huaweicloud-devkit 1.1.2-next.0 → 1.1.2-next.2

package/plugins/huaweicloud-core/src/detect-framework.mjs

@@ -0,0 +1,366 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+const FRAMEWORKS = {
+  nextjs: {
+    type: 'ssr',
+    framework: 'Next.js',
+    installCmd: 'npm install',
+    buildCmd: 'npm run build',
+    outputDir: '.next',
+    port: 3000,
+    serveCmd: 'nohup npm start > /tmp/app.log 2>&1 &',
+    checkUrl: 'http://localhost:3000',
+    nginxType: 'proxy',
+  },
+  nuxt: {
+    type: 'ssr',
+    framework: 'Nuxt',
+    installCmd: 'npm install',
+    buildCmd: 'npm run build',
+    outputDir: '.output',
+    port: 3000,
+    serveCmd: 'nohup node .output/server/index.mjs > /tmp/app.log 2>&1 &',
+    checkUrl: 'http://localhost:3000',
+    nginxType: 'proxy',
+  },
+  vitepress: {
+    type: 'ssg',
+    framework: 'VitePress',
+    installCmd: 'npm install',
+    buildCmd: 'npm run docs:build',
+    outputDir: '.vitepress/dist',
+    port: 8080,
+    serveCmd: null,
+    checkUrl: 'http://localhost:8080',
+    nginxType: 'spa',
+  },
+  docusaurus: {
+    type: 'ssg',
+    framework: 'Docusaurus',
+    installCmd: 'npm install',
+    buildCmd: 'npm run build',
+    outputDir: 'build',
+    port: 8080,
+    serveCmd: null,
+    checkUrl: 'http://localhost:8080',
+    nginxType: 'spa',
+  },
+  hugo: {
+    type: 'ssg',
+    framework: 'Hugo',
+    installCmd: null,
+    buildCmd: 'hugo',
+    outputDir: 'public',
+    port: 8080,
+    serveCmd: null,
+    checkUrl: 'http://localhost:8080',
+    nginxType: 'static',
+  },
+  hexo: {
+    type: 'ssg',
+    framework: 'Hexo',
+    installCmd: 'npm install',
+    buildCmd: 'npm run build',
+    outputDir: 'public',
+    port: 8080,
+    serveCmd: null,
+    checkUrl: 'http://localhost:8080',
+    nginxType: 'static',
+  },
+  taro: {
+    type: 'cross-platform',
+    framework: 'Taro',
+    installCmd: 'npm install',
+    buildCmd: 'npm run build:h5',
+    outputDir: 'dist',
+    port: 8080,
+    serveCmd: null,
+    checkUrl: 'http://localhost:8080',
+    nginxType: 'spa',
+  },
+  uniapp: {
+    type: 'cross-platform',
+    framework: 'uni-app',
+    installCmd: 'npm install',
+    buildCmd: 'npm run build:h5',
+    outputDir: 'dist/build/h5',
+    port: 8080,
+    serveCmd: null,
+    checkUrl: 'http://localhost:8080',
+    nginxType: 'spa',
+  },
+  angular: {
+    type: 'spa',
+    framework: 'Angular',
+    installCmd: 'npm install',
+    buildCmd: 'npm run build',
+    outputDir: null,
+    port: 8080,
+    serveCmd: null,
+    checkUrl: 'http://localhost:8080',
+    nginxType: 'spa',
+  },
+  vite: {
+    type: 'spa',
+    framework: 'Vite (React/Vue/Svelte)',
+    installCmd: 'npm install',
+    buildCmd: 'npm run build',
+    outputDir: 'dist',
+    port: 8080,
+    serveCmd: null,
+    checkUrl: 'http://localhost:8080',
+    nginxType: 'spa',
+  },
+  cra: {
+    type: 'spa',
+    framework: 'Create React App',
+    installCmd: 'npm install',
+    buildCmd: 'npm run build',
+    outputDir: 'build',
+    port: 8080,
+    serveCmd: null,
+    checkUrl: 'http://localhost:8080',
+    nginxType: 'spa',
+  },
+  vueCli: {
+    type: 'spa',
+    framework: 'Vue CLI',
+    installCmd: 'npm install',
+    buildCmd: 'npm run build',
+    outputDir: 'dist',
+    port: 8080,
+    serveCmd: null,
+    checkUrl: 'http://localhost:8080',
