huaweicloud-devkit 1.1.2-next.4 → 1.1.2-next.6

package/README.md

@@ -22,13 +22,19 @@ Supports OpenCode, Codex, CodeArts Agent, WorkBuddy, DeepSeek Harness (DSH), Off
 > ```
 >
 > Restore the default registry: `npm config delete registry`
+>
+> **Mirror lag**: npm mirrors (npmmirror, mirrors.huaweicloud.com) may lag behind the official registry for hours after a new release. If install fails with `ETARGET` or you get an older version, install via the official registry instead:
+>
+> ```bash
+> npx --yes --registry=https://registry.npmjs.org huaweicloud-devkit install --target <target>
+> ```
 
 ## Quick Start
 
 > If `--target` is omitted, the installer auto-detects agents on your machine. When multiple agents are detected, **all of them** will be installed. Specify `--target` to control which agent receives the install.
 
 ```bash
-npx --yes huaweicloud-devkit version  # print the installed plugin version per agent
+npx --yes huaweicloud-devkit version  # print CLI version and installed plugin versions per agent
 npx --yes huaweicloud-devkit uninstall --target all --clean-global  # also remove KooCLI + OBS config
 ```
 

package/README.zh-CN.md

@@ -22,13 +22,19 @@
 > ```
 >
 > 恢复默认镜像：`npm config delete registry`
+>
+> **镜像滞后**：npm 镜像（npmmirror、mirrors.huaweicloud.com）在新版本发布后可能滞后官方源数小时。若安装报 `ETARGET` 或拿到旧版本，改用官方源安装：
+>
+> ```bash
+> npx --yes --registry=https://registry.npmjs.org huaweicloud-devkit install --target <target>
+> ```
 
 ## 快速开始
 
 > 省略 `--target` 时，安装器会自动检测机器上的 agent，检测到多个时**全部安装**。建议始终指定 `--target` 以明确安装目标。
 
 ```bash
-npx --yes huaweicloud-devkit version  # 查看各 agent 已安装的插件版本
+npx --yes huaweicloud-devkit version  # 查看 CLI 版本和各 agent 已安装的插件版本
 npx --yes huaweicloud-devkit uninstall --target all --clean-global  # 一并删除 KooCLI 与 OBS 配置
 ```
 

package/integrations/dsh/hook-plugin.mjs

@@ -65,18 +65,23 @@ function isHuaweiCloudSkill(name) {
 // hcloud command classification (mirrors skill-tracker.js)
 // ══════════════════════════════════════════════════════════════════
 
-const HCLOUD_RE = /(?:^|[;&|]\s*)hcloud(?:\.exe)?\s+(.+)/i;
+const HCLOUD_RE = /(?:^|[;&|]\s*)hcloud(?:\.exe)?\s+([^\s;&|"<>]+(?:\s+[^\s;&|"<>]+){0,3})/i;
 const READ_VERBS = /\b(List|Show|Get|Describe|NovaList|NovaShow)\w*/i;
 const WRITE_VERBS =
   /\b(Create|Delete|Update|Modify|Remove|Revoke|Grant|Attach|Detach|Enable|Disable|Set|Add|Bind|Unbind|Reset|Change|Activate|Deactivate|Register|Unregister|Import|Export|Download|Upload|Copy|Move|Convert|Migrate|Run|Execute|Invoke|Trigger|Deploy|Push|Start|Stop|Restart|Reboot|Suspend|Resume|Terminate|Release|Allocate)\w*/i;
 
-function classifyHcloud(text) {
+export function classifyHcloud(text) {
   const m = HCLOUD_RE.exec(text);
   if (!m) return null;
-  const rest = m[1].trim();
-  const parts = rest.split(/\s+/).filter((p) => !p.startsWith('--'));
-  const cmd = parts.join(' ');
-  if (!cmd) return null;
+  const raw = m[1].trim();
+  if (!raw) return null;
+  const cmdTokens = [];
+  for (const t of raw.split(/\s+/)) {
+    if (t.startsWith('--')) break;
+    cmdTokens.push(t);
+  }
+  if (cmdTokens.length === 0) return null;
+  const cmd = cmdTokens.join(' ');
   if (READ_VERBS.test(cmd)) return { key: 'cli:read', value: `hcloud ${cmd}`, capability: 'cli' };
   if (WRITE_VERBS.test(cmd)) return { key: 'cli:write', value: `hcloud ${cmd}`, capability: 'cli' };
   return { key: 'cli:invoke', value: `hcloud ${cmd}`, capability: 'cli' };

