huaweicloud-devkit 1.1.2-next.0 → 1.1.2-next.2

package/plugins/huaweicloud-core/safety/policy.json

@@ -1,100 +1,76 @@
 {
-    "version":  "0.1.0",
-    "secretKeyNamePatterns":  [
-                                  "access[_-]?key",
-                                  "secret[_-]?key",
-                                  "security[_-]?token",
-                                  "x[_-]?auth[_-]?token",
-                                  "authorization",
-                                  "password",
-                                  "passwd",
-                                  "token",
-                                  "credential",
-                                  "private[_-]?key",
-                                  "ak",
-                                  "sk"
-                              ],
-    "credentialFilePatterns":  [
-                                   "\\.hcloud",
-                                   "\\.huaweicloud",
-                                   "hcloud[/\\\\](config|credentials)",
-                                   "huaweicloud[/\\\\](config|credentials)"
-                               ],
-    "blockedConfigureSubcommands":  [
-                                        "show",
-                                        "get",
-                                        "list",
-                                        "export",
-                                        "init"
-                                    ],
-    "blockedSecretOperations":  [
-                                    "ShowSecretVersion",
-                                    "DownloadSecret",
-                                    "GetSecretValue"
-                                ],
-    "writeOperationPrefixes":  [
-                                   "Create",
-                                   "BatchCreate",
-                                   "Delete",
-                                   "BatchDelete",
-                                   "Update",
-                                   "Modify",
-                                   "Resize",
-                                   "Reboot",
-                                   "Stop",
-                                   "Start",
-                                   "Restart",
-                                   "Authorize",
-                                   "Revoke",
-                                   "Add",
-                                   "Remove",
-                                   "Associate",
-                                   "Disassociate",
-                                   "Attach",
-                                   "Detach",
-                                    "Enable",
-                                    "Disable",
-                                    "Set",
-                                    "Put",
-                                    "Upload",
-                                    "Install",
-                                    "Publish",
-                                    "Bind",
-                                    "Unbind",
-                                    "Invoke",
-                                    "Execute",
-                                    "Trigger",
-                                    "Deploy"
-                               ],
-    "readOperationPrefixes":  [
-                                  "List",
-                                  "Show",
-                                  "Get",
-                                  "Describe",
-                                  "NovaList",
-                                  "NovaShow"
-                              ],
-    "safeTextReadCommands":  [
-                                 "rg",
-                                 "grep",
-                                 "findstr",
-                                 "git",
-                                 "ls",
-                                 "dir",
-                                 "Get-ChildItem"
-                             ],
-    "blockedSandboxCommands":  [
-                                  "rm\\s+-rf\\s+/",
-                                  "mkfs",
-                                  "dd\\s+if=",
-                                  ":\\(\\)\\{:\\|:&\\};:",
-                                  "shutdown",
-                                  "reboot",
-                                  "init\\s+[06]",
-                                  "fdisk"
-                              ],
-    "sandboxWriteTools":  [
-                               "huaweicloud_sandbox_connect",
-                               "huaweicloud_sandbox_credentials"
-                           ]
-}
+  "version": "0.1.0",
+  "secretKeyNamePatterns": [
+    "access[_-]?key",
+    "secret[_-]?key",
+    "security[_-]?token",
+    "x[_-]?auth[_-]?token",
+    "authorization",
+    "password",
+    "passwd",
+    "token",
+    "credential",
+    "private[_-]?key",
+    "ak",
+    "sk"
+  ],
+  "credentialFilePatterns": [
+    "\\.hcloud",
+    "\\.huaweicloud",
+    "hcloud[/\\\\](config|credentials)",
+    "huaweicloud[/\\\\](config|credentials)"
+  ],
+  "blockedConfigureSubcommands": ["show", "get", "list", "export", "init"],
+  "blockedSecretOperations": ["ShowSecretVersion", "DownloadSecret", "GetSecretValue"],
+  "writeOperationPrefixes": [
+    "Create",
+    "BatchCreate",
+    "Delete",
+    "BatchDelete",
+    "Update",
+    "Modify",
+    "Resize",
+    "Reboot",
+    "Stop",
+    "Start",
+    "Restart",
+    "Authorize",
+    "Revoke",
+    "Add",
+    "Remove",
+    "Associate",
+    "Disassociate",
+    "Attach",
+    "Detach",
+    "Enable",
+    "Disable",
+    "Set",
+    "Put",
+    "Upload",
+    "Install",
+    "Publish",
+    "Bind",
+    "Unbind",
+    "Invoke",
+    "Execute",
+    "Trigger",
+    "Deploy"
+  ],
+  "readOperationPrefixes": ["List", "Show", "Get", "Describe", "NovaList", "NovaShow"],
+  "safeTextReadCommands": ["rg", "grep", "findstr", "git", "ls", "dir", "Get-ChildItem"],
+  "blockedSandboxCommands": [
+    "rm\\s+-rf\\s+/",
+    "mkfs",
+    "dd\\s+if=",
+    ":\\(\\)\\{:\\|:&\\};:",
+    "shutdown",
+    "reboot",
+    "init\\s+[06]",
+    "fdisk"
+  ],
+  "sandboxWriteTools": [
+    "huaweicloud_sandbox_connect",
+    "huaweicloud_sandbox_credentials",
+    "huaweicloud_sandbox_upload_file"
+  ]
+}

