huaweicloud-devkit 1.1.2-next.2 → 1.1.2-next.4

package/plugins/huaweicloud-core/skills/huawei-iam/references/quick-ref.md

@@ -15,9 +15,9 @@ hcloud IAM KeystoneShowUser                      # show user detail
 ## Credential Management
 
 ```bash
-hcloud IAM KeystoneListAccessKeys --user_id=<id> # list AK/SK for user
-hcloud IAM CreateLoginToken                      # create login token
-hcloud IAM GetAccountSummary                     # account summary
+hcloud IAM ListAccessKeysV5 --user_id=<id> # list AK/SK for user
+hcloud IAM CreateLoginToken                # create login token
+hcloud IAM GetAccountSummaryV5             # account summary
 ```
 
 ## Security Best Practices

package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md

@@ -62,21 +62,21 @@ hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK> -t=token
 
 ## Common Workflows
 
-| Task                         | Command                                                                |
-| ---------------------------- | ---------------------------------------------------------------------- |
-| Create bucket                | `hcloud OBS mb obs://<bucket> -location=<region>`                      |
-| List buckets/objects         | `hcloud OBS ls [obs://<bucket>]`                                       |
-| Upload file                  | `hcloud OBS cp <file> obs://<bucket>/<key>`                            |
-| Upload directory (recursive) | `hcloud OBS cp <dir>/ obs://<bucket>/ -r -f -flat`                     |
-| Download object              | `hcloud OBS cp obs://<bucket>/<key> <local-path>`                      |
-| Set bucket ACL               | `hcloud OBS chattri obs://<bucket> -acl=public-read`                   |
-| Set object ACL               | `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read`             | Bucket ACL does NOT cascade — anonymous reads need both |
-| Set lifecycle                | `hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<json>`    |
-| Set bucket policy            | `hcloud OBS bucketpolicy obs://<bucket> -method=put -localfile=<json>` |
-| Set CORS                     | `hcloud OBS cors obs://<bucket> -method=put -localfile=<json>`         |
-| Delete bucket                | `hcloud OBS rm obs://<bucket> -r` (must be empty)                      |
-| Presigned URL                | `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>`                    |
-| Object metadata              | `hcloud OBS stat obs://<bucket>/<key>`                                 |
+| Task                         | Command                                                                   |
+| ---------------------------- | ------------------------------------------------------------------------- |
+| Create bucket                | `hcloud OBS mb obs://<bucket> -location=<region>`                         |
+| List buckets/objects         | `hcloud OBS ls [obs://<bucket>]`                                          |
+| Upload file                  | `hcloud OBS cp <file> obs://<bucket>/<key>`                               |
+| Upload directory (recursive) | `hcloud OBS cp <dir>/ obs://<bucket>/ -r -f -flat`                        |
+| Download object              | `hcloud OBS cp obs://<bucket>/<key> <local-path>`                         |
+| Set bucket ACL               | `hcloud OBS chattri obs://<bucket> -acl=public-read`                      |
+| Set object ACL               | `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read`                | Bucket ACL does NOT cascade — anonymous reads need both |
+| Set lifecycle                | `hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<json>`       |
+| Set bucket policy            | `hcloud OBS bucketpolicy obs://<bucket> -method=put -localfile=<json>`    |
+| Set CORS                     | Not available via `hcloud OBS` — use API/SDK (`SetBucketCors`) or console |
+| Delete bucket                | `hcloud OBS rm obs://<bucket> -r` (must be empty)                         |
+| Presigned URL                | `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>`                       |
+| Object metadata              | `hcloud OBS stat obs://<bucket>/<key>`                                    |
 
 ## Static Website Deployment Workflow
 

package/plugins/huaweicloud-core/skills/huawei-vpc/references/network.md

@@ -54,7 +54,7 @@ hcloud EIP AssociatePublicips --publicip_id=<id> \
   --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT
 
 # Unbind
-hcloud EIP DisassociatePublicip --publicip_id=<id>
+hcloud EIP DisassociatePublicips --publicip_id=<id>
 
 # List
 hcloud EIP ListPublicips

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -13,56 +13,58 @@ Use KooCLI `hcloud` for local inspection and reviewed operations. Never ask the
 
 Official guide: `https://support.huaweicloud.com/qs-hcli/hcli_02_003.html`.
 