package/integrations/opencode/hooks/skill-tracker.js

@@ -28,7 +28,7 @@ function writeEvent(key, value, extra = {}) {
 
 // ── CLI command classification ────────────────────────────────
 
-const HCLOUD_RE = /(?:^|[;&|]\s*)hcloud(?:\.exe)?\s+(.+)/i;
+const HCLOUD_RE = /(?:^|[;&|]\s*)hcloud(?:\.exe)?\s+([^\s;&|"<>]+(?:\s+[^\s;&|"<>]+){0,3})/i;
 const READ_VERBS = /\b(List|Show|Get|Describe|NovaList|NovaShow)\w*/i;
 const WRITE_VERBS = new RegExp(
   '\\b(Create|Delete|Update|Modify|Remove|Revoke|Grant|Attach|Detach|' +
@@ -42,14 +42,15 @@ const WRITE_VERBS = new RegExp(
 function classifyHcloud(text) {
   const m = HCLOUD_RE.exec(text);
   if (!m) return null;
-  const rest = m[1].trim();
-  const cmdEnd = rest.search(/\s[|&<>;]/);
-  const cmdPart = cmdEnd > -1 ? rest.slice(0, cmdEnd) : rest;
-  const parts = cmdPart
-    .split(/\s+/)
-    .filter((p) => !p.startsWith('--') && !/^\d*>(&?\d*|%devnull)/.test(p) && !/^(&\d+)$/.test(p));
-  const cmd = parts.join(' ');
-  if (!cmd) return null;
+  const raw = m[1].trim();
+  if (!raw) return null;
+  const cmdTokens = [];
+  for (const t of raw.split(/\s+/)) {
+    if (t.startsWith('--')) break;
+    cmdTokens.push(t);
+  }
+  if (cmdTokens.length === 0) return null;
+  const cmd = cmdTokens.join(' ');
   if (READ_VERBS.test(cmd)) return { key: 'cli:read', value: `hcloud ${cmd}` };
   if (WRITE_VERBS.test(cmd)) return { key: 'cli:write', value: `hcloud ${cmd}` };
   return { key: 'cli:invoke', value: `hcloud ${cmd}` };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.6",
   "kooCliVersion": "7.2.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.6",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.6",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.6",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.6",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.6",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.2-next.4",
+  "version": "1.1.2-next.6",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/skills/huawei-billing/SKILL.md

@@ -16,23 +16,24 @@ Domain expertise for billing queries (BSS). Covers cost tracking, bill details,
 
 ## Critical Warnings
 
-| Trap                       | Why                                                                                                                                                 |
-| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Bills delayed ~24h         | Yesterday's costs may not appear until the next day                                                                                                 |
-| BSS Admin role needed      | IAM user must have BSS Administrator or Finance role                                                                                                |
-| Currency conversion varies | Cross-region costs use daily exchange rates                                                                                                         |
-| Region fixed to cn-north-1 | BSS operations only support `--cli-region=cn-north-1` in KooCLI. This is a KooCLI metadata limitation — the billing data itself covers all regions. |
+| Trap                           | Why                                                                                                                                                                                         |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Bills delayed ~24h             | Yesterday's costs may not appear until the next day                                                                                                                                         |
+| BSS Admin role needed          | IAM user must have BSS Administrator or Finance role                                                                                                                                        |
+| Currency conversion varies     | Cross-region costs use daily exchange rates                                                                                                                                                 |
+| Region fixed to cn-north-1     | BSS operations only support `--cli-region=cn-north-1` in KooCLI. This is a KooCLI metadata limitation — the billing data itself covers all regions.                                         |
+| Global service needs domain-id | BSS is a global service: AK/SK mode requires `--cli-domain-id`. If unknown, run `hcloud STS GetCallerIdentity --cli-region=<region>` and use `account_id` (see `huaweicloud-cli-and-auth`). |
 
 ## Common Workflows
 
-| Task                 | Operation                                                              |
-| -------------------- | ---------------------------------------------------------------------- |
-| List costs           | `ListCosts --cli-region=cn-north-1 --project_id=<p>`                   |
-| List customer bills  | `ListCustomerBillsFeeRecords --cli-region=cn-north-1 --project_id=<p>` |
-| List resource usage  | `ListResourceUsage --cli-region=cn-north-1 --project_id=<p>`           |
-| List sub-customers   | `ListConsumeSubCustomers --cli-region=cn-north-1 --project_id=<p>`     |
-| Show account balance | `ShowCustomerAccountBalances --cli-region=cn-north-1 --project_id=<p>` |
-| List conversions     | `ListConversions --cli-region=cn-north-1 --project_id=<p>`             |
+| Task                 | Operation                                                                         |
+| -------------------- | --------------------------------------------------------------------------------- |
+| List costs           | `ListCosts --cli-region=cn-north-1 --project_id=<p>`                              |
+| List customer bills  | `ListCustomerBillsFeeRecords --cli-region=cn-north-1 --project_id=<p>`            |
+| List resource usage  | `ListResourceUsage --cli-region=cn-north-1 --project_id=<p>`                      |
+| List sub-customers   | `ListConsumeSubCustomers --cli-region=cn-north-1 --project_id=<p>`                |
+| Show account balance | `ShowCustomerAccountBalances --cli-region=cn-north-1 --cli-domain-id=<domain_id>` |
+| List conversions     | `ListConversions --cli-region=cn-north-1 --project_id=<p>`                        |
 
 Discover exact parameters with `--help` before executing any command. All BSS operations are read-only.
 