package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json

@@ -9,8 +9,14 @@
       "stages": ["command"],
       "match": {
         "any": [
-          { "field": "text", "regex": "(^|\\s)(cat|type|Get-Content|gc|less|more)\\s+[^\\n]*(\\.hcloud|\\.huaweicloud)" },
-          { "field": "text", "regex": "(hcloud|huaweicloud)[/\\\\](config|credentials)" }
+          {
+            "field": "text",
+            "regex": "(^|\\s)(cat|type|Get-Content|gc|less|more)\\s+[^\\n]*(\\.hcloud|\\.huaweicloud)"
+          },
+          {
+            "field": "text",
+            "regex": "(hcloud|huaweicloud)[/\\\\](config|credentials)"
+          }
         ]
       },
       "message": "The command may read local Huawei Cloud credential or profile files into the agent context.",
@@ -24,8 +30,14 @@
       "stages": ["command"],
       "match": {
         "all": [
-          { "field": "text", "regex": "(^|\\s)(env|printenv|Get-ChildItem\\s+Env:|gci\\s+Env:|dir\\s+Env:)" },
-          { "field": "text", "regex": "(HUAWEICLOUD|HWC_|HCLOUD|OS_)" }
+          {
+            "field": "text",
+            "regex": "(^|\\s)(env|printenv|Get-ChildItem\\s+Env:|gci\\s+Env:|dir\\s+Env:)"
+          },
+          {
+            "field": "text",
+            "regex": "(HUAWEICLOUD|HWC_|HCLOUD|OS_)"
+          }
         ]
       },
       "message": "The command may print cloud credential environment variables.",
@@ -39,13 +51,36 @@
       "stages": ["command"],
       "match": {
         "any": [
-          { "field": "text", "regex": "(ShowSecretVersion|DownloadSecret|GetSecretValue)" },
-          { "field": "text", "regex": "(secret_string|secret_binary|secretString|secretBinary)" }
+          {
+            "field": "text",
+            "regex": "(ShowSecretVersion|DownloadSecret|GetSecretValue)"
+          },
+          {
+            "field": "text",
+            "regex": "(secret_string|secret_binary|secretString|secretBinary)"
+          }
         ]
       },
       "message": "The command appears to retrieve plaintext secret values.",
       "remediation": "Use runtime secret references, user-side inspection, or redacted metadata checks instead of returning secret values to the agent."
     },
+    {
+      "id": "hwc-command-sts-credential",
+      "title": "Temporary credential exposure",
+      "category": "credential",
+      "severity": "warn",
+      "stages": ["command"],
+      "match": {
+        "any": [
+          {
+            "field": "text",
+            "regex": "hcloud\\s+STS\\s+(AssumeAgency|GetCallerIdentity|GetTemporaryCredential)\\b"
+          }
+        ]
+      },
+      "message": "此操作将返回临时 AK/SK 和 SecurityToken。注意敏感数据保密，不要将凭证输出到日志或分享给第三方。",
+      "remediation": "临时凭证仅用于当前会话，使用完毕后及时销毁，不要持久化存储。"
+    },
     {
       "id": "hwc-command-encoded-shell-exec",
       "title": "Encoded payload piped to shell",
@@ -54,9 +89,18 @@
       "stages": ["command"],
       "match": {
         "all": [
-          { "field": "text", "regex": "(base64\\s+(-d|--decode)|xxd\\s+-r|certutil\\s+-decode|FromBase64String|hex\\s*decode)" },
-          { "field": "text", "regex": "(\\||;|&&)" },
-          { "field": "text", "regex": "\\b(bash|sh|zsh|powershell|pwsh|cmd|python|node)\\b" }
+          {
+            "field": "text",
+            "regex": "(base64\\s+(-d|--decode)|xxd\\s+-r|certutil\\s+-decode|FromBase64String|hex\\s*decode)"
+          },
+          {
+            "field": "text",
+            "regex": "(\\||;|&&)"
+          },
+          {
+            "field": "text",
+            "regex": "\\b(bash|sh|zsh|powershell|pwsh|cmd|python|node)\\b"
+          }
         ]
       },
