huaweicloud-devkit 1.1.2-next.3 → 1.1.2-next.4

package/README.md

@@ -57,14 +57,36 @@ npx --yes huaweicloud-devkit install --target codex
 **Restart the Codex session** after installation.
 
 ```bash
+codex plugin list  # verify huaweicloud-devkit@huaweicloud-devkit is installed and enabled
 npx --yes huaweicloud-devkit doctor --target codex
 npx --yes huaweicloud-devkit status --target codex
 npx --yes huaweicloud-devkit update --target codex
 npx --yes huaweicloud-devkit uninstall --target codex
 ```
 
+Then mention `@huaweicloud-devkit` in Codex or describe your Huawei Cloud task directly.
+
 > **Requires Codex CLI** — the `codex` command must be in PATH. If Codex is installed via WindowsApps (Microsoft Store), use `--target codex-desktop` instead. Run `codex --version` to verify CLI availability.
 
+### Codex Desktop
+
+Use this target when the Codex CLI is unavailable or when Codex is installed through WindowsApps on Windows.
+
+```bash
+npx --yes huaweicloud-devkit install --target codex-desktop
+```
+
+**Restart the Codex Desktop session** after installation.
+
+```bash
+npx --yes huaweicloud-devkit doctor --target codex-desktop
+npx --yes huaweicloud-devkit status --target codex-desktop
+npx --yes huaweicloud-devkit update --target codex-desktop
+npx --yes huaweicloud-devkit uninstall --target codex-desktop
+```
+
+Then mention `@huaweicloud-devkit` in a new Codex Desktop task or describe your Huawei Cloud task directly.
+
 ### CodeArts Agent
 
 ```bash

package/README.zh-CN.md

@@ -57,14 +57,36 @@ npx --yes huaweicloud-devkit install --target codex
 安装后**重启 Codex 会话**。
 
 ```bash
+codex plugin list  # 验证 huaweicloud-devkit@huaweicloud-devkit 已安装并启用
 npx --yes huaweicloud-devkit doctor --target codex
 npx --yes huaweicloud-devkit status --target codex
 npx --yes huaweicloud-devkit update --target codex
 npx --yes huaweicloud-devkit uninstall --target codex
 ```
 
+随后在 Codex 中提及 `@huaweicloud-devkit`，或直接描述华为云任务。
+
 > **需要 Codex CLI** — `codex` 命令必须在 PATH 中。若 Codex 通过 WindowsApps（Microsoft Store）安装，请使用 `--target codex-desktop` 替代。运行 `codex --version` 验证 CLI 可用性。
 
+### Codex Desktop
+
+当 Codex CLI 不可用，或 Windows 上通过 WindowsApps 安装 Codex 时，使用此目标。
+
+```bash
+npx --yes huaweicloud-devkit install --target codex-desktop
+```
+
+安装后**重启 Codex Desktop 会话**。
+
+```bash
+npx --yes huaweicloud-devkit doctor --target codex-desktop
+npx --yes huaweicloud-devkit status --target codex-desktop
+npx --yes huaweicloud-devkit update --target codex-desktop
+npx --yes huaweicloud-devkit uninstall --target codex-desktop
+```
+
+随后在新的 Codex Desktop 任务中提及 `@huaweicloud-devkit`，或直接描述华为云任务。
+
 ### CodeArts Agent（码道）
 
 ```bash

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.2-next.3",
+  "version": "1.1.2-next.4",
   "kooCliVersion": "7.2.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.2-next.3",
+  "version": "1.1.2-next.4",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.2-next.3",
+  "version": "1.1.2-next.4",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.2-next.3",
+  "version": "1.1.2-next.4",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.2-next.3",
+  "version": "1.1.2-next.4",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.2-next.3",
+  "version": "1.1.2-next.4",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/hooks/hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"${CLAUDE_PLUGIN_ROOT}/hooks/huaweicloud-safety.py\"",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/huaweicloud-safety.mjs\"",
             "timeout": 5
           }
         ]
@@ -16,7 +16,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"${CLAUDE_PLUGIN_ROOT}/hooks/huaweicloud-safety.py\"",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/huaweicloud-safety.mjs\"",
             "timeout": 5
           }
         ]

package/plugins/huaweicloud-core/hooks/huaweicloud-safety.mjs

@@ -0,0 +1,56 @@
+import { readFileSync } from 'node:fs';
+
+import { classifyTextCommand } from '../src/safety-policy.mjs';
+
+const DENY_PREFIX = 'Huawei Cloud safety hook blocked this action: ';
+
+function commandText(toolInput) {
+  if (typeof toolInput === 'string') return toolInput;
+  if (toolInput && typeof toolInput === 'object') {
+    const values = [];
+    for (const key of ['command', 'cmd', 'script', 'args', 'arguments']) {
+      const value = toolInput[key];
+      if (Array.isArray(value)) values.push(value.map(String).join(' '));
+      else if (value !== undefined && value !== null) values.push(String(value));
+    }
+    if (values.length > 0) return values.join('\n');
+    return JSON.stringify(toolInput);
+  }
+  return JSON.stringify(toolInput);
+}
+
+function deny(reason) {
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'deny',
+        permissionDecisionReason: DENY_PREFIX + reason,
+      },
+    }) + '\n',
+  );
+}
+
+function readStdin() {
+  try {
+    return readFileSync(0, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+function main() {
+  const input = readStdin();
+  let data;
+  try {
+    data = JSON.parse(input);
+  } catch {
+    return;
+  }
+
+  const text = commandText(data.tool_input ?? {});
+  const result = classifyTextCommand(text);
+  if (result.decision === 'deny') deny(result.reason);
+}
+
+main();

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.2-next.3",
+  "version": "1.1.2-next.4",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/skills/huaweicloud-safety/SKILL.md

@@ -27,7 +27,7 @@ Use this skill before any Huawei Cloud action that may expose secrets, change re
 
 ## Enforcement Layers
 
-- Hooks: `hooks/huaweicloud-safety.py` can block risky tool calls on platforms that support plugin hooks.
+- Hooks: `hooks/huaweicloud-safety.mjs` blocks risky Codex native hook calls without requiring Python; `hooks/huaweicloud-safety.py` remains for Hermes/Python hook compatibility.
 - MCP wrapper: the Node MCP server applies the same safety policy for Codex/OpenCode paths that do not enforce hooks.
 - Skills: this document teaches agents the rule before they act.
 