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md

@@ -69,4 +69,6 @@ hcloud IAM AssociateAgencyWithDomainPermission --agency_id=<id> --domain_id=<id>
 hcloud FunctionGraph CreateFunction --func_vpc.vpc_id=<vpc> --func_vpc.subnet_id=<subnet> --app_xrole=<name> ...
 ```
 
+> IAM is a global service in KooCLI. If `CreateAgency` / `AssociateAgencyWithDomainPermission` fail with `缺少必填参数 cli-domain-id`, prefer a concrete `--cli-region` (e.g. `cn-north-4`), or discover the domain-id via `hcloud STS GetCallerIdentity --cli-region=<region>` (see `huaweicloud-cli-and-auth`).
+
 | QuotaExceeded | Max 10 functions per project per region |

package/plugins/huaweicloud-core/skills/huawei-iac/SKILL.md

@@ -15,6 +15,7 @@ Always run `hcloud <Service> <Operation> --help` before constructing commands to
 - This skill orchestrates the **purchase lifecycle of ALL supported resources**: proposal → pricing → provisioning → destroy, across every service in the plugin catalog.
 - **Web app deployment keeps sandbox as the first choice** (see `huaweicloud-core` Deployment Target Options). Route here only when the user wants billed, long-term, or multi-resource cloud infrastructure, or explicitly asks for an architecture + cost proposal.
 - Single-resource tasks go directly to the service skill. This skill adds value for **multi-resource orchestration, mandatory cost gating, and ordered destroy**.
+- **A user-specified hosting target (e.g. "部署到 ECS") does NOT exempt the flow**: stages 1-5 (code inspection, cost estimate, balance check, risk warnings) still run in full - the user's target choice only narrows stage 2/3 options, it never skips the gates.
 
 ## Workflow (strict order)
 
@@ -47,7 +48,7 @@ Preconditions - all required:
 3. The user explicitly names the target deployment. Ambiguous "delete it" → list deployments and ask. Never guess.
 4. Every delete command still goes through plan → approve → run.
 
-Execution: show the to-be-deleted list for final confirmation → delete in **reverse creation order** → a "resource not found" error counts as already deleted, continue → mark `destroyed`. OBS: upload paths like `assets/style.css` auto-create folder-marker objects that outlive the files - prefer one recursive sweep `hcloud OBS rm obs://<bucket>/ -r -f` over per-object deletes, then delete the bucket (a non-empty bucket fails with 409 `BucketNotEmpty`). CDN: disable then delete. DNS: delete the record set (only if hosted in Huawei Cloud DNS).
+Execution: show the to-be-deleted list for final confirmation → delete in **reverse creation order** → a "resource not found" error counts as already deleted, continue → mark `destroyed`. OBS: recursive sweeps (`OBS rm obs://<bucket>/ -r -f`) are DENIED by the safety rule `hwc-destructive-delete-force` even after manifest approval - do not plan them. Instead list objects (`hcloud OBS ls obs://<bucket>/ -s`) and delete per-object (watch for folder-marker objects like `assets/` that outlive the files), then delete the bucket (a non-empty bucket fails with 409 `BucketNotEmpty`). CDN: disable then delete. DNS: delete the record set (only if hosted in Huawei Cloud DNS).
 
 ## Critical Warnings
 
@@ -63,6 +64,9 @@ Execution: show the to-be-deleted list for final confirmation → delete in **re
 | Public exposure is auto-blocked                      | Risk rules deny `0.0.0.0/0` port rules at plan time. For test/dev use a narrower `remote_ip_prefix` (e.g. the VPC CIDR) or get user consent for a documented exception                                                                                                                                                                             |
 | ECS CreateServers hidden required params             | Besides flavor/image/nics/az it also needs `--server.vpcid` and `--server.root_volume.volumetype` - order submission fails without them                                                                                                                                                                                                            |
 | FunctionGraph runtime/code enums are strict          | runtime must be exact (`Node.js18.15`, `Python3.9`, `Go1.x`, ...); inline code is the PAIR `--package=default --code_type=inline` (`--package=inline` → `FSS.1006`); TIMER triggers use `--event_data.schedule_type=Rate --event_data.schedule=1m` (`@every` style → `FSS.1109`); DeleteFunction takes `--function_urn` WITHOUT `:latest`          |
+| Keypairs: `NovaCreateKeypair`, not CreateKeypair     | `ECS CreateKeypair` does NOT exist - use `hcloud ECS NovaCreateKeypair`; delete takes `--keypair_name` (not `--keypair.name`). The API-generated `private_key` is MASKED in tool output - for SSH access create the keypair in the console or import the user's own public key, then bind with `--server.key_name=<n>`                             |
+| Long inline args break MCP JSON                      | Values >~2KB inline (e.g. `--server.user_data=<base64 cloud-init>`) fail JSON parsing silently. Write a local JSON file and pass `--cli-jsonInput=<file>` (see `references/resource-catalog.md` header note)                                                                                                                                       |
+| EIP quota fails at RUN stage, not at plan            | `EIP.7905 Quota exceeded` appears only after plan+approval - pre-check quota during stage 5 (and count precisely: `ListPublicips --limit=50` truncates, a "50/50" read on a 59-EIP account is wrong). Released quotas may lag minutes before `EIP.7905` clears                                                                                     |
 | Zero balance blocks order submission                 | ECS creation fails with `Ecs.7000 Insufficient account balance` when cash + voucher accounts are 0. This is the stage-5 gate materialized: stop, mark `partial`, tell the user pay-by-duration resources need a deposit. Free-tier resources (FunctionGraph, small OBS) DO work at 0 balance - the gate applies to order-submission resources only |
 | CDN mainland acceleration requires ICP filing        | Unregistered domains cannot go live on CDN - check before stage 3. CDN create ALSO requires domain ownership verification first (`CDN.00010185 Verify domain ownership failed` - user must add a DNS record or upload a verification file)                                                                                                         |
