huaweicloud-devkit 1.1.2-next.0 → 1.1.2-next.2

package/package.json

@@ -1,46 +1,77 @@
 {
-    "name": "huaweicloud-devkit",
-    "version": "1.1.2-next.0",
-    "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
-    "type": "module",
-    "files": [
-        "bin",
-        ".agents",
-        "plugins/huaweicloud-core",
-        "integrations/opencode"
-    ],
-    "bin": {
-        "huaweicloud-devkit": "./bin/setup.cjs"
-    },
-    "repository": {
-        "type": "git",
-        "url": "https://github.com/huaweicloud/HuaweiCloud-Devkit.git"
-    },
-    "scripts": {
-        "test": "node --test",
-        "lint:md": "markdownlint-cli2 \"**/*.md\" \"#node_modules\" \"#.git\" \"#test/**\" \"#docs/**\"",
-        "lint": "npm run lint:md",
-        "validate": "node ./scripts/validate-package.mjs",
-        "postinstall": "node -e \"console.log('\\nHuaweiCloud DevKit installed. Run: npx huaweicloud-devkit install\\n')\""
-    },
-    "devDependencies": {
-        "markdownlint-cli2": "^0.23.2"
-    },
-    "keywords": [
-        "huaweicloud",
-        "huawei-cloud",
-        "agent",
-        "codex",
-        "opencode",
-        "workbuddy",
-        "dsh",
-        "deepseek-harness",
-        "mcp",
-        "koocli",
-        "hcloud"
-    ],
-    "license": "Apache-2.0",
-    "engines": {
-        "node": ">=20"
+  "name": "huaweicloud-devkit",
+  "version": "1.1.2-next.2",
+  "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
+  "type": "module",
+  "files": [
+    "cordis.patch.yml",
+    "bin",
+    ".agents",
+    "plugins/huaweicloud-core",
+    "integrations/hermes",
+    "integrations/opencode",
+    "integrations/dsh",
+    "integrations/workbuddy",
+    "integrations/atomcode"
+  ],
+  "bin": {
+    "huaweicloud-devkit": "./bin/setup.cjs",
+    "huaweicloud-devkit-mcp": "./plugins/huaweicloud-core/src/mcp-server.mjs"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/huaweicloud/huaweicloud-devkit.git"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
     }
+  },
+  "scripts": {
+    "test": "node --test \"test/*.test.mjs\"",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "lint:md": "markdownlint-cli2 \"**/*.md\" \"#node_modules\" \"#.git\" \"#test/**\" \"#docs/**\"",
+    "lint:js": "eslint .",
+    "lint": "npm run lint:md && npm run lint:js",
+    "validate": "node ./scripts/validate-package.mjs",
+    "pack:verify": "node ./scripts/pack-verify.mjs",
+    "postinstall": "node ./bin/dsh-postinstall.cjs"
+  },
+  "dependencies": {
+    "undici": "^8.10.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.8.1",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-import-x": "^4.17.1",
+    "eslint-plugin-n": "^18.3.0",
+    "eslint-plugin-unicorn": "^73.0.0",
+    "globals": "^17.11.0",
+    "markdownlint-cli2": "^0.23.2",
+    "prettier": "^3.9.6"
+  },
+  "keywords": [
+    "huaweicloud",
+    "huawei-cloud",
+    "agent",
+    "codex",
+    "opencode",
+    "codearts",
+    "codearts-work",
+    "officeace",
+    "office-claw",
+    "workbuddy",
+    "atomcode",
+    "dsh",
+    "deepseek-harness",
+    "mcp",
+    "koocli",
+    "hcloud"
+  ],
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=22"
+  }
 }

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -5,10 +5,7 @@
     "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
     "developerName": "HuaweiCloud Mate",
     "category": "Cloud",
-    "capabilities": [
-      "Read",
-      "Interactive"
-    ],
+    "capabilities": ["Read", "Interactive"],
     "websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
     "brandColor": "#C7000B",
     "defaultPrompt": [
@@ -20,25 +17,15 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.2-next.0",
+  "version": "1.1.2-next.2",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"
   },
   "hooks": "./hooks/",
-  "name": "huaweicloud-core",
+  "name": "huaweicloud-devkit",
   "homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
   "repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
   "license": "Apache-2.0",
-  "keywords": [
-    "huaweicloud",
-    "huawei-cloud",
-    "koocli",
-    "hcloud",
-    "agent",
-    "mcp",
-    "api",
-    "sdk",
-    "skills"
-  ]
+  "keywords": ["huaweicloud", "huawei-cloud", "koocli", "hcloud", "agent", "mcp", "api", "sdk", "skills"]
 }