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -272,10 +272,14 @@ export function readLastSync() {
   }
 }
 
-export function writeLastSync() {
+export function writeLastSync(metadata = {}) {
   const path = lastSyncPath();
   mkdirSync(dirname(path), { recursive: true });
-  const payload = { ts: Date.now() };
+  const payload = {
+    ts: Date.now(),
+    ...(metadata.kooCliProfile ? { kooCliProfile: String(metadata.kooCliProfile) } : {}),
+    ...(metadata.s1Fingerprint ? { s1Fingerprint: String(metadata.s1Fingerprint) } : {}),
+  };
   writeFileSync(path, JSON.stringify(payload), { encoding: 'utf8', mode: 0o600 });
   ensurePrivateMode(path);
 }

package/plugins/huaweicloud-core/src/auth/reconcile.mjs

@@ -11,6 +11,7 @@ import {
   readLastSync,
   resolveCredentialsWithRuntime,
 } from './credentials.mjs';
+import { resolveHcloudCommand } from '../hcloud-probe.mjs';
 import { redactSecrets } from '../safety-policy.mjs';
 
 export { hasRuntimeCredentials };
@@ -47,6 +48,7 @@ export function readKooCliProfiles() {
     return {
       current,
       mtimeMs,
+      configPath,
       profiles: profiles.map((p) => ({
         name: String(p.name || ''),
         fingerprint: fingerprint(p.accessKeyId, p.secretAccessKey),
@@ -70,15 +72,32 @@ export function currentFingerprintFromHcloud(res) {
   return cur ? cur.fingerprint : null;
 }
 
+function currentProfileFromHcloud(res) {
+  if (res.error) return null;
+  return res.profiles.find((p) => p.name === res.current) || null;
+}
+
+function s2CurrentMatchesLastDevkitSync(kooCli, s1, s1Fingerprint) {
+  const current = currentProfileFromHcloud(kooCli);
+  const lastSync = readLastSync();
+  if (!current || !lastSync?.ts || !lastSync.kooCliProfile || !lastSync.s1Fingerprint) return false;
+  if (!s1?.ak || current.accessKeyId !== s1.ak) return false;
+  if (lastSync.kooCliProfile !== kooCli.current) return false;
+  if (lastSync.s1Fingerprint !== s1Fingerprint) return false;
+  return Number(kooCli.mtimeMs || 0) <= Number(lastSync.ts) + 1000;
+}
+
 export function scanState() {
   const s1 = readGlobalCredentials() || {};
   const envAk = process.env.HW_ACCESS_KEY || '';
   const envSk = process.env.HW_SECRET_KEY || '';
   const kooCli = readKooCliProfiles();
-  const currentFp = currentFingerprintFromHcloud(kooCli);
   const inconsistencies = [];
 
   const s1Fingerprint = fingerprint(s1.ak, s1.sk);
+  const currentFp = currentFingerprintFromHcloud(kooCli);
+  const s2SyncedByDevkit = s1Fingerprint ? s2CurrentMatchesLastDevkitSync(kooCli, s1, s1Fingerprint) : false;
+  const effectiveCurrentFp = s2SyncedByDevkit ? s1Fingerprint : currentFp;
   const envFingerprint = fingerprint(envAk, envSk);
   const s3 = existsSync(obsConfigPath()) ? parseS3ObsConfig(obsConfigPath()) : null;
   const s3Fingerprint = s3 ? fingerprint(s3.ak, s3.sk) : null;
@@ -93,12 +112,12 @@ export function scanState() {
     // nothing resolvable → runtime store inactive
   }
 
-  if (s1Fingerprint && currentFp && s1Fingerprint !== currentFp) {
+  if (s1Fingerprint && currentFp && s1Fingerprint !== effectiveCurrentFp) {
     inconsistencies.push({
       store: 'S2-current',
       source: 'KooCLI current profile',
       fingerprint: currentFp,
-      manualModified: isManualModified(join(baseHome(), '.hcloud', 'config.json')),
+      manualModified: isManualModified(kooCli.configPath || join(baseHome(), '.hcloud', 'config.json')),
     });
   }
   if (s1Fingerprint && s3Fingerprint && s1Fingerprint !== s3Fingerprint) {
@@ -114,7 +133,7 @@ export function scanState() {
     stores: {
       s1Fingerprint,
       envFingerprint,
-      currentFingerprint: currentFp,
+      currentFingerprint: effectiveCurrentFp,
       s3Fingerprint,
       runtimeFingerprint,
     },
@@ -153,7 +172,7 @@ export function exportStateForStatus(_jailed) {
 }
 
 export function runHcloudConfigure(profile, ak, sk, region) {
-  const bin = process.env.HCLOUD_BIN || 'hcloud';
+  const { executable, argsPrefix } = resolveHcloudCommand();
   const args = [
     'configure',
     'set',
@@ -162,7 +181,12 @@ export function runHcloudConfigure(profile, ak, sk, region) {
     `--cli-secret-key=${sk}`,
     `--cli-region=${region || ''}`,
   ];
-  const r = spawnSync(bin, args, { shell: false, windowsHide: true, stdio: 'pipe', timeout: 30000 });
+  const r = spawnSync(executable, [...argsPrefix, ...args], {
+    shell: false,
+    windowsHide: true,
+    stdio: 'pipe',
+    timeout: 30000,
+  });
   return {
     ok: r.status === 0,
     error: redactSecrets(