       "message": "The command decodes an encoded payload and pipes it into an interpreter.",
@@ -70,11 +114,17 @@
       "stages": ["command", "artifact", "deploy_plan"],
       "match": {
         "all": [
-          { "field": "text", "regex": "(0\\.0\\.0\\.0\\s*/\\s*0|::\\s*/\\s*0|remote_ip_prefix\\s*[=:]\\s*0\\.0\\.0\\.0\\s*/\\s*0|cidr\\s*[=:]\\s*0\\.0\\.0\\.0\\s*/\\s*0)" },
-          { "field": "text", "regex": "(port_range_min|port_range_max|from_port|to_port|port|\\b22\\b|\\b3389\\b|\\b3306\\b|\\b5432\\b|\\b6379\\b|\\b9200\\b)" }
+          {
+            "field": "text",
+            "regex": "(0\\.0\\.0\\.0\\s*/\\s*0|::\\s*/\\s*0|remote_ip_prefix\\s*[=:]\\s*0\\.0\\.0\\.0\\s*/\\s*0|cidr\\s*[=:]\\s*0\\.0\\.0\\.0\\s*/\\s*0)"
+          },
+          {
+            "field": "text",
+            "regex": "\\b(22|3389|3306|5432|6379|9200|27017|1433|2375|2376|5900|11211|8080|8443)\\b"
+          }
         ]
       },
-      "message": "The change appears to expose an administrative or database port to the public internet.",
+      "message": "The change appears to expose an administrative or database port to the public internet. Web ports (80/443) are allowed - this rule only covers admin/database ports.",
       "remediation": "Restrict the source CIDR to a trusted range, use a bastion or VPN, and keep public preview endpoints behind authenticated HTTP services."
     },
     {
@@ -85,11 +135,20 @@
       "stages": ["command", "artifact", "deploy_plan"],
       "match": {
         "all": [
-          { "field": "text", "regex": "(OBS|obs://|bucket|object|Statement|Principal)" }
+          {
+            "field": "text",
+            "regex": "(OBS|obs://|bucket|object|Statement|Principal)"
+          }
         ],
         "any": [
-          { "field": "text", "regex": "((Anonymous|Everyone|\\\"Principal\\\"\\s*:\\s*\\\"\\*\\\"|AllUsers).*(PutObject|DeleteObject|PutBucketPolicy|FULL_CONTROL|WRITE|obs:object:PutObject|obs:bucket:PutBucketPolicy)|(PutObject|DeleteObject|PutBucketPolicy|FULL_CONTROL|WRITE|obs:object:PutObject|obs:bucket:PutBucketPolicy).*(Anonymous|Everyone|\\\"Principal\\\"\\s*:\\s*\\\"\\*\\\"|AllUsers))" },
-          { "field": "text", "regex": "(-acl\\s*=?\\s*public-read-write|acl\\s*[=:]\\s*[\\\"']?public-read-write|public-write)" }
+          {
+            "field": "text",
+            "regex": "((Anonymous|Everyone|\\\"Principal\\\"\\s*:\\s*\\\"\\*\\\"|AllUsers).*(PutObject|DeleteObject|PutBucketPolicy|FULL_CONTROL|WRITE|obs:object:PutObject|obs:bucket:PutBucketPolicy)|(PutObject|DeleteObject|PutBucketPolicy|FULL_CONTROL|WRITE|obs:object:PutObject|obs:bucket:PutBucketPolicy).*(Anonymous|Everyone|\\\"Principal\\\"\\s*:\\s*\\\"\\*\\\"|AllUsers))"
+          },
+          {
+            "field": "text",
+            "regex": "(-acl\\s*=?\\s*public-read-write|acl\\s*[=:]\\s*[\\\"']?public-read-write|public-write)"
+          }
         ]
       },
       "message": "The change may grant anonymous write or full-control access to OBS data.",
@@ -103,8 +162,14 @@
       "stages": ["command", "artifact", "deploy_plan"],
       "match": {
         "all": [
-          { "field": "text", "regex": "(FunctionGraph|APIG|CreateTrigger|CreateApi|DEDICATEDGATEWAY|API Gateway)" },
-          { "field": "text", "regex": "(public|PUBLIC|0\\.0\\.0\\.0\\s*/\\s*0|auth[\\\"']?\\s*[=:]\\s*[\\\"']?(NONE|none|false)|security_authentication[\\\"']?\\s*[=:]\\s*[\\\"']?(NONE|none))" }
+          {
+            "field": "text",
+            "regex": "(FunctionGraph|APIG|CreateTrigger|CreateApi|DEDICATEDGATEWAY|API Gateway)"
+          },
+          {
+            "field": "text",