+    nginxType: 'spa',
+  },
+  static: {
+    type: 'static',
+    framework: 'Static Site',
+    installCmd: null,
+    buildCmd: null,
+    outputDir: '.',
+    port: 8080,
+    serveCmd: null,
+    checkUrl: 'http://localhost:8080',
+    nginxType: 'static',
+  },
+};
+
+function readPkg(projectPath) {
+  const pkgPath = join(projectPath, 'package.json');
+  if (!existsSync(pkgPath)) return null;
+  try {
+    return JSON.parse(readFileSync(pkgPath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function detectPackageManager(projectPath, pkg) {
+  if (existsSync(join(projectPath, 'pnpm-lock.yaml'))) return 'pnpm';
+  if (existsSync(join(projectPath, 'yarn.lock'))) return 'yarn';
+  if (existsSync(join(projectPath, 'package-lock.json'))) return 'npm';
+  if (existsSync(join(projectPath, 'bun.lockb'))) return 'bun';
+  const declared = (pkg?.packageManager || '').split('@')[0];
+  if (declared && ['pnpm', 'yarn', 'npm', 'bun'].includes(declared)) return declared;
+  return 'npm';
+}
+
+function collectDeps(pkg) {
+  if (!pkg) return {};
+  return { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
+}
+
+function scanSubApps(projectPath) {
+  const apps = [];
+  for (const dir of ['apps', 'packages']) {
+    const dirPath = join(projectPath, dir);
+    if (!existsSync(dirPath)) continue;
+    try {
+      const entries = readdirSync(dirPath, { withFileTypes: true });
+      for (const entry of entries) {
+        if (!entry.isDirectory()) continue;
+        const subPath = join(dirPath, entry.name);
+        const subPkg = readPkg(subPath);
+        if (!subPkg) continue;
+        const result = detectFramework(subPath);
+        if (!result) continue;
+        apps.push({
+          name: subPkg.name || entry.name,
+          path: `${dir}/${entry.name}`,
+          framework: result.framework,
+          type: result.type,
+        });
+      }
+    } catch {
+      // skip unreadable directories
+    }
+  }
+  return apps;
+}
+
+function resolveAngularOutput(projectPath, pkg) {
+  try {
+    const angularJson = join(projectPath, 'angular.json');
+    if (existsSync(angularJson)) {
+      const config = JSON.parse(readFileSync(angularJson, 'utf8'));
+      const defaultProject = config.defaultProject || Object.keys(config.projects || {})[0];
+      if (defaultProject && config.projects?.[defaultProject]?.architect?.build?.options?.outputPath) {
+        return config.projects[defaultProject].architect.build.options.outputPath;
+      }
+    }
+  } catch {
+    // ignore parse errors
+  }
+  const name = pkg?.name || 'app';
+  return `dist/${name}`;
+}
+
+function patchCommands(result, pm) {
+  if (result.installCmd && result.installCmd.startsWith('npm install')) {
+    if (pm === 'pnpm') result.installCmd = 'pnpm install';
+    else if (pm === 'yarn') result.installCmd = 'yarn install';
+  }
+  if (result.buildCmd && result.buildCmd.startsWith('npm run')) {
+    if (pm === 'pnpm') result.buildCmd = result.buildCmd.replace('npm run', 'pnpm run');
+    else if (pm === 'yarn') result.buildCmd = result.buildCmd.replace('npm run', 'yarn run');
+  }
+  if (result.serveCmd && result.serveCmd.includes('npm start')) {
+    if (pm === 'pnpm') result.serveCmd = result.serveCmd.replace('npm start', 'pnpm start');
+    else if (pm === 'yarn') result.serveCmd = result.serveCmd.replace('npm start', 'yarn start');
