huaweicloud-devkit 1.1.2-next.4 → 1.1.2-next.5

package/README.md

@@ -22,13 +22,19 @@ Supports OpenCode, Codex, CodeArts Agent, WorkBuddy, DeepSeek Harness (DSH), Off
 > ```
 >
 > Restore the default registry: `npm config delete registry`
+>
+> **Mirror lag**: npm mirrors (npmmirror, mirrors.huaweicloud.com) may lag behind the official registry for hours after a new release. If install fails with `ETARGET` or you get an older version, install via the official registry instead:
+>
+> ```bash
+> npx --yes --registry=https://registry.npmjs.org huaweicloud-devkit install --target <target>
+> ```
 
 ## Quick Start
 
 > If `--target` is omitted, the installer auto-detects agents on your machine. When multiple agents are detected, **all of them** will be installed. Specify `--target` to control which agent receives the install.
 
 ```bash
-npx --yes huaweicloud-devkit version  # print the installed plugin version per agent
+npx --yes huaweicloud-devkit version  # print CLI version and installed plugin versions per agent
 npx --yes huaweicloud-devkit uninstall --target all --clean-global  # also remove KooCLI + OBS config
 ```
 

package/README.zh-CN.md

@@ -22,13 +22,19 @@
 > ```
 >
 > 恢复默认镜像：`npm config delete registry`
+>
+> **镜像滞后**：npm 镜像（npmmirror、mirrors.huaweicloud.com）在新版本发布后可能滞后官方源数小时。若安装报 `ETARGET` 或拿到旧版本，改用官方源安装：
+>
+> ```bash
+> npx --yes --registry=https://registry.npmjs.org huaweicloud-devkit install --target <target>
+> ```
 
 ## 快速开始
 
 > 省略 `--target` 时，安装器会自动检测机器上的 agent，检测到多个时**全部安装**。建议始终指定 `--target` 以明确安装目标。
 
 ```bash
-npx --yes huaweicloud-devkit version  # 查看各 agent 已安装的插件版本
+npx --yes huaweicloud-devkit version  # 查看 CLI 版本和各 agent 已安装的插件版本
 npx --yes huaweicloud-devkit uninstall --target all --clean-global  # 一并删除 KooCLI 与 OBS 配置
 ```
 

package/integrations/dsh/hook-plugin.mjs

@@ -65,18 +65,23 @@ function isHuaweiCloudSkill(name) {
 // hcloud command classification (mirrors skill-tracker.js)
 // ══════════════════════════════════════════════════════════════════
 
-const HCLOUD_RE = /(?:^|[;&|]\s*)hcloud(?:\.exe)?\s+(.+)/i;
+const HCLOUD_RE = /(?:^|[;&|]\s*)hcloud(?:\.exe)?\s+([^\s;&|"<>]+(?:\s+[^\s;&|"<>]+){0,3})/i;
 const READ_VERBS = /\b(List|Show|Get|Describe|NovaList|NovaShow)\w*/i;
 const WRITE_VERBS =
   /\b(Create|Delete|Update|Modify|Remove|Revoke|Grant|Attach|Detach|Enable|Disable|Set|Add|Bind|Unbind|Reset|Change|Activate|Deactivate|Register|Unregister|Import|Export|Download|Upload|Copy|Move|Convert|Migrate|Run|Execute|Invoke|Trigger|Deploy|Push|Start|Stop|Restart|Reboot|Suspend|Resume|Terminate|Release|Allocate)\w*/i;
 
-function classifyHcloud(text) {
+export function classifyHcloud(text) {
   const m = HCLOUD_RE.exec(text);
   if (!m) return null;
-  const rest = m[1].trim();
-  const parts = rest.split(/\s+/).filter((p) => !p.startsWith('--'));
-  const cmd = parts.join(' ');
-  if (!cmd) return null;
+  const raw = m[1].trim();
+  if (!raw) return null;
+  const cmdTokens = [];
+  for (const t of raw.split(/\s+/)) {
+    if (t.startsWith('--')) break;
+    cmdTokens.push(t);
+  }
+  if (cmdTokens.length === 0) return null;
+  const cmd = cmdTokens.join(' ');
   if (READ_VERBS.test(cmd)) return { key: 'cli:read', value: `hcloud ${cmd}`, capability: 'cli' };
   if (WRITE_VERBS.test(cmd)) return { key: 'cli:write', value: `hcloud ${cmd}`, capability: 'cli' };
   return { key: 'cli:invoke', value: `hcloud ${cmd}`, capability: 'cli' };