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -1,43 +1,33 @@
 {
-  "name": "huaweicloud-core",
-  "version": "1.1.2-next.0",
-  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
-  "author": {
-    "name": "HuaweiCloud Mate",
-    "url": "https://github.com/huaweicloud"
-  },
-  "homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
-  "repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
-  "license": "Apache-2.0",
-  "keywords": [
-    "huaweicloud",
-    "huawei-cloud",
-    "koocli",
-    "hcloud",
-    "agent",
-    "mcp",
-    "api",
-    "sdk",
-    "skills"
-  ],
-  "skills": "./skills/",
-  "mcpServers": "./.mcp.json",
   "interface": {
-    "displayName": "HuaweiCloud Devkit",
     "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
-    "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
     "developerName": "HuaweiCloud Mate",
-    "category": "Cloud",
-    "capabilities": [
-      "Read",
-      "Interactive"
-    ],
-    "websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+    "capabilities": ["Read", "Interactive"],
     "brandColor": "#C7000B",
+    "composerIcon": "./assets/icon.png",
+    "logo": "./assets/logo.png",
+    "logoDark": "./assets/logo-dark.png",
+    "category": "Cloud",
     "defaultPrompt": [
       "Help me choose the right Huawei Cloud capability.",
       "Check my Huawei Cloud CLI setup safely.",
       "Plan this Huawei Cloud API or SDK task."
-    ]
-  }
+    ],
+    "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
+    "websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+    "displayName": "HuaweiCloud Devkit"
+  },
+  "mcpServers": "./.mcp.json",
+  "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
+  "skills": "./skills/",
+  "version": "1.1.2-next.2",
+  "author": {
+    "name": "HuaweiCloud Mate",
+    "url": "https://github.com/huaweicloud"
+  },
+  "name": "huaweicloud-devkit",
+  "homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+  "repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+  "license": "Apache-2.0",
+  "keywords": ["huaweicloud", "huawei-cloud", "koocli", "hcloud", "agent", "mcp", "api", "sdk", "skills"]
 }

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -5,10 +5,7 @@
     "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
     "developerName": "HuaweiCloud Mate",
     "category": "Cloud",
-    "capabilities": [
-      "Read",
-      "Interactive"
-    ],
+    "capabilities": ["Read", "Interactive"],
     "websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
     "brandColor": "#C7000B",
     "defaultPrompt": [
@@ -20,25 +17,15 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.2-next.0",
+  "version": "1.1.2-next.2",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"
   },
   "hooks": "./hooks/",
-  "name": "huaweicloud-core",
+  "name": "huaweicloud-devkit",
   "homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
   "repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
   "license": "Apache-2.0",
-  "keywords": [
-    "huaweicloud",
-    "huawei-cloud",
-    "koocli",
-    "hcloud",
-    "agent",
-    "mcp",
-    "api",
-    "sdk",
-    "skills"
-  ]
+  "keywords": ["huaweicloud", "huawei-cloud", "koocli", "hcloud", "agent", "mcp", "api", "sdk", "skills"]
 }

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -0,0 +1,30 @@
+{
+  "name": "huaweicloud-devkit",
+  "version": "1.1.2-next.2",
+  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
+  "author": {
+    "name": "HuaweiCloud Mate",
+    "url": "https://github.com/huaweicloud"
+  },
+  "homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+  "repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+  "license": "Apache-2.0",
+  "keywords": ["huaweicloud", "huawei-cloud", "koocli", "hcloud", "agent", "mcp", "api", "sdk", "skills"],
+  "skills": "./skills/",
+  "mcpServers": "./.mcp.json",
+  "interface": {
+    "displayName": "HuaweiCloud Devkit",
+    "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
+    "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
+    "developerName": "HuaweiCloud Mate",
+    "category": "Cloud",
+    "capabilities": ["Read", "Interactive"],
+    "websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
+    "brandColor": "#C7000B",
+    "defaultPrompt": [
+      "Help me choose the right Huawei Cloud capability.",
+      "Check my Huawei Cloud CLI setup safely.",
+      "Plan this Huawei Cloud API or SDK task."
+    ]
+  }
+}

package/plugins/huaweicloud-core/.mcp.json

@@ -2,13 +2,10 @@
   "mcpServers": {
     "huaweicloud-devkit": {
       "command": "node",
-      "args": [
-        "./src/mcp-server.mjs"
-      ],
+      "args": ["./src/mcp-server.mjs"],
       "cwd": ".",
       "env": {
-        "HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local",
-        "HDKITSERVICE_ENDPOINT": ""
+        "HUAWEICLOUD_AGENT_TOOLKIT_MODE": "local"
       }
     }
   }

