status=='ACTIVE'
 hcloud <Service> <Op> --cli-debug=true
 ```
+## Credential Resolution Priority
+Credentials are resolved in this order (highest priority first):
+| Priority | Source                                          | When active                                                                                | Persistence                 |
+| -------- | ----------------------------------------------- | ------------------------------------------------------------------------------------------ | --------------------------- |
+| 1        | Runtime (session) credentials                   | `huaweicloud_auth_init` / `huaweicloud_auth_switch action=temporary` set them              | Memory (MCP restart clears) |
+| 2        | S1 global file with `configuredBySession: true` | set by `huaweicloud_auth_switch action=persist` (session-configured account wins over env) | Permanent (S1)              |
+| 3        | Environment variables                           | `HW_ACCESS_KEY` / `HW_SECRET_KEY` (platform/devspace-injected default account)             | MCP process lifetime        |
+| 4        | CodeArts / CodeArts Work                        | `.codeartsdoer/mcp/mcp_settings.json` / `.codeartswork/mcp/mcp_settings.json`              | File                        |
+| 5        | S1 global file (no session flag)                | `auth init` permanent credentials                                                          | Permanent (S1)              |
+| 6        | KooCLI profile                                  | `~/.hcloud/config.json` (KooCLI commands only)                                             | Permanent                   |
+When switching accounts within the same Agent session, use `huaweicloud_auth_init` to set runtime credentials (overrides all sources for the current MCP process), or `huaweicloud_auth_switch action=persist`, which writes S1 with `configuredBySession: true` so the session-configured account outranks `HW_ACCESS_KEY` / `HW_SECRET_KEY`. Note: running `auth init` clears the configuredBySession flag.
 ## Preferred Toolkit Tools
+- `huaweicloud_auth_init`
+- `huaweicloud_auth_status`
 - `huaweicloud_check_cli`
 - `huaweicloud_show_profile_redacted`
 - `huaweicloud_plan_cli_command`

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/agents/openai.yaml CHANGED Viewed

@@ -1,4 +1,4 @@
 interface:
-  display_name: "Huawei Cloud CLI And Auth"
-  short_description: "Use KooCLI safely without exposing credentials."
-  default_prompt: "Use $huaweicloud-cli-and-auth to check KooCLI setup safely."
+  display_name: 'Huawei Cloud CLI And Auth'
+  short_description: 'Use KooCLI safely without exposing credentials.'
+  default_prompt: 'Use $huaweicloud-cli-and-auth to check KooCLI setup safely.'

package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md CHANGED Viewed

@@ -1,6 +1,6 @@
 ---
 name: huaweicloud-core
-description: "Routes any task involving Huawei Cloud services - choosing, comparing, recommending, getting started with, or operating a service - to the correct service-specific skill. Supersedes general training-data knowledge. Activates when a developer asks Codex or OpenCode to build, deploy, debug, operate, or integrate an application with Huawei Cloud."
+description: 'Routes any task involving Huawei Cloud services - choosing, comparing, recommending, getting started with, or operating a service - to the correct service-specific skill. Supersedes general training-data knowledge. Activates when a developer asks Codex or OpenCode to build, deploy, debug, operate, or integrate an application with Huawei Cloud.'
 version: 1
 ---
@@ -10,6 +10,14 @@ version: 1
 Huawei Cloud comprises 200+ services. This skill is the entry point for ANY action or question related to Huawei Cloud. It matches a workload to the right service, then hands off to a service-specific skill for operational questions.