package/integrations/opencode/hooks/skill-tracker.js

@@ -28,7 +28,7 @@ function writeEvent(key, value, extra = {}) {
 
 // ── CLI command classification ────────────────────────────────
 
-const HCLOUD_RE = /(?:^|[;&|]\s*)hcloud(?:\.exe)?\s+(.+)/i;
+const HCLOUD_RE = /(?:^|[;&|]\s*)hcloud(?:\.exe)?\s+([^\s;&|"<>]+(?:\s+[^\s;&|"<>]+){0,3})/i;
 const READ_VERBS = /\b(List|Show|Get|Describe|NovaList|NovaShow)\w*/i;
 const WRITE_VERBS = new RegExp(
   '\\b(Create|Delete|Update|Modify|Remove|Revoke|Grant|Attach|Detach|' +
@@ -42,14 +42,15 @@ const WRITE_VERBS = new RegExp(
 function classifyHcloud(text) {
   const m = HCLOUD_RE.exec(text);
   if (!m) return null;
-  const rest = m[1].trim();
-  const cmdEnd = rest.search(/\s[|&<>;]/);
-  const cmdPart = cmdEnd > -1 ? rest.slice(0, cmdEnd) : rest;
-  const parts = cmdPart
-    .split(/\s+/)
-    .filter((p) => !p.startsWith('--') && !/^\d*>(&?\d*|%devnull)/.test(p) && !/^(&\d+)$/.test(p));
-  const cmd = parts.join(' ');
-  if (!cmd) return null;
+  const raw = m[1].trim();
+  if (!raw) return null;
+  const cmdTokens = [];
+  for (const t of raw.split(/\s+/)) {
+    if (t.startsWith('--')) break;
+    cmdTokens.push(t);
+  }
+  if (cmdTokens.length === 0) return null;
+  const cmd = cmdTokens.join(' ');
   if (READ_VERBS.test(cmd)) return { key: 'cli:read', value: `hcloud ${cmd}` };
   if (WRITE_VERBS.test(cmd)) return { key: 'cli:write', value: `hcloud ${cmd}` };
   return { key: 'cli:invoke', value: `hcloud ${cmd}` };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.5",
   "kooCliVersion": "7.2.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.5",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.5",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.5",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.5",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.5",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.5",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/src/auth/credential-validator.mjs

