huaweicloud-devkit 1.1.2-next.0 → 1.1.2-next.2

package/plugins/huaweicloud-core/src/proxy/proxy-agent.mjs

@@ -3,6 +3,15 @@ import { getProxyUrlForTarget } from './proxy-config.mjs';
 let cachedDispatcher = undefined;
 let cachedDispatcherProxyUrl = null;
 
+async function importUndici() {
+  try {
+    /* eslint-disable-next-line n/no-missing-import */
+    return await import('node:undici');
+  } catch {
+    return await import('undici');
+  }
+}
+
 export async function getProxyDispatcher(targetUrl) {
   const proxyUrl = getProxyUrlForTarget(targetUrl);
   if (!proxyUrl) return undefined;
@@ -11,7 +20,7 @@ export async function getProxyDispatcher(targetUrl) {
     return cachedDispatcher;
   }
 
-  const { ProxyAgent } = await import('undici');
+  const { ProxyAgent } = await importUndici();
   cachedDispatcher = new ProxyAgent(proxyUrl);
   cachedDispatcherProxyUrl = proxyUrl;
   return cachedDispatcher;
@@ -29,7 +38,7 @@ export async function createProxyWebSocket(url, protocols) {
   }
 
   const dispatcher = await getProxyDispatcher(url);
-  const { WebSocket: UndiciWebSocket } = await import('undici');
+  const { WebSocket: UndiciWebSocket } = await importUndici();
 
   const wsOptions = { dispatcher };
   if (protocols) {
@@ -43,113 +52,22 @@ export async function createProxyWebSocket(url, protocols) {
   return new UndiciWebSocket(url, wsOptions);
 }
 
-export function getWebSocketImpl(targetUrl) {
+export async function getWebSocketImpl(targetUrl) {
   const proxyUrl = getProxyUrlForTarget(targetUrl);
   if (!proxyUrl) return globalThis.WebSocket;
 
-  return (url, protocols) => {
-    const proxyUrlForTarget = getProxyUrlForTarget(url);
-    if (!proxyUrlForTarget) {
-      return new globalThis.WebSocket(url, protocols);
-    }
-
-    const wsPromise = (async () => {
-      const dispatcher = await getProxyDispatcher(url);
-      const { WebSocket: UndiciWebSocket } = await import('undici');
+  const dispatcher = await getProxyDispatcher(targetUrl);
+  const { WebSocket: UndiciWebSocket } = await importUndici();
 
-      const wsOptions = { dispatcher };
+  class ProxyWebSocket extends UndiciWebSocket {
+    constructor(url, protocols) {
+      const options = { dispatcher };
       if (protocols) {
-        if (Array.isArray(protocols)) {
-          wsOptions.protocols = protocols;
-        } else {
-          wsOptions.protocols = [protocols];
-        }
-      }
-
-      return new UndiciWebSocket(url, wsOptions);
-    })();
-
-    return createSyncProxyWebSocketWrapper(wsPromise);
-  };
-}
-
-function createSyncProxyWebSocketWrapper(wsPromise) {
-  const pendingEvents = [];
-  const eventHandlers = new Map();
-  let ws = null;
-  let settled = false;
-  let readyState = 0;
-  let binaryType = 'arraybuffer';
-
-  const wrapper = {
-    get readyState() { return ws ? ws.readyState : readyState; },
-    get url() { return ws ? ws.url : ''; },
-    get protocol() { return ws ? ws.protocol : ''; },
-    get binaryType() { return ws ? ws.binaryType : binaryType; },
-    set binaryType(v) {
-      binaryType = v;
-      if (ws) ws.binaryType = v;
-    },
-
-    send(data, callback) {
-      if (ws) {
-        if (ws.send.length >= 2) return ws.send(data, callback);
-        try { ws.send(data); if (callback) callback(null); } catch (e) { if (callback) callback(e); }
-        return;
-      }
-      pendingEvents.push({ type: 'send', data, callback });
-    },
-
-    close(code, reason) {
-      if (ws) { ws.close(code, reason); return; }
-      readyState = 3;
-      pendingEvents.push({ type: 'close', code, reason });
-    },
-
-    addEventListener(type, handler) {
-      if (!eventHandlers.has(type)) eventHandlers.set(type, new Set());
-      eventHandlers.get(type).add(handler);
-      if (ws) ws.addEventListener(type, handler);
-    },
-
-    removeEventListener(type, handler) {
-      const handlers = eventHandlers.get(type);
-      if (handlers) handlers.delete(handler);
-      if (ws) ws.removeEventListener(type, handler);
-    },
-
-    on(type, handler) { wrapper.addEventListener(type, handler); },
-    off(type, handler) { wrapper.removeEventListener(type, handler); },
-  };
-
-  function flushPendingEvents() {
-    for (const evt of pendingEvents) {
-      if (evt.type === 'send') {
-        if (ws.send.length >= 2) ws.send(evt.data, evt.callback);
-        else { try { ws.send(evt.data); if (evt.callback) evt.callback(null); } catch (e) { if (evt.callback) evt.callback(e); } }
-      } else if (evt.type === 'close') {
-        ws.close(evt.code, evt.reason);
+        options.protocols = Array.isArray(protocols) ? protocols : [protocols];
       }
+      super(url, options);
     }
-    pendingEvents.length = 0;
   }
 