+  }
+  return result;
+}
+
+function frameworkResult(fw, pm, projectPath) {
+  return patchCommands({ ...fw, packageManager: pm, rootDir: projectPath }, pm);
+}
+
+function readVitepressOutDir(projectPath) {
+  const configFiles = ['config.mts', 'config.ts', 'config.mjs', 'config.js'];
+  for (const cf of configFiles) {
+    const configPath = join(projectPath, '.vitepress', cf);
+    if (!existsSync(configPath)) continue;
+    try {
+      const content = readFileSync(configPath, 'utf8');
+      const match = content.match(/outDir\s*:\s*['"`]?([^'"`\s,}]+)['"`]?/);
+      if (match) return match[1];
+    } catch {}
+  }
+  return null;
+}
+
+export function detectFramework(projectPath) {
+  const pkg = readPkg(projectPath);
+  const deps = collectDeps(pkg);
+  const pm = detectPackageManager(projectPath, pkg);
+
+  if (
+    existsSync(join(projectPath, 'pnpm-workspace.yaml')) ||
+    existsSync(join(projectPath, 'turbo.json')) ||
+    existsSync(join(projectPath, 'nx.json')) ||
+    existsSync(join(projectPath, 'lerna.json'))
+  ) {
+    const monorepoSubApps = scanSubApps(projectPath);
+    return {
+      type: 'monorepo',
+      framework: 'Monorepo',
+      monorepoTool: existsSync(join(projectPath, 'turbo.json'))
+        ? 'Turborepo'
+        : existsSync(join(projectPath, 'nx.json'))
+          ? 'Nx'
+          : existsSync(join(projectPath, 'lerna.json'))
+            ? 'Lerna'
+            : 'pnpm Workspace',
+      subApps: monorepoSubApps,
+      packageManager: pm,
+      rootDir: projectPath,
+    };
+  }
+
+  if (
+    existsSync(join(projectPath, 'next.config.js')) ||
+    existsSync(join(projectPath, 'next.config.mjs')) ||
+    existsSync(join(projectPath, 'next.config.ts'))
+  ) {
+    return frameworkResult(FRAMEWORKS.nextjs, pm, projectPath);
+  }
+
+  if (
+    existsSync(join(projectPath, 'nuxt.config.js')) ||
+    existsSync(join(projectPath, 'nuxt.config.mjs')) ||
+    existsSync(join(projectPath, 'nuxt.config.ts'))
+  ) {
+    return frameworkResult(FRAMEWORKS.nuxt, pm, projectPath);
+  }
+
+  if ('@tarojs/taro' in deps) {
+    return frameworkResult(FRAMEWORKS.taro, pm, projectPath);
+  }
+
+  if ('@dcloudio/uni-app' in deps || 'uni-app' in deps) {
+    return frameworkResult(FRAMEWORKS.uniapp, pm, projectPath);
+  }
+
+  if (existsSync(join(projectPath, '.vitepress'))) {
+    const outDir = readVitepressOutDir(projectPath);
+    return frameworkResult(
+      outDir ? { ...FRAMEWORKS.vitepress, outputDir: outDir } : FRAMEWORKS.vitepress,
+      pm,
+      projectPath,
+    );
+  }
+
+  if (
+    existsSync(join(projectPath, 'docusaurus.config.js')) ||
+    existsSync(join(projectPath, 'docusaurus.config.ts')) ||
+    existsSync(join(projectPath, 'docusaurus.config.mjs'))
+  ) {
+    return frameworkResult(FRAMEWORKS.docusaurus, pm, projectPath);
+  }
+
+  if (existsSync(join(projectPath, 'hugo.toml')) || existsSync(join(projectPath, 'config.toml'))) {
+    return frameworkResult(FRAMEWORKS.hugo, pm, projectPath);
+  }
+
+  if (existsSync(join(projectPath, '_config.yml'))) {
+    return frameworkResult(FRAMEWORKS.hexo, pm, projectPath);
+  }
+
+  if (existsSync(join(projectPath, 'angular.json'))) {
+    const outputDir = resolveAngularOutput(projectPath, pkg);
+    return frameworkResult({ ...FRAMEWORKS.angular, outputDir }, pm, projectPath);
+  }
+
+  if (
