huaweicloud-devkit 1.1.2-next.0 → 1.1.2-next.2

package/plugins/huaweicloud-core/skills/huawei-dew/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-dew
-description: "Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secrets, KMS for encryption keys, and credential rotation. Triggers on: secret, credential, API key, token, password, encrypt, decrypt, KMS, CSMS, DEW, certificate, CSR, rotation. Activates for ANY task involving secrets or credentials — load this skill first before touching secrets."
+description: 'Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secrets, KMS for encryption keys, and credential rotation. Triggers on: secret, credential, API key, token, password, encrypt, decrypt, KMS, CSMS, DEW, certificate, CSR, rotation. Activates for ANY task involving secrets or credentials — load this skill first before touching secrets.'
 version: 1
 ---
 
@@ -16,64 +16,73 @@ Domain expertise for Huawei Cloud Data Encryption Workshop (DEW). Covers CSMS fo
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| NEVER fetch secret values into agent context | Use {{resolve:csms:secret-id:SecretString:key}} runtime injection |
-| NEVER echo credentials in conversation | AK/SK, passwords, tokens must never appear in chat |
-| KMS key deletion is irreversible | 7-30 day pending deletion window. Once gone, data is unrecoverable |
-| Secret rotation requires automation | Manual rotation risks stale credentials |
-| Cross-account KMS needs grants | KMS keys are regional. Cross-region data needs grant setup |
+| Trap                                         | Why                                                                |
+| -------------------------------------------- | ------------------------------------------------------------------ |
+| NEVER fetch secret values into agent context | Use {{resolve:csms:secret-id:SecretString:key}} runtime injection  |
+| NEVER echo credentials in conversation       | AK/SK, passwords, tokens must never appear in chat                 |
+| KMS key deletion is irreversible             | 7-30 day pending deletion window. Once gone, data is unrecoverable |
+| Secret rotation requires automation          | Manual rotation risks stale credentials                            |
+| Cross-account KMS needs grants               | KMS keys are regional. Cross-region data needs grant setup         |
 
 ## CSMS Operations
 
 ### Read-only (safe — metadata only)
-| Operation | Description |
-|-----------|-------------|
-| ListSecrets | List all secrets (names only, no values) |
-| DescribeSecret | Get secret metadata (rotation config, KMS key, status) |
-| ListSecretVersions | List version IDs and stages (no values) |
+
+| Operation          | Description                                            |
+| ------------------ | ------------------------------------------------------ |
+| ListSecrets        | List all secrets (names only, no values)               |
+| DescribeSecret     | Get secret metadata (rotation config, KMS key, status) |
+| ListSecretVersions | List version IDs and stages (no values)                |
 
 ### Secret Value (blocked by policy — use runtime injection)
-| Operation | Safe Alternative |
-|-----------|-----------------|
-| DownloadSecret | Use {{resolve:csms:secret-id}} in IaC or SDK |
+
+| Operation         | Safe Alternative                              |
+| ----------------- | --------------------------------------------- |
+| DownloadSecret    | Use {{resolve:csms:secret-id}} in IaC or SDK  |
 | ShowSecretVersion | Use runtime injection, never in agent context |
-| GetSecretValue | Blocked. Use MCP proxy resolve pattern |
+| GetSecretValue    | Blocked. Use MCP proxy resolve pattern        |
 
 ## KMS Operations
 
-| Task | Command | Notes |
-|------|---------|-------|
-| List keys | hcloud KMS ListKeys | Read-only |
-| Create key | hcloud KMS CreateKey --key_alias=<name> | Requires write approval |
-| Encrypt | hcloud KMS EncryptData --key_id=<id> --plaintext=<b64> | Prefer SDK offline encrypt |
-| Decrypt | hcloud KMS DecryptData (**BLOCKED**) | Use runtime injection |
+| Task       | Command                                                | Notes                      |
+| ---------- | ------------------------------------------------------ | -------------------------- |
+| List keys  | hcloud KMS ListKeys                                    | Read-only                  |
+| Create key | hcloud KMS CreateKey --key_alias=<name>                | Requires write approval    |
+| Encrypt    | hcloud KMS EncryptData --key_id=<id> --plaintext=<b64> | Prefer SDK offline encrypt |
+| Decrypt    | hcloud KMS DecryptData (**BLOCKED**)                   | Use runtime injection      |
 
 ## Runtime Injection Pattern
 
 `ash
+
 # Terraform / IaC
+
 resource "huaweicloud_csms_secret" "db_password" {
-  secret_string = var.db_password  # NEVER hardcode
+secret_string = var.db_password # NEVER hardcode
 }
 