+> **Version pairing**: this plugin is paired with **KooCLI v7.2.12** (`kooCliVersion` in `package.json`). Prefer the pinned download below. The one-liner script `hcloud_install.sh` always installs the `latest` version and cannot be pinned — if you use it, `check_cli`/`doctor` will warn when the installed version does not match v7.2.12.
+
 ### Windows
 
-1. Download and unzip: `https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-windows-amd64.zip`
+1. Download and unzip: `https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/7.2.12/huaweicloud-cli-windows-amd64.zip`
 2. Extract to `%USERPROFILE%\hcloud`, add to user `PATH`
 3. Verify: `hcloud version`
 
 ### Linux (amd64 / arm64)
 
-One-liner (recommended):
-
-```bash
-curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
-```
-
-Or manual download:
+Fixed download (recommended):
 
 ```bash
 # amd64
-curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-amd64.tar.gz"
+curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/7.2.12/huaweicloud-cli-linux-amd64.tar.gz"
 tar -zxvf huaweicloud-cli-linux-amd64.tar.gz
 # arm64
-curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-arm64.tar.gz"
+curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/7.2.12/huaweicloud-cli-linux-arm64.tar.gz"
 tar -zxvf huaweicloud-cli-linux-arm64.tar.gz
 ```
 
 Move to PATH: `mv $(pwd)/hcloud ~/.local/bin/`
 Verify: `hcloud version`
 
-### macOS (amd64 / arm64)
-
-One-liner (recommended):
+One-liner (installs `latest`, may drift from v7.2.12):
 
 ```bash
 curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
 ```
 
-Or manual download:
+### macOS (amd64 / arm64)
+
+Fixed download (recommended):
 
 ```bash
 # amd64
-curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-amd64.tar.gz"
+curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/7.2.12/huaweicloud-cli-mac-amd64.tar.gz"
 tar -zxvf huaweicloud-cli-mac-amd64.tar.gz
 # arm64 (Apple Silicon)
-curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-arm64.tar.gz"
+curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/7.2.12/huaweicloud-cli-mac-arm64.tar.gz"
 tar -zxvf huaweicloud-cli-mac-arm64.tar.gz
 ```
 
 Move to PATH: `mv $(pwd)/hcloud /usr/local/bin/`
 Verify: `hcloud version`
 
+One-liner (installs `latest`, may drift from v7.2.12):
+
+```bash
+curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
+```
+
 Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `hcloud`, restart after updating `PATH`, or set `HCLOUD_BIN`.
 
 ## Configure Credentials Outside Chat

package/plugins/huaweicloud-core/skills/huaweicloud-safety/SKILL.md

@@ -27,7 +27,7 @@ Use this skill before any Huawei Cloud action that may expose secrets, change re
 
 ## Enforcement Layers
 
-- Hooks: `hooks/huaweicloud-safety.py` can block risky tool calls on platforms that support plugin hooks.
+- Hooks: `hooks/huaweicloud-safety.mjs` blocks risky Codex native hook calls without requiring Python; `hooks/huaweicloud-safety.py` remains for Hermes/Python hook compatibility.
 - MCP wrapper: the Node MCP server applies the same safety policy for Codex/OpenCode paths that do not enforce hooks.
 - Skills: this document teaches agents the rule before they act.
 