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -1,5 +1,4 @@
 import { existsSync } from 'node:fs';
-import { spawnSync } from 'node:child_process';
 
 import { getAgentRegistrationStatuses } from './agent-registration.mjs';
 import {
@@ -10,38 +9,27 @@ import {
   writeObsConfig,
 } from './credentials.mjs';
 import {
+  fingerprint,
   exportStateForStatus,
   hasRuntimeCredentials,
   resolveManagedProfile,
   runHcloudConfigure,
 } from './reconcile.mjs';
-
-function hcloudInstalled() {
-  const bin = process.env.HCLOUD_BIN || 'hcloud';
-  try {
-    const r = spawnSync(`"${bin}" version`, [], {
-      shell: true,
-      windowsHide: true,
-      stdio: 'pipe',
-      timeout: 5000,
-    });
-    const out = `${r.stdout || ''}${r.stderr || ''}`;
-    return r.status === 0 && /KooCLI|Current.*version|当前KooCLI/i.test(out);
-  } catch {
-    return false;
-  }
-}
+import { hcloudProbeNextStep, probeHcloud } from '../hcloud-probe.mjs';
 
 export function getAuthStatus(target = 'all') {
   const credentials = readGlobalCredentials();
   const reconciled = { ...exportStateForStatus(), runtimeActive: hasRuntimeCredentials() };
+  const hcloud = probeHcloud();
   return {
     target,
     credentialsConfigured: Boolean(credentials?.ak && credentials?.sk),
     credentialsPath: globalCredentialsPath(),
     obsConfigured: existsSync(obsConfigPath()),
     obsConfigPath: obsConfigPath(),
-    kooCliInstalled: hcloudInstalled(),
+    kooCliInstalled: hcloud.installed,
+    kooCliStatus: hcloud.status,
+    kooCliNextStep: hcloudProbeNextStep(hcloud),
     reconciled,
     agents: getAgentRegistrationStatuses(target).agents,
   };
@@ -85,11 +73,17 @@ export function syncAuth(target = 'all') {
     };
   }
 
-  if (!hcloudInstalled()) {
+  const hcloud = probeHcloud();
+  if (!hcloud.ok) {
     return {
       ok: false,
-      error: 'KooCLI not installed.',
-      nextStep: 'Install KooCLI or point HCLOUD_BIN at the hcloud executable.',
+      error:
+        hcloud.status === 'sandbox_home_failure'
+          ? 'KooCLI detected but cannot resolve the user home directory in this agent sandbox.'
+          : hcloud.status === 'privacy_pending'
+            ? 'KooCLI privacy agreement is pending.'
+            : 'KooCLI not ready.',
+      nextStep: hcloudProbeNextStep(hcloud),
       obs: { configured: true, path: obs.path, endpoint: obs.endpoint },
     };
   }
@@ -104,7 +98,7 @@ export function syncAuth(target = 'all') {
     };
   }
 
-  writeLastSync();
+  writeLastSync({ kooCliProfile: profile, s1Fingerprint: fingerprint(credentials.ak, credentials.sk) });
 
   return {
     ok: true,

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -1,11 +1,11 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
+import { mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 import { classifyHcloudArgs, redactSecrets, assertAllowed } from './safety-policy.mjs';
 import { getProxySettings } from './proxy/proxy-config.mjs';
+import { findHcloudBin, resolveHcloudCommand } from './hcloud-probe.mjs';
 
 const DEFAULT_TIMEOUT_MS = 60_000;
 const DEFAULT_FORCE_KILL_AFTER_MS = 2_000;
@@ -67,10 +67,10 @@ function preflightSecurityGroupCheck(normalizedArgs) {
   const findings = [];
   for (const sgId of sgIds) {
     try {
-      const hcloudBin = process.env.HCLOUD_BIN || 'hcloud';
+      const { executable, argsPrefix } = resolveHcloudCommand();
       const spawnArgs = ['VPC', 'ListSecurityGroupRules', `--security_group_id.1=${sgId}`];
       if (regionArg) spawnArgs.push(regionArg);
-      const r = spawnSync(hcloudBin, spawnArgs, {
+      const r = spawnSync(executable, [...argsPrefix, ...spawnArgs], {
         shell: false,
         windowsHide: true,
         stdio: 'pipe',
@@ -216,12 +216,7 @@ async function runtimeCurrentMismatchWarning() {
 }
 
 function discoverHcloudPath() {
-  if (process.env.HCLOUD_BIN && existsSync(process.env.HCLOUD_BIN)) return process.env.HCLOUD_BIN;
-  const candidates =
-    process.platform === 'win32'
-      ? [join(homedir(), 'hcloud', 'hcloud.exe')]
-      : [join(homedir(), '.local', 'bin', 'hcloud'), join(homedir(), 'hcloud', 'hcloud')];
-  return candidates.find((c) => existsSync(c)) || null;
+  return findHcloudBin();
 }
 