@@ -0,0 +1,163 @@
+import crypto from 'node:crypto';
+
+import { getProxyDispatcher } from '../proxy/proxy-agent.mjs';
+
+function iamBaseUrl() {
+  return process.env.HW_IAM_ENDPOINT || 'https://iam.myhuaweicloud.com';
+}
+
+function sha256Hex(data) {
+  return crypto.createHash('sha256').update(data).digest('hex');
+}
+
+function hmacSha256(key, data) {
+  return crypto.createHmac('sha256', key).update(data).digest('hex');
+}
+
+function urlEncode(str) {
+  const hex = (c) => '%' + (c < 16 ? '0' : '') + c.toString(16).toUpperCase();
+  const noEscape = new Set('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~'.split(''));
+  let out = '';
+  for (const ch of str) {
+    const c = ch.codePointAt(0);
+    out += noEscape.has(ch) && c < 0x80 ? ch : c < 0x80 ? hex(c) : encodeURIComponent(ch);
+  }
+  return out;
+}
+
+function timestamp() {
+  return new Date().toISOString().replace(/[-:]/g, '').replace(/\.\d+/, '') + 'Z';
+}
+
+function signIamRequest(path, query, ak, sk, securitytoken) {
+  const ts = timestamp();
+  const host = new URL(iamBaseUrl()).host;
+
+  const cqs = Object.entries(query)
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([k, v]) => `${urlEncode(k)}=${urlEncode(v)}`)
+    .join('&');
+
+  const curi =
+    '/' +
+    path
+      .split('/')
+      .filter(Boolean)
+      .map((s) => urlEncode(s))
+      .join('/') +
+    '/';
+
+  const signedHeaders = securitytoken ? 'host;x-sdk-date;x-security-token' : 'host;x-sdk-date';
+  const canonicalHeaders = securitytoken
+    ? `host:${host}\nx-sdk-date:${ts}\nx-security-token:${securitytoken}\n`
+    : `host:${host}\nx-sdk-date:${ts}\n`;
+
+  const payloadHash = sha256Hex('');
+  const canonicalRequest = ['GET', curi, cqs, canonicalHeaders, signedHeaders, payloadHash].join('\n');
+  const stringToSign = `SDK-HMAC-SHA256\n${ts}\n${sha256Hex(canonicalRequest)}`;
+  const signature = hmacSha256(sk, stringToSign);
+
+  const headers = {
+    host,
+    'x-sdk-date': ts,
+    Authorization: `SDK-HMAC-SHA256 Access=${ak}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
+  };
+  if (securitytoken) {
+    headers['x-security-token'] = securitytoken;
+  }
+  return headers;
+}
+
+function projectForRegion(projects, region) {
+  if (region) {
+    const match = projects.find((p) => p && p.name === region && p.id);
+    if (match) return match.id;
+  }
+  return projects.find((p) => p && p.id)?.id || null;
+}
+
+/**
+ * Validate AK/SK by calling IAM KeystoneListProjects (read-only) with
+ * SDK-HMAC-SHA256 request signing. A wrong SK produces an invalid signature,
+ * which IAM rejects with HTTP 401 before any project data is returned.
+ *
+ * Returns { valid, projectId, error, warning }:
+ * - valid: true when IAM verified the signature (or the rejection is not
+ *   authentication-related), false when the credentials are unusable.
+ * - projectId: first project matching `region`, else the first visible project.
+ * - warning: set when credentials passed but project discovery was denied.
+ */
+export async function validateIamCredentials({ ak, sk, securityToken, region, timeoutMs = 15000 } = {}) {
+  if (!ak || !sk) {
+    return { valid: false, projectId: null, error: 'AK and SK are both required for credential validation.' };
+  }
+
+  const base = iamBaseUrl();
+  const path = '/v3/projects';
+  const query = region ? { name: region } : {};
+  const qs = Object.entries(query)
+    .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
+    .join('&');
+  const url = `${base}${path}${qs ? `?${qs}` : ''}`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+  let resp;
+  try {
+    const headers = signIamRequest(path, query, ak, sk, securityToken);
+    const fetchOpts = { headers, signal: controller.signal };
+    const dispatcher = await getProxyDispatcher(url);
+    if (dispatcher) {
+      fetchOpts.dispatcher = dispatcher;
+      const { fetch: undiciFetch } = await import('undici');
+      resp = await undiciFetch(url, fetchOpts);
+    } else {
+      resp = await fetch(url, fetchOpts);
+    }
+  } catch (error) {
+    return {
+      valid: false,
+      projectId: null,
+      skipped: true,
+      error: `IAM validation request failed (treating credentials as unverified): ${error.message}`,
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+
+  const text = await resp.text();
+  let data = null;
+  try {
+    data = JSON.parse(text);
+  } catch {}
+
+  if (resp.status === 200) {
+    const projects = Array.isArray(data?.projects) ? data.projects : [];
+    return { valid: true, projectId: projectForRegion(projects, region), error: null, warning: null };
+  }
+
+  if (resp.status === 401) {
+    const msg = data?.error?.message || text.slice(0, 200);
+    return {
+      valid: false,
+      projectId: null,
+      error: `IAM rejected the credentials (HTTP 401: ${msg}). The AK/SK is invalid - check the SK for typos or expired security tokens.`,
+    };
+  }
+
+  if (resp.status === 403) {
+    return {
+      valid: true,
+      projectId: null,
+      error: null,
+      warning: `Credentials signed successfully but project listing was denied (HTTP 403). Continuing without project_id.`,
+    };
+  }
+
+  return {
+    valid: false,
+    projectId: null,
+    skipped: true,
+    error: `Unexpected IAM response (HTTP ${resp.status}): ${text.slice(0, 200)}`,
+  };
+}