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -272,10 +272,14 @@ export function readLastSync() {
   }
 }
 
-export function writeLastSync() {
+export function writeLastSync(metadata = {}) {
   const path = lastSyncPath();
   mkdirSync(dirname(path), { recursive: true });
-  const payload = { ts: Date.now() };
+  const payload = {
+    ts: Date.now(),
+    ...(metadata.kooCliProfile ? { kooCliProfile: String(metadata.kooCliProfile) } : {}),
+    ...(metadata.s1Fingerprint ? { s1Fingerprint: String(metadata.s1Fingerprint) } : {}),
+  };
   writeFileSync(path, JSON.stringify(payload), { encoding: 'utf8', mode: 0o600 });
   ensurePrivateMode(path);
 }

package/plugins/huaweicloud-core/src/auth/reconcile.mjs

@@ -11,6 +11,7 @@ import {
   readLastSync,
   resolveCredentialsWithRuntime,
 } from './credentials.mjs';
+import { resolveHcloudCommand } from '../hcloud-probe.mjs';
 import { redactSecrets } from '../safety-policy.mjs';
 
 export { hasRuntimeCredentials };
@@ -47,6 +48,7 @@ export function readKooCliProfiles() {
     return {
       current,
       mtimeMs,
+      configPath,
       profiles: profiles.map((p) => ({
         name: String(p.name || ''),
         fingerprint: fingerprint(p.accessKeyId, p.secretAccessKey),
@@ -70,15 +72,32 @@ export function currentFingerprintFromHcloud(res) {
   return cur ? cur.fingerprint : null;
 }
 
+function currentProfileFromHcloud(res) {
+  if (res.error) return null;
+  return res.profiles.find((p) => p.name === res.current) || null;
+}
+
+function s2CurrentMatchesLastDevkitSync(kooCli, s1, s1Fingerprint) {
+  const current = currentProfileFromHcloud(kooCli);
+  const lastSync = readLastSync();
+  if (!current || !lastSync?.ts || !lastSync.kooCliProfile || !lastSync.s1Fingerprint) return false;
+  if (!s1?.ak || current.accessKeyId !== s1.ak) return false;
+  if (lastSync.kooCliProfile !== kooCli.current) return false;
+  if (lastSync.s1Fingerprint !== s1Fingerprint) return false;
+  return Number(kooCli.mtimeMs || 0) <= Number(lastSync.ts) + 1000;
+}
+
 export function scanState() {
   const s1 = readGlobalCredentials() || {};
   const envAk = process.env.HW_ACCESS_KEY || '';
   const envSk = process.env.HW_SECRET_KEY || '';
   const kooCli = readKooCliProfiles();
-  const currentFp = currentFingerprintFromHcloud(kooCli);
   const inconsistencies = [];
 
   const s1Fingerprint = fingerprint(s1.ak, s1.sk);
+  const currentFp = currentFingerprintFromHcloud(kooCli);
+  const s2SyncedByDevkit = s1Fingerprint ? s2CurrentMatchesLastDevkitSync(kooCli, s1, s1Fingerprint) : false;
+  const effectiveCurrentFp = s2SyncedByDevkit ? s1Fingerprint : currentFp;
   const envFingerprint = fingerprint(envAk, envSk);
   const s3 = existsSync(obsConfigPath()) ? parseS3ObsConfig(obsConfigPath()) : null;
   const s3Fingerprint = s3 ? fingerprint(s3.ak, s3.sk) : null;
@@ -93,12 +112,12 @@ export function scanState() {
     // nothing resolvable → runtime store inactive
   }
 
-  if (s1Fingerprint && currentFp && s1Fingerprint !== currentFp) {
+  if (s1Fingerprint && currentFp && s1Fingerprint !== effectiveCurrentFp) {
     inconsistencies.push({
       store: 'S2-current',
       source: 'KooCLI current profile',
       fingerprint: currentFp,
-      manualModified: isManualModified(join(baseHome(), '.hcloud', 'config.json')),
+      manualModified: isManualModified(kooCli.configPath || join(baseHome(), '.hcloud', 'config.json')),
     });
   }
   if (s1Fingerprint && s3Fingerprint && s1Fingerprint !== s3Fingerprint) {
@@ -114,7 +133,7 @@ export function scanState() {
     stores: {
       s1Fingerprint,
       envFingerprint,
-      currentFingerprint: currentFp,
+      currentFingerprint: effectiveCurrentFp,
       s3Fingerprint,
       runtimeFingerprint,
     },
@@ -153,7 +172,7 @@ export function exportStateForStatus(_jailed) {
 }
 
