huaweicloud-devkit 1.1.2-next.3 → 1.1.2-next.5

package/plugins/huaweicloud-core/src/auth/reconcile.mjs

@@ -11,6 +11,7 @@ import {
   readLastSync,
   resolveCredentialsWithRuntime,
 } from './credentials.mjs';
+import { resolveHcloudCommand } from '../hcloud-probe.mjs';
 import { redactSecrets } from '../safety-policy.mjs';
 
 export { hasRuntimeCredentials };
@@ -47,6 +48,7 @@ export function readKooCliProfiles() {
     return {
       current,
       mtimeMs,
+      configPath,
       profiles: profiles.map((p) => ({
         name: String(p.name || ''),
         fingerprint: fingerprint(p.accessKeyId, p.secretAccessKey),
@@ -70,15 +72,32 @@ export function currentFingerprintFromHcloud(res) {
   return cur ? cur.fingerprint : null;
 }
 
+function currentProfileFromHcloud(res) {
+  if (res.error) return null;
+  return res.profiles.find((p) => p.name === res.current) || null;
+}
+
+function s2CurrentMatchesLastDevkitSync(kooCli, s1, s1Fingerprint) {
+  const current = currentProfileFromHcloud(kooCli);
+  const lastSync = readLastSync();
+  if (!current || !lastSync?.ts || !lastSync.kooCliProfile || !lastSync.s1Fingerprint) return false;
+  if (!s1?.ak || current.accessKeyId !== s1.ak) return false;
+  if (lastSync.kooCliProfile !== kooCli.current) return false;
+  if (lastSync.s1Fingerprint !== s1Fingerprint) return false;
+  return Number(kooCli.mtimeMs || 0) <= Number(lastSync.ts) + 1000;
+}
+
 export function scanState() {
   const s1 = readGlobalCredentials() || {};
   const envAk = process.env.HW_ACCESS_KEY || '';
   const envSk = process.env.HW_SECRET_KEY || '';
   const kooCli = readKooCliProfiles();
-  const currentFp = currentFingerprintFromHcloud(kooCli);
   const inconsistencies = [];
 
   const s1Fingerprint = fingerprint(s1.ak, s1.sk);
+  const currentFp = currentFingerprintFromHcloud(kooCli);
+  const s2SyncedByDevkit = s1Fingerprint ? s2CurrentMatchesLastDevkitSync(kooCli, s1, s1Fingerprint) : false;
+  const effectiveCurrentFp = s2SyncedByDevkit ? s1Fingerprint : currentFp;
   const envFingerprint = fingerprint(envAk, envSk);
   const s3 = existsSync(obsConfigPath()) ? parseS3ObsConfig(obsConfigPath()) : null;
   const s3Fingerprint = s3 ? fingerprint(s3.ak, s3.sk) : null;
@@ -93,12 +112,12 @@ export function scanState() {
     // nothing resolvable → runtime store inactive
   }
 
-  if (s1Fingerprint && currentFp && s1Fingerprint !== currentFp) {
+  if (s1Fingerprint && currentFp && s1Fingerprint !== effectiveCurrentFp) {
     inconsistencies.push({
       store: 'S2-current',
       source: 'KooCLI current profile',
       fingerprint: currentFp,
-      manualModified: isManualModified(join(baseHome(), '.hcloud', 'config.json')),
+      manualModified: isManualModified(kooCli.configPath || join(baseHome(), '.hcloud', 'config.json')),
     });
   }
   if (s1Fingerprint && s3Fingerprint && s1Fingerprint !== s3Fingerprint) {
@@ -114,7 +133,7 @@ export function scanState() {
     stores: {
       s1Fingerprint,
       envFingerprint,
-      currentFingerprint: currentFp,
+      currentFingerprint: effectiveCurrentFp,
       s3Fingerprint,
       runtimeFingerprint,
     },
@@ -153,7 +172,7 @@ export function exportStateForStatus(_jailed) {
 }
 
 export function runHcloudConfigure(profile, ak, sk, region) {
-  const bin = process.env.HCLOUD_BIN || 'hcloud';
+  const { executable, argsPrefix } = resolveHcloudCommand();
   const args = [
     'configure',
     'set',
@@ -162,7 +181,12 @@ export function runHcloudConfigure(profile, ak, sk, region) {
     `--cli-secret-key=${sk}`,
     `--cli-region=${region || ''}`,
   ];
-  const r = spawnSync(bin, args, { shell: false, windowsHide: true, stdio: 'pipe', timeout: 30000 });
+  const r = spawnSync(executable, [...argsPrefix, ...args], {
+    shell: false,
+    windowsHide: true,
+    stdio: 'pipe',
+    timeout: 30000,
+  });
   return {
     ok: r.status === 0,
     error: redactSecrets(