 # SDK
+
 secret_value = client.get_secret(secret_id="my-secret")
+
 # Use immediately, never print or store in context
 
 # hcloud (for approved automation only)
-hcloud CSMS DownloadSecret --secret_name=<name>
+
+hcloud CSMS DownloadSecretBlob --secret_name=<name>
+
 # WARNING: Output goes to stdout. Pipe directly, never capture in agent.
+
 `
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Secret not found | Wrong region or project -> Verify secret ARN includes region/project |
-| AccessDenied on CSMS | Missing IAM CSMS policy -> Add csms:DescribeSecret + kms:Decrypt |
-| KMS key disabled | Key scheduled for deletion or manually disabled -> Enable or create new key |
-| Rotation stuck | Lambda/Python function error -> Check rotation function logs |
+| Error                | Root Cause -> Fix                                                           |
+| -------------------- | --------------------------------------------------------------------------- |
+| Secret not found     | Wrong region or project -> Verify secret ARN includes region/project        |
+| AccessDenied on CSMS | Missing IAM CSMS policy -> Add csms:DescribeSecret + kms:Decrypt            |
+| KMS key disabled     | Key scheduled for deletion or manually disabled -> Enable or create new key |
+| Rotation stuck       | Lambda/Python function error -> Check rotation function logs                |
 
 ## Security Considerations
 

package/plugins/huaweicloud-core/skills/huawei-dew/references/csms-usage.md

@@ -1,28 +1,35 @@
 # CSMS Usage Guide
 
 ## Create Secret
+
 hcloud CSMS CreateSecret --secret_name=prod-db-password --secret_string='{"password":"CHANGE_ME"}'
 
 ## List Secrets (metadata only)
+
 hcloud CSMS ListSecrets
 
 ## Describe Secret
+
 hcloud CSMS DescribeSecret --secret_name=prod-db-password
 
 ## List Versions
+
 hcloud CSMS ListSecretVersions --secret_name=prod-db-password
 
 ## Runtime Injection (Terraform)
+
 data "huaweicloud_csms_secret" "db" {
-  secret_name = "prod-db-password"
+secret_name = "prod-db-password"
 }
 Use: data.huaweicloud_csms_secret.db.secret_string
 
 ## Rotation
+
 - Enable auto-rotation: hcloud CSMS EnableSecretRotation --secret_name=<name> --rotation_interval=30
 - Rotation function ARN: provide Lambda to generate new secret value
 
 ## Policy Rules
+
 - hcloud CSMS DownloadSecret -> BLOCKED (use runtime injection)
 - hcloud CSMS ShowSecretVersion -> BLOCKED
 - hcloud CSMS ListSecrets -> ALLOWED (metadata only)

package/plugins/huaweicloud-core/skills/huawei-dew/references/kms-usage.md

@@ -1,23 +1,29 @@
 # KMS Usage Guide
 
 ## Create Key
+
 hcloud KMS CreateKey --key_alias=app-encryption-key --key_description="Application data encryption"
 
 ## List Keys (metadata only)
+
 hcloud KMS ListKeys
 
 ## Encrypt (offline preferred)
+
 hcloud KMS EncryptData --key_id=<key-id> --plaintext=<base64-data>
 
 ## Decrypt (BLOCKED - use runtime)
+
 DO NOT use hcloud KMS DecryptData directly.
 Use SDK with KMS client in application runtime.
 
 ## Key Rotation
+
 - Enable: hcloud KMS EnableKeyRotation --key_id=<key-id>
 - Rotation period: 365 days (default)
 
 ## Key Deletion
+
 - Schedule: hcloud KMS ScheduleKeyDeletion --key_id=<key-id> --pending_days=7
 - Cancel during pending window: hcloud KMS CancelKeyDeletion --key_id=<key-id>
 - WARNING: After deletion window passes, data encrypted with this key is UNRECOVERABLE

package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: huawei-ecs
-description: "Use when creating, configuring, managing, or troubleshooting ECS instances on Huawei Cloud. Covers instance creation (hcloud ECS CreateServers), flavor selection, image management, security groups, EIP binding, disk attachment, auto-scaling (AS), and troubleshooting. Triggers on: ECS, instance, flavor, image, security group, EIP, EVS, auto-scaling. NOT for: CCE container workloads (use huawei-cce), BMS bare metal servers."
+description: 'Use when creating, configuring, managing, or troubleshooting ECS instances on Huawei Cloud. Covers instance creation (hcloud ECS CreateServers), flavor selection, image management, security groups, EIP binding, disk attachment, auto-scaling (AS), and troubleshooting. Triggers on: ECS, instance, flavor, image, security group, EIP, EVS, auto-scaling. NOT for: CCE container workloads (use huawei-cce), BMS bare metal servers.
+
+HC活动场景(ECS+Nginx部署后端服务)触发词: HC活动, 华为HC, HC大会, 活动部署, HC ECS, 活动流程, 部署后端, Nginx部署, Nodejs部署, 上线后端服务, 部署个人网站, /hc-activity/.'
 version: 1
 ---
 