 export function runHcloudConfigure(profile, ak, sk, region) {
-  const bin = process.env.HCLOUD_BIN || 'hcloud';
+  const { executable, argsPrefix } = resolveHcloudCommand();
   const args = [
     'configure',
     'set',
@@ -162,7 +181,12 @@ export function runHcloudConfigure(profile, ak, sk, region) {
     `--cli-secret-key=${sk}`,
     `--cli-region=${region || ''}`,
   ];
-  const r = spawnSync(bin, args, { shell: false, windowsHide: true, stdio: 'pipe', timeout: 30000 });
+  const r = spawnSync(executable, [...argsPrefix, ...args], {
+    shell: false,
+    windowsHide: true,
+    stdio: 'pipe',
+    timeout: 30000,
+  });
   return {
     ok: r.status === 0,
     error: redactSecrets(

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -1,5 +1,4 @@
 import { existsSync } from 'node:fs';
-import { spawnSync } from 'node:child_process';
 
 import { getAgentRegistrationStatuses } from './agent-registration.mjs';
 import {
@@ -10,38 +9,27 @@ import {
   writeObsConfig,
 } from './credentials.mjs';
 import {
+  fingerprint,
   exportStateForStatus,
   hasRuntimeCredentials,
   resolveManagedProfile,
   runHcloudConfigure,
 } from './reconcile.mjs';
-
-function hcloudInstalled() {
-  const bin = process.env.HCLOUD_BIN || 'hcloud';
-  try {
-    const r = spawnSync(`"${bin}" version`, [], {
-      shell: true,
-      windowsHide: true,
-      stdio: 'pipe',
-      timeout: 5000,
-    });
-    const out = `${r.stdout || ''}${r.stderr || ''}`;
-    return r.status === 0 && /KooCLI|Current.*version|当前KooCLI/i.test(out);
-  } catch {
-    return false;
-  }
-}
+import { hcloudProbeNextStep, probeHcloud } from '../hcloud-probe.mjs';
 
 export function getAuthStatus(target = 'all') {
   const credentials = readGlobalCredentials();
   const reconciled = { ...exportStateForStatus(), runtimeActive: hasRuntimeCredentials() };
+  const hcloud = probeHcloud();
   return {
     target,
     credentialsConfigured: Boolean(credentials?.ak && credentials?.sk),
     credentialsPath: globalCredentialsPath(),
     obsConfigured: existsSync(obsConfigPath()),
     obsConfigPath: obsConfigPath(),
-    kooCliInstalled: hcloudInstalled(),
+    kooCliInstalled: hcloud.installed,
+    kooCliStatus: hcloud.status,
+    kooCliNextStep: hcloudProbeNextStep(hcloud),
     reconciled,
     agents: getAgentRegistrationStatuses(target).agents,
   };
@@ -85,11 +73,17 @@ export function syncAuth(target = 'all') {
     };
   }
 
-  if (!hcloudInstalled()) {
+  const hcloud = probeHcloud();
+  if (!hcloud.ok) {
     return {
       ok: false,
-      error: 'KooCLI not installed.',
-      nextStep: 'Install KooCLI or point HCLOUD_BIN at the hcloud executable.',
+      error:
+        hcloud.status === 'sandbox_home_failure'
+          ? 'KooCLI detected but cannot resolve the user home directory in this agent sandbox.'
+          : hcloud.status === 'privacy_pending'
+            ? 'KooCLI privacy agreement is pending.'
+            : 'KooCLI not ready.',
+      nextStep: hcloudProbeNextStep(hcloud),
       obs: { configured: true, path: obs.path, endpoint: obs.endpoint },
     };
   }
@@ -104,7 +98,7 @@ export function syncAuth(target = 'all') {
     };
   }
 