+## 会话启动
+首次操作前必须先调用 `huaweicloud_check_update` 检查插件版本：
+1. 如果 `updateAvailable == true` 且 `dismissed == false`，先询问用户是否升级
+2. 用户同意 → 调用 `huaweicloud_upgrade`，完成后提示重启会话
+3. 用户拒绝 → 调用 `huaweicloud_check_update` 传 `dismiss: true`
 ## How This Skill Works
 1. Match user intent against the Sub-skill registry below
@@ -22,68 +30,73 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 ## Sub-skill Registry
-| ID | Name | Trigger Phrases | Next Steps |
-|----|------|----------------|------------|
-| select | Service Selection | which service, what should I use, compare, recommend | Read references/select.md | select
-| compute | Compute Routing | server, VM, instance, ECS, BMS, GPU, HPC | Handoff to huawei-ecs or huawei-cce |
-| storage | Storage Routing | store files, bucket, OBS, backup, disk, EVS, SFS (long-term storage/CDN intent only) | Handoff to huawei-obs or huawei-cbr |
-| database | Database Routing | database, SQL, NoSQL, cache, RDS, GaussDB, DDS, DCS | Handoff to huawei-rds or huawei-gaussdb |
-| network | Network Routing | VPC, subnet, security group, EIP, NAT, VPN | Handoff to huawei-vpc |
-| serverless | Serverless Routing | function, Lambda, serverless, FunctionGraph, API gateway | Handoff to huawei-functiongraph or huawei-apig |
-| ai | AI/ML Routing | AI, model, LLM, Pangu, training, inference, RAG | Handoff to huawei-modelarts |
-| messaging | Messaging Routing | message queue, notification, Kafka, RabbitMQ, event, SMN | Handoff to huawei-smn-dms |
-| security | Security Routing | secret, credential, encrypt, KMS, WAF, firewall, DDoS | Handoff to huawei-dew or huawei-waf-aad |
-| observability | Observability Routing | monitor, alarm, log, audit, trace, Cloud Eye | Handoff to huawei-cloud-eye or huawei-cts |
-| billing | Billing Routing | cost, bill, budget, spending, invoice | Handoff to huawei-billing |
-| iam | IAM Routing | permission, policy, role, user, group, AK/SK | Handoff to huawei-iam |
-| deployment | Deployment Routing | deploy, host, publish, CI/CD, pipeline, release | CI/CD pipeline -> huawei-deployment; deploy/host/preview a web app or static website (no CI/CD target) -> present deployment-target options first, see "Deployment Target Options" below |
-| sandbox | Sandbox Routing | sandbox, DevStation, workspace, terminal, preview, temporary runtime | Handoff to huawei-sandbox |
-| cli | CLI and Auth Routing | install hcloud, configure KooCLI, AK/SK setup | Handoff to huaweicloud-cli-and-auth |
-| safety | Safety Routing | is this safe, approve command, risk review | Handoff to huaweicloud-safety |
-| troubleshoot | Troubleshooting Routing | error, bug, failed, AccessDenied, quota | Handoff to huaweicloud-troubleshooting |
-| api-sdk | API/SDK Routing | API call, SDK, REST, integration, code example | Handoff to huaweicloud-api-and-sdk |
-| report-issue | Issue Reporting | wrong service, you picked wrong, incorrect | Read references/report-issue.md |
+| ID            | Name                    | Trigger Phrases                                                                                                                             | Next Steps                                                                                                                                                                               |
+| ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| select        | Service Selection       | which service, what should I use, compare, recommend                                                                                        | Read references/select.md                                                                                                                                                                | select |
+| compute       | Compute Routing         | server, VM, instance, ECS, BMS, GPU, HPC                                                                                                    | Handoff to huawei-ecs or huawei-cce                                                                                                                                                      |
+| storage       | Storage Routing         | store files, bucket, OBS, backup, disk, EVS, SFS (long-term storage/CDN intent only)                                                        | Handoff to huawei-obs or huawei-cbr                                                                                                                                                      |
+| database      | Database Routing        | database, SQL, NoSQL, cache, RDS, GaussDB, DDS, DCS                                                                                         | Handoff to huawei-rds or huawei-gaussdb                                                                                                                                                  |
+| network       | Network Routing         | VPC, subnet, security group, EIP, NAT, VPN                                                                                                  | Handoff to huawei-vpc                                                                                                                                                                    |
+| serverless    | Serverless Routing      | function, Lambda, serverless, FunctionGraph, API gateway                                                                                    | Handoff to huawei-functiongraph or huawei-apig                                                                                                                                           |
+| ai            | AI/ML Routing           | AI, model, LLM, Pangu, training, inference, RAG                                                                                             | Handoff to huawei-modelarts                                                                                                                                                              |
+| messaging     | Messaging Routing       | message queue, notification, Kafka, RabbitMQ, event, SMN                                                                                    | Handoff to huawei-smn-dms                                                                                                                                                                |