+    existsSync(join(projectPath, 'vite.config.js')) ||
+    existsSync(join(projectPath, 'vite.config.mjs')) ||
+    existsSync(join(projectPath, 'vite.config.ts'))
+  ) {
+    return frameworkResult(FRAMEWORKS.vite, pm, projectPath);
+  }
+
+  if ('@vue/cli-service' in deps) {
+    return frameworkResult(FRAMEWORKS.vueCli, pm, projectPath);
+  }
+
+  if (
+    'react-scripts' in deps ||
+    'react' in deps ||
+    '@angular/core' in deps ||
+    'vue' in deps ||
+    'svelte' in deps ||
+    'solid-js' in deps
+  ) {
+    if (existsSync(join(projectPath, 'public', 'index.html')) || existsSync(join(projectPath, 'index.html'))) {
+      return frameworkResult(FRAMEWORKS.cra, pm, projectPath);
+    }
+  }
+
+  if (existsSync(join(projectPath, 'index.html'))) {
+    return frameworkResult(FRAMEWORKS.static, pm, projectPath);
+  }
+
+  return null;
+}

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -1,15 +1,145 @@
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
 import { classifyHcloudArgs, redactSecrets, assertAllowed } from './safety-policy.mjs';
+import { getProxySettings } from './proxy/proxy-config.mjs';
 
 const DEFAULT_TIMEOUT_MS = 60_000;
 const DEFAULT_FORCE_KILL_AFTER_MS = 2_000;
 const DEFAULT_MAX_RETRIES = 1;
+const APPROVAL_TTL_MS = 5 * 60_000;
+const LARGE_OUTPUT_THRESHOLD = 50_000;
+const OUTPUT_DIR = join('/tmp', 'huaweicloud-devkit');
+
+const approvalStore = new Map();
+
+export function createApprovalToken(rawArgs) {
+  const token = randomUUID();
+  approvalStore.set(token, { rawArgs, createdAt: Date.now() });
+  if (approvalStore.size % 20 === 0) {
+    const now = Date.now();
+    for (const [k, v] of approvalStore) {
+      if (now - v.createdAt > APPROVAL_TTL_MS) approvalStore.delete(k);
+    }
+  }
+  return token;
+}
+
+export function consumeApprovalToken(token) {
+  const entry = approvalStore.get(token);
+  if (!entry) return null;
+  if (Date.now() - entry.createdAt > APPROVAL_TTL_MS) {
+    approvalStore.delete(token);
+    return null;
+  }
+  approvalStore.delete(token);
+  return entry.rawArgs;
+}
+
+function saveLargeOutput(rawStdout) {
+  if (rawStdout.length <= LARGE_OUTPUT_THRESHOLD) return null;
+  try {
+    mkdirSync(OUTPUT_DIR, { recursive: true });
+    const filePath = join(OUTPUT_DIR, `output-${Date.now()}.json`);
+    writeFileSync(filePath, rawStdout, { encoding: 'utf8' });
+    return filePath;
+  } catch {
+    return null;
+  }
+}
+
+function preflightSecurityGroupCheck(normalizedArgs) {
+  const service = normalizedArgs[0];
+  const operation = normalizedArgs[1];
+  if (service !== 'ECS' || !/CreateServers|RunInstances/i.test(operation)) return [];
+
+  const sgIds = [];
+  for (const arg of normalizedArgs) {
+    const m = arg.match(/^(?:--security_group_id(?:\.\d+)?|--server\.security_groups(?:\.\d+)?\.id)=(.+)/);
+    if (m) sgIds.push(m[1]);
+  }
+  if (sgIds.length === 0) return [];
+
+  const regionArg = normalizedArgs.find((a) => a.startsWith('--cli-region='));
+  const findings = [];
+  for (const sgId of sgIds) {
+    try {
+      const hcloudBin = process.env.HCLOUD_BIN || 'hcloud';
+      const spawnArgs = ['VPC', 'ListSecurityGroupRules', `--security_group_id.1=${sgId}`];
+      if (regionArg) spawnArgs.push(regionArg);
+      const r = spawnSync(hcloudBin, spawnArgs, {
+        shell: false,
+        windowsHide: true,
+        stdio: 'pipe',