-  writeLastSync();
+  writeLastSync({ kooCliProfile: profile, s1Fingerprint: fingerprint(credentials.ak, credentials.sk) });
 
   return {
     ok: true,

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -1,11 +1,11 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
+import { mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 import { classifyHcloudArgs, redactSecrets, assertAllowed } from './safety-policy.mjs';
 import { getProxySettings } from './proxy/proxy-config.mjs';
+import { findHcloudBin, resolveHcloudCommand } from './hcloud-probe.mjs';
 
 const DEFAULT_TIMEOUT_MS = 60_000;
 const DEFAULT_FORCE_KILL_AFTER_MS = 2_000;
@@ -67,10 +67,10 @@ function preflightSecurityGroupCheck(normalizedArgs) {
   const findings = [];
   for (const sgId of sgIds) {
     try {
-      const hcloudBin = process.env.HCLOUD_BIN || 'hcloud';
+      const { executable, argsPrefix } = resolveHcloudCommand();
       const spawnArgs = ['VPC', 'ListSecurityGroupRules', `--security_group_id.1=${sgId}`];
       if (regionArg) spawnArgs.push(regionArg);
-      const r = spawnSync(hcloudBin, spawnArgs, {
+      const r = spawnSync(executable, [...argsPrefix, ...spawnArgs], {
         shell: false,
         windowsHide: true,
         stdio: 'pipe',
@@ -131,11 +131,22 @@ function applyPreflightFindings(classification, sgFindings) {
   return classification;
 }
 
+const OBS_WRITE_SUBCOMMANDS = new Set(['mb', 'cp', 'mv', 'rm', 'chattri', 'restore']);
+
+function obsWriteHint(args) {
+  if (!Array.isArray(args) || args.length < 2) return null;
+  if (String(args[0]).toUpperCase() !== 'OBS') return null;
+  if (!OBS_WRITE_SUBCOMMANDS.has(String(args[1]).toLowerCase())) return null;
+  return 'OBS write operations are obsutil-style and always write-class. Before executing, present the full resource manifest (bucket/object list) to the user for ONE batch approval, then run each command through plan → approve (see huawei-iac skill, Provisioning Rules).';
+}
+
 export function planHcloudCommand(args, options = {}) {
   const normalizedArgs = Array.isArray(args) ? args.map(String) : [];
   const classification = classifyHcloudArgs(normalizedArgs, options);
   const command = ['hcloud', ...normalizedArgs].map((arg) => quoteShellArg(arg)).join(' ');
   const warnings = planningWarnings(normalizedArgs);
+  const obsHint = obsWriteHint(normalizedArgs);
+  if (obsHint) warnings.push(obsHint);
   const sgFindings = preflightSecurityGroupCheck(normalizedArgs);
   if (sgFindings.length > 0) {
     for (const f of sgFindings) warnings.push(f);
@@ -205,12 +216,7 @@ async function runtimeCurrentMismatchWarning() {
 }
 
 function discoverHcloudPath() {
-  if (process.env.HCLOUD_BIN && existsSync(process.env.HCLOUD_BIN)) return process.env.HCLOUD_BIN;
-  const candidates =
-    process.platform === 'win32'
-      ? [join(homedir(), 'hcloud', 'hcloud.exe')]
-      : [join(homedir(), '.local', 'bin', 'hcloud'), join(homedir(), 'hcloud', 'hcloud')];
-  return candidates.find((c) => existsSync(c)) || null;
+  return findHcloudBin();
 }
 