+| security      | Security Routing        | secret, credential, encrypt, KMS, WAF, firewall, DDoS                                                                                       | Handoff to huawei-dew or huawei-waf-aad                                                                                                                                                  |
+| observability | Observability Routing   | monitor, alarm, log, audit, trace, Cloud Eye                                                                                                | Handoff to huawei-cloud-eye or huawei-cts                                                                                                                                                |
+| billing       | Billing Routing         | cost, bill, budget, spending, invoice                                                                                                       | Handoff to huawei-billing                                                                                                                                                                |
+| iam           | IAM Routing             | permission, policy, role, user, group, AK/SK                                                                                                | Handoff to huawei-iam                                                                                                                                                                    |
+| deployment    | Deployment Routing      | deploy, host, publish, CI/CD, pipeline, release                                                                                             | CI/CD pipeline -> huawei-deployment; deploy/host/preview a web app or static website (no CI/CD target) -> present deployment-target options first, see "Deployment Target Options" below |
+| iac           | IaC Orchestration       | 部署方案, 资源编排, 购买资源, 搭建环境, 部署一套, 成本估算, 销毁部署, provision resources, architecture proposal, multi-resource deployment | Handoff to huawei-iac - multi-resource purchase orchestration with cost gating and ordered destroy. Single web app preview still goes to huawei-sandbox first                            |
+| sandbox       | Sandbox Routing         | sandbox, DevStation, workspace, terminal, preview, temporary runtime                                                                        | Handoff to huawei-sandbox                                                                                                                                                                |
+| cli           | CLI and Auth Routing    | install hcloud, configure KooCLI, AK/SK setup                                                                                               | Handoff to huaweicloud-cli-and-auth                                                                                                                                                      |
+| safety        | Safety Routing          | is this safe, approve command, risk review                                                                                                  | Handoff to huaweicloud-safety                                                                                                                                                            |
+| troubleshoot  | Troubleshooting Routing | error, bug, failed, AccessDenied, quota                                                                                                     | Handoff to huaweicloud-troubleshooting                                                                                                                                                   |
+| api-sdk       | API/SDK Routing         | API call, SDK, REST, integration, code example                                                                                              | Handoff to huaweicloud-api-and-sdk                                                                                                                                                       |
+| report-issue  | Issue Reporting         | wrong service, you picked wrong, incorrect                                                                                                  | Read references/report-issue.md                                                                                                                                                          |
+| voucher       | Voucher Routing         | 领券, 代金券, 优惠券, 激励金, 领取, voucher, coupon, incentive                                                                              | Handoff to huawei-voucher                                                                                                                                                                |
 ## Service Map
-| Workload | Primary Service | Skill |
-|----------|----------------|-------|
-| Web application hosting | ECS | huawei-ecs |
-| Containerized microservices | CCE | huawei-cce |
-| Static file storage / CDN (long-term) | OBS | huawei-obs |
-| Relational database (MySQL/PG) | RDS | huawei-rds |
-| Distributed SQL database | GaussDB | huawei-gaussdb |
-| Document database (MongoDB API) | DDS | huawei-dds-dcs |
-| In-memory cache | DCS (Redis) | huawei-dds-dcs |
-| Serverless functions | FunctionGraph | huawei-functiongraph |
-| API management | APIG | huawei-apig |
-| AI model training/inference | ModelArts | huawei-modelarts |
-| Message queuing | DMS (Kafka/RabbitMQ) | huawei-smn-dms |
-| Push notifications | SMN | huawei-smn-dms |
-| Secret management | DEW (CSMS) | huawei-dew |
-| Key management | DEW (KMS) | huawei-dew |
-| DDoS protection | AAD | huawei-waf-aad |
-| Web firewall | WAF | huawei-waf-aad |
-| Monitoring dashboards | Cloud Eye (CES) | huawei-cloud-eye |
-| Audit trails | CTS | huawei-cts |
-| Backup / disaster recovery | CBR | huawei-cbr |
-| CI/CD pipeline | CloudDeploy | huawei-deployment |
-| Temporary runtime / web app preview | Sandbox (DevStation) | huawei-sandbox |
-| Getting started | Account setup | huaweicloud-cli-and-auth |
+| Workload                                         | Primary Service      | Skill                    |
+| ------------------------------------------------ | -------------------- | ------------------------ |
+| Web application hosting (production / long-term) | ECS                  | huawei-ecs               |