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
-import { spawnSync } from 'node:child_process';
 
 import { getAgentRegistrationStatuses } from './agent-registration.mjs';
+import { resolveAndApplyProjectId } from './project-id.mjs';
 import {
   globalCredentialsPath,
   obsConfigPath,
@@ -10,38 +10,27 @@ import {
   writeObsConfig,
 } from './credentials.mjs';
 import {
+  fingerprint,
   exportStateForStatus,
   hasRuntimeCredentials,
   resolveManagedProfile,
   runHcloudConfigure,
 } from './reconcile.mjs';
-
-function hcloudInstalled() {
-  const bin = process.env.HCLOUD_BIN || 'hcloud';
-  try {
-    const r = spawnSync(`"${bin}" version`, [], {
-      shell: true,
-      windowsHide: true,
-      stdio: 'pipe',
-      timeout: 5000,
-    });
-    const out = `${r.stdout || ''}${r.stderr || ''}`;
-    return r.status === 0 && /KooCLI|Current.*version|当前KooCLI/i.test(out);
-  } catch {
-    return false;
-  }
-}
+import { hcloudProbeNextStep, probeHcloud } from '../hcloud-probe.mjs';
 
 export function getAuthStatus(target = 'all') {
   const credentials = readGlobalCredentials();
   const reconciled = { ...exportStateForStatus(), runtimeActive: hasRuntimeCredentials() };
+  const hcloud = probeHcloud();
   return {
     target,
     credentialsConfigured: Boolean(credentials?.ak && credentials?.sk),
     credentialsPath: globalCredentialsPath(),
     obsConfigured: existsSync(obsConfigPath()),
     obsConfigPath: obsConfigPath(),
-    kooCliInstalled: hcloudInstalled(),
+    kooCliInstalled: hcloud.installed,
+    kooCliStatus: hcloud.status,
+    kooCliNextStep: hcloudProbeNextStep(hcloud),
     reconciled,
     agents: getAgentRegistrationStatuses(target).agents,
   };
@@ -85,11 +74,17 @@ export function syncAuth(target = 'all') {
     };
   }
 
-  if (!hcloudInstalled()) {
+  const hcloud = probeHcloud();
+  if (!hcloud.ok) {
     return {
       ok: false,
-      error: 'KooCLI not installed.',
-      nextStep: 'Install KooCLI or point HCLOUD_BIN at the hcloud executable.',
+      error:
+        hcloud.status === 'sandbox_home_failure'
+          ? 'KooCLI detected but cannot resolve the user home directory in this agent sandbox.'
+          : hcloud.status === 'privacy_pending'
+            ? 'KooCLI privacy agreement is pending.'
+            : 'KooCLI not ready.',
+      nextStep: hcloudProbeNextStep(hcloud),
       obs: { configured: true, path: obs.path, endpoint: obs.endpoint },
     };
   }
@@ -104,9 +99,11 @@ export function syncAuth(target = 'all') {
     };
   }
 
-  writeLastSync();
+  const project = resolveAndApplyProjectId({ region: credentials.region, profile });
 
-  return {
+  writeLastSync({ kooCliProfile: profile, s1Fingerprint: fingerprint(credentials.ak, credentials.sk) });
+
+  const result = {
     ok: true,
     profile,
     obs: { configured: true, path: obs.path, endpoint: obs.endpoint },
@@ -115,4 +112,6 @@ export function syncAuth(target = 'all') {
     agents: getAgentRegistrationStatuses(target).agents,
     note: 'OBS credentials were synced from the global credential vault. Agent MCP registration is managed by "npx huaweicloud-devkit install --target <agent>".',
   };
+  if (project.ok) result.projectId = project.projectId;
+  return result;
 }

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -1,11 +1,11 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
+import { mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 import { classifyHcloudArgs, redactSecrets, assertAllowed } from './safety-policy.mjs';
 import { getProxySettings } from './proxy/proxy-config.mjs';
+import { findHcloudBin, resolveHcloudCommand } from './hcloud-probe.mjs';
 