 function runHcloudOnce(plan, options) {

package/plugins/huaweicloud-core/src/hcloud-probe.mjs

@@ -0,0 +1,154 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+import { compareVersion, getKooCliVersion, parseHcloudVersion } from './koocli-version.mjs';
+import { redactSecrets } from './safety-policy.mjs';
+
+const VERSION_RE = /KooCLI|Current.*version|当前KooCLI/i;
+
+export function findHcloudBin() {
+  if (process.env.HCLOUD_BIN && existsSync(process.env.HCLOUD_BIN)) return process.env.HCLOUD_BIN;
+  const candidates =
+    process.platform === 'win32'
+      ? [join(homedir(), 'hcloud', 'hcloud.exe')]
+      : [join(homedir(), '.local', 'bin', 'hcloud'), join(homedir(), 'hcloud', 'hcloud')];
+  const found = candidates.find((candidate) => existsSync(candidate));
+  if (found) return found;
+
+  const locator =
+    process.platform === 'win32'
+      ? spawnSync('where.exe', ['hcloud'], { windowsHide: true, stdio: 'pipe', encoding: 'utf8', timeout: 3000 })
+      : spawnSync('sh', ['-c', 'command -v hcloud'], {
+          windowsHide: true,
+          stdio: 'pipe',
+          encoding: 'utf8',
+          timeout: 3000,
+        });
+  if (locator.status === 0) {
+    const first = String(locator.stdout || '')
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .find(Boolean);
+    if (first) return first;
+  }
+  return null;
+}
+
+function envHcloudArgs() {
+  if (!process.env.HCLOUD_BIN_ARGS_JSON) return [];
+  try {
+    const parsed = JSON.parse(process.env.HCLOUD_BIN_ARGS_JSON);
+    if (Array.isArray(parsed)) return parsed.map((item) => String(item));
+  } catch {}
+  return [];
+}
+
+export function resolveHcloudCommand(options = {}) {
+  return {
+    executable: options.executable || findHcloudBin() || 'hcloud',
+    argsPrefix: Array.isArray(options.executableArgs) ? options.executableArgs : envHcloudArgs(),
+  };
+}
+
+export function classifyHcloudProbe(result, requiredVersion = getKooCliVersion()) {
+  const stdout = String(result.stdout || '');
+  const stderr = String(result.stderr || '');
+  const output = `${stdout}${stderr}`;
+  const installedVersion = parseHcloudVersion(output);
+
+  if (result.error?.code === 'ENOENT') {
+    return {
+      status: 'not_found',
+      installed: false,
+      ok: false,
+      errorCode: 'HCLOUD_NOT_FOUND',
+    };
+  }
+
+  if (result.status === 0 && (VERSION_RE.test(output) || installedVersion)) {
+    const versionMismatch = !!(
+      requiredVersion &&
+      installedVersion &&
+      compareVersion(installedVersion, requiredVersion) !== 0
+    );
+    return {
+      status: versionMismatch ? 'version_mismatch' : 'ok',
+      installed: true,
+      ok: true,
+      installedVersion,
+      requiredVersion: requiredVersion || undefined,
+      versionMismatch,
+    };
+  }
+
+  if (/获取当前用户家目录失败|home\s+directory|user\s+home|home\s+dir|homedir/i.test(output)) {
+    return {
+      status: 'sandbox_home_failure',
+      installed: true,
+      ok: false,
+      errorCode: 'HCLOUD_SANDBOX_HOME_FAILURE',
+    };
+  }
+
+  if (
+    /同意并继续使用|不同意并退出|隐私协议|隐私声明|privacy agreement|privacy statement|invalid character|无效字符/i.test(
+      output,
+    )
+  ) {
+    return {
+      status: 'privacy_pending',
+      installed: true,
+      ok: false,
+      errorCode: 'HCLOUD_PRIVACY_PENDING',
+    };
+  }
+
+  return {
+    status: 'unavailable',
+    installed: false,
+    ok: false,
+    errorCode: 'HCLOUD_UNAVAILABLE',
+  };
+}
+
+export function probeHcloud(options = {}) {
+  const { executable, argsPrefix } = resolveHcloudCommand(options);
+  const r = spawnSync(executable, [...argsPrefix, 'version'], {
+    shell: false,
+    windowsHide: true,
+    stdio: 'pipe',
+    encoding: 'utf8',
+    timeout: options.timeoutMs ?? 5000,
+  });
+  const classified = classifyHcloudProbe(r, options.requiredVersion);
+  const stdout = redactSecrets(String(r.stdout || '').trim());
+  const stderr = redactSecrets(String(r.stderr || r.error?.message || '').trim());
+  return {
+    executable,
+    exitCode: r.status,
+    stdout,
+    stderr,
+    output: classified.ok ? stdout : stderr || stdout,
+    ...classified,
+  };
+}
+
+export function hcloudProbeNextStep(probe) {
+  if (probe.status === 'ok')
+    return 'Use huaweicloud_show_profile_redacted to inspect the active KooCLI profile safely.';
+  if (probe.status === 'version_mismatch') {
+    return `KooCLI version mismatch: installed ${probe.installedVersion}, this plugin is paired with ${probe.requiredVersion}. Reinstall the pinned version (see huaweicloud-cli-and-auth skill) and restart the agent.`;
+  }
+  if (probe.status === 'sandbox_home_failure') {
+    return 'KooCLI was found, but this agent sandbox cannot resolve the Windows user home directory. Set HCLOUD_BIN to the full hcloud path, restart Codex, or verify from a normal terminal.';
+  }
+  if (probe.status === 'privacy_pending') {
+    return 'KooCLI requires accepting its one-time privacy agreement. Run hcloud version in a real terminal and accept the prompt, then restart the agent.';
+  }
+  if (probe.status === 'not_found') {
+    return 'hcloud executable not found. Set HCLOUD_BIN to the full hcloud path, or install KooCLI: npx huaweicloud-devkit install-hcloud. Then restart the agent.';
+  }
+  return 'Install Huawei Cloud KooCLI: npx huaweicloud-devkit install-hcloud. Configure credentials outside the agent conversation.';
+}