+| Containerized microservices                      | CCE                  | huawei-cce               |
+| Static file storage / CDN (long-term)            | OBS                  | huawei-obs               |
+| Relational database (MySQL/PG)                   | RDS                  | huawei-rds               |
+| Distributed SQL database                         | GaussDB              | huawei-gaussdb           |
+| Document database (MongoDB API)                  | DDS                  | huawei-dds-dcs           |
+| In-memory cache                                  | DCS (Redis)          | huawei-dds-dcs           |
+| Serverless functions                             | FunctionGraph        | huawei-functiongraph     |
+| API management                                   | APIG                 | huawei-apig              |
+| AI model training/inference                      | ModelArts            | huawei-modelarts         |
+| Message queuing                                  | DMS (Kafka/RabbitMQ) | huawei-smn-dms           |
+| Push notifications                               | SMN                  | huawei-smn-dms           |
+| Secret management                                | DEW (CSMS)           | huawei-dew               |
+| Key management                                   | DEW (KMS)            | huawei-dew               |
+| DDoS protection                                  | AAD                  | huawei-waf-aad           |
+| Web firewall                                     | WAF                  | huawei-waf-aad           |
+| Monitoring dashboards                            | Cloud Eye (CES)      | huawei-cloud-eye         |
+| Audit trails                                     | CTS                  | huawei-cts               |
+| Backup / disaster recovery                       | CBR                  | huawei-cbr               |
+| CI/CD pipeline                                   | CloudDeploy          | huawei-deployment        |
+| Temporary runtime / web app preview              | Sandbox (DevStation) | huawei-sandbox           |
+| Getting started                                  | Account setup        | huaweicloud-cli-and-auth |
+| Incentive voucher                                | Voucher              | huawei-voucher           |
+**Web app scenario layering**: for "deploy a web app", prefer `huawei-sandbox` for free/quick try (hello world, prototype, demo, temporary preview — temporary runtime + public URL, ~8h validity, zero billed resources); route to `huawei-functiongraph` / `huawei-ecs` (or `huawei-cce`) for production / long-term / custom-domain / high-availability hosting. When the chosen target requires **multiple purchased resources** (e.g. VPC + subnet + ECS + EIP + RDS, or OBS + CDN + DNS) or the user asks for an architecture/cost proposal first, hand off to `huawei-iac` for orchestrated provisioning with a mandatory cost gate.
 ## Deployment Target Options
 When the intent is to **deploy, host, or preview a web app or static website** (no explicit target named), NEVER default to a single service such as OBS. Ask the developer to choose a target and present the options in this order:
-| # | Option | When to choose | Skill |
-|---|--------|----------------|-------|
-| 1 | **Sandbox (DevStation) — recommended** | Temporary runtime, quick preview, demo; instant public URL | huawei-sandbox |
-| 2 | OBS static website hosting | Long-term static hosting / CDN, no backend | huawei-obs |
-| 3 | ECS | Needs a server runtime (backend, custom server) | huawei-ecs |
-| 4 | CCE | Containerized workloads, scaling | huawei-cce |
+| #   | Option                                 | When to choose                                             | Skill          |
+| --- | -------------------------------------- | ---------------------------------------------------------- | -------------- |
+| 1   | **Sandbox (DevStation) — recommended** | Temporary runtime, quick preview, demo; instant public URL | huawei-sandbox |
+| 2   | OBS static website hosting             | Long-term static hosting / CDN, no backend                 | huawei-obs     |
+| 3   | ECS                                    | Needs a server runtime (backend, custom server)            | huawei-ecs     |
+| 4   | CCE                                    | Containerized workloads, scaling                           | huawei-cce     |
 - Recommended prompt: "这个项目是 Web 应用/静态网站，建议优先部署到沙箱（临时运行环境，立即可预览）。也可选择 OBS 静态托管、ECS 或 CCE，你想部署到哪里？"
-- If the developer explicitly names a target (e.g. "deploy to OBS"), follow that target and hand off to the corresponding service skill.
+- If the developer explicitly names a target (e.g. "deploy to OBS"), the SANDBOX target hands off directly to `huawei-sandbox`; every other target (OBS / ECS / CCE / FunctionGraph / ...) hands off to `huawei-iac` for orchestration - iac loads the corresponding service skill for commands and adds the mandatory cost+balance gate, batch approval, state tracking, and ordered destroy. Direct handoff to the bare service skill skips these safety stages and must not happen for deployment intent. **Existing network resources (a reusable VPC) do NOT downgrade this to a single-service task - the purchase itself (compute, EIP, disk, rules) is what triggers iac.**
 - If the developer has no preference, recommend the sandbox first.
 ## Capability Sources
@@ -100,6 +113,7 @@ When the intent is to **deploy, host, or preview a web app or static website** (
 - Use huaweicloud_search_docs to discover skills covering a topic
 - Use huaweicloud_retrieve_skill to load a full SKILL.md after routing
+- Use huaweicloud_auth_init to switch credentials at runtime when different accounts co-exist in the same session
 - If no built-in skill matches, consult huaweicloud-capability-discovery for external marketplace options
 - Use huaweicloud_list_regions before creating regional resources
 - Use huaweicloud_get_regional_availability when unsure about service-region pairs
@@ -108,4 +122,4 @@ When the intent is to **deploy, host, or preview a web app or static website** (
 ## Quality Bar
-Prefer short, precise instructions with commands the developer can run. Give source names and exact fields to verify. Avoid inventing service behavior. When uncertain, route to Huawei Cloud Skills or official API/SDK documentation.