package/plugins/huaweicloud-core/src/auth/project-id.mjs

@@ -0,0 +1,68 @@
+import { existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+function hcloudCommand(args) {
+  const bin = process.env.HCLOUD_BIN || 'hcloud';
+  // Test doubles (and exotic setups) may point HCLOUD_BIN at a Node script;
+  // those must be launched through node instead of the shell.
+  if (/\.(mjs|cjs|js)$/i.test(bin) && existsSync(bin)) {
+    return { file: process.execPath, args: [bin, ...args] };
+  }
+  return { file: bin, args };
+}
+
+function runHcloud(args, timeoutMs = 20000) {
+  const { file, args: spawnArgs } = hcloudCommand(args);
+  return spawnSync(file, spawnArgs, {
+    windowsHide: true,
+    stdio: 'pipe',
+    timeout: timeoutMs,
+  });
+}
+
+/**
+ * Resolve the project_id for `region` via IAM KeystoneListProjects using the
+ * credentials already stored in the KooCLI profile, then write it back with
+ * `hcloud configure set --cli-project-id=<id>`. Read-only discovery + local
+ * config write only - no secrets appear in process arguments because the
+ * profile carries the credentials.
+ *
+ * Best-effort by design: any failure returns { ok: false, reason } and never
+ * throws, so callers can stay non-fatal.
+ */
+export function resolveAndApplyProjectId({ region, profile } = {}) {
+  if (!region) return { ok: false, reason: 'region is required' };
+  const profileArgs = profile ? [`--cli-profile=${profile}`] : [];
+  try {
+    const list = runHcloud([
+      'IAM',
+      'KeystoneListProjects',
+      ...profileArgs,
+      `--cli-region=${region}`,
+      `--name=${region}`,
+    ]);
+    if (list.status !== 0) {
+      return { ok: false, reason: `KeystoneListProjects failed (exit ${list.status})` };
+    }
+    let projects = null;
+    try {
+      const parsed = JSON.parse(String(list.stdout || ''));
+      projects = Array.isArray(parsed?.projects) ? parsed.projects : Array.isArray(parsed) ? parsed : null;
+    } catch {
+      return { ok: false, reason: 'could not parse KeystoneListProjects output' };
+    }
+    if (!projects || projects.length === 0) {
+      return { ok: false, reason: `no projects found for region ${region}` };
+    }
+    const match = projects.find((p) => p && p.name === region && p.id) || projects.find((p) => p && p.id);
+    if (!match) return { ok: false, reason: 'project list contained no usable ids' };
+
+    const set = runHcloud(['configure', 'set', ...profileArgs, `--cli-project-id=${match.id}`]);
+    if (set.status !== 0) {
+      return { ok: false, reason: `configure set --cli-project-id failed (exit ${set.status})` };
+    }
+    return { ok: true, projectId: match.id };
+  } catch (error) {
+    return { ok: false, reason: error.message };
+  }
+}

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -1,6 +1,7 @@
 import { existsSync } from 'node:fs';
 
 import { getAgentRegistrationStatuses } from './agent-registration.mjs';
+import { resolveAndApplyProjectId } from './project-id.mjs';
 import {
   globalCredentialsPath,
   obsConfigPath,
@@ -98,9 +99,11 @@ export function syncAuth(target = 'all') {
     };
   }
 
+  const project = resolveAndApplyProjectId({ region: credentials.region, profile });
+
   writeLastSync({ kooCliProfile: profile, s1Fingerprint: fingerprint(credentials.ak, credentials.sk) });
 
-  return {
+  const result = {
     ok: true,
     profile,
     obs: { configured: true, path: obs.path, endpoint: obs.endpoint },
@@ -109,4 +112,6 @@ export function syncAuth(target = 'all') {
     agents: getAgentRegistrationStatuses(target).agents,
     note: 'OBS credentials were synced from the global credential vault. Agent MCP registration is managed by "npx huaweicloud-devkit install --target <agent>".',
   };
+  if (project.ok) result.projectId = project.projectId;
+  return result;
 }

package/plugins/huaweicloud-core/src/proxy/proxy-agent.mjs

@@ -26,6 +26,13 @@ export async function getProxyDispatcher(targetUrl) {
   return cachedDispatcher;
 }
 
+export async function fetchWithProxy(url, options = {}) {
+  const dispatcher = await getProxyDispatcher(url);
+  if (!dispatcher) return fetch(url, options);
+  const { fetch: undiciFetch } = await import('undici');
+  return undiciFetch(url, { ...options, dispatcher });
+}
+
 export function clearProxyDispatcherCache() {
   cachedDispatcher = undefined;
   cachedDispatcherProxyUrl = null;

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -17,6 +17,7 @@ import { randomUUID } from 'node:crypto';
 import { createRequire } from 'node:module';
 
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
+import { resolveAndApplyProjectId } from './auth/project-id.mjs';
 import { SUPPORTED_AGENT_TARGETS } from './auth/agent-registration.mjs';
 import { fingerprint, resolveManagedProfile } from './auth/reconcile.mjs';
 import { redactSecrets } from './safety-policy.mjs';
@@ -4350,6 +4351,18 @@ async function cmdAuthInit() {
   if (findHcloudBin()) {
     const result = configureHcloud({ ak, sk, region });
     if (!result.ok) console.log(`KooCLI update failed: ${result.error || result.code}`);
+    else {
+      const proj = resolveAndApplyProjectId({ region });
+      if (proj.ok) {
+        console.log(`  Project ID auto-set: ${proj.projectId}`);
+      } else {
+        console.log(
+          `\x1b[33m  Project ID not auto-set (${proj.reason}). Sandbox exec may fail with APIGW.0301 until it is configured:\x1b[0m`,
+        );
+        console.log(`    hcloud IAM KeystoneListProjects --cli-region=${region} --name=${region}`);
+        console.log(`    hcloud configure set --cli-project-id=<project_id>`);
+      }
+    }
   } else {
     console.log('KooCLI not found. Run "npx huaweicloud-devkit install-hcloud" and then "auth sync".');
   }
@@ -4552,6 +4565,8 @@ function readInstalledVersion(pluginsDir) {
 }
 