 const DEFAULT_TIMEOUT_MS = 60_000;
 const DEFAULT_FORCE_KILL_AFTER_MS = 2_000;
@@ -67,10 +67,10 @@ function preflightSecurityGroupCheck(normalizedArgs) {
   const findings = [];
   for (const sgId of sgIds) {
     try {
-      const hcloudBin = process.env.HCLOUD_BIN || 'hcloud';
+      const { executable, argsPrefix } = resolveHcloudCommand();
       const spawnArgs = ['VPC', 'ListSecurityGroupRules', `--security_group_id.1=${sgId}`];
       if (regionArg) spawnArgs.push(regionArg);
-      const r = spawnSync(hcloudBin, spawnArgs, {
+      const r = spawnSync(executable, [...argsPrefix, ...spawnArgs], {
         shell: false,
         windowsHide: true,
         stdio: 'pipe',
@@ -216,12 +216,7 @@ async function runtimeCurrentMismatchWarning() {
 }
 
 function discoverHcloudPath() {
-  if (process.env.HCLOUD_BIN && existsSync(process.env.HCLOUD_BIN)) return process.env.HCLOUD_BIN;
-  const candidates =
-    process.platform === 'win32'
-      ? [join(homedir(), 'hcloud', 'hcloud.exe')]
-      : [join(homedir(), '.local', 'bin', 'hcloud'), join(homedir(), 'hcloud', 'hcloud')];
-  return candidates.find((c) => existsSync(c)) || null;
+  return findHcloudBin();
 }
 
 function runHcloudOnce(plan, options) {

package/plugins/huaweicloud-core/src/hcloud-probe.mjs

@@ -0,0 +1,154 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+import { compareVersion, getKooCliVersion, parseHcloudVersion } from './koocli-version.mjs';
+import { redactSecrets } from './safety-policy.mjs';
+
+const VERSION_RE = /KooCLI|Current.*version|当前KooCLI/i;
+
+export function findHcloudBin() {
+  if (process.env.HCLOUD_BIN && existsSync(process.env.HCLOUD_BIN)) return process.env.HCLOUD_BIN;
+  const candidates =
+    process.platform === 'win32'
+      ? [join(homedir(), 'hcloud', 'hcloud.exe')]
+      : [join(homedir(), '.local', 'bin', 'hcloud'), join(homedir(), 'hcloud', 'hcloud')];
+  const found = candidates.find((candidate) => existsSync(candidate));
+  if (found) return found;
+
+  const locator =
+    process.platform === 'win32'
+      ? spawnSync('where.exe', ['hcloud'], { windowsHide: true, stdio: 'pipe', encoding: 'utf8', timeout: 3000 })
+      : spawnSync('sh', ['-c', 'command -v hcloud'], {
+          windowsHide: true,
+          stdio: 'pipe',
+          encoding: 'utf8',
+          timeout: 3000,
+        });
+  if (locator.status === 0) {
+    const first = String(locator.stdout || '')
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .find(Boolean);
+    if (first) return first;
+  }
+  return null;
+}
+
+function envHcloudArgs() {
+  if (!process.env.HCLOUD_BIN_ARGS_JSON) return [];
+  try {
+    const parsed = JSON.parse(process.env.HCLOUD_BIN_ARGS_JSON);
+    if (Array.isArray(parsed)) return parsed.map((item) => String(item));
+  } catch {}
+  return [];
+}
+
+export function resolveHcloudCommand(options = {}) {
+  return {
+    executable: options.executable || findHcloudBin() || 'hcloud',
+    argsPrefix: Array.isArray(options.executableArgs) ? options.executableArgs : envHcloudArgs(),
+  };
+}
+
+export function classifyHcloudProbe(result, requiredVersion = getKooCliVersion()) {
+  const stdout = String(result.stdout || '');
+  const stderr = String(result.stderr || '');
+  const output = `${stdout}${stderr}`;
+  const installedVersion = parseHcloudVersion(output);
+
+  if (result.error?.code === 'ENOENT') {
+    return {
+      status: 'not_found',
+      installed: false,
+      ok: false,
+      errorCode: 'HCLOUD_NOT_FOUND',
+    };
+  }
+
+  if (result.status === 0 && (VERSION_RE.test(output) || installedVersion)) {
+    const versionMismatch = !!(
+      requiredVersion &&
+      installedVersion &&
+      compareVersion(installedVersion, requiredVersion) !== 0
+    );
+    return {
+      status: versionMismatch ? 'version_mismatch' : 'ok',
+      installed: true,
+      ok: true,
+      installedVersion,
+      requiredVersion: requiredVersion || undefined,
+      versionMismatch,
+    };
+  }
+
+  if (/获取当前用户家目录失败|home\s+directory|user\s+home|home\s+dir|homedir/i.test(output)) {
+    return {
+      status: 'sandbox_home_failure',
+      installed: true,
+      ok: false,
+      errorCode: 'HCLOUD_SANDBOX_HOME_FAILURE',
+    };
+  }
+
+  if (
+    /同意并继续使用|不同意并退出|隐私协议|隐私声明|privacy agreement|privacy statement|invalid character|无效字符/i.test(
+      output,
+    )
+  ) {
+    return {
+      status: 'privacy_pending',
+      installed: true,
+      ok: false,
+      errorCode: 'HCLOUD_PRIVACY_PENDING',
+    };
+  }
+
+  return {
+    status: 'unavailable',
+    installed: false,
+    ok: false,
+    errorCode: 'HCLOUD_UNAVAILABLE',
+  };
+}
+
+export function probeHcloud(options = {}) {
+  const { executable, argsPrefix } = resolveHcloudCommand(options);
+  const r = spawnSync(executable, [...argsPrefix, 'version'], {
+    shell: false,
+    windowsHide: true,
+    stdio: 'pipe',
+    encoding: 'utf8',
+    timeout: options.timeoutMs ?? 5000,
+  });
+  const classified = classifyHcloudProbe(r, options.requiredVersion);
+  const stdout = redactSecrets(String(r.stdout || '').trim());
+  const stderr = redactSecrets(String(r.stderr || r.error?.message || '').trim());
+  return {
+    executable,
+    exitCode: r.status,
+    stdout,
+    stderr,
+    output: classified.ok ? stdout : stderr || stdout,
+    ...classified,
+  };
+}
+
+export function hcloudProbeNextStep(probe) {
+  if (probe.status === 'ok')
+    return 'Use huaweicloud_show_profile_redacted to inspect the active KooCLI profile safely.';
+  if (probe.status === 'version_mismatch') {
+    return `KooCLI version mismatch: installed ${probe.installedVersion}, this plugin is paired with ${probe.requiredVersion}. Reinstall the pinned version (see huaweicloud-cli-and-auth skill) and restart the agent.`;
+  }
+  if (probe.status === 'sandbox_home_failure') {
+    return 'KooCLI was found, but this agent sandbox cannot resolve the Windows user home directory. Set HCLOUD_BIN to the full hcloud path, restart Codex, or verify from a normal terminal.';
+  }
+  if (probe.status === 'privacy_pending') {
+    return 'KooCLI requires accepting its one-time privacy agreement. Run hcloud version in a real terminal and accept the prompt, then restart the agent.';
+  }
+  if (probe.status === 'not_found') {
+    return 'hcloud executable not found. Set HCLOUD_BIN to the full hcloud path, or install KooCLI: npx huaweicloud-devkit install-hcloud. Then restart the agent.';
+  }
+  return 'Install Huawei Cloud KooCLI: npx huaweicloud-devkit install-hcloud. Configure credentials outside the agent conversation.';
+}