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
-  "name": "huaweicloud-core",
-  "version": "1.1.2-next.0",
+  "name": "huaweicloud-devkit",
+  "version": "1.1.2-next.2",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",
@@ -9,30 +9,16 @@
   "homepage": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
   "repository": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
   "license": "Apache-2.0",
-  "keywords": [
-    "huaweicloud",
-    "huawei-cloud",
-    "koocli",
-    "hcloud",
-    "agent",
-    "mcp",
-    "api",
-    "sdk",
-    "skills"
-  ],
+  "keywords": ["huaweicloud", "huawei-cloud", "koocli", "hcloud", "agent", "mcp", "api", "sdk", "skills"],
   "skills": "./skills/",
   "mcpServers": "./.mcp.json",
-  "hooks": "./hooks/",
   "interface": {
     "displayName": "HuaweiCloud Devkit",
     "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
     "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
     "developerName": "HuaweiCloud Mate",
     "category": "Cloud",
-    "capabilities": [
-      "Read",
-      "Interactive"
-    ],
+    "capabilities": ["Read", "Interactive"],
     "websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
     "brandColor": "#C7000B",
     "defaultPrompt": [

package/plugins/huaweicloud-core/hooks/huaweicloud-safety.py

@@ -15,31 +15,65 @@ import json
 import re
 import sys
 from pathlib import Path
+from datetime import datetime, timezone
 
 DENY_PREFIX = "Huawei Cloud safety hook blocked this action: "
 RULES_PATH = Path(__file__).resolve().parents[1] / "safety" / "rules" / "cloud-risk-rules.json"
+POLICY_PATH = Path(__file__).resolve().parents[1] / "safety" / "policy.json"
 
-CONFIG_FILE_RE = re.compile(r"(\.hcloud|\.huaweicloud|hcloud[/\\](config|credentials)|huaweicloud[/\\](config|credentials))", re.I)
-ENV_DUMP_RE = re.compile(r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I)
-SECRET_READ_RE = re.compile(r"(ShowSecretVersion|GetSecretValue|secret_string|secret_binary)", re.I)
-HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
-WRITE_OPERATION_RE = re.compile(
-    r"\b(BatchCreate|BatchDelete|Create|Delete|Update|Modify|Resize|Reboot|Stop|Start|Restart|Authorize|Revoke|Add|Remove|Associate|Disassociate|Attach|Detach|Enable|Disable)\w*",
-    re.I,
+PLUGIN_DIR = Path(__file__).resolve().parents[2]
+TELEMETRY_DIR = PLUGIN_DIR / "telemetry"
+HOOK_EVENTS_PATH = TELEMETRY_DIR / "hook-events.jsonl"
+
+CONFIG_FILE_RE = None
+SECRET_READ_RE = None
+WRITE_OPERATION_RE = None
+
+
+def load_policy():
+    global CONFIG_FILE_RE, SECRET_READ_RE, WRITE_OPERATION_RE
+    try:
+        with POLICY_PATH.open("r", encoding="utf-8") as file_obj:
+            policy = json.load(file_obj)
+        cred_patterns = policy.get("credentialFilePatterns", [])
+        if cred_patterns:
+            CONFIG_FILE_RE = re.compile("|".join(cred_patterns), re.I)
+        blocked_secrets = policy.get("blockedSecretOperations", [])
+        if blocked_secrets:
+            SECRET_READ_RE = re.compile("|".join(re.escape(op) for op in blocked_secrets), re.I)
+        write_prefixes = policy.get("writeOperationPrefixes", [])
+        if write_prefixes:
+            WRITE_OPERATION_RE = re.compile(r"\b(" + "|".join(write_prefixes) + r")\w*", re.I)
+    except Exception:
+        pass
+
+
+load_policy()
+
+ENV_DUMP_RE = re.compile(
+    r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I,
 )
+HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
 READ_OPERATION_RE = re.compile(r"\b(List|Show|Get|Describe|NovaList|NovaShow)\w*", re.I)
 
 
-def deny(reason):
-    json.dump(
-        {
-            "hookSpecificOutput": {
-                "hookEventName": "PreToolUse",
-                "permissionDecision": "deny",
-                "permissionDecisionReason": DENY_PREFIX + reason,
+def deny(reason, hermes=False):
+    sys.stdout.write(
+        json.dumps(
+            {
+                "action": "block",
+                "message": DENY_PREFIX + reason,
+            }
+            if hermes
+            else {
+                "hookSpecificOutput": {
+                    "hookEventName": "PreToolUse",
+                    "permissionDecision": "deny",
+                    "permissionDecisionReason": DENY_PREFIX + reason,
+                }
             }
-        },
-        sys.stdout,
+        )
+        + "\n"
     )
     sys.exit(0)
 
@@ -48,6 +82,27 @@ def allow():
     sys.exit(0)
 