+            "regex": "(public|PUBLIC|0\\.0\\.0\\.0\\s*/\\s*0|auth[\\\"']?\\s*[=:]\\s*[\\\"']?(NONE|none|false)|security_authentication[\\\"']?\\s*[=:]\\s*[\\\"']?(NONE|none))"
+          }
         ]
       },
       "message": "The generated FunctionGraph or API Gateway path may be publicly reachable without authentication.",
@@ -118,9 +183,18 @@
       "stages": ["command", "artifact", "deploy_plan"],
       "match": {
         "all": [
-          { "field": "text", "regex": "(IAM|policy|role|agency|Statement|Action)" },
-          { "field": "text", "regex": "(\\\"Action\\\"\\s*:\\s*(\\\"(\\*|\\*:\\*)\\\"|\\[\\s*\\\"(\\*|\\*:\\*)\\\")|Action\\s*[=:]\\s*(\\*|\\*:\\*)|AdministratorAccess|FullAccess)" },
-          { "field": "text", "regex": "(\\\"Effect\\\"\\s*:\\s*\\\"Allow\\\"|Effect\\s*[=:]\\s*Allow)" }
+          {
+            "field": "text",
+            "regex": "(IAM|policy|role|agency|Statement|Action)"
+          },
+          {
+            "field": "text",
+            "regex": "(\\\"Action\\\"\\s*:\\s*(\\\"(\\*|\\*:\\*)\\\"|\\[\\s*\\\"(\\*|\\*:\\*)\\\")|Action\\s*[=:]\\s*(\\*|\\*:\\*)|AdministratorAccess|FullAccess)"
+          },
+          {
+            "field": "text",
+            "regex": "(\\\"Effect\\\"\\s*:\\s*\\\"Allow\\\"|Effect\\s*[=:]\\s*Allow)"
+          }
         ]
       },
       "message": "The change appears to grant broad administrator permissions.",
@@ -134,13 +208,61 @@
       "stages": ["command"],
       "match": {
         "all": [
-          { "field": "text", "regex": "(Delete|BatchDelete|Remove|\\brm\\b|delete)" },
-          { "field": "text", "regex": "(--force|-f|--recursive|-r|delete_publicip\\s*[=:]\\s*true)" }
+          {
+            "field": "text",
+            "regex": "(Delete|BatchDelete|Remove|\\brm\\b|delete)"
+          },
+          {
+            "field": "text",
+            "regex": "(\\s--force|\\s-f\\s|\\s--recursive|\\s-r\\s)"
+          }
         ]
       },
       "message": "The command combines deletion with force, recursive, or cascading deletion behavior.",
       "remediation": "Show the exact resources to be deleted, confirm backups or recovery path, and require explicit user approval for the exact command."
     },
+    {
+      "id": "hwc-destructive-delete-operation",
+      "title": "Destructive cloud resource operation",
+      "category": "destructive",
+      "severity": "warn",
+      "stages": ["command"],
+      "match": {
+        "any": [
+          {
+            "field": "text",
+            "regex": "hcloud\\s+\\w+\\s+(Delete\\w*|Detach\\w*|Remove\\w*|Dissociate\\w*|Unassign\\w*|Revoke\\w*)\\b"
+          },
+          {
+            "field": "text",
+            "regex": "hcloud\\s+\\w+\\s+(BatchDelete\\w*|BatchRemove\\w*)\\b"
+          }
+        ]
+      },
+      "message": "This hcloud command will delete, detach, or remove cloud resources. The operation may be irreversible.",
+      "remediation": "List the resources to be affected first, confirm with the user, and require explicit approval before executing any destructive operation."
+    },
+    {
+      "id": "hwc-destructive-delete-cascade",
+      "title": "Cascading cloud resource deletion",
+      "category": "destructive",
+      "severity": "warn",
+      "stages": ["command"],
+      "match": {
+        "all": [
+          {
+            "field": "text",
+            "regex": "(Delete|BatchDelete|Remove|\\brm\\b|delete)"
+          },
+          {
+            "field": "text",
+            "regex": "(delete_publicip\\s*[=:]\\s*true|delete_volume\\s*[=:]\\s*true)"
+          }
+        ]
+      },
+      "message": "This delete command will also remove associated resources (EIP, volume). Check that these should be deleted together.",