-  wsPromise.then((resolvedWs) => {
-    ws = resolvedWs;
-    if ('binaryType' in ws) ws.binaryType = binaryType;
-    for (const [type, handlers] of eventHandlers) {
-      for (const handler of handlers) {
-        ws.addEventListener(type, handler);
-      }
-    }
-    flushPendingEvents();
-  }).catch((err) => {
-    readyState = 3;
-    const handlers = eventHandlers.get('error');
-    if (handlers) for (const h of handlers) h(err instanceof Error ? err : new Error(String(err)));
-    const closeHandlers = eventHandlers.get('close');
-    if (closeHandlers) for (const h of closeHandlers) h({ code: 1006, reason: err.message || String(err) });
-  });
-
-  return wrapper;
+  return ProxyWebSocket;
 }

package/plugins/huaweicloud-core/src/proxy/proxy-config.mjs

@@ -47,6 +47,10 @@ function shouldBypassProxy(hostname, noProxyList) {
     if (!p) continue;
     if (p === lower) return true;
     if (p === '*') return true;
+    if (p.startsWith('*.')) {
+      const domain = p.slice(1);
+      if (lower.endsWith(domain) || lower === p.slice(2)) return true;
+    }
     if (p.startsWith('.') && lower.endsWith(p)) return true;
     if (lower.endsWith('.' + p)) return true;
   }
@@ -60,13 +64,16 @@ export function getProxySettings(targetUrl) {
 
   const fileConfig = readProxyConfig();
 
-  const https_proxy = envHttps || (fileConfig?.https_proxy || '');
-  const http_proxy = envHttp || (fileConfig?.http_proxy || '');
-  const no_proxy = envNoProxy || (fileConfig?.no_proxy || '');
+  const https_proxy = envHttps || fileConfig?.https_proxy || fileConfig?.HTTPS_PROXY || '';
+  const http_proxy = envHttp || fileConfig?.http_proxy || fileConfig?.HTTP_PROXY || '';
+  const no_proxy = envNoProxy || fileConfig?.no_proxy || fileConfig?.NO_PROXY || '';
 
   if (!https_proxy && !http_proxy) return null;
 
-  const noProxyList = no_proxy.split(',').map((s) => s.trim()).filter(Boolean);
+  const noProxyList = no_proxy
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
 
   if (targetUrl) {
     const parsed = new URL(targetUrl);

package/plugins/huaweicloud-core/src/risk-rule-engine.mjs

@@ -18,7 +18,10 @@ export function loadRiskRules(options = {}) {
 
 function redactEvidence(text) {
   return String(text)
-    .replace(/((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|authorization|password|passwd|adminPass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi, '$1<redacted>')
+    .replace(
+      /((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|authorization|password|passwd|adminPass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
+      '$1<redacted>',
+    )
     .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>');
 }
 

package/plugins/huaweicloud-core/src/safety-policy.mjs

@@ -1,6 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+
 import { evaluateCommandRisk, mergeRiskDecision } from './risk-rule-engine.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -17,9 +18,13 @@ function regexFrom(pattern) {
 }
 
 function isSecretKeyName(key, policy = DEFAULT_POLICY) {
-  const normalized = String(key).toLowerCase().replace(/[^a-z0-9]/g, '');
+  const normalized = String(key)
+    .toLowerCase()
+    .replace(/[^a-z0-9]/g, '');
   if (
-    /access.*key|secret.*key|security.*token|xauth.*token|authorization|password|passwd|adminpass|credential|private.*key/.test(normalized)
+    /access.*key|secret.*key|security.*token|xauth.*token|authorization|password|passwd|adminpass|credential|private.*key/.test(
+      normalized,
+    )
   ) {
     return true;
   }
@@ -28,7 +33,10 @@ function isSecretKeyName(key, policy = DEFAULT_POLICY) {
 
 function redactString(text) {
   return String(text)
-    .replace(/((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|authorization|password|passwd|adminPass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi, '$1<redacted>')
+    .replace(
+      /((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|authorization|password|passwd|adminPass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
+      '$1<redacted>',
+    )
     .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>');
 }
 