 
+def record_cli_event(text):
+    m = HCLOUD_RE.search(text)
+    if not m:
+        return
+    rest = text[m.end():].strip()
+    parts = rest.split()
+    cmd = " ".join(p for p in parts if not p.startswith("--") and not p.startswith("-") and "=" not in p)
+    if not cmd:
+        return
+    is_read = bool(READ_OPERATION_RE.search(cmd))
+    is_write = bool(WRITE_OPERATION_RE.search(cmd)) if WRITE_OPERATION_RE else False
+    event_key = "cli:read" if is_read else ("cli:write" if is_write else "cli:invoke")
+    event = {"key": event_key, "value": f"hcloud {cmd}", "capability": "cli"}
+    try:
+        TELEMETRY_DIR.mkdir(parents=True, exist_ok=True)
+        with HOOK_EVENTS_PATH.open("a", encoding="utf-8") as f:
+            f.write(json.dumps(event) + "\n")
+    except Exception:
+        pass
+
+
 def command_text(tool_input):
     if isinstance(tool_input, str):
         return tool_input
@@ -108,6 +163,31 @@ def first_denied_command_rule(text):
     return None
 
 
+def evaluate(tool_name, tool_input):
+    """Run the full safety check and return a raw block reason, or None to allow.
+
+    Shared by the CLI shell (``main``) and the Hermes Python-plugin hook, which
+    reuses this module via ``importlib`` so a single implementation enforces the
+    policy everywhere. The returned reason does NOT include ``DENY_PREFIX`` —
+    callers decide the exact output shape.
+    """
+    text = command_text(tool_input)
+
+    if CONFIG_FILE_RE and CONFIG_FILE_RE.search(text):
+        return "reading Huawei Cloud credential/profile files can expose AK/SK or tokens. Use redacted toolkit tools."
+    if ENV_DUMP_RE.search(text):
+        return "dumping cloud credential environment variables is not allowed."
+    if SECRET_READ_RE and SECRET_READ_RE.search(text):
+        return "direct secret value retrieval would put plaintext secrets into the agent context."
+    denied_rule = first_denied_command_rule(text)
+    if denied_rule:
+        return f"{denied_rule.get('message')} Remediation: {denied_rule.get('remediation')}"
+    if tool_name in ("Bash", "terminal") and HCLOUD_RE.search(text) and WRITE_OPERATION_RE.search(text) and not READ_OPERATION_RE.search(text):
+        return "unapproved Huawei Cloud write operations must be planned first and explicitly approved by the user."
+
+    return None
+
+
 def main():
     try:
         data = json.load(sys.stdin)
@@ -115,19 +195,15 @@ def main():
         allow()
 
     tool_name = data.get("tool_name", "")
-    text = command_text(data.get("tool_input", {}))
+    tool_input = data.get("tool_input", {})
+    hermes = "hook_event_name" in data
 
-    if CONFIG_FILE_RE.search(text):
-        deny("reading Huawei Cloud credential/profile files can expose AK/SK or tokens. Use redacted toolkit tools.")
-    if ENV_DUMP_RE.search(text):
-        deny("dumping cloud credential environment variables is not allowed.")
-    if SECRET_READ_RE.search(text):
-        deny("direct secret value retrieval would put plaintext secrets into the agent context.")
-    denied_rule = first_denied_command_rule(text)
-    if denied_rule:
-        deny(f"{denied_rule.get('message')} Remediation: {denied_rule.get('remediation')}")
-    if tool_name == "Bash" and HCLOUD_RE.search(text) and WRITE_OPERATION_RE.search(text) and not READ_OPERATION_RE.search(text):
-        deny("unapproved Huawei Cloud write operations must be planned first and explicitly approved by the user.")
+    text = command_text(tool_input)
+    record_cli_event(text)
+
+    reason = evaluate(tool_name, tool_input)
+    if reason:
+        deny(reason, hermes)
 
     allow()
 

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -0,0 +1,20 @@
+{
+  "name": "huaweicloud-devkit",
+  "id": "huaweicloud-devkit",
+  "displayName": "HuaweiCloud DevKit",
+  "version": "1.1.2-next.2",
+  "family": "bundle-plugin",
+  "bundleFormat": "codex",
+  "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",
+  "author": {
+    "name": "HuaweiCloud Mate",
+    "url": "https://github.com/huaweicloud"
+  },
+  "homepage": "https://github.com/huaweicloud/huaweicloud-devkit",
+  "repository": "https://github.com/huaweicloud/huaweicloud-devkit",
+  "license": "Apache-2.0",
+  "keywords": ["huaweicloud", "huawei-cloud", "koocli", "hcloud", "agent", "mcp", "api", "sdk", "skills", "cloud"],
+  "category": "Cloud",
+  "capabilities": ["Read", "Interactive"],
+  "brandColor": "#C7000B"
+}