+Prefer short, precise instructions with commands the developer can run. Give source names and exact fields to verify. Avoid inventing service behavior. When uncertain, route to Huawei Cloud Skills or official API/SDK documentation.

package/plugins/huaweicloud-core/skills/huaweicloud-core/agents/openai.yaml CHANGED Viewed

@@ -1,4 +1,4 @@
 interface:
-  display_name: "Huawei Cloud Core"
-  short_description: "Route Huawei Cloud tasks to Skills, CLI, API, SDK, MCP, or Terraform."
-  default_prompt: "Use $huaweicloud-core to choose the right Huawei Cloud capability path."
+  display_name: 'Huawei Cloud Core'
+  short_description: 'Route Huawei Cloud tasks to Skills, CLI, API, SDK, MCP, or Terraform.'
+  default_prompt: 'Use $huaweicloud-core to choose the right Huawei Cloud capability path.'

package/plugins/huaweicloud-core/skills/huaweicloud-core/references/report-issue.md CHANGED Viewed

@@ -12,9 +12,9 @@ Use when the user reports an issue with a previous routing decision.
 ## Common Corrections
-| Wrong Routing | Likely Correct |
-|---------------|---------------|
-| ECS for containers | CCE |
-| OBS for block storage | EVS (via huawei-ecs) |
-| RDS for cache | DCS (via huawei-dds-dcs) |
-| FunctionGraph for long-running tasks | ECS or CCE |
+| Wrong Routing                        | Likely Correct           |
+| ------------------------------------ | ------------------------ |
+| ECS for containers                   | CCE                      |
+| OBS for block storage                | EVS (via huawei-ecs)     |
+| RDS for cache                        | DCS (via huawei-dds-dcs) |
+| FunctionGraph for long-running tasks | ECS or CCE               |

package/plugins/huaweicloud-core/skills/huaweicloud-core/references/select.md CHANGED Viewed

@@ -17,12 +17,26 @@ Use when the user asks which service to use or compares services.
 ## Example: I need a database
 Ask:
 - What type of data? Structured (tables) or flexible (documents)?
 - What scale? Small app or enterprise?
 - Do you need SQL queries?
 Route based on answers:
 - SQL + standard scale -> huawei-rds
 - SQL + massive scale / distributed -> huawei-gaussdb
 - Document model (MongoDB-compatible) -> huawei-dds-dcs
-- Cache / key-value -> huawei-dds-dcs (DCS)
+- Cache / key-value -> huawei-dds-dcs (DCS)
+## Example: I need to deploy a web app
+Ask:
+- Is this a quick try / prototype / demo / temporary preview (free)?
+- Or production (long-term, custom domain, high availability)?
+Route by scenario:
+- Free / quick try / prototype / demo / temporary preview -> huawei-sandbox (temporary runtime + public URL, ~8h validity, zero billed resources)
+- Production / long-term / custom domain / high availability -> huawei-functiongraph / huawei-ecs (or huawei-cce for containers)

package/plugins/huaweicloud-core/skills/huaweicloud-safety/SKILL.md CHANGED Viewed

@@ -5,7 +5,6 @@ description: Huawei Cloud safety policy for agents. Use when handling credential
 # Huawei Cloud Safety
 **STOP - Do not answer from general knowledge.** Follow the procedure below.
 Use this skill before any Huawei Cloud action that may expose secrets, change resources, affect cost, change IAM, or expose a network endpoint.

package/plugins/huaweicloud-core/skills/huaweicloud-safety/agents/openai.yaml CHANGED Viewed

@@ -1,4 +1,4 @@
 interface:
-  display_name: "Huawei Cloud Safety"
-  short_description: "Keep Huawei Cloud agent operations safe and redacted."
-  default_prompt: "Use $huaweicloud-safety to review this Huawei Cloud operation."
+  display_name: 'Huawei Cloud Safety'
+  short_description: 'Keep Huawei Cloud agent operations safe and redacted.'
+  default_prompt: 'Use $huaweicloud-safety to review this Huawei Cloud operation.'