@@ -17,47 +19,50 @@ Domain expertise for Huawei Cloud Elastic Cloud Server (ECS). Covers instance li
 ## Prerequisites
 
 Before creating an ECS instance from scratch, you MUST have:
+
 - A VPC (see `huawei-vpc`)
 - A subnet with DNS configured (see `huawei-vpc`)
 - A security group with application ports open (see `huawei-vpc`)
 
-If these do not exist, load the `huawei-vpc` skill first and create them before returning here.
+**Deployment routing guard**: if this skill was reached via a DEPLOYMENT intent (creating resources to host an application), load the `huawei-iac` skill FIRST and follow its orchestration flow - UNCONDITIONALLY. Reusing an existing VPC does NOT make it single-resource: the purchase still involves billable resources (ECS, system disk, EIP, keypair, SG rules) that must pass the cost+balance gate, batch approval, and state tracking. Only create directly here if the user explicitly declines the orchestration flow or the user only wants a lifecycle operation on an EXISTING instance (query/reboot/resize/delete). Discovery already done (flavors, images, AZs) carries over.
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Flavor not in region | Not all flavors available everywhere. Check with ECS ListFlavors first |
-| Security group denies all | New SGs deny ALL inbound. Must explicitly add rules |
-| EIP bills when idle | Unattached EIP still incurs charges |
-| Stopped instance still bills | Pay-per-use instances bill when stopped (unless shutdown-no-billing flavor) |
-| Disk survives instance delete | Deleting instance does NOT delete system disk by default |
+| Trap                            | Why                                                                                                                                                |
+| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Flavor not in region            | Not all flavors available everywhere. Check with ECS ListFlavors first                                                                             |
+| Security group denies all       | New SGs deny ALL inbound. Must explicitly add rules                                                                                                |
+| Reusing existing security group | Existing SGs may have 0.0.0.0/0 rules. Before referencing, run hcloud VPC ListSecurityGroupRules --security_group_id.1=<id> to audit inbound rules |
+| EIP bills when idle             | Unattached EIP still incurs charges                                                                                                                |
+| Stopped instance still bills    | Pay-per-use instances bill when stopped (unless shutdown-no-billing flavor)                                                                        |
+| Disk survives instance delete   | Deleting instance does NOT delete system disk by default                                                                                           |
 
 ## Flavor Selection Guide
 
 Flavor families are **region-dependent**. Always run `hcloud ECS ListFlavors --cli-region=<r>` to discover available flavors before recommending.
 
-| Scenario | Family | What to look for |
-|----------|--------|-----------------|
-| Web app / microservices | General-purpose (ac, s, sn, c) | 2-4 vCPU, 4-8 GB RAM |
-| Database / big data | Memory-optimized (m, r) | 4-8 vCPU, 16-64 GB RAM |
-| AI inference | GPU (g, p) | 8+ vCPU, 64+ GB RAM + GPU |
-| HPC | High-IO (h, ir, i) | 8+ vCPU, local SSD |
+| Scenario                | Family                         | What to look for          |
+| ----------------------- | ------------------------------ | ------------------------- |
+| Web app / microservices | General-purpose (ac, s, sn, c) | 2-4 vCPU, 4-8 GB RAM      |
+| Database / big data     | Memory-optimized (m, r)        | 4-8 vCPU, 16-64 GB RAM    |
+| AI inference            | GPU (g, p)                     | 8+ vCPU, 64+ GB RAM + GPU |
+| HPC                     | High-IO (h, ir, i)             | 8+ vCPU, local SSD        |
 
 > See `references/flavors.md` for discovery workflow. **Do not hardcode flavor names** — availability changes by region and over time.
 