@@ -78,15 +86,11 @@ function matchesAny(value, patterns) {
 
 function hasWritePrefix(operation, policy) {
   const normalized = String(operation);
-  return policy.writeOperationPrefixes.some((prefix) =>
-    new RegExp(`(^|[A-Za-z0-9])${prefix}`, 'i').test(normalized),
-  );
+  return policy.writeOperationPrefixes.some((prefix) => new RegExp(`(^|[A-Za-z0-9])${prefix}`, 'i').test(normalized));
 }
 
 function hasReadPrefix(operation, policy) {
-  return policy.readOperationPrefixes.some((prefix) =>
-    new RegExp(`^${prefix}`, 'i').test(operation),
-  );
+  return policy.readOperationPrefixes.some((prefix) => new RegExp(`^${prefix}`, 'i').test(operation));
 }
 
 function isLocalMetadataCommand(args) {
@@ -119,26 +123,31 @@ export function classifyHcloudArgs(args, options = {}) {
   }
 
   if (isLocalMetadataCommand(normalizedArgs)) {
-    return applyCommandRiskRules({
-      decision: 'allow',
-      risk: 'local_metadata',
-      reason: 'KooCLI local help and version commands are read-only and do not call Huawei Cloud resource APIs.',
-      service,
-      operation,
-      args: normalizedArgs,
-    }, normalizedArgs, options);
+    return applyCommandRiskRules(
+      {
+        decision: 'allow',
+        risk: 'local_metadata',
+        reason: 'KooCLI local help and version commands are read-only and do not call Huawei Cloud resource APIs.',
+        service,
+        operation,
+        args: normalizedArgs,
+      },
+      normalizedArgs,
+      options,
+    );
   }
 
   if (service.toLowerCase() === 'configure') {
     const subcommand = operation.toLowerCase();
     if (
-      policy.blockedConfigureSubcommands.map((cmd) => cmd.toLowerCase()).includes(subcommand)
-      && options.allowCredentialRead !== true
+      policy.blockedConfigureSubcommands.map((cmd) => cmd.toLowerCase()).includes(subcommand) &&
+      options.allowCredentialRead !== true
     ) {
       return {
         decision: 'deny',
         risk: 'credential',
-        reason: 'Direct hcloud configure inspection may expose profile credentials. Use the redacted toolkit tools instead.',
+        reason:
+          'Direct hcloud configure inspection may expose profile credentials. Use the redacted toolkit tools instead.',
       };
     }
   }
@@ -160,7 +169,8 @@ export function classifyHcloudArgs(args, options = {}) {
   }
 
   const readOnly = hasReadPrefix(operation, policy);
-  const executionOps = /(^|\.)(Invoke|SyncInvoke|AsyncInvoke|Send|Trigger|Execute|Start|Reboot|Restart|Stop|Publish|Deploy)/i;
+  const executionOps =
+    /(^|\.)(Invoke|SyncInvoke|AsyncInvoke|Send|Trigger|Execute|Start|Reboot|Restart|Stop|Publish|Deploy)/i;
   const isExecution = executionOps.test(operation) && !readOnly;
   const isWrite = !readOnly && hasWritePrefix(operation, policy);
 
@@ -176,11 +186,30 @@ export function classifyHcloudArgs(args, options = {}) {
     return {
       decision: 'deny',
       risk: 'write',
-      reason: 'Huawei Cloud write operation blocked until the agent presents a plan and receives explicit user approval.',
+      reason:
+        'Huawei Cloud write operation blocked until the agent presents a plan and receives explicit user approval.',
     };
   }
 