+      "remediation": "Confirm with the user whether to delete the associated resources, or set delete_publicip/delete_volume to false to keep them."
+    },
     {
       "id": "hwc-sandbox-missing-ttl",
       "title": "Sandbox deployment missing cleanup metadata",
@@ -149,11 +271,20 @@
       "stages": ["artifact", "deploy_plan"],
       "match": {
         "all": [
-          { "field": "text", "regex": "(sandbox|preview|temporary|ephemeral|dev environment|FunctionGraph|ECS|CCE|APIG)" },
-          { "field": "text", "regex": "(Create|Deploy|Provision|resource|stack|environment)" }
+          {
+            "field": "text",
+            "regex": "(sandbox|preview|temporary|ephemeral|dev environment|FunctionGraph|ECS|CCE|APIG)"
+          },
+          {
+            "field": "text",
+            "regex": "(Create|Deploy|Provision|resource|stack|environment)"
+          }
         ],
         "none": [
-          { "field": "text", "regex": "(ttl|expires_at|expire_at|cleanup|owner|cost_center|auto_delete|auto-delete)" }
+          {
+            "field": "text",
+            "regex": "(ttl|expires_at|expire_at|cleanup|owner|cost_center|auto_delete|auto-delete)"
+          }
         ]
       },
       "message": "The preview or sandbox deployment does not show cleanup or ownership metadata.",
@@ -167,8 +298,14 @@
       "stages": ["command", "artifact", "deploy_plan"],
       "match": {
         "any": [
-          { "field": "text", "regex": "(max_instances|max_node_count|max_replica|desired\\s*[=:]\\s*[5-9][0-9]|replicas\\s*[=:]\\s*[5-9][0-9])" },
-          { "field": "text", "regex": "(GPU|gpu|large|xlarge|charging_mode\\s*[=:]\\s*prePaid|period_type|period_num)" }
+          {
+            "field": "text",
+            "regex": "(max_instances|max_node_count|max_replica|desired\\s*[=:]\\s*[5-9][0-9]|replicas\\s*[=:]\\s*[5-9][0-9])"
+          },
+          {
+            "field": "text",
+            "regex": "(GPU|gpu|large|xlarge|charging_mode\\s*[=:]\\s*prePaid|period_type|period_num)"
+          }
         ]
       },
       "message": "The generated plan may create high-cost or unbounded capacity.",
@@ -182,14 +319,38 @@
       "stages": ["command"],
       "match": {
         "any": [
-          { "field": "text", "regex": "rm\\s+-rf\\s+/" },
-          { "field": "text", "regex": "mkfs" },
-          { "field": "text", "regex": "dd\\s+if=" },
-          { "field": "text", "regex": ":\\\\(\\\\)\\\\{[^}]*\\\\|[^}]*&[^}]*\\\\}[^;]*;:" },
-          { "field": "text", "regex": "\\bshutdown\\b" },
-          { "field": "text", "regex": "\\breboot\\b" },
-          { "field": "text", "regex": "\\binit\\s+[06]\\b" },
-          { "field": "text", "regex": "\\bfdisk\\b" }
+          {
+            "field": "text",
+            "regex": "rm\\s+-rf\\s+/"
+          },
+          {
+            "field": "text",
+            "regex": "mkfs"
+          },
+          {
+            "field": "text",
+            "regex": "dd\\s+if="
+          },
+          {
+            "field": "text",
+            "regex": ":\\\\(\\\\)\\\\{[^}]*\\\\|[^}]*&[^}]*\\\\}[^;]*;:"
+          },
+          {
+            "field": "text",
+            "regex": "\\bshutdown\\b"
+          },
+          {
+            "field": "text",
+            "regex": "\\breboot\\b"
+          },
+          {
+            "field": "text",
+            "regex": "\\binit\\s+[06]\\b"
+          },
+          {
+            "field": "text",
+            "regex": "\\bfdisk\\b"
+          }
         ]
       },
       "message": "The sandbox terminal command is destructively dangerous and could destroy the workspace.",