 ## Common Workflows
 
-| Task | Command | Steps |
-|------|---------|-------|
-| List flavors | hcloud ECS ListFlavors --cli-region=<region> | references/flavors.md |
-| Create instance | hcloud ECS CreateServers --server.name=<n> --server.flavorRef=<id> --server.imageRef=<id> --server.nics.1.subnet_id=<id> --server.availability_zone=<az> | references/create-instance.md |
-| Find by name | See "How to search for instances" below | |
-| Bind EIP | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
-| Security group rule | hcloud VPC CreateSecurityGroupRule --security_group_id=<id> --direction=<direction> --protocol=<protocol> | references/sg.md |
-| Attach disk | hcloud EVS AttachVolume --volume_id=<id> --server_id=<id> | references/evs.md |
-| Delete instance | hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true | references/create-instance.md |
-| Reboot instance | hcloud ECS BatchRebootServers --reboot.servers.1.id=<id> --reboot.type=SOFT | NOT `RebootServer` — that operation does not exist |
+| Task                | Command                                                                                                                                                  | Steps                                                                                    |
+| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
+| List flavors        | hcloud ECS ListFlavors --cli-region=<region>                                                                                                             | references/flavors.md                                                                    |
+| Create instance     | hcloud ECS CreateServers --server.name=<n> --server.flavorRef=<id> --server.imageRef=<id> --server.nics.1.subnet_id=<id> --server.availability_zone=<az> | references/create-instance.md                                                            |
+| Find by name        | See "How to search for instances" below                                                                                                                  |                                                                                          |
+| Bind EIP            | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT                      | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
+| Security group rule | hcloud VPC CreateSecurityGroupRule --security_group_id=<id> --direction=<direction> --protocol=<protocol>                                                | references/sg.md                                                                         |
+| Attach disk         | hcloud EVS AttachVolume --volume_id=<id> --server_id=<id>                                                                                                | references/evs.md                                                                        |
+| Delete instance     | hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true                                                                 | references/create-instance.md                                                            |
+| Reboot instance     | hcloud ECS BatchRebootServers --reboot.servers.1.id=<id> --reboot.type=SOFT                                                                              | NOT `RebootServer` — that operation does not exist                                       |
+| HC活动部署          | 按量付费购买ECS+Nginx部署后端服务                                                                                                                        | references/hc-activity.md                                                                |
 