 function runHcloudOnce(plan, options) {

package/plugins/huaweicloud-core/src/hcloud-probe.mjs

@@ -0,0 +1,154 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+import { compareVersion, getKooCliVersion, parseHcloudVersion } from './koocli-version.mjs';
+import { redactSecrets } from './safety-policy.mjs';
+
+const VERSION_RE = /KooCLI|Current.*version|当前KooCLI/i;
+
+export function findHcloudBin() {
+  if (process.env.HCLOUD_BIN && existsSync(process.env.HCLOUD_BIN)) return process.env.HCLOUD_BIN;
+  const candidates =
+    process.platform === 'win32'
+      ? [join(homedir(), 'hcloud', 'hcloud.exe')]
+      : [join(homedir(), '.local', 'bin', 'hcloud'), join(homedir(), 'hcloud', 'hcloud')];
+  const found = candidates.find((candidate) => existsSync(candidate));
+  if (found) return found;
+
+  const locator =
+    process.platform === 'win32'
+      ? spawnSync('where.exe', ['hcloud'], { windowsHide: true, stdio: 'pipe', encoding: 'utf8', timeout: 3000 })
+      : spawnSync('sh', ['-c', 'command -v hcloud'], {
+          windowsHide: true,
+          stdio: 'pipe',
+          encoding: 'utf8',
+          timeout: 3000,
+        });
+  if (locator.status === 0) {
+    const first = String(locator.stdout || '')
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .find(Boolean);
+    if (first) return first;
+  }
+  return null;
+}
+
+function envHcloudArgs() {
+  if (!process.env.HCLOUD_BIN_ARGS_JSON) return [];
+  try {
+    const parsed = JSON.parse(process.env.HCLOUD_BIN_ARGS_JSON);
+    if (Array.isArray(parsed)) return parsed.map((item) => String(item));
+  } catch {}
+  return [];
+}
+
+export function resolveHcloudCommand(options = {}) {
+  return {
+    executable: options.executable || findHcloudBin() || 'hcloud',
+    argsPrefix: Array.isArray(options.executableArgs) ? options.executableArgs : envHcloudArgs(),
+  };
+}
+
+export function classifyHcloudProbe(result, requiredVersion = getKooCliVersion()) {
+  const stdout = String(result.stdout || '');
+  const stderr = String(result.stderr || '');
+  const output = `${stdout}${stderr}`;
+  const installedVersion = parseHcloudVersion(output);
+
+  if (result.error?.code === 'ENOENT') {
+    return {
+      status: 'not_found',
+      installed: false,
+      ok: false,
+      errorCode: 'HCLOUD_NOT_FOUND',
+    };
+  }
+
+  if (result.status === 0 && (VERSION_RE.test(output) || installedVersion)) {
+    const versionMismatch = !!(
+      requiredVersion &&
+      installedVersion &&
+      compareVersion(installedVersion, requiredVersion) !== 0
+    );
+    return {
+      status: versionMismatch ? 'version_mismatch' : 'ok',
+      installed: true,
+      ok: true,
+      installedVersion,
+      requiredVersion: requiredVersion || undefined,
+      versionMismatch,
+    };
+  }
+
+  if (/获取当前用户家目录失败|home\s+directory|user\s+home|home\s+dir|homedir/i.test(output)) {
+    return {
+      status: 'sandbox_home_failure',
+      installed: true,
+      ok: false,
+      errorCode: 'HCLOUD_SANDBOX_HOME_FAILURE',
+    };
+  }
+
+  if (
+    /同意并继续使用|不同意并退出|隐私协议|隐私声明|privacy agreement|privacy statement|invalid character|无效字符/i.test(
+      output,
+    )
+  ) {
+    return {
+      status: 'privacy_pending',
+      installed: true,
+      ok: false,
+      errorCode: 'HCLOUD_PRIVACY_PENDING',
+    };
+  }
+
+  return {
+    status: 'unavailable',
+    installed: false,
+    ok: false,
+    errorCode: 'HCLOUD_UNAVAILABLE',
+  };
+}
+
+export function probeHcloud(options = {}) {
+  const { executable, argsPrefix } = resolveHcloudCommand(options);
+  const r = spawnSync(executable, [...argsPrefix, 'version'], {
+    shell: false,
+    windowsHide: true,
+    stdio: 'pipe',
+    encoding: 'utf8',
+    timeout: options.timeoutMs ?? 5000,
+  });
+  const classified = classifyHcloudProbe(r, options.requiredVersion);
+  const stdout = redactSecrets(String(r.stdout || '').trim());
+  const stderr = redactSecrets(String(r.stderr || r.error?.message || '').trim());
+  return {
+    executable,
+    exitCode: r.status,
+    stdout,
+    stderr,
+    output: classified.ok ? stdout : stderr || stdout,
+    ...classified,
+  };
+}
+
+export function hcloudProbeNextStep(probe) {
+  if (probe.status === 'ok')
+    return 'Use huaweicloud_show_profile_redacted to inspect the active KooCLI profile safely.';
+  if (probe.status === 'version_mismatch') {
+    return `KooCLI version mismatch: installed ${probe.installedVersion}, this plugin is paired with ${probe.requiredVersion}. Reinstall the pinned version (see huaweicloud-cli-and-auth skill) and restart the agent.`;
+  }
+  if (probe.status === 'sandbox_home_failure') {
+    return 'KooCLI was found, but this agent sandbox cannot resolve the Windows user home directory. Set HCLOUD_BIN to the full hcloud path, restart Codex, or verify from a normal terminal.';
+  }
+  if (probe.status === 'privacy_pending') {
+    return 'KooCLI requires accepting its one-time privacy agreement. Run hcloud version in a real terminal and accept the prompt, then restart the agent.';
+  }
+  if (probe.status === 'not_found') {
+    return 'hcloud executable not found. Set HCLOUD_BIN to the full hcloud path, or install KooCLI: npx huaweicloud-devkit install-hcloud. Then restart the agent.';
+  }
+  return 'Install Huawei Cloud KooCLI: npx huaweicloud-devkit install-hcloud. Configure credentials outside the agent conversation.';
+}

package/plugins/huaweicloud-core/src/safety-policy.mjs

@@ -109,6 +109,14 @@ function applyCommandRiskRules(base, normalizedArgs, options = {}) {
   return mergeRiskDecision(base, risk);
 }
 
+function applyRawCommandRiskRules(base, command, options = {}) {
+  if (base.decision === 'deny' || options.skipRiskRules === true) {
+    return base;
+  }
+  const risk = evaluateCommandRisk(command);
+  return mergeRiskDecision(base, risk);
+}
+
 export function classifyHcloudArgs(args, options = {}) {
   const policy = options.policy || DEFAULT_POLICY;
   const { service, operation, args: normalizedArgs } = commandOperation(args);
@@ -340,11 +348,15 @@ export function classifyTextCommand(command, options = {}) {
     };
   }
 
-  return {
-    decision: 'allow',
-    risk: 'not_huaweicloud',
-    reason: 'No Huawei Cloud safety rule matched.',
-  };
+  return applyRawCommandRiskRules(
+    {
+      decision: 'allow',
+      risk: 'not_huaweicloud',
+      reason: 'No Huawei Cloud safety rule matched.',
+    },
+    text,
+    options,
+  );
 }
 
 export function assertAllowed(result) {

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -18,7 +18,7 @@ import { createRequire } from 'node:module';
 