 | CDN is a global service in KooCLI                    | CDN operations only accept `--cli-region=cn-north-1` or `ap-southeast-1` - never the resource region                                                                                                                                                                                                                                               |
@@ -82,7 +86,7 @@ Execution: show the to-be-deleted list for final confirmation → delete in **re
 - `huaweicloud_run_readonly_command` → discovery (flavors, images, zones, prices)
 - `huaweicloud_list_regions` / `huaweicloud_get_regional_availability` → region intent
 - `huaweicloud_hook_check_deploy_plan` → risk-check the plan before approval
-- Balance and pricing: `huawei-billing` skill. Balance operation (BSS is pinned to cn-north-1 in KooCLI): `hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1 --cli-domain-id=<domain_id>`. Global services (BSS/IAM) require `--cli-domain-id` per call or in the profile - if unknown, extract it from any resource response's `tenant_id` field (e.g. a VPC create response), or from the profile's domainId once configured
+- Balance and pricing: `huawei-billing` skill. Balance operation (BSS is pinned to cn-north-1 in KooCLI): `hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1 --cli-domain-id=<domain_id>`. Global services (BSS/IAM) require `--cli-domain-id` per call or in the profile. If unknown, discover it with `hcloud STS GetCallerIdentity --cli-region=<region>` (`account_id` = domain-id); use `tenant_id` from a resource response only as a fallback
 
 ## Cross-Skill References
 

package/plugins/huaweicloud-core/skills/huawei-iac/references/resource-catalog.md

@@ -3,10 +3,12 @@
 Every resource type the orchestration flow can purchase, bind, and destroy. This is the authoritative checklist when composing a deployment plan.
 
 > **Operation names below are entry points, not gospel.** Always confirm exact parameters with `hcloud <Service> <Operation> --help` before planning a command. When an operation name is uncertain, run `hcloud <Service> --help` first.
+>
+> **Long parameter values MUST go through a file.** Inline args longer than ~2KB (e.g. `--server.user_data=<base64 cloud-init>`) break MCP JSON parsing and the command silently fails. Write a local JSON file and pass `--cli-jsonInput=<file>` instead (KooCLI-native; the approval gate matches the arg verbatim, so use the same file path in plan and run).
 
 ## Networking (foundation - create first, destroy last)
 
-> **v3 API notes (verified by E2E)**: `CreateSecurityGroup` is account-scoped - NO `vpc_id` param. `CreateSecurityGroupRule` uses `multiport=80` (not `port_range_min/max`). `DeleteSubnet` requires `--vpc_id` in addition to `--subnet_id`. Deletion APIs return empty output on success (async 202/204) - confirm via list, not stdout.
+> **v3 API notes (verified by E2E)**: `CreateSecurityGroup` is account-scoped - NO `vpc_id` param. `CreateSecurityGroupRule` uses `multiport=80` (not `port_range_min/max`). `DeleteSubnet` requires `--vpc_id` in addition to `--subnet_id`. Deletion APIs return empty output on success (async 202/204) - confirm via list, not stdout. `ListPorts` uses array-style params (`--device_id.1=<uuid>`, `--network_id.1=<id>`) - flat `--device_id`/`--network_id` fail with USE_ERROR, and `--limit` is not supported.
 
 | Resource             | Create                                                                                                                                                                                                                                                                                           | Delete                                                             | Skill      | Depends on                                                                                                                                  |
 | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -19,18 +21,21 @@ Every resource type the orchestration flow can purchase, bind, and destroy. This
 
 ## Compute
 
-| Resource      | Create                                                                                                                                                                                                                                                                                                                                                                               | Delete                                                                                     | Skill      | Depends on                                                                 |
-| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------ | ---------- | -------------------------------------------------------------------------- |
-| ECS instance  | `hcloud ECS CreateServers --server.name=<n> --server.flavorRef=<id> --server.imageRef=<id> --server.vpcid=<id> --server.nics.1.subnet_id=<id> --server.security_groups.1.id=<id> --server.availability_zone=<az> --server.root_volume.volumetype=<type>` (hidden required: `vpcid` + `root_volume.volumetype`; check flavor family vs image arch, e.g. kc1 = ARM needs an ARM image) | `hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true` | huawei-ecs | VPC + Subnet + SG. Set both delete flags true on teardown or EIP/disk leak |
-| EVS data disk | `hcloud EVS CreateVolume`                                                                                                                                                                                                                                                                                                                                                            | `hcloud EVS DeleteVolume`                                                                  | huawei-ecs | - (attach with `hcloud ECS AttachServerVolume`)                            |
+| Resource      | Create                                                                                                                                                                                                                                                                                                                                                                               | Delete                                                                                              | Skill      | Depends on                                                                 |
+| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------- | ---------- | -------------------------------------------------------------------------- |