 ## How to Search for Instances
 
@@ -112,6 +117,7 @@ ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'command'
 ```
 
 Example — re-run failed cloud-init setup manually:
+
 ```bash
 ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'dnf install -y nginx && systemctl enable --now nginx'
 ```
@@ -127,14 +133,14 @@ ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'dnf install -y ngin
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Cannot SSH | SG missing port 22 or no EIP -> Add ingress rule / Bind EIP |
-| Flavor unavailable | Region limitation -> ListFlavors in target region |
-| Insufficient resources | Stock depleted -> Change flavor or AZ |
-| AuthFailure | Expired AK/SK -> re-run `npx huaweicloud-devkit auth init` |
-| APIGW.0802 / region permission | IAM user has no access to this region -> IAM console → User → Permissions → add region, or switch to another region |
-| Cannot SSH (port 22 open) | SCP policy may be blocking SSH. Check `SYS.0403` errors in command output -> Use cloud-init/user_data for initial setup instead. See `references/create-instance.md` §Bootstrap |
+| Error                          | Root Cause -> Fix                                                                                                                                                               |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Cannot SSH                     | SG missing port 22 or no EIP -> Add ingress rule / Bind EIP                                                                                                                     |
+| Flavor unavailable             | Region limitation -> ListFlavors in target region                                                                                                                               |
+| Insufficient resources         | Stock depleted -> Change flavor or AZ                                                                                                                                           |
+| AuthFailure                    | Expired AK/SK -> re-run `npx huaweicloud-devkit auth init`                                                                                                                      |
+| APIGW.0802 / region permission | IAM user has no access to this region -> IAM console → User → Permissions → add region, or switch to another region                                                             |
+| Cannot SSH (port 22 open)      | SCP policy may be blocking SSH. Check `SYS.0403` errors in command output -> Use cloud-init/user_data for initial setup instead. See `references/create-instance.md` §Bootstrap |
 
 ## Security Considerations
 
@@ -158,6 +164,7 @@ Prefer these tools over raw hcloud CLI — they enforce safety policies:
 ## Without MCP (Fallback)
 
 If MCP tools are NOT available (new install, session not restarted):
+
 - Raw hcloud commands WILL appear in shell history — passwords and secrets are at risk
 - Always use key_name instead of adminPass
 - Verify safety manually: no secret value reads, no credential file access
@@ -171,10 +178,10 @@ Fall back to hcloud CLI. State: "MCP unavailable, using local hcloud CLI."
 
 Flexus is the lightweight ECS family. Two variants:
 
-| Variant | API | CLI | Billing |
-|---------|-----|:---:|---------|
-| **Flexus L** | HCSS (hcss:lightInstances) | ❌ No hcloud — Python SDK only | Prepaid only |
-| **Flexus X** | Standard ECS API | ✅ `hcloud ECS` with `x1.*` flavors | On-demand & prepaid |
+| Variant      | API                        |                 CLI                 | Billing             |
+| ------------ | -------------------------- | :---------------------------------: | ------------------- |
+| **Flexus L** | HCSS (hcss:lightInstances) |   ❌ No hcloud — Python SDK only    | Prepaid only        |
+| **Flexus X** | Standard ECS API           | ✅ `hcloud ECS` with `x1.*` flavors | On-demand & prepaid |
 
 For Flexus X, use standard ECS CreateServers flow with `x1.*` flavors. For Flexus L, manual console provisioning is recommended — no KooCLI path exists.
 
@@ -183,3 +190,4 @@ For Flexus X, use standard ECS CreateServers flow with `x1.*` flavors. For Flexu
 - ECS Docs: https://support.huaweicloud.com/ecs/
 - Flavor specs: references/flavors.md
 - Create instance: references/create-instance.md
+- HC活动 ECS+Nginx部署: references/hc-activity.md

package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md

@@ -3,10 +3,12 @@
 **Before executing any command: If MCP tools are not available** (new session after install), restart your session or use hcloud CLI directly with caution. Commands using adminPass/password WILL appear in shell history — prefer key_name.
 
 ## 1. Discover flavors
+
 hcloud ECS ListFlavors --cli-region=<region> --cli-output=json
 Filter for `os_extra_specs.cond:operation:status == normal` — most results are abandoned. See references/flavors.md.
 
 ## 2. Find availability zones
+
 hcloud ECS NovaListAvailabilityZones --cli-region=<region>
 