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
 import { SUPPORTED_AGENT_TARGETS } from './auth/agent-registration.mjs';
-import { resolveManagedProfile } from './auth/reconcile.mjs';
+import { fingerprint, resolveManagedProfile } from './auth/reconcile.mjs';
 import { redactSecrets } from './safety-policy.mjs';
 import {
   globalCredentialsPath,
@@ -36,13 +36,8 @@ import {
 } from './proxy/proxy-config.mjs';
 import { removeKooCli, removeObsConfig } from './sandbox/uninstall-cleanup.mjs';
 import { queryDistTagsSync, determineTarget, semverCompare } from './update-check.mjs';
-import {
-  getKooCliVersion,
-  parseHcloudVersion,
-  compareVersion,
-  kooCliDownloadBase,
-  KOO_CLI_BASE,
-} from './koocli-version.mjs';
+import { getKooCliVersion, compareVersion, kooCliDownloadBase, KOO_CLI_BASE } from './koocli-version.mjs';
+import { findHcloudBin, hcloudProbeNextStep, probeHcloud } from './hcloud-probe.mjs';
 
 const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
 
@@ -420,23 +415,6 @@ function detectCodeartsSandbox() {
   }
 }
 
-// Locate an existing hcloud executable (HCLOUD_BIN, ~/hcloud on Windows, ~/.local/bin elsewhere).
-function findHcloudBin() {
-  if (process.env.HCLOUD_BIN && existsSync(process.env.HCLOUD_BIN)) return process.env.HCLOUD_BIN;
-  const isWin = platform() === 'win32';
-  const candidates = isWin
-    ? [join(homedir(), 'hcloud', 'hcloud.exe')]
-    : [
-        join(homedir(), '.local', 'bin', 'hcloud'),
-        join(homedir(), 'hcloud', 'hcloud'),
-        join(homedir(), 'hcloud', 'hcloud.exe'),
-      ];
-  for (const c of candidates) {
-    if (existsSync(c)) return c;
-  }
-  return null;
-}
-
 function printSandboxWarning(reason) {
   console.log(`\n\x1b[1m\x1b[31m⚠ 检测到码道沙箱模式 (bash_mode: sandbox)\x1b[0m`);
   console.log(`\x1b[31m  ${reason}\x1b[0m`);
@@ -630,27 +608,25 @@ function hasCodexCLI() {
   return false;
 }
 
-function checkHcloud() {
-  const bin = findHcloudBin() || process.env.HCLOUD_BIN || 'hcloud';
-  if (!existsSync(bin)) return false;
-  try {
-    if (statSync(bin).size < 1024) return false;
-  } catch {
-    return false;
-  }
+function getMarketplaceName() {
+  const marketplacePath = join(PACKAGE_ROOT, '.agents', 'plugins', 'marketplace.json');
   try {
-    const r = spawnSync(`"${bin}" version`, [], { shell: true, windowsHide: true, stdio: 'pipe', timeout: 5000 });
-    const out = (r.stdout ? r.stdout.toString() : '') + (r.stderr ? r.stderr.toString() : '');
-    return r.status === 0 && /KooCLI|Current.*version|当前KooCLI/i.test(out);
-  } catch {
-    return false;
-  }
+    const manifest = JSON.parse(readFileSync(marketplacePath, 'utf8'));
+    if (manifest.name) return manifest.name;
+  } catch {}
+  return 'huaweicloud-devkit';
 }
 
-function getMarketplaceName() {
+function getCodexPluginName() {
   const marketplacePath = join(PACKAGE_ROOT, '.agents', 'plugins', 'marketplace.json');
   try {
-    const manifest = JSON.parse(readFileSync(marketplacePath, 'utf8'));
+    const marketplace = JSON.parse(readFileSync(marketplacePath, 'utf8'));
+    const pluginName = marketplace.plugins?.[0]?.name;
+    if (pluginName) return pluginName;
+  } catch {}
+  const codexManifestPath = join(PLUGIN_ROOT, '.codex-plugin', 'plugin.json');
+  try {
+    const manifest = JSON.parse(readFileSync(codexManifestPath, 'utf8'));
     if (manifest.name) return manifest.name;
   } catch {}
   return 'huaweicloud-devkit';
@@ -658,7 +634,7 @@ function getMarketplaceName() {
 
 function installCodex() {
   const marketplaceRoot = PACKAGE_ROOT;
-  const pluginName = 'huaweicloud-core';
+  const pluginName = getCodexPluginName();
   const marketplaceName = getMarketplaceName();
 
   console.log(`  Registering Codex marketplace: ${marketplaceRoot}`);
@@ -674,6 +650,10 @@ function installCodex() {
     console.log(`  \x1b[33mUse: npx huaweicloud-devkit install --target codex-desktop\x1b[0m`);
     return false;
   }
+  if (r1.status !== 0) {
+    console.log(`  \x1b[31mCodex marketplace registration failed.\x1b[0m`);
+    return false;
+  }
 
   console.log(`  Installing plugin: ${pluginName}@${marketplaceName}`);
   const r2 = spawnSync(`codex plugin add "${pluginName}@${marketplaceName}"`, [], {
@@ -688,20 +668,26 @@ function installCodex() {
     console.log(`  \x1b[33mUse: npx huaweicloud-devkit install --target codex-desktop\x1b[0m`);
     return false;
   }
+  if (r2.status !== 0) {
+    console.log(`  \x1b[31mCodex plugin installation failed.\x1b[0m`);
+    return false;
+  }
 
   return true;
 }
 
 function uninstallCodex() {
-  const pluginName = 'huaweicloud-core';
+  const pluginName = getCodexPluginName();
   const marketplaceName = getMarketplaceName();
-  console.log(`  Removing Codex plugin: ${pluginName}@${marketplaceName}`);
-  const r = spawnSync(`codex plugin remove "${pluginName}@${marketplaceName}"`, [], {
-    shell: true,
-    windowsHide: true,
-    stdio: 'pipe',
-  });
-  console.log(`  ${r.stdout ? r.stdout.toString().trim() : r.stderr.toString().trim()}`);
+  for (const name of new Set([pluginName, 'huaweicloud-core'])) {
+    console.log(`  Removing Codex plugin: ${name}@${marketplaceName}`);
+    const r = spawnSync(`codex plugin remove "${name}@${marketplaceName}"`, [], {
+      shell: true,
+      windowsHide: true,
+      stdio: 'pipe',
+    });
+    console.log(`  ${r.stdout ? r.stdout.toString().trim() : r.stderr.toString().trim()}`);
+  }
 
   for (const name of new Set([marketplaceName, 'HuaweiCloud-Devkit'])) {
     console.log(`  Removing Codex marketplace: ${name}`);
@@ -717,7 +703,7 @@ function uninstallCodex() {
 function codexStatus() {
   const r = spawnSync('codex plugin list', [], { shell: true, windowsHide: true, stdio: 'pipe' });
   const out = r.stdout ? r.stdout.toString() : '';
-  return out.includes('huaweicloud-core');
+  return out.includes(getCodexPluginName()) || out.includes('huaweicloud-core');
 }
 
 async function installOpenCode() {
@@ -3074,75 +3060,116 @@ function checkForUpdate() {
   }
 }
 