 function cmdVersion() {
+  console.log(`HuaweiCloud DevKit CLI: ${pkgVersion}`);
+
   const agents = [
     ['OpenCode', opencodePluginsDir()],
     ['Codex Desktop', codexDesktopPluginsDir()],
@@ -4564,16 +4579,24 @@ function cmdVersion() {
     ['Hermes', hermesPluginsDir()],
     ['AtomCode', atomcodePluginsDir()],
   ];
-  let found = 0;
+  const installed = [];
   for (const [label, dir] of agents) {
     const v = dir ? readInstalledVersion(dir) : null;
     if (!v) continue;
-    console.log(`${label}: ${v}`);
-    found += 1;
+    installed.push([label, v]);
   }
-  if (found === 0) {
+
+  if (installed.length === 0) {
+    console.log('');
     console.log('No Huawei Cloud DevKit plugin installed. Run `npx huaweicloud-devkit install --target <agent>`.');
+    return;
+  }
+
+  console.log('\nInstalled agent plugins:');
+  for (const [label, version] of installed) {
+    console.log(`${label}: ${version}`);
   }
+  console.log('\nRun `npx huaweicloud-devkit update --target <agent>` to refresh installed agent plugins.');
 }
 
 async function main() {
@@ -4636,13 +4659,13 @@ async function main() {
       console.log('  install-hcloud  Show KooCLI install commands for your OS');
       console.log('  auth         Manage unified auth: init | sync | status | reconcile');
       console.log('  proxy        Manage proxy config: init | show | clear');
-      console.log('  version      Print installed plugin version per agent');
+      console.log('  version      Print CLI version and installed plugin version per agent');
       console.log('  help         Show this help');
       console.log('\nOptions:');
       console.log(
         '  --target     Target agent: opencode (default), codex, codearts, codearts-work, workbuddy, dsh, officeace, hermes, openclaw, atomcode, all',
       );
-      console.log('  --version    Print installed plugin version per agent');
+      console.log('  --version    Print CLI version and installed plugin version per agent');
       console.log('  --clean-kocli   (with: uninstall --target all) also remove KooCLI');
       console.log('  --clean-obs     (with: uninstall --target all) also remove OBS config');
       console.log('  --clean-global  (with: uninstall --target all) also remove KooCLI + OBS config');

package/plugins/huaweicloud-core/src/telemetry/agent-detect.mjs

@@ -7,7 +7,7 @@ import { AGENTS, matchAgent, detectVersion, installSegment } from './agent-regis
 export function detectAgentHarness(clientInfo = {}) {
   if (process.env.AGENT_HARNESS) return process.env.AGENT_HARNESS;
   for (const agent of AGENTS) {
-    if (matchAgent(agent)) return agent.id;
+    if (matchAgent(agent, clientInfo)) return agent.id;
   }
   return clientInfo.name || null;
 }
@@ -22,7 +22,7 @@ export function detectAgent(clientInfo = {}) {
   }
 
   for (const agent of AGENTS) {
-    if (matchAgent(agent)) {
+    if (matchAgent(agent, clientInfo)) {
       return {
         harness: agent.id,
         version: detectVersion(agent.version) || clientInfo.version || '0.0.0',

package/plugins/huaweicloud-core/src/telemetry/agent-registry.mjs

@@ -43,6 +43,7 @@ export const AGENTS = [
     id: 'codex',
     pathPatterns: null,
     envVars: ['CODEX_SESSION_ID', 'CODEX_CLI_VERSION', 'CODEX_SANDBOX', 'CODEX_THREAD_ID'],
+    clientNames: ['codex-mcp-client'],
     version: null,
   },
   {
@@ -67,6 +68,7 @@ export const AGENTS = [
     id: 'officeace',
     pathPatterns: ['/.office-claw/', '/.officeace/'],
     envVars: ['OFFICEACE_SESSION_ID', 'OFFICE_CLAW_CONFIG_ROOT'],
+    clientNames: ['office-claw-mcp-connector-probe'],
     version: { type: 'officeace' },
   },
   {
@@ -85,6 +87,7 @@ export const AGENTS = [
     id: 'openclaw',
     pathPatterns: ['/.openclaw/', '/.agents/huaweicloud-plugins/'],
     envVars: ['OPENCLAW_SESSION_ID', 'OPENCLAW_CONFIG_ROOT'],
+    clientNames: ['openclaw-bundle-mcp'],
     version: null,
   },
   {
@@ -161,9 +164,14 @@ export const AGENTS = [
   },
 ];
 