 ## 3. Find image
@@ -19,33 +21,78 @@ hcloud IMS ListImages --cli-region=<region> --__imagetype=gold --__isregistered=
 If searching by name (e.g. --name="Ubuntu") returns empty: use broad search without name filter, pick from results. Some regions only offer Huawei Cloud EulerOS (HCE).
 
 Common images (verify live per region):
-| Image | Region | ID |
-|-------|--------|----|
+
+| Image            | Region     | ID                                   |
+| ---------------- | ---------- | ------------------------------------ |
 | HCE 2.0 Standard | cn-north-4 | 7d940784-ac0a-425f-b3fa-8478f1a1df70 |
-| Ubuntu 22.04 | Query live | Query live |
-| CentOS 8.2 | Query live | Query live |
+| Ubuntu 22.04     | Query live | Query live                           |
+| CentOS 8.2       | Query live | Query live                           |
 
 ## 4. Verify or create VPC/subnet
+
 hcloud VPC ListVpcs --cli-region=<region>
 hcloud VPC ListSubnets --vpc_id=<vpc-id> --cli-region=<region>
 If no VPC/subnet exists: load `huawei-vpc` skill → create VPC → create subnet (with DNS) → create security group → return here.
 
 ## 5. Create keypair (recommended over adminPass)
-hcloud ECS NovaCreateKeypair --keypair.name=<name>
-Save the returned private key to a local file. The public key is auto-injected.
+
+**MCP 环境下必须用"本地生成 + 导入"流程**——`NovaCreateKeypair` 返回的 `private_key` 会被 MCP 脱敏管道替换为 `<redacted>`，而私钥仅此一次机会，读不到即作废：
+
+```bash
+# 1. 本地生成
+ssh-keygen -t rsa -b 2048 -f ./<name> -N '""'
+# 2. 导入公钥
+hcloud ECS NovaCreateKeypair --keypair.name=<name> --keypair.public_key=<本地 .pub 文件内容>
+# 3. 使用私钥文件 ./<name> 连接实例
+```
+
+> **陷阱**：删除密钥对的参数是 `--keypair_name=<name>`（path 风格），不是 `--keypair.name=<name>`（body 风格），混用报 USE_ERROR。
 
 Password alternative:
+
 - adminPass: 8-26 chars, must have uppercase + lowercase + digit + special char
 - Passwords appear ONCE in creation output and are not retrievable
 - Passwords are logged in shell history — this is a security risk
 
 ## 6. Create instance
+
 hcloud ECS CreateServers --cli-region=<region> --server.name=<name> --server.flavorRef=<flavor-id> --server.imageRef=<image-id> --server.nics.1.subnet_id=<subnet-id> --server.root_volume.volumetype=<type> --server.root_volume.size=<minsize> --server.vpcid=<vpc-id> --server.availability_zone=<az> --server.key_name=<keypair-name> --server.count=1
 
 ### Bootstrap with user_data (cloud-init)
 
 Use `--server.user_data` to run a cloud-init script at first boot. The value must be **base64-encoded**. This is also the recommended bootstrap path when SCP policies block SSH access — user_data serves as the full deployment path, no SSH needed.
 
+**中国区镜像源强制规则**（实测：`deb.nodesource.com` 从北京四不可达，cloud-init 全链失败）：
+
+```bash
+#!/bin/bash
+set -eux
+# Node: 用华为云镜像二进制直装，固定小版本，禁用 NodeSource/curl Nodesource 脚本
+# ⚠️ ARCH 必须与实例架构一致：kc1/kc2 等鲲鹏 = arm64；s6/s7/c7 等 x86 = x64
+NODE_VERSION=v22.14.0
+ARCH=arm64   # x86 实例改为 x64
+curl -fsSL "https://mirrors.huaweicloud.com/nodejs/${NODE_VERSION}/node-${NODE_VERSION}-linux-${ARCH}.tar.xz" -o /tmp/node.tar.xz
+mkdir -p /usr/local/lib/nodejs && tar -xJf /tmp/node.tar.xz -C /usr/local/lib/nodejs
+export PATH=/usr/local/lib/nodejs/node-${NODE_VERSION}-linux-${ARCH}/bin:$PATH
+ln -sf /usr/local/lib/nodejs/node-${NODE_VERSION}-linux-${ARCH}/bin/{node,npm,npx} /usr/local/bin/
+# npm registry 指向华为云
+npm config set registry https://repo.huaweicloud.com/repository/npm/
+# DNS 兜底（子网 dnsList 缺失时自救）
+grep -q 100.125.0.20 /etc/resolv.conf || echo "nameserver 100.125.0.20" >> /etc/resolv.conf
+```
+
+**可观测性模板**（实测教训：cloud-init 失败后无感知、固定 sleep 空等 ≈8 分钟）：
+
+```bash
+# 每阶段落 sentinel，收尾打标记；agent 侧轮询标记而非固定 sleep
+touch /var/log/kit-step1-deps-done
+# ... 构建完成后：
+touch /var/log/kit-deploy-done   # ← agent 轮询此文件出现即成功
+# 失败时：cloud-init status --long + /var/log/cloud-init-output.log 定位
+```
+
+> **SSR/Next.js 项目强烈推荐"本地构建 + 上传产物"**（next standalone / `.next` + node_modules），服务器零构建可省 ~20 分钟且绕开服务器侧依赖解析风险。必须服务器构建时：先本地 `npm install` 验证 lockfile 再上传；已知坏组合黑名单——`isomorphic-dompurify@^2` 场景加 `overrides: {"html-encoding-sniffer":"4.0.0","jsdom":"25.0.1"}`（最新 jsdom→cssstyle→@csstools 链全 ESM-only，Next 14 构建期 CJS require 必挂，首个 `ERR_REQUIRE_ESM` 即跑 `npm ls <包>` 查依赖树，不要盲目重装）。
+
 ```bash
 # Encode the script
 user_data=$(cat << 'SCRIPT' | base64
@@ -63,6 +110,7 @@ hcloud ECS CreateServers ... --server.user_data=$user_data
 > **Debugging**: If the script didn't run, check `/var/log/cloud-init-output.log` on the instance.
 >
 > **Recovery after failure**: user_data only executes on **first boot**. Restarting the instance will NOT re-run user_data scripts. If cloud-init fails (e.g., DNS missing → `yum`/`apt` cannot resolve repos):
+>
 > 1. Fix the root cause (e.g., update subnet DNS via `VPC UpdateSubnet`)
 > 2. Either: SSH into the instance and run the setup commands manually (see `huawei-ecs` → SSH Connection Verification → Running Commands Inside the Instance)
 > 3. Or: Delete the instance and recreate with corrected user_data (fresh boot)
@@ -70,6 +118,7 @@ hcloud ECS CreateServers ... --server.user_data=$user_data
 ## 7. EIP (two methods)
 