+function installMarkerDirForTarget(target) {
+  if (target === 'codex') return null;
+  if (target === 'dsh') return dshPluginsDir();
+  if (target === 'codearts') return codeartsPluginsDir();
+  if (target === 'codearts-work') return codeartsWorkPluginsDir();
+  if (target === 'workbuddy') return workbuddyPluginsDir();
+  if (target === 'officeace') return officeacePluginsDir();
+  if (target === 'hermes') return hermesPluginsDir();
+  if (target === 'openclaw') return openclawPluginsDir();
+  if (target === 'atomcode') return atomcodePluginsDir();
+  if (target === 'codex-desktop') return codexDesktopPluginsDir();
+  if (target === 'opencode') return opencodePluginsDir();
+  return null;
+}
+
+function writeInstallMarker(target) {
+  const markerDir = installMarkerDirForTarget(target);
+  if (!markerDir) return;
+  mkdirSync(markerDir, { recursive: true });
+  writeFileSync(join(markerDir, '.installed'), new Date().toISOString());
+}
+
 async function cmdInstall() {
   const target = parseTarget();
   console.log(BANNER);
   console.log(`Installing HuaweiCloud DevKit${target !== 'opencode' ? ` for ${target}` : ''}...\n`);
   checkNode();
   checkForUpdate();
+  const installFailures = [];
+
+  async function runInstallStep(stepTarget, title, fn) {
+    console.log(title);
+    try {
+      const result = await fn();
+      if (result === false) {
+        installFailures.push(stepTarget);
+        return false;
+      }
+      writeInstallMarker(stepTarget);
+      return true;
+    } catch (error) {
+      installFailures.push(stepTarget);
+      console.log(`  \x1b[31m${stepTarget} install failed: ${error.message}\x1b[0m`);
+      return false;
+    }
+  }
 
   if (target === 'opencode' || target === 'all') {
-    console.log('[OpenCode]');
-    await installOpenCode();
+    await runInstallStep('opencode', '[OpenCode]', installOpenCode);
   }
   if (target === 'codex-desktop' || target === 'all') {
-    console.log('\n[Codex Desktop]');
-    await installCodexDesktop();
+    await runInstallStep('codex-desktop', '\n[Codex Desktop]', installCodexDesktop);
   }
   if (target === 'codearts' || target === 'all') {
-    console.log('\n[CodeArts]');
-    await installCodeArts();
+    await runInstallStep('codearts', '\n[CodeArts]', installCodeArts);
   }
   if (target === 'codearts-work' || target === 'all') {
-    console.log('\n[CodeArts Work]');
-    await installCodeArtsWork();
+    await runInstallStep('codearts-work', '\n[CodeArts Work]', installCodeArtsWork);
   }
   if (target === 'workbuddy' || target === 'all') {
-    console.log('\n[WorkBuddy]');
-    await installWorkBuddy();
+    await runInstallStep('workbuddy', '\n[WorkBuddy]', installWorkBuddy);
   }
   if (target === 'dsh' || target === 'all') {
-    console.log('\n[DSH]');
-    await installDsh();
+    await runInstallStep('dsh', '\n[DSH]', installDsh);
   }
   if (target === 'officeace' || target === 'all') {
-    console.log('\n[OfficeAce]');
-    await installOfficeAce();
+    await runInstallStep('officeace', '\n[OfficeAce]', installOfficeAce);
   }
   if (target === 'hermes' || target === 'all') {
-    console.log('\n[Hermes Agent]');
-    await installHermes();
+    await runInstallStep('hermes', '\n[Hermes Agent]', installHermes);
   }
   if (target === 'openclaw' || target === 'all') {
-    console.log('\n[OpenClaw]');
-    await installOpenClaw();
+    await runInstallStep('openclaw', '\n[OpenClaw]', installOpenClaw);
   }
   if (target === 'atomcode' || target === 'all') {
-    console.log('\n[AtomCode]');
-    await installAtomCode();
+    await runInstallStep('atomcode', '\n[AtomCode]', installAtomCode);
   }
   if (target === 'codex' || target === 'all') {
-    console.log('\n[Codex]');
-    if (!hasCodexCLI()) {
-      if (target === 'codex') {
-        console.log(`  \x1b[31mCodex CLI not found.\x1b[0m`);
+    await runInstallStep('codex', '\n[Codex]', () => {
+      if (!hasCodexCLI()) {
+        if (target === 'codex') {
+          console.log(`  \x1b[31mCodex CLI not found.\x1b[0m`);
+          if (process.platform === 'win32') {
+            console.log(`  \x1b[33mTip: Codex Desktop on Windows installs codex.exe under WindowsApps,\x1b[0m`);
+            console.log(`  \x1b[33m     which may fail with "Access is denied". Try instead:\x1b[0m`);
+            console.log(`  \x1b[33m     npx huaweicloud-devkit install --target codex-desktop\x1b[0m`);
+          }
+          console.log(`  \x1b[31mOr install Codex CLI: https://github.com/openai/codex-cli\x1b[0m`);
+          return false;
+        }
+        console.log(`  \x1b[33mCodex CLI not found. Skipping Codex.\x1b[0m`);
         if (process.platform === 'win32') {
-          console.log(`  \x1b[33mTip: Codex Desktop on Windows installs codex.exe under WindowsApps,\x1b[0m`);
-          console.log(`  \x1b[33m     which may fail with "Access is denied". Try instead:\x1b[0m`);
-          console.log(`  \x1b[33m     npx huaweicloud-devkit install --target codex-desktop\x1b[0m`);
+          console.log('  \x1b[33mTip: try --target codex-desktop for Codex Desktop on Windows\x1b[0m');
+        } else {
+          console.log('  Install Codex CLI to enable: npx huaweicloud-devkit install --target codex');
         }
-        console.log(`  \x1b[31mOr install Codex CLI: https://github.com/openai/codex-cli\x1b[0m`);
-        process.exit(1);
-      }
-      console.log(`  \x1b[33mCodex CLI not found. Skipping Codex.\x1b[0m`);
-      if (process.platform === 'win32') {
-        console.log('  \x1b[33mTip: try --target codex-desktop for Codex Desktop on Windows\x1b[0m');
-      } else {
-        console.log('  Install Codex CLI to enable: npx huaweicloud-devkit install --target codex');
+        return true;
       }
-    } else {
-      installCodex();
+      return installCodex();
+    });
+  }
+
+  if (installFailures.length > 0) {
+    console.log(`\n\x1b[31mInstallation failed for: ${installFailures.join(', ')}\x1b[0m`);
+    if (target === 'all') {
+      console.log(
+        '\x1b[33mSome targets may have been installed before the failure. Re-run status/doctor per target.\x1b[0m',
+      );
     }
+    process.exit(1);
   }
 