-export function matchAgent(agent) {
+export function matchAgent(agent, clientInfo = {}) {
   if (agent.pathPatterns && agent.pathPatterns.some((p) => selfPath.includes(p))) return true;
   if (agent.envVars && agent.envVars.some((v) => process.env[v])) return true;
+  const name = clientInfo.name;
+  if (!name) return false;
+  const lower = String(name).toLowerCase();
+  if (agent.id.toLowerCase() === lower) return true;
+  if (agent.clientNames && agent.clientNames.some((n) => n.toLowerCase() === lower)) return true;
   return false;
 }
 

package/plugins/huaweicloud-core/src/telemetry/telemetry.mjs

@@ -13,6 +13,8 @@ import { homedir, hostname, type as osType, networkInterfaces, release as osRele
 import { createHash, randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 
+import { fetchWithProxy } from '../proxy/proxy-agent.mjs';
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const PLUGIN_DIR = join(__dirname, '..', '..');
@@ -56,6 +58,8 @@ const MAX_QUEUE_SIZE = 500;
 const FLUSH_INTERVAL_MS = 60_000;
 const BATCH_SIZE = 100;
 const FETCH_TIMEOUT_MS = 5000;
+const MAX_VALUE_LENGTH = 255;
+const MAX_RETRIES = 3;
 
 const DEFAULT_ENDPOINT = 'https://devkit.huaweicloud.com/rest/developer/server/hdkitservice/telemetry/events';
 
@@ -178,10 +182,19 @@ function capabilityFromKey(key) {
   return undefined;
 }
 
+export function sanitizeValue(value) {
+  if (typeof value !== 'string') value = value == null ? '' : String(value);
+  value = value.replace(/[\r\n\t]+/g, ' ').trim();
+  if (value.length > MAX_VALUE_LENGTH) {
+    value = value.slice(0, MAX_VALUE_LENGTH - 3) + '...';
+  }
+  return value;
+}
+
 function buildEvent(raw) {
   const event = {
     key: raw.key,
-    value: raw.value,
+    value: sanitizeValue(raw.value),
     installId: installId,
     userHash: userHash,
     version: PLUGIN_VERSION,
@@ -300,6 +313,13 @@ export function cacheUserHash(hash) {
   writeTextFile(USER_HASH_PATH, hash);
 }
 
+export function clearUserHash() {
+  userHash = null;
+  try {
+    unlinkSync(USER_HASH_PATH);
+  } catch {}
+}
+
 function flushEvents() {
   if (isFlushing) return;
   if (eventQueue.length === 0) return;
@@ -315,10 +335,10 @@ function flushEvents() {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
 
-  fetch(endpoint, {
+  fetchWithProxy(endpoint, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(batch),
+    body: JSON.stringify(batch.map(({ _retries, ...rest }) => rest)),
     signal: controller.signal,
   })
     .then((resp) => {
@@ -330,19 +350,35 @@ function flushEvents() {
           if (event.key === 'plugin:install') touchFile(installStampPath());
           if (event.key === 'plugin:first_use') touchFile(firstUseStampPath());
         }
+      } else if (resp.status >= 400 && resp.status < 500) {
+        debugLog(`POST status=${resp.status} dropping ${batch.length} events (client error)`);
       } else {
-        eventQueue = [...batch, ...eventQueue];
+        requeueEvents(batch);
       }
       isFlushing = false;
     })
     .catch((error) => {
       clearTimeout(timer);
       debugLog(`POST FAIL err=${error.message} events=${batch.length}`);
-      eventQueue = [...batch, ...eventQueue];
+      requeueEvents(batch);
       isFlushing = false;
     });
 }
 
+function requeueEvents(batch) {
+  const kept = [];
+  for (const event of batch) {
+    const retries = event._retries || 0;
+    if (retries >= MAX_RETRIES) {
+      debugLog(`DROP event key=${event.key} after ${MAX_RETRIES} retries`);
+      continue;
+    }
+    event._retries = retries + 1;
+    kept.push(event);
+  }
+  if (kept.length > 0) eventQueue = [...kept, ...eventQueue];
+}
+
 export function initTelemetry({ harness, version }) {
   installId = generateOrRecoverInstallId();
   agentHarness = harness || 'unknown';