+| ECS instance  | `hcloud ECS CreateServers --server.name=<n> --server.flavorRef=<id> --server.imageRef=<id> --server.vpcid=<id> --server.nics.1.subnet_id=<id> --server.security_groups.1.id=<id> --server.availability_zone=<az> --server.root_volume.volumetype=<type>` (hidden required: `vpcid` + `root_volume.volumetype`; check flavor family vs image arch, e.g. kc1 = ARM needs an ARM image) | `hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true`          | huawei-ecs | VPC + Subnet + SG. Set both delete flags true on teardown or EIP/disk leak |
+| ECS keypair   | `hcloud ECS NovaCreateKeypair --keypair.name=<n>` (⚠️ `ECS CreateKeypair` does NOT exist; `NovaCreateKeypair` with a `public_key` field imports your own pubkey, otherwise the API generates one)                                                                                                                                                                                    | `hcloud ECS NovaDeleteKeypair --keypair_name=<n>` (param is `--keypair_name`, NOT `--keypair.name`) | huawei-ecs | -                                                                          |
+| EVS data disk | `hcloud EVS CreateVolume`                                                                                                                                                                                                                                                                                                                                                            | `hcloud EVS DeleteVolume`                                                                           | huawei-ecs | - (attach with `hcloud ECS AttachServerVolume`)                            |
+
+> **Keypair private_key is NOT retrievable via CLI**: the API-created keypair returns `private_key` once, but the tool output redaction masks it - the agent can never read it back. For SSH access, either guide the user to create the keypair in the console, or have them bring their own public key (import via `NovaCreateKeypair` `public_key` field, then reference with `--server.key_name=<n>` at ECS create).
 
 ## Databases
 
-| Resource                    | Create                                                    | Delete                                                  | Skill          | Depends on   |
-| --------------------------- | --------------------------------------------------------- | ------------------------------------------------------- | -------------- | ------------ |
-| RDS (MySQL/PG/SQLServer)    | discover with `hcloud RDS --help` (CreateInstance family) | discover with `hcloud RDS --help`                       | huawei-rds     | VPC + Subnet |
-| GaussDB                     | discover with `hcloud GaussDB --help`                     | discover with `hcloud GaussDB --help`                   | huawei-gaussdb | VPC + Subnet |
-| DDS (MongoDB) / DCS (Redis) | discover with `hcloud DDS --help` / `hcloud DCS --help`   | discover with `hcloud DDS --help` / `hcloud DCS --help` | huawei-dds-dcs | VPC + Subnet |
+| Resource                    | Create                                                                                                                                                                                                                                                                                                          | Delete                                                                                                                                     | Skill          | Depends on   |
+| --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | -------------- | ------------ |
+| RDS (MySQL/PG/SQLServer)    | `hcloud RDS CreateInstance` — `flavor_ref` MUST be the **spec-code string** (e.g. `rds.mysql.n1.large.2`), NOT the UUID from `ListFlavors` (UUID → `DBS.280434 Invalid specification code`); single-instance mode may omit the `ha` block; x1 series are dedicated-ish flavors - prefer n1 for general accounts | discover with `hcloud RDS --help`                                                                                                          | huawei-rds     | VPC + Subnet |
+| GaussDB                     | discover with `hcloud GaussDB --help`                                                                                                                                                                                                                                                                           | discover with `hcloud GaussDB --help`                                                                                                      | huawei-gaussdb | VPC + Subnet |
+| DDS (MongoDB) / DCS (Redis) | DCS `CreateInstance`: `available_zones` takes **AZ IDs** (passing AZ codes fails with `DCS.4042`)                                                                                                                                                                                                               | DCS delete: `hcloud DCS BatchDeleteInstances --instances.1=<id>` (`DeleteInstances` does NOT exist); DDS discover with `hcloud DDS --help` | huawei-dds-dcs | VPC + Subnet |
 
 ## Storage / Delivery
 
@@ -90,18 +95,20 @@ hcloud BSS ListOnDemandResourceRatings --project_id=<pid> \
 - `usage_measure_id=4` = hour; `usage_value=730` = one month. Response: `amount` (CNY) per product label
 - **ECS codes verified**: service `hws.service.type.ec2`, resource `hws.resource.type.vm`, spec = `<flavor>.linux` (or `.win`); monthly price for kc1.small.1 = 87.60 CNY (official, cn-north-4)
 - **EIP codes NOT usable (verified)**: `hws.service.type.vpc` + `19_bgp` fails with `CBC.6074` - use official website prices as static estimates and label them 估算
+- **RDS / DCS codes NOT usable (verified 2026-09-08)**: RDS combos fail with `CBC.6074`, DCS with `CBC.6006`; the metadata discovery path is unusable - `ListServiceTypes` returns 895 entries with no filter param and `ListResourceTypes` has no service filter either. Degrade to official website prices as static estimates and label them 估算
 - **Other services**: codes are per-service and MUST be looked up via BSS metadata APIs (`ListServiceTypes` / `ListResourceTypes` / `ListUsageTypes`) or docs - a wrong combination fails with `CBC.6074`. Never guess
 - **Balance query may be permission-blocked**: `CBC.0151` = IAM user lacks `billing:balance:view` → degrade to "user self-checks balance" and continue (do not block; `Ecs.7000` at order time is recoverable). domain_id 可从报错信息 `iam::<domain_id>:user:<name>` 提取
 