   console.log(`\n\x1b[32mInstallation complete!\x1b[0m`);
@@ -3197,10 +3224,15 @@ async function cmdInstall() {
     console.log(`\x1b[1m\x1b[33m╚══════════════════════════════════════════════════════╝\x1b[0m`);
   }
 
-  const hcloudOk = checkHcloud();
-  if (!hcloudOk) {
-    console.log(`\n\x1b[33mKooCLI (hcloud) is not installed.`);
-    console.log(`  Run: npx huaweicloud-devkit install-hcloud\x1b[0m`);
+  const hcloudProbe = probeHcloud();
+  if (!hcloudProbe.ok) {
+    if (hcloudProbe.status === 'sandbox_home_failure') {
+      console.log(`\n\x1b[33mKooCLI (hcloud) detected, but cannot run in this sandbox.`);
+      console.log(`  ${hcloudProbeNextStep(hcloudProbe)}\x1b[0m`);
+    } else {
+      console.log(`\n\x1b[33mKooCLI (hcloud) is not ready.`);
+      console.log(`  ${hcloudProbeNextStep(hcloudProbe)}\x1b[0m`);
+    }
   } else {
     console.log(`\nKooCLI (hcloud) detected.`);
   }
@@ -3219,27 +3251,6 @@ async function cmdInstall() {
   }
   console.log(`  4. 运行自检：npx huaweicloud-devkit doctor`);
 
-  // Write install marker for doctor to detect
-  const markerDir =
-    target === 'dsh'
-      ? dshPluginsDir()
-      : target === 'codearts'
-        ? codeartsPluginsDir()
-        : target === 'codearts-work'
-          ? codeartsWorkPluginsDir()
-          : target === 'workbuddy'
-            ? workbuddyPluginsDir()
-            : target === 'officeace'
-              ? officeacePluginsDir()
-              : target === 'openclaw'
-                ? codexDesktopPluginsDir()
-                : target === 'atomcode'
-                  ? atomcodePluginsDir()
-                  : target === 'codex-desktop'
-                    ? codexDesktopPluginsDir()
-                    : opencodePluginsDir();
-  mkdirSync(markerDir, { recursive: true });
-  writeFileSync(join(markerDir, '.installed'), new Date().toISOString());
   if (target === 'opencode' || target === 'all') {
     console.log('Or describe your Huawei Cloud task in OpenCode');
   }
@@ -3250,7 +3261,7 @@ async function cmdInstall() {
     console.log('Or describe your Huawei Cloud task in CodeArts Work');
   }
   if (target === 'codex' || target === 'all') {
-    console.log('Or mention @huaweicloud-core in Codex');
+    console.log('Or mention @huaweicloud-devkit in Codex');
   }
   if (target === 'workbuddy' || target === 'all') {
     console.log('Or describe your Huawei Cloud task in WorkBuddy');
@@ -3553,6 +3564,21 @@ async function cmdDoctor() {
     existsSync(join(atomcodePluginDir, 'safety', 'policy.json'));
   check('Safety policy installed', safetyOk, 'Run: npx huaweicloud-devkit install');
 
+  const hookConfigPath = join(PLUGIN_ROOT, 'hooks', 'hooks.json');
+  const hookNodePath = join(PLUGIN_ROOT, 'hooks', 'huaweicloud-safety.mjs');
+  let hookConfigUsesNode = false;
+  let hookConfigUsesPython = false;
+  try {
+    const hookConfigText = readFileSync(hookConfigPath, 'utf8');
+    hookConfigUsesNode = hookConfigText.includes('huaweicloud-safety.mjs') && /\bnode\b/.test(hookConfigText);
+    hookConfigUsesPython = /\bpython3?\b/.test(hookConfigText);
+  } catch {}
+  check(
+    'Safety hook runtime (Node)',
+    existsSync(hookNodePath) && hookConfigUsesNode && !hookConfigUsesPython,
+    'hooks/hooks.json should invoke node hooks/huaweicloud-safety.mjs, not python3',
+  );
+
   // MCP config — check OpenCode, Codex Desktop, CodeArts, WorkBuddy, and DSH
   let mcpConfigured = false;
   let mcpCfgTarget = '';
@@ -3664,20 +3690,23 @@ async function cmdDoctor() {
   }
 