 ### Method A: Inline with CreateServers (Recommended)
+
 Add EIP parameters to the `CreateServers` command in step 6:
 
 ```bash
@@ -84,6 +133,7 @@ hcloud ECS CreateServers \
 > **Trap**: Parameter names differ from `EIP CreatePublicip`. Use `iptype` (not `type`), `sharetype` (not `share_type`), and `chargemode` (not `charging_mode`). Always verify with `hcloud ECS CreateServers --help`.
 
 ### Method B: Create and bind separately
+
 hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
 
 ```bash
@@ -131,3 +181,4 @@ Warning: --delete_publicip and --delete_volume default to false. Set to true to
 - Flavor: must be available in target region — always ListFlavors first
 - Root volume: SSD 40GB min
 - Keypair is safer than adminPass (passwords leak into shell history)
+```

package/plugins/huaweicloud-core/skills/huawei-ecs/references/flavors.md

@@ -20,21 +20,23 @@ hcloud ECS ListFlavors --cli-region=<region> --cli-output=json \
 
 ## Step 2: Filter by scenario
 
-| Scenario | Look for | Preference |
-|----------|----------|------------|
-| Web app / microservices | General-purpose families (ac, s, sn) | 2-4 vCPU, 4-8 GB RAM |
-| Database / big data | Memory-optimized families (m, r) | 4-8 vCPU, 16-64 GB RAM |
-| AI inference / training | GPU families (g, p) | 8+ vCPU, 64+ GB RAM |
-| HPC / high throughput | High-IO families (h, ir, i) | 8+ vCPU, local SSD |
+| Scenario                | Look for                             | Preference             |
+| ----------------------- | ------------------------------------ | ---------------------- |
+| Web app / microservices | General-purpose families (ac, s, sn) | 2-4 vCPU, 4-8 GB RAM   |
+| Database / big data     | Memory-optimized families (m, r)     | 4-8 vCPU, 16-64 GB RAM |
+| AI inference / training | GPU families (g, p)                  | 8+ vCPU, 64+ GB RAM    |
+| HPC / high throughput   | High-IO families (h, ir, i)          | 8+ vCPU, local SSD     |
 
 ## Step 3: Match spec from ListFlavors output
 
 Common naming pattern: `<family><gen>.<type>x<ratio>`
+
 - `ac6.2xlarge.2` = ac6 family, 2xlarge (8 vCPU), ratio 2 (vCPU:RAM = 1:2 → 16 GB)
 
 ## Do Not Hardcode
 
 Flavor family names are region-dependent. Example discrepancies seen in testing:
+
 - cn-south-1: ac6/ac7/kc/r-c7e (s6/m6/g6 NOT available)
 - Other regions may have s6/m6/g6 families
 
@@ -44,10 +46,10 @@ Always run ListFlavors and pick from actual results.
 
 `ListFlavors` returns ALL specs including abandoned ones. Before selecting a spec, check the `os_extra_specs` field in the JSON response:
 
-| Field | Values | Meaning |
-|-------|--------|---------|
+| Field                                  | Values                         | Meaning                                                                              |
+| -------------------------------------- | ------------------------------ | ------------------------------------------------------------------------------------ |
 | `os_extra_specs.cond:operation:status` | `normal`, `abandon`, `sellout` | Only `normal` specs can be created. `abandon` = deprecated, `sellout` = out of stock |
-| `os_extra_specs.cond:operation:az` | e.g. `cn-north-4g(normal)` | Spec is available in this AZ. Multiple entries = multiple AZ support |
+| `os_extra_specs.cond:operation:az`     | e.g. `cn-north-4g(normal)`     | Spec is available in this AZ. Multiple entries = multiple AZ support                 |
 
 A flavor can be `normal` globally but `abandon` in specific AZs. Selecting an `abandon` or `sellout` spec will fail with **`Ecs.0019`** at creation time — there is no pre-flight validation in `ListFlavors`. If creation fails:
 

package/plugins/huaweicloud-core/skills/huawei-ecs/references/hc-activity.md

@@ -0,0 +1,27 @@
+# HC活动 ECS + Nginx/Node.js 部署后端服务
+
+## 目标
+
+在华为云 cn-north-4 区域，按量付费购买 ECS，部署后端代码仓的后端服务。
+
+## 前置条件
+
+- 后端代码仓 git 地址
+- 账户已有默认 VPC 和子网(Agent 自动查询)
+
+## 流程
+
+1. 查询 VPC/子网，创建安全组，放通 SSH(22)仅本机IP、HTTP(80)全网
+2. 查询镜像(推荐 HCE 2.0)和规格，直接购买1核2G
+3. 创建 keypair，创建按量付费 ECS(系统盘 SSD 40GB)，轮询等待 ACTIVE
+4. 创建 5_bgp 按流量计费 EIP，绑定到 ECS 端口
+5. SSH 登录，安装 Node.js 18，git clone 代码仓，npm install
+6. Nginx反向代理:80->:3000
+7. 验证 /hc-activity/api/title 和 /hc-activity/health
+
+## 注意事项
+
+- 后端3000仅监听回环
+- Nginx修改后 nginx -t 再 reload
+- 按量付费停机仍计费
+- 删除实例时 --delete_publicip=true --delete_volume=true