package/plugins/huaweicloud-core/src/tools.mjs

@@ -29,9 +29,11 @@ import {
   hdkitCredentials,
   hdkitVoucherStatus,
   hdkitVoucherClaim,
+  hdkitGenerateUserHash,
 } from './sandbox/hdkitservice-api.mjs';
 import { getCredentials } from './sandbox/hwlink-api.mjs';
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
+import { validateIamCredentials } from './auth/credential-validator.mjs';
 import {
   readGlobalCredentials,
   writeGlobalCredentials,
@@ -43,8 +45,9 @@ import {
   writeLastSync,
   readCodeArtsCredentials,
   globalCredentialsPath,
+  resolveCredentialsWithRuntime,
 } from './auth/credentials.mjs';
-import { trackToolInvoke, trackSkillRetrieve } from './telemetry/telemetry.mjs';
+import { trackToolInvoke, trackSkillRetrieve, clearUserHash } from './telemetry/telemetry.mjs';
 import { fingerprint, runHcloudConfigure, resolveManagedProfile } from './auth/reconcile.mjs';
 import {
   getCachedUpdateInfo,
@@ -771,13 +774,18 @@ export const TOOL_DEFINITIONS = [
   {
     name: 'huaweicloud_sandbox_credentials',
     description:
-      'Configure temporary AK/SK for a sandbox via hdkitservice. Injects temporary credentials into the sandbox. The sandbox must be in RUNNING state.',
+      'Configure temporary AK/SK for a sandbox via hdkitservice. Validates the current AK/SK against IAM before injecting (invalid SK is rejected here instead of failing later with APIGW.0301 during exec), then injects temporary credentials into the sandbox. The sandbox must be in RUNNING state.',
     inputSchema: {
       type: 'object',
       properties: {
         session_id: { type: 'string', description: 'Session ID from huaweicloud_sandbox_connect' },
         dev_stage_id: { type: 'string', description: 'DevStation environment ID (alternative to session_id)' },
         enable_sts: { type: 'boolean', description: 'Whether to enable STS temporary AK/SK (default: true)' },
+        region: {
+          type: 'string',
+          description:
+            'Region used for IAM credential validation and project_id resolution (defaults to the configured region)',
+        },
       },
     },
   },
@@ -997,6 +1005,13 @@ function persistCredentials(ak, sk, securityToken, region) {
   };
 }
 
+function refreshUserHashAfterAuthChange({ regenerate = true } = {}) {
+  clearUserHash();
+  if (regenerate) {
+    hdkitGenerateUserHash().catch(() => {});
+  }
+}
+
 export async function callTool(name, args = {}) {
   const toolValue = toolInvokeValue(name, args);
   trackToolInvoke(name, toolValue);
@@ -1055,22 +1070,28 @@ export async function callTool(name, args = {}) {
       return setupObsConfig(args.profile);
     case 'huaweicloud_auth_status':
       return getAuthStatus(args.target || 'all');
-    case 'huaweicloud_auth_sync':
-      return syncAuth(args.target || 'all');
+    case 'huaweicloud_auth_sync': {
+      const result = syncAuth(args.target || 'all');
+      refreshUserHashAfterAuthChange();
+      return result;
+    }
     case 'huaweicloud_auth_init':
       if (args.clear) {
         clearRuntimeCredentials();
+        refreshUserHashAfterAuthChange({ regenerate: false });
         return { status: 'cleared', message: 'Runtime credentials cleared. Fallback to env/file.' };
       }
       if (!args.ak || !args.sk) {
         throw new Error('ak and sk are required. Set clear=true to clear runtime credentials.');
       }
       setRuntimeCredentials(args.ak, args.sk, undefined, args.region);
+      refreshUserHashAfterAuthChange();
       return { status: 'ok', message: 'Runtime credentials set for this MCP session.' };
     case 'huaweicloud_auth_switch': {
       const action = args.action || 'temporary';
       if (action === 'clear') {
         clearRuntimeCredentials();
+        refreshUserHashAfterAuthChange({ regenerate: false });
         return { status: 'cleared', message: 'Runtime credentials cleared. Fallback to env/file/S1.' };
       }
 
@@ -1100,6 +1121,7 @@ export async function callTool(name, args = {}) {
 
       if (action === 'temporary') {
         setRuntimeCredentials(ak, sk, securityToken || undefined, region);
+        refreshUserHashAfterAuthChange();
         return {
           status: 'ok',
           scope: 'temporary',
@@ -1131,7 +1153,9 @@ export async function callTool(name, args = {}) {
         };
       }
 