package/plugins/huaweicloud-core/src/proxy/proxy-agent.mjs

@@ -26,6 +26,13 @@ export async function getProxyDispatcher(targetUrl) {
   return cachedDispatcher;
 }
 
+export async function fetchWithProxy(url, options = {}) {
+  const dispatcher = await getProxyDispatcher(url);
+  if (!dispatcher) return fetch(url, options);
+  const { fetch: undiciFetch } = await import('undici');
+  return undiciFetch(url, { ...options, dispatcher });
+}
+
 export function clearProxyDispatcherCache() {
   cachedDispatcher = undefined;
   cachedDispatcherProxyUrl = null;

package/plugins/huaweicloud-core/src/safety-policy.mjs

@@ -109,6 +109,14 @@ function applyCommandRiskRules(base, normalizedArgs, options = {}) {
   return mergeRiskDecision(base, risk);
 }
 
+function applyRawCommandRiskRules(base, command, options = {}) {
+  if (base.decision === 'deny' || options.skipRiskRules === true) {
+    return base;
+  }
+  const risk = evaluateCommandRisk(command);
+  return mergeRiskDecision(base, risk);
+}
+
 export function classifyHcloudArgs(args, options = {}) {
   const policy = options.policy || DEFAULT_POLICY;
   const { service, operation, args: normalizedArgs } = commandOperation(args);
@@ -340,11 +348,15 @@ export function classifyTextCommand(command, options = {}) {
     };
   }
 
-  return {
-    decision: 'allow',
-    risk: 'not_huaweicloud',
-    reason: 'No Huawei Cloud safety rule matched.',
-  };
+  return applyRawCommandRiskRules(
+    {
+      decision: 'allow',
+      risk: 'not_huaweicloud',
+      reason: 'No Huawei Cloud safety rule matched.',
+    },
+    text,
+    options,
+  );
 }
 
 export function assertAllowed(result) {