 - Account balance: `hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1 --cli-domain-id=<domain_id>`
   - Global services (BSS/IAM/CDN) demand `--cli-domain-id` per call (or in the profile) under AK/SK auth
-  - If the domain_id is unknown: extract it from ANY resource response's `tenant_id` field (e.g. a VPC create response) or from the console (My Credentials page)
+  - If the domain_id is unknown: discover it via `hcloud STS GetCallerIdentity --cli-region=<region>` (`account_id` = domain-id); fall back to `tenant_id` from a resource response or the console
   - Response shape: `account_balances[].amount` (cash account type=1, voucher account type=5), `debt_amount`, `currency`
 - Cost gate rule: no deployment without a per-resource cost estimate AND a balance check. Verified failure mode when skipped: ECS creation dies with `Ecs.7000 Insufficient account balance` at order submission
+- **Quota pre-check (EIP and friends)**: quota errors surface only at RUN stage (`EIP.7905 Quota exceeded` AFTER plan+approval), wasting an approval cycle. Before provisioning, pre-check counts with `hcloud EIP ListPublicips` (⚠️ beware pagination truncation: `--limit=50` on a 59-EIP account showed "50" - the first "50/50 full" verdict was wrong; count precisely, e.g. loop pages or use the console quota page). If quota is exhausted, surface it at the cost gate instead of after approval. Note: after releasing an EIP, quota counting may lag several minutes - `EIP.7905` can persist briefly even under the limit
 
 ## Auth Bootstrapping (prerequisite for every command above)
 
 - Symptom of a broken profile: every hcloud API returns `APIGW.0301 Incorrect IAM authentication information` while OBS/obsutil keeps working - caused by a stale `securityToken` in the profile
 - Fix: `hcloud configure delete --cli-profile=default`, then re-run `npx huaweicloud-devkit auth init` with permanent AK/SK only (no token). `configure set` refuses empty values, so the token cannot be cleared in place
 - project_id is auto-discovered once signing works - no need to configure it manually
-- VPC/OBS create responses expose `tenant_id` (= domain_id) - the reliable fallback source when BSS/IAM discovery is blocked
+- VPC/OBS create responses expose `tenant_id` (= domain_id) - a fallback when `STS GetCallerIdentity` discovery is unavailable

package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md

@@ -16,13 +16,14 @@ Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers u
 
 ## Critical Warnings
 
-| Trap                              | Why                                                             |
-| --------------------------------- | --------------------------------------------------------------- |
-| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO            |
-| NEVER create long-term AK/SK      | Use temporary STS tokens via agencies                           |
-| Wildcard policies dangerous       | Effect:Allow + Resource:* = full access. Always scope resources |
-| Agency trust is powerful          | Agencies let services assume roles. Always add conditions       |
-| Root account must have MFA        | Root AK/SK is all-powerful. Enable MFA immediately              |
+| Trap                              | Why                                                                                                                                                                                                                                                              |
+| --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO                                                                                                                                                                                                             |
+| NEVER create long-term AK/SK      | Use temporary STS tokens via agencies                                                                                                                                                                                                                            |
+| Wildcard policies dangerous       | Effect:Allow + Resource:* = full access. Always scope resources                                                                                                                                                                                                  |
+| Agency trust is powerful          | Agencies let services assume roles. Always add conditions                                                                                                                                                                                                        |
+| Root account must have MFA        | Root AK/SK is all-powerful. Enable MFA immediately                                                                                                                                                                                                               |
+| IAM is a global service in KooCLI | `--cli-region=cn-north-1` routes to the global endpoint and then AK/SK mode needs `--cli-domain-id`. Prefer a concrete region (e.g. `cn-north-4`); if you hit `缺少必填参数 cli-domain-id`, discover it via `hcloud STS GetCallerIdentity --cli-region=<region>` |
 
 ## Policy Structure
 

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -365,6 +365,14 @@ git -c http.sslVerify=false clone <repo-url>
 
 Then retry the clone. This bypasses SSL verification only for this single clone.
 
+**index.html overwritten by the platform landing page**: when a repo is cloned **inside** the sandbox (fallback path, used only when the operator machine has no git), the DevStation portal-template init may asynchronously write a default GitCode/AtomGit landing page over the repo's `index.html`, leaving a blank page after deploy. Symptoms: `git show HEAD:index.html` shows the user's original page but `/workspace/<repo>/index.html` is a Vue SPA shell referencing `cdn-static.gitcode.com`. Recovery:
+
+```bash
+cd /workspace/<repo> && git checkout HEAD -- index.html
+```
+
+Prevention: `sandbox_connect` clones locally and uploads the finished tree by default (`_repoStatus: 'uploaded_from_local'`), which never triggers this race — keep local git available so the fallback in-sandbox clone is not used. The overwrite itself is DevStation platform behavior; report persistent occurrences to the platform team.
+
 #### 3b: Install nginx (before project upload)
 