package/plugins/huaweicloud-core/skills/huawei-ecs/references/troubleshooting.md

@@ -4,16 +4,16 @@
 
 ## 错误码映射
 
-| 错误 | 根因 | 修复 |
-|------|------|------|
-| `Ecs.0005` flavor-image 不匹配 | 镜像虚拟化类型与规格不兼容 | 检查 image `__support_amd`/`__support_xen` 与 flavor `os_extra_specs`。BareMetal 镜像不兼容标准 ECS 规格 |
-| `[USE_ERROR]不正确的参数:imagetype` | 参数名错误 | KooCLI 使用双下划线前缀：`--__imagetype=gold`（不是 `--imagetype`） |
-| `[USE_ERROR]不正确的参数:chargingMode` | 参数路径错误 | 计费模式参数路径：`--server.extendparam.chargingMode=postPaid`。不传默认按需付费 |
-| `[USE_ERROR]不正确的参数:__support_amd` | 参数无效 | `IMS ListImages` 某些版本不支持此过滤。去掉该参数，使用 client-side 过滤 |
-| Cannot SSH | 安全组未开放22端口 或 未绑定EIP | 1) 添加入方向规则 tcp 22。2) `hcloud EIP BindPublicIp` |
-| Flavor unavailable | 区域不支持该规格 | `hcloud ECS ListFlavors --cli-region=<r>` 先查。不硬编码 s6/m6 等规格名 |
-| Insufficient resources | AZ 库存不足 | 换规格、换 AZ、或等待资源释放 |
-| AuthFailure | AK/SK 过期或无效 | `npx huaweicloud-devkit auth init` 重新配置统一凭据 |
+| 错误                                    | 根因                            | 修复                                                                                                     |
+| --------------------------------------- | ------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| `Ecs.0005` flavor-image 不匹配          | 镜像虚拟化类型与规格不兼容      | 检查 image `__support_amd`/`__support_xen` 与 flavor `os_extra_specs`。BareMetal 镜像不兼容标准 ECS 规格 |
+| `[USE_ERROR]不正确的参数:imagetype`     | 参数名错误                      | KooCLI 使用双下划线前缀：`--__imagetype=gold`（不是 `--imagetype`）                                      |
+| `[USE_ERROR]不正确的参数:chargingMode`  | 参数路径错误                    | 计费模式参数路径：`--server.extendparam.chargingMode=postPaid`。不传默认按需付费                         |
+| `[USE_ERROR]不正确的参数:__support_amd` | 参数无效                        | `IMS ListImages` 某些版本不支持此过滤。去掉该参数，使用 client-side 过滤                                 |
+| Cannot SSH                              | 安全组未开放22端口 或 未绑定EIP | 1) 添加入方向规则 tcp 22。2) `hcloud EIP BindPublicIp`                                                   |
+| Flavor unavailable                      | 区域不支持该规格                | `hcloud ECS ListFlavors --cli-region=<r>` 先查。不硬编码 s6/m6 等规格名                                  |
+| Insufficient resources                  | AZ 库存不足                     | 换规格、换 AZ、或等待资源释放                                                                            |
+| AuthFailure                             | AK/SK 过期或无效                | `npx huaweicloud-devkit auth init` 重新配置统一凭据                                                      |
 
 ## 创建失败诊断流程
 
@@ -38,10 +38,10 @@ hcloud IMS ListImages --cli-region=<r> --__imagetype=gold --__isregistered=true
 
 ## 密钥对 vs 密码
 
-| 方式 | 安全 | 建议 |
-|------|------|------|
+| 方式                       | 安全  | 建议                                               |
+| -------------------------- | ----- | -------------------------------------------------- |
 | `--server.key_name=<name>` | ✅ 高 | **推荐**。先 `hcloud DEW CreateKeypair` 创建密钥对 |
-| `--server.adminPass=<pw>` | ❌ 低 | 密码明文进入 shell 历史。仅测试用 |
+| `--server.adminPass=<pw>`  | ❌ 低 | 密码明文进入 shell 历史。仅测试用                  |
 
 密码要求：8-26 字符，含大写 + 小写 + 数字 + 特殊字符。