   // hcloud CLI
-  const hcloudBin = findHcloudBin() || process.env.HCLOUD_BIN || 'hcloud';
-  const hcloudCheck = spawnSync(`"${hcloudBin}" version`, [], {
-    shell: true,
-    windowsHide: true,
-    stdio: 'pipe',
-    timeout: 5000,
-  });
-  const hcloudOut = (hcloudCheck.stdout || '').toString() + (hcloudCheck.stderr || '').toString();
-  const hcloudOk = hcloudCheck.status === 0 && /KooCLI|Current.*version|当前KooCLI/i.test(hcloudOut);
-  check('hcloud CLI installed', hcloudOk, 'Run: npx huaweicloud-devkit install-hcloud');
+  const hcloudProbe = probeHcloud();
+  const hcloudBin = hcloudProbe.executable;
+  const hcloudOk = hcloudProbe.ok;
+  check('hcloud CLI installed', hcloudProbe.installed, hcloudProbeNextStep(hcloudProbe));
+  if (hcloudProbe.status === 'sandbox_home_failure') {
+    warn++;
+    console.log(`  \x1b[33m[WARN]\x1b[0m hcloud cannot resolve the Windows user home in this agent sandbox.`);
+    console.log(`        ${hcloudProbeNextStep(hcloudProbe)}`);
+  } else if (hcloudProbe.status === 'privacy_pending') {
+    warn++;
+    console.log(`  \x1b[33m[WARN]\x1b[0m KooCLI privacy agreement is pending.`);
+    console.log(`        ${hcloudProbeNextStep(hcloudProbe)}`);
+  }
 
   const kooCliTarget = getKooCliVersion();
   if (hcloudOk && kooCliTarget) {
-    const installed = parseHcloudVersion(hcloudOut);
+    const installed = hcloudProbe.installedVersion;
     if (installed && compareVersion(installed, kooCliTarget) !== 0) {
       warn++;
       console.log(
@@ -3701,7 +3730,7 @@ async function cmdDoctor() {
   }
 
   if (hcloudOk) {
-    const ver = (hcloudCheck.stdout.toString().match(/(\d+\.\d+\.\d+)/) || [])[1] || 'unknown';
+    const ver = hcloudProbe.installedVersion || 'unknown';
     console.log(`    Version: ${ver}`);
 
     // Check auth
@@ -4373,12 +4402,18 @@ async function cmdAuthReconcile() {
     console.log(`OBS sync failed: ${error.message}`);
   }
   const profile = resolveManagedProfile();
+  let hcloudSynced = false;
   if (profile) {
     const r = runHcloudConfigure(profile, credentials.ak, credentials.sk, credentials.region);
+    hcloudSynced = r.ok;
     console.log(`  KooCLI ${r.ok ? 'synced' : 'sync failed'}: profile=${profile} ${r.error || ''}`);
   }
-  writeLastSync();
-  console.log('Done. .last_sync refreshed.');
+  if (hcloudSynced) {
+    writeLastSync({ kooCliProfile: profile, s1Fingerprint: fingerprint(credentials.ak, credentials.sk) });
+    console.log('Done. .last_sync refreshed.');
+  } else {
+    console.log('Done. .last_sync was not refreshed because KooCLI sync did not complete.');
+  }
 }
 
 async function cmdAuthSync() {

package/plugins/huaweicloud-core/src/tools.mjs

@@ -57,7 +57,7 @@ import {
   resolveSkipFilePath,
   upgradePackage,
 } from './update-check.mjs';
-import { getKooCliVersion, parseHcloudVersion, compareVersion } from './koocli-version.mjs';
+import { hcloudProbeNextStep, probeHcloud } from './hcloud-probe.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const SKILLS_ROOT_DEV = join(__dirname, '..', 'skills');
@@ -984,7 +984,9 @@ function persistCredentials(ak, sk, securityToken, region) {
   } else {
     hcloud = runHcloudConfigure(profile, ak, sk, region);
   }
-  writeLastSync();
+  if (hcloud.ok) {
+    writeLastSync({ kooCliProfile: profile, s1Fingerprint: fingerprint(ak, sk) });
+  }
   return {
     status: 'ok',
     scope: 'persist',
@@ -1382,35 +1384,17 @@ function hookResult(result) {
 }
 
 export async function runVersionCheck(options = {}) {
-  const result = await runHcloud(['version'], {
-    ...options,
-    maxRetries: options.maxRetries ?? 0,
-  });
-  const errorText = result.error || result.stderr || '';
-  const isSpawnError = /ENOENT|SPAWN_ERROR/i.test(errorText) || result.code === 'SPAWN_ERROR';
-  const requiredVersion = getKooCliVersion();
-  const installedVersion = parseHcloudVersion(result.stdout || '');
-  const versionMismatch = !!(
-    result.ok &&
-    requiredVersion &&
-    installedVersion &&
-    compareVersion(installedVersion, requiredVersion) !== 0
-  );
+  const result = probeHcloud(options);
   return {
-    installed: result.ok,
-    authenticated: result.ok && !/配置文件中不存在配置项|USE_ERROR.*配置/i.test(result.stdout || ''),
-    errorCode: isSpawnError ? 'HCLOUD_NOT_FOUND' : undefined,
-    output: result.ok ? result.stdout : errorText,
-    kooCliVersion: requiredVersion || undefined,
-    installedVersion: installedVersion || undefined,
-    versionMismatch,
-    nextStep: result.ok
-      ? versionMismatch
-        ? `KooCLI version mismatch: installed ${installedVersion}, this plugin is paired with ${requiredVersion}. Reinstall the pinned version (see huaweicloud-cli-and-auth skill) and restart the agent.`
-        : 'Use huaweicloud_show_profile_redacted to inspect the active KooCLI profile safely.'
-      : isSpawnError
-        ? 'hcloud executable not found. Set HCLOUD_BIN to the full hcloud path, or install KooCLI: npx huaweicloud-devkit install-hcloud. Then restart the agent.'
-        : 'Install Huawei Cloud KooCLI: npx huaweicloud-devkit install-hcloud. Configure credentials outside the agent conversation.',
+    installed: result.installed,
+    authenticated: result.ok && !/配置文件中不存在配置项|USE_ERROR.*配置/i.test(result.output || ''),
+    errorCode: result.errorCode,
+    status: result.status,
+    output: result.output,
+    kooCliVersion: result.requiredVersion || undefined,
+    installedVersion: result.installedVersion || undefined,
+    versionMismatch: Boolean(result.versionMismatch),
+    nextStep: hcloudProbeNextStep(result),
     authHint:
       'If hcloud is installed but commands fail with "配置文件中不存在配置项", run `npx huaweicloud-devkit auth init` outside agent chat to configure credentials.',
   };