-  const obsutilWrites = ['mb', 'cp', 'mv', 'rm', 'delete', 'mkdir', 'sync', 'restore', 'chattri', 'bucketpolicy', 'lifecycle', 'cors', 'website', 'sign', 'share-add', 'share-update', 'share-rm'];
+  const obsutilWrites = [
+    'mb',
+    'cp',
+    'mv',
+    'rm',
+    'delete',
+    'mkdir',
+    'sync',
+    'restore',
+    'chattri',
+    'bucketpolicy',
+    'lifecycle',
+    'cors',
+    'website',
+    'sign',
+    'share-add',
+    'share-update',
+    'share-rm',
+  ];
   const obsutilReads = ['ls', 'stat', 'cat', 'help', 'version'];
   const isObs = service.toLowerCase() === 'obs' || service.toLowerCase() === 'hcloud obs';
   const isObsWrite = isObs && obsutilWrites.includes(operation);
@@ -193,64 +222,86 @@ export function classifyHcloudArgs(args, options = {}) {
     };
   }
   if (isObsRead) {
-    return applyCommandRiskRules({
-      decision: 'allow',
-      risk: 'read_only',
-      reason: 'OBS read-only operation.',
-      service,
-      operation,
-      args: normalizedArgs,
-    }, normalizedArgs, options);
+    return applyCommandRiskRules(
+      {
+        decision: 'allow',
+        risk: 'read_only',
+        reason: 'OBS read-only operation.',
+        service,
+        operation,
+        args: normalizedArgs,
+      },
+      normalizedArgs,
+      options,
+    );
   }
   if (isObsWrite && options.allowWrites) {
-    return applyCommandRiskRules({
-      decision: 'allow',
-      risk: 'write',
-      reason: 'OBS write operation approved by user.',
-      service,
-      operation,
-      args: normalizedArgs,
-    }, normalizedArgs, options);
+    return applyCommandRiskRules(
+      {
+        decision: 'allow',
+        risk: 'write',
+        reason: 'OBS write operation approved by user.',
+        service,
+        operation,
+        args: normalizedArgs,
+      },
+      normalizedArgs,
+      options,
+    );
   }
 
   if (isExecution && options.allowWrites) {
-    return applyCommandRiskRules({
-      decision: 'allow',
-      risk: 'execution',
-      reason: 'Huawei Cloud execution/trigger operation approved by user.',
-      service,
-      operation,
-      args: normalizedArgs,
-    }, normalizedArgs, options);
+    return applyCommandRiskRules(
+      {
+        decision: 'allow',
+        risk: 'execution',
+        reason: 'Huawei Cloud execution/trigger operation approved by user.',
+        service,
+        operation,
+        args: normalizedArgs,
+      },
+      normalizedArgs,
+      options,
+    );
   }
 
   if (isWrite && options.allowWrites) {
-    return applyCommandRiskRules({
+    return applyCommandRiskRules(
+      {
+        decision: 'allow',
+        risk: 'write',
+        reason: 'Huawei Cloud write operation approved by user.',
+        service,
+        operation,
+        args: normalizedArgs,
+      },
+      normalizedArgs,
+      options,
+    );
+  }
+
+  return applyCommandRiskRules(
+    {
       decision: 'allow',
-      risk: 'write',
-      reason: 'Huawei Cloud write operation approved by user.',
+      risk: readOnly ? 'read_only' : 'unknown_read',
+      reason: readOnly
+        ? 'Command appears to be a read-only Huawei Cloud operation.'
+        : 'Command does not match a known write or secret operation; treat output as untrusted and redact it.',
       service,
       operation,
       args: normalizedArgs,
-    }, normalizedArgs, options);
-  }
-
-  return applyCommandRiskRules({
-    decision: 'allow',
-    risk: readOnly ? 'read_only' : 'unknown_read',
-    reason: readOnly
-      ? 'Command appears to be a read-only Huawei Cloud operation.'
-      : 'Command does not match a known write or secret operation; treat output as untrusted and redact it.',
-    service,
-    operation,
-    args: normalizedArgs,
-  }, normalizedArgs, options);
+    },
+    normalizedArgs,
+    options,
+  );
 }
 
 function splitSimpleCommand(command) {
-  return String(command)
-    .match(/"[^"]*"|'[^']*'|\S+/g)
-    ?.map((part) => part.replace(/^['"]|['"]$/g, '')) || [];
+  return (
+    String(command)
+      .match(/"[^"]*"|'[^']*'|\S+/g)
+      ?.map((part) => part.replace(/^['"]|['"]$/g, '')) || []
+  );
 }
 
 export function classifyTextCommand(command, options = {}) {
@@ -261,11 +312,15 @@ export function classifyTextCommand(command, options = {}) {
     return {
       decision: 'deny',
       risk: 'credential',
-      reason: 'Reading Huawei Cloud credential or profile files is blocked. Use redacted profile inspection tools instead.',
+      reason:
+        'Reading Huawei Cloud credential or profile files is blocked. Use redacted profile inspection tools instead.',
     };
   }
 