+        timeout: 20000,
+      });
+      const stdout = (r.stdout || '').toString();
+      if (r.status !== 0 || !stdout.includes('security_group_rules')) continue;
+
+      const bracketIdx = stdout.indexOf('{');
+      const jsonText = bracketIdx >= 0 ? stdout.slice(bracketIdx) : stdout;
+      const data = JSON.parse(jsonText);
+      const rules = data?.security_group_rules || [];
+
+      for (const rule of rules) {
+        const direction = rule.direction || '';
+        const remoteIp = rule.remote_ip_prefix || rule.remote_address_group_id || '';
+        const portMin = String(rule.port_range_min || rule.multiport || '');
+        const portMax = String(rule.port_range_max || rule.multiport || '');
+        const protocol = (rule.protocol || '').toLowerCase();
+        if (direction !== 'ingress') continue;
+        if (remoteIp !== '0.0.0.0/0' && remoteIp !== '::/0') continue;
+        if (protocol === 'icmp' || protocol === 'icmpv6') {
+          findings.push({
+            severity: 'warn',
+            title: `Security group ${sgId}: ICMP open to public`,
+            message: `安全组 ${sgId} 对公网开放了 ICMP (ping)，可能被用于探测。是否继续？`,
+          });
+          continue;
+        }
+        const sensitivePorts = ['22', '3389', '3306', '5432', '6379', '9200', '27017', '8080', '8443'];
+        const port = portMin || portMax;
+        if (port && sensitivePorts.includes(port)) {
+          findings.push({
+            severity: 'deny',
+            title: `Security group ${sgId}: port ${port} open to public`,
+            message: `安全组 ${sgId} 已对公网开放 ${port} 端口（${protocol || 'TCP'}）。确认继续创建 ECS？`,
+          });
+        }
+      }
+    } catch (error) {
+      // Preflight failed silently; don't block the plan
+    }
+  }
+  return findings;
+}
+
+function applyPreflightFindings(classification, sgFindings) {
+  if (!sgFindings || sgFindings.length === 0) return classification;
+  const hasDeny = sgFindings.some((f) => f.severity === 'deny');
+  if (hasDeny) {
+    return {
+      ...classification,
+      decision: 'deny',
+      risk: 'public_exposure',
+      reason: sgFindings[0].message,
+    };
+  }
+  return classification;
+}
 
 export function planHcloudCommand(args, options = {}) {
   const normalizedArgs = Array.isArray(args) ? args.map(String) : [];
   const classification = classifyHcloudArgs(normalizedArgs, options);
-  const command = ['hcloud', ...normalizedArgs].map(quoteShellArg).join(' ');
+  const command = ['hcloud', ...normalizedArgs].map((arg) => quoteShellArg(arg)).join(' ');
   const warnings = planningWarnings(normalizedArgs);
+  const sgFindings = preflightSecurityGroupCheck(normalizedArgs);
+  if (sgFindings.length > 0) {
+    for (const f of sgFindings) warnings.push(f);
+  }
   const paramValidation = validateRequiredParams(normalizedArgs);
   if (paramValidation.missing.length > 0) {
     warnings.push('Missing required parameters: ' + paramValidation.missing.join(', '));
@@ -23,7 +153,9 @@ export function planHcloudCommand(args, options = {}) {
     command: redactOutput(command),
     executableBlock: redactOutput(command),
     warnings,
-    classification,
+    classification: applyPreflightFindings(classification, sgFindings),
+    sgFindings,
+    approvalToken: createApprovalToken(normalizedArgs),
     safeToRun: classification.decision === 'allow',