package/plugins/huaweicloud-core/skills/huawei-apig/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-apig
-description: "Use when creating or managing API Gateway (APIG). Covers API creation, throttling, auth (IAM/APP/basic), CORS, publishing, instance management. Triggers: APIG, API gateway, throttling, publish API. NOT for: FunctionGraph triggers (use huawei-functiongraph)."
+description: 'Use when creating or managing API Gateway (APIG). Covers API creation, throttling, auth (IAM/APP/basic), CORS, publishing, instance management. Triggers: APIG, API gateway, throttling, publish API. NOT for: FunctionGraph triggers (use huawei-functiongraph).'
 version: 1
 ---
 
@@ -8,6 +8,10 @@ version: 1
 
 **STOP - Do not answer from general knowledge.** Follow the procedure below.
 
+## Deployment Routing Guard
+
+If this skill was reached via a DEPLOYMENT intent (the gateway instance is part of an application deployment, not a standalone ad-hoc operation), this is a cloud resource purchase: load `huawei-iac` first for orchestration (mandatory cost+balance gate, batch approval, session state, ordered destroy), then return here for the exact instance/API commands. Sandbox-deployed workloads (huawei-sandbox) bypass iac - no purchase involved.
+
 ## Overview
 
 Domain expertise for Huawei Cloud API Gateway (APIG). Covers instance lifecycle, API group/API creation, publishing, and FunctionGraph trigger integration.
@@ -16,16 +20,16 @@ Always discover parameters with `hcloud APIG <Operation> --help` before executin
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| API group region-locked | Cannot move across regions |
-| Throttling per-API default | Use app-level quotas for per-user limits |
-| CORS must be explicit | OPTIONS preflight fails until configured |
-| `BASIC` spec has no public IP | Use `PROFESSIONAL` + `elb` provider for public access |
-| Instance creation takes 5-15min | Long-running async operation. State is **Running** (NOT "SUCCESS"). Poll with `ListInstancesV2`, wait for `status == "Running"` |
-| `sl_domain` is from API **Group** | NOT from Instance. Get it from `CreateApiGroupV2` or `ListApiGroupsV2` response |
-| API name must NOT have hyphens | `[a-zA-Z0-9_]+` only. Hyphens cause regex validation failure |
-| VPC params need prefix | `--vpc.name=<n>` / `--subnet.vpc_id=<id>` / `--security_group.name=<n>` with KooCLI 7.x |
+| Trap                              | Why                                                                                                                             |
+| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| API group region-locked           | Cannot move across regions                                                                                                      |
+| Throttling per-API default        | Use app-level quotas for per-user limits                                                                                        |
+| CORS must be explicit             | OPTIONS preflight fails until configured                                                                                        |
+| `BASIC` spec has no public IP     | Use `PROFESSIONAL` + `elb` provider for public access                                                                           |
+| Instance creation takes 5-15min   | Long-running async operation. State is **Running** (NOT "SUCCESS"). Poll with `ListInstancesV2`, wait for `status == "Running"` |
+| `sl_domain` is from API **Group** | NOT from Instance. Get it from `CreateApiGroupV2` or `ListApiGroupsV2` response                                                 |
+| API name must NOT have hyphens    | `[a-zA-Z0-9_]+` only. Hyphens cause regex validation failure                                                                    |
+| VPC params need prefix            | `--vpc.name=<n>` / `--subnet.vpc_id=<id>` / `--security_group.name=<n>` with KooCLI 7.x                                         |
 