 ```bash

package/plugins/huaweicloud-core/skills/huawei-voucher/SKILL.md

@@ -49,7 +49,7 @@ version: 1
 ## 环境注意
 
 - 生产环境：`voucher_status` / `voucher_claim` 无需传 `domain_id`，后端从 IAM 自动解析账号。
-- 测试环境：需传 `domain_id`（华为云账号 ID）；未传时返回 `测试环境需提供 domain_id`，此时可用 `hcloud IAM KeystoneListAuthDomains` 查询账号 ID 后补传。
+- 测试环境：需传 `domain_id`（华为云账号 ID）；未传时返回 `测试环境需提供 domain_id`。
 
 ## 注意事项
 

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -137,6 +137,22 @@ Credentials are resolved in this order (highest priority first):
 
 When switching accounts within the same Agent session, use `huaweicloud_auth_init` to set runtime credentials (overrides all sources for the current MCP process), or `huaweicloud_auth_switch action=persist`, which writes S1 with `configuredBySession: true` so the session-configured account outranks `HW_ACCESS_KEY` / `HW_SECRET_KEY`. Note: running `auth init` clears the configuredBySession flag.
 
+## Global Services & domain-id
+
+Global services (BSS, and IAM routed via the `cn-north-1` global endpoint) require `--cli-domain-id` under AK/SK auth. When it is missing, KooCLI fails with `[USE_ERROR]...缺少必填参数cli-domain-id`.
+
+Do **not** ask the user to run `hcloud configure set --cli-domain-id=...`. Discover the domain-id yourself:
+
+```bash
+hcloud STS GetCallerIdentity --cli-region=<region>
+# → account_id IS the domain-id; retry the original call with --cli-domain-id=<account_id>
+```
+
+- `<region>` is the profile's current region. **STS is not deployed in `cn-north-1`** — if the profile region is `cn-north-1`, use another region (e.g. `cn-north-4`).
+- Temporary credentials (AK/SK + security token) work too: add `--cli-security-token=<token>`.
+- Prefer `STS GetCallerIdentity` over `IAM KeystoneListAuthDomains` — the latter only works with permanent credentials and outside `cn-north-1`; it fails under temporary credentials.
+- `cli-domain-id` is a KooCLI CLI requirement, not a Huawei Cloud API requirement: the raw `GET /v3/auth/domains` can be signed with just AK/SK.
+
 ## Preferred Toolkit Tools
 