   };
 }
@@ -40,39 +172,78 @@ export async function runHcloud(args, options = {}) {
   for (let attempt = 0; attempt <= maxRetries; attempt += 1) {
     const result = await runHcloudOnce(plan, options);
     if (result.ok || attempt >= maxRetries || !isRetryableNetworkError(result)) {
-      return {
+      const merged = {
         ...result,
         retries: attempt,
         attempts: attempt + 1,
       };
+      if (merged.ok) {
+        const warning = await runtimeCurrentMismatchWarning();
+        return warning ? { ...merged, authWarning: warning } : merged;
+      }
+      return merged;
     }
-    await wait((options.retryBaseDelayMs ?? 500) * (2 ** attempt));
+    await wait((options.retryBaseDelayMs ?? 500) * 2 ** attempt);
   }
   throw new Error('Unreachable retry state.');
 }
 
+async function runtimeCurrentMismatchWarning() {
+  try {
+    const { hasRuntimeCredentials, scanState } = await import('./auth/reconcile.mjs');
+    if (!hasRuntimeCredentials()) return null;
+    const scan = scanState();
+    const { runtimeFingerprint, currentFingerprint } = scan.stores;
+    if (runtimeFingerprint && currentFingerprint && runtimeFingerprint !== currentFingerprint) {
+      return '会话内临时账号与 KooCLI current 档不一致：hcloud 命令仍使用 current 档账号。如需对齐请用 huaweicloud_auth_switch action=persist。';
+    }
+    return null;
+  } catch {
+    // reconcile unavailable → no warning, never block the command
+    return null;
+  }
+}
+
+function discoverHcloudPath() {
+  if (process.env.HCLOUD_BIN && existsSync(process.env.HCLOUD_BIN)) return process.env.HCLOUD_BIN;
+  const candidates =
+    process.platform === 'win32'
+      ? [join(homedir(), 'hcloud', 'hcloud.exe')]
+      : [join(homedir(), '.local', 'bin', 'hcloud'), join(homedir(), 'hcloud', 'hcloud')];
+  return candidates.find((c) => existsSync(c)) || null;
+}
+
 function runHcloudOnce(plan, options) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const forceKillAfterMs = options.forceKillAfterMs ?? DEFAULT_FORCE_KILL_AFTER_MS;
-  const executable = options.executable || options.env?.HCLOUD_BIN || process.env.HCLOUD_BIN || 'hcloud';
+  const executable = options.executable || options.env?.HCLOUD_BIN || discoverHcloudPath() || 'hcloud';
   const executableArgs = Array.isArray(options.executableArgs) ? options.executableArgs.map(String) : [];
   const cwd = options.cwd || undefined;
+  const stdin = options.stdin ?? 'y\n';
 
   return new Promise((resolve) => {
+    const proxySettings = getProxySettings();
+    const proxyEnv = {};
+    if (proxySettings) {
+      if (proxySettings.https_proxy) proxyEnv.HTTPS_PROXY = proxySettings.https_proxy;
+      if (proxySettings.http_proxy) proxyEnv.HTTP_PROXY = proxySettings.http_proxy;
+      if (proxySettings.no_proxy) proxyEnv.NO_PROXY = proxySettings.no_proxy;
+    }
     const child = spawn(executable, [...executableArgs, ...plan.rawArgs], {
       shell: false,
       windowsHide: true,
       cwd,
       env: {
         ...process.env,
+        ...proxyEnv,
         ...options.env,
       },
     });
-    if (options.stdin) {
-      if (typeof options.stdin === 'function') {
-        options.stdin(child.stdin);
+    if (stdin) {
+      if (typeof stdin === 'function') {
+        stdin(child.stdin);
       } else {
-        child.stdin.write(String(options.stdin));
+        child.stdin.write(String(stdin));