-      return persistCredentials(ak, sk, securityToken, region);
+      const persisted = persistCredentials(ak, sk, securityToken, region);
+      refreshUserHashAfterAuthChange();
+      return persisted;
     }
     case 'huaweicloud_auth_confirm': {
       const pending = pendingConfirms.get(args.token);
@@ -1140,7 +1164,9 @@ export async function callTool(name, args = {}) {
       if (args.decision === 's1') {
         return { status: 'ok', outcome: 'aborted', message: '保持 S1 现有账号，未覆盖。' };
       }
-      return persistCredentials(pending.newAk, pending.newSk, pending.newSecurityToken, pending.newRegion);
+      const confirmed = persistCredentials(pending.newAk, pending.newSk, pending.newSecurityToken, pending.newRegion);
+      refreshUserHashAfterAuthChange();
+      return confirmed;
     }
     case 'huaweicloud_sandbox_exec_with_session': {
       const sandboxWsId2 = args.workspace_id || getCurrentWorkspaceId();
@@ -1300,6 +1326,32 @@ export async function callTool(name, args = {}) {
     }
     case 'huaweicloud_sandbox_credentials': {
       const devStageId = args.dev_stage_id || getCurrentWorkspaceId();
+      let resolved;
+      try {
+        resolved = resolveCredentialsWithRuntime();
+      } catch {
+        resolved = null;
+      }
+      if (!resolved?.ak || !resolved?.sk) {
+        return {
+          ok: false,
+          error: 'Huawei Cloud credentials are not configured. Nothing was injected into the sandbox.',
+          hint: 'Run "npx huaweicloud-devkit auth init" or set HW_ACCESS_KEY/HW_SECRET_KEY, then retry.',
+        };
+      }
+      const validation = await validateIamCredentials({
+        ak: resolved.ak,
+        sk: resolved.sk,
+        securityToken: resolved.securityToken,
+        region: args.region || resolved.region,
+      });
+      if (!validation.valid && !validation.skipped) {
+        return {
+          ok: false,
+          error: 'Credential validation failed before injection: ' + validation.error,
+          hint: 'Credentials were NOT injected into the sandbox. Fix AK/SK first: run "npx huaweicloud-devkit auth init" or correct HW_ACCESS_KEY/HW_SECRET_KEY, then retry.',
+        };
+      }
       const credResult = await hdkitCredentials(args.session_id, devStageId, args.enable_sts !== false);
       const sandboxWsIdCred = args.dev_stage_id || getCurrentWorkspaceId();
       if (sandboxWsIdCred) {
@@ -1310,6 +1362,7 @@ export async function callTool(name, args = {}) {
             `export HW_SECRET_KEY='${sk}'`,
             securitytoken ? `export HW_SECURITY_TOKEN='${securitytoken}'` : '',
             securitytoken ? `export X_HW_SECURITY_TOKEN='${securitytoken}'` : '',
+            validation.projectId ? `export HW_PROJECT_ID='${validation.projectId}'` : '',
           ]
             .filter(Boolean)
             .join('\n');
@@ -1323,7 +1376,14 @@ export async function callTool(name, args = {}) {
           await execWithSession(sandboxWsIdCred, `source ${credsFile} && echo "CREDS_SOURCED"`, 'root', 15000);
         } catch {}
       }
-      return credResult;
+      const result = {
+        ...credResult,
+        credentialValidation: validation.warning ? 'passed-with-warning' : 'passed',
+      };
+      if (validation.projectId) result.projectId = validation.projectId;
+      if (validation.warning) result.warning = validation.warning;
+      if (validation.skipped) result.warning = validation.error;
+      return result;
     }
     case 'huaweicloud_voucher_status':
       return await hdkitVoucherStatus(args.domain_id);
@@ -1806,6 +1866,8 @@ function explainError({ service = 'unknown', errorCode = '', message = '', reque
       'VPC.0301': 'Bandwidth name is required for PER type EIPs, even though --help marks it optional.',
     },
     APIGW: {
+      'APIGW.0301':
+        'Incorrect IAM authentication information. The AK/SK is invalid (check the SK for typos), the security token is missing or expired, or the profile lacks project_id. Fix: re-run "npx huaweicloud-devkit auth init" (it auto-sets project_id), or set it manually: hcloud configure set --cli-project-id=<project_id> after finding it via hcloud IAM KeystoneListProjects --cli-region=<region> --name=<region>.',
       'APIGW.0802':
         'The current IAM user has no permissions in the requested region. Go to IAM console → Users → Permissions → add the target region, or switch to a different region.',
     },
@@ -1836,7 +1898,9 @@ function explainError({ service = 'unknown', errorCode = '', message = '', reque
         ': API Gateway layer error. ' +
         (errorCode === 'APIGW.0802'
           ? 'IAM user has no region permissions — check IAM console → User → Permissions → add target region.'
-          : 'Verify the API request, region endpoint, and IAM permissions.'),
+          : errorCode === 'APIGW.0301'
+            ? 'Incorrect IAM authentication information — verify AK/SK (SK typos are the usual cause), security token expiry, and that project_id is configured (auth init auto-sets it).'
+            : 'Verify the API request, region endpoint, and IAM permissions.'),
     );
   }
   if (/region|endpoint|project/i.test(combined)) {