 ## Instance Management
 
@@ -43,14 +47,14 @@ hcloud APIG CreateInstanceV2 --help
 
 Key gotchas when creating:
 
-| Param | Note |
-|-------|------|
-| `--spec_id` | `BASIC` (no public access), `PROFESSIONAL` (requires `--loadbalancer_provider`) |
-| `--loadbalancer_provider` | `elb` for public access (supports `AddIngressEipV2`), `lvs` for internal only (supports `AddEipV2`) |
-| `--enterprise_project_id` | **Required** for enterprise accounts. Use `"0"` for default project |
-| `--available_zone_ids` | Use AZ code like `ap-southeast-3a`, NOT UUID from `ListAvailableZonesV2` |
-| `--vpc_id`, `--subnet_id` | Must exist in the target region |
-| `--security_group_id` | **Required**. Create a security group first via `VPC CreateSecurityGroup` (VPC v3 API — no `vpc_id` param needed) |
+| Param                     | Note                                                                                                              |
+| ------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| `--spec_id`               | `BASIC` (no public access), `PROFESSIONAL` (requires `--loadbalancer_provider`)                                   |
+| `--loadbalancer_provider` | `elb` for public access (supports `AddIngressEipV2`), `lvs` for internal only (supports `AddEipV2`)               |
+| `--enterprise_project_id` | **Required** for enterprise accounts. Use `"0"` for default project                                               |
+| `--available_zone_ids`    | Use AZ code like `ap-southeast-3a`, NOT UUID from `ListAvailableZonesV2`                                          |
+| `--vpc_id`, `--subnet_id` | Must exist in the target region                                                                                   |
+| `--security_group_id`     | **Required**. Create a security group first via `VPC CreateSecurityGroup` (VPC v3 API — no `vpc_id` param needed) |
 
 ### Add Public Access (ELB Provider Only)
 
@@ -89,9 +93,9 @@ Wait for `eip_address` to show a valid IP (may take up to 2 minutes). If `eip_ad
 hcloud APIG CreateApiGroupV2 --instance_id=<id> --name=<n>
 ```
 
-| Param | Note |
-|-------|------|
-| `--name` | Group name (required) |
+| Param      | Note                   |
+| ---------- | ---------------------- |
+| `--name`   | Group name (required)  |
 | `--remark` | Description (optional) |
 
 ## API Management
@@ -120,18 +124,18 @@ hcloud APIG CreateThrottlingPolicyV2 --name=<n> --api_call_limits=1000
 
 ## Common Workflows
 
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstancesV2` |
-| Create instance | `CreateInstanceV2` |
-| Delete instance | `DeleteInstancesV2` |
-| Add public EIP | `AddIngressEipV2` |
-| Create API group | `CreateApiGroupV2` |
-| Create API | `CreateApiV2` |
-| Update API | `UpdateApiV2` — change auth mode, path, etc. |
-| List APIs | `ListApisV2` |
-| Publish | `BatchPublishOrOfflineApiV2` |
-| List APIs | `ListApisV2` |
+| Task             | Operation                                    |
+| ---------------- | -------------------------------------------- |
+| List instances   | `ListInstancesV2`                            |
+| Create instance  | `CreateInstanceV2`                           |
+| Delete instance  | `DeleteInstancesV2`                          |
+| Add public EIP   | `AddIngressEipV2`                            |
+| Create API group | `CreateApiGroupV2`                           |
+| Create API       | `CreateApiV2`                                |
+| Update API       | `UpdateApiV2` — change auth mode, path, etc. |
+| List APIs        | `ListApisV2`                                 |
+| Publish          | `BatchPublishOrOfflineApiV2`                 |
+| List APIs        | `ListApisV2`                                 |
 
 ## FunctionGraph Integration