         child.stdin.end();
       }
     }
@@ -89,6 +260,13 @@ function runHcloudOnce(plan, options) {
       clearTimeout(timer);
       clearTimeout(forceTimer);
       clearTimeout(settleTimer);
+      if (result.stdout && String(result.stdout).length > LARGE_OUTPUT_THRESHOLD) {
+        const outputFile = saveLargeOutput(stdout);
+        if (outputFile) {
+          result.outputFile = outputFile;
+          result.stdout = String(result.stdout).slice(0, 2000) + `\n...(truncated, full output saved to ${outputFile})`;
+        }
+      }
       resolve(result);
     }
 
@@ -151,7 +329,10 @@ function runHcloudOnce(plan, options) {
         return;
       }
       finish({
-        ok: code === 0 || (code !== 0 && /successfully|succ?ess.*\[200\]|create bucket successfully|upload successfully/i.test(stdout + stderr)),
+        ok:
+          code === 0 ||
+          (code !== 0 &&
+            /successfully|succ?ess.*\[200\]|create bucket successfully|upload successfully/i.test(stdout + stderr)),
         exitCode: code,
         signal,
         stdout: redactOutput(stdout),
@@ -165,7 +346,9 @@ function runHcloudOnce(plan, options) {
 function isRetryableNetworkError(result) {
   if (result.code === 'TIMEOUT') return false;
   const text = `${result.error || ''}\n${result.stdout || ''}\n${result.stderr || ''}`;
-  return /\[NETWORK_ERROR\]|connection timed out|ECONNRESET|ETIMEDOUT|temporary failure|TLS handshake timeout/i.test(text);
+  return /\[NETWORK_ERROR\]|connection timed out|ECONNRESET|ETIMEDOUT|temporary failure|TLS handshake timeout/i.test(
+    text,
+  );
 }
 
 function wait(ms) {
@@ -194,7 +377,11 @@ const REQUIRED_PARAMS = {
   'ECS CreateServers': ['server.flavorRef', 'server.imageRef', 'server.nics.1.subnet_id'],
   'VPC CreateVpc': ['vpc.cidr'],
   'VPC CreateSubnet': ['subnet.vpc_id', 'subnet.cidr'],
-  'VPC CreateSecurityGroupRule': ['security_group_rule.security_group_id', 'security_group_rule.direction', 'security_group_rule.protocol'],
+  'VPC CreateSecurityGroupRule': [
+    'security_group_rule.security_group_id',
+    'security_group_rule.direction',
+    'security_group_rule.protocol',
+  ],
   'EIP CreatePublicip': ['bandwidth.share_type', 'publicip.type'],
   'FunctionGraph CreateFunction': ['func_name', 'runtime', 'handler', 'memory_size', 'package', 'timeout'],
   'FunctionGraph CreateFunctionTrigger': ['function_urn', 'trigger_type_code'],
@@ -208,9 +395,9 @@ const PARAM_VALUE_HINTS = {
   'server.imageRef': 'Run `hcloud IMS ListImages --cli-region=<r> --__imagetype=gold` to find valid image IDs',
   'server.nics.1.subnet_id': 'Run `hcloud VPC ListSubnets --cli-region=<r>` to find subnet IDs',
   'subnet.vpc_id': 'Run `hcloud VPC ListVpcs --cli-region=<r>` to find VPC IDs',
-  'func_name': 'Function name must be unique within project',
-  'runtime': 'Run `hcloud FunctionGraph ListRuntimes` to see available runtimes',
-  'spec_id': 'APIG spec: BASIC (no public IP) or PROFESSIONAL (requires --loadbalancer_provider)',
+  func_name: 'Function name must be unique within project',
+  runtime: 'Run `hcloud FunctionGraph ListRuntimes` to see available runtimes',
+  spec_id: 'APIG spec: BASIC (no public IP) or PROFESSIONAL (requires --loadbalancer_provider)',
   'obs://': 'Bucket name must be globally unique and DNS-compliant (lowercase, numbers, hyphens only)',
 };