package/plugins/huaweicloud-core/src/koocli-version.mjs

@@ -0,0 +1,47 @@
+import { readFileSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PACKAGE_JSON = resolve(__dirname, '..', '..', '..', 'package.json');
+
+export const KOO_CLI_BASE = 'https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli';
+
+const VERSION_RE = /\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/;
+
+export function getKooCliVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(PACKAGE_JSON, 'utf8'));
+    return pkg.kooCliVersion || null;
+  } catch {
+    return null;
+  }
+}
+
+export function parseHcloudVersion(out) {
+  if (!out) return null;
+  const match = String(out).match(VERSION_RE);
+  return match ? match[0] : null;
+}
+
+export function compareVersion(a, b) {
+  const pa = String(a || '')
+    .split(/[-+]/)[0]
+    .split('.')
+    .map((n) => Number.parseInt(n, 10) || 0);
+  const pb = String(b || '')
+    .split(/[-+]/)[0]
+    .split('.')
+    .map((n) => Number.parseInt(n, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i += 1) {
+    const va = pa[i] || 0;
+    const vb = pb[i] || 0;
+    if (va > vb) return 1;
+    if (va < vb) return -1;
+  }
+  return 0;
+}
+
+export function kooCliDownloadBase() {
+  return `${KOO_CLI_BASE}/${getKooCliVersion() || 'latest'}`;
+}

package/plugins/huaweicloud-core/src/safety-policy.mjs

@@ -109,6 +109,14 @@ function applyCommandRiskRules(base, normalizedArgs, options = {}) {
   return mergeRiskDecision(base, risk);
 }
 
+function applyRawCommandRiskRules(base, command, options = {}) {
+  if (base.decision === 'deny' || options.skipRiskRules === true) {
+    return base;
+  }
+  const risk = evaluateCommandRisk(command);
+  return mergeRiskDecision(base, risk);
+}
+
 export function classifyHcloudArgs(args, options = {}) {
   const policy = options.policy || DEFAULT_POLICY;
   const { service, operation, args: normalizedArgs } = commandOperation(args);
@@ -340,11 +348,15 @@ export function classifyTextCommand(command, options = {}) {
     };
   }
 
-  return {
-    decision: 'allow',
-    risk: 'not_huaweicloud',
-    reason: 'No Huawei Cloud safety rule matched.',
-  };
+  return applyRawCommandRiskRules(
+    {
+      decision: 'allow',
+      risk: 'not_huaweicloud',
+      reason: 'No Huawei Cloud safety rule matched.',
+    },
+    text,
+    options,
+  );
 }
 
 export function assertAllowed(result) {