-  if (/(^|\s)(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:)/i.test(text) && /HUAWEICLOUD|HWC_|HCLOUD|OS_/i.test(text)) {
+  if (
+    /(^|\s)(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:)/i.test(text) &&
+    /HUAWEICLOUD|HWC_|HCLOUD|OS_/i.test(text)
+  ) {
     return {
       decision: 'deny',
       risk: 'credential',

package/plugins/huaweicloud-core/src/sandbox/hdkitservice-api.mjs

@@ -1,13 +1,20 @@
 import { getCredentials } from './hwlink-api.mjs';
 import { getProxyDispatcher } from '../proxy/proxy-agent.mjs';
+import { cacheUserHash } from '../telemetry/telemetry.mjs';
 
-const HDKIT_BASE_URL =
-  process.env.HDKITSERVICE_ENDPOINT ||
-  'https://devkit.huaweicloud.com/rest/developer/server/hdkitservice/';
+function getHdkitBaseUrl() {
+  return process.env.HDKITSERVICE_ENDPOINT || 'https://devkit.huaweicloud.com/rest/developer/server/hdkitservice/';
+}
 
 async function hdkitRequest(method, path, body, timeoutMs = 300000) {
   const { ak, sk, securitytoken } = getCredentials();
 
+  if (!ak || !sk) {
+    throw new Error(
+      'Huawei Cloud credentials are not configured. ' +
+        'Run "npx huaweicloud-devkit auth init" or set HW_ACCESS_KEY/HW_SECRET_KEY.',
+    );
+  }
   const headers = {
     'Content-Type': 'application/json',
     'X-HW-AK': ak,
@@ -17,7 +24,7 @@ async function hdkitRequest(method, path, body, timeoutMs = 300000) {
     headers['X-HW-Security-Token'] = securitytoken;
   }
 
-  const url = `${HDKIT_BASE_URL}${path}`;
+  const url = `${getHdkitBaseUrl()}${path}`;
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
 
@@ -30,8 +37,13 @@ async function hdkitRequest(method, path, body, timeoutMs = 300000) {
       body: body ? JSON.stringify(body) : undefined,
       signal: controller.signal,
     };
-    if (dispatcher) fetchOpts.dispatcher = dispatcher;
-    resp = await fetch(url, fetchOpts);
+    if (dispatcher) {
+      fetchOpts.dispatcher = dispatcher;
+      const { fetch: undiciFetch } = await import('undici');
+      resp = await undiciFetch(url, fetchOpts);
+    } else {
+      resp = await fetch(url, fetchOpts);
+    }
   } finally {
     clearTimeout(timer);
   }
@@ -45,12 +57,12 @@ async function hdkitRequest(method, path, body, timeoutMs = 300000) {
   }
 
   if (!resp.ok) {
-    const err = new Error(
-      data.message || `hdkitservice error: ${data.code || resp.status}`
-    );
-    err.code = data.code;
+    const code = data.code || `HTTP_${resp.status}`;
+    const trace = data.traceId ? ` [trace: ${data.traceId}]` : '';
+    const err = new Error(`${code}: ${data.message || 'hdkitservice error'}${trace}`);
+    err.code = code;
     err.status = resp.status;
-    err.traceId = data.traceId; // 后端实际返回驼峰 traceId
+    err.traceId = data.traceId;
     throw err;
   }
 
@@ -58,7 +70,15 @@ async function hdkitRequest(method, path, body, timeoutMs = 300000) {
 }
 
 export async function hdkitCheckUser() {
-  return await hdkitRequest('GET', 'check-user', undefined, 30000);
+  const result = await hdkitRequest('GET', 'check-user', undefined, 30000);
+  if (result.userHash) cacheUserHash(result.userHash);
+  return result;
+}
+
+export async function hdkitGenerateUserHash() {
+  const result = await hdkitRequest('GET', 'user/generatorUserIDHash', undefined, 30000);
+  if (result.userHash) cacheUserHash(result.userHash);
+  return result;
 }
 
 export async function hdkitSignAgreement() {
@@ -88,4 +108,20 @@ export async function hdkitCredentials(sessionId, devStageId, enableSts = true)
   return await hdkitRequest('POST', 'credentials', body);
 }
 
+export async function hdkitVoucherStatus(domainId) {
+  try {
+    const path = domainId ? `voucher/status?domain_id=${encodeURIComponent(domainId)}` : 'voucher/status';
+    return await hdkitRequest('GET', path, undefined, 30000);
+  } catch (error) {
+    return { claimed: false, message: 'Incentive service unavailable, please try again later' };
+  }
+}
 
+export async function hdkitVoucherClaim(domainId) {
+  try {
+    const body = domainId ? { domain_id: domainId } : {};
+    return await hdkitRequest('POST', 'voucher/claim', body);
+  } catch (error) {
+    return { claimed: false, message: 'Incentive service unavailable, please try again later' };
+  }
+}