 - `huaweicloud_auth_init`

package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/SKILL.md

@@ -50,18 +50,19 @@ Use evidence before fixes. Do not guess service behavior when request IDs, regio
 
 ## Common Error Codes
 
-| Error                    | Likely Cause                       | Fix                                                          |
-| ------------------------ | ---------------------------------- | ------------------------------------------------------------ |
-| AuthFailure / 401        | AK/SK invalid or expired           | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init`  |
-| AccessDenied / 403       | IAM permission missing             | Check `huawei-iam` skill, add required policy action         |
-| NoSuchKey / 404          | Resource not found                 | Verify resource ID, region, and project_id                   |
-| QuotaExceeded            | Account limit reached              | Request quota increase in console                            |
-| [USE_ERROR] 不正确的参数 | Wrong param name                   | Run `--help`, check `--param=value` format and nested prefix |
-| Ecs.0005                 | Flavor-image mismatch              | Check image `__support_*` against flavor virtualization type |
-| FSS.0400                 | FunctionGraph latest version error | Strip `:latest` from function URN                            |
-| FSS.1417                 | DEDICATEDGATEWAY missing params    | Add instance_id, group_id, protocol, env_name, env_id        |
-| APIC.7201                | Missing security_group_id          | Add `--security_group_id` param for APIG CreateInstanceV2    |
-| [NETWORK_ERROR]          | Transient network failure          | Retry with `maxRetries` param or wait and retry              |
+| Error                                   | Likely Cause                                           | Fix                                                                                                                                                 |
+| --------------------------------------- | ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- |
+| AuthFailure / 401                       | AK/SK invalid or expired                               | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init`                                                                                         |
+| AccessDenied / 403                      | IAM permission missing                                 | Check `huawei-iam` skill, add required policy action                                                                                                |
+| NoSuchKey / 404                         | Resource not found                                     | Verify resource ID, region, and project_id                                                                                                          |
+| QuotaExceeded                           | Account limit reached                                  | Request quota increase in console                                                                                                                   |
+| [USE_ERROR] 不正确的参数                | Wrong param name                                       | Run `--help`, check `--param=value` format and nested prefix                                                                                        |
+| `[USE_ERROR]缺少必填参数 cli-domain-id` | Global service (BSS / IAM global endpoint) under AK/SK | Run `hcloud STS GetCallerIdentity --cli-region=<region>` → `account_id`, retry with `--cli-domain-id=<account_id>` (see `huaweicloud-cli-and-auth`) |
+| Ecs.0005                                | Flavor-image mismatch                                  | Check image `__support_*` against flavor virtualization type                                                                                        |
+| FSS.0400                                | FunctionGraph latest version error                     | Strip `:latest` from function URN                                                                                                                   |
+| FSS.1417                                | DEDICATEDGATEWAY missing params                        | Add instance_id, group_id, protocol, env_name, env_id                                                                                               |
+| APIC.7201                               | Missing security_group_id                              | Add `--security_group_id` param for APIG CreateInstanceV2                                                                                           |
+| [NETWORK_ERROR]                         | Transient network failure                              | Retry with `maxRetries` param or wait and retry                                                                                                     |
 
 ## KooCLI Error Types
 

package/plugins/huaweicloud-core/src/auth/credential-validator.mjs

@@ -0,0 +1,163 @@
+import crypto from 'node:crypto';
+
+import { getProxyDispatcher } from '../proxy/proxy-agent.mjs';
+
+function iamBaseUrl() {
+  return process.env.HW_IAM_ENDPOINT || 'https://iam.myhuaweicloud.com';
+}
+
+function sha256Hex(data) {
+  return crypto.createHash('sha256').update(data).digest('hex');
+}
+
+function hmacSha256(key, data) {
+  return crypto.createHmac('sha256', key).update(data).digest('hex');
+}
+
+function urlEncode(str) {
+  const hex = (c) => '%' + (c < 16 ? '0' : '') + c.toString(16).toUpperCase();
+  const noEscape = new Set('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~'.split(''));
+  let out = '';
+  for (const ch of str) {
+    const c = ch.codePointAt(0);
+    out += noEscape.has(ch) && c < 0x80 ? ch : c < 0x80 ? hex(c) : encodeURIComponent(ch);
+  }
+  return out;
+}
+
+function timestamp() {
+  return new Date().toISOString().replace(/[-:]/g, '').replace(/\.\d+/, '') + 'Z';
+}
+
+function signIamRequest(path, query, ak, sk, securitytoken) {
+  const ts = timestamp();
+  const host = new URL(iamBaseUrl()).host;
+
+  const cqs = Object.entries(query)
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([k, v]) => `${urlEncode(k)}=${urlEncode(v)}`)
+    .join('&');
+
+  const curi =
+    '/' +
+    path
+      .split('/')
+      .filter(Boolean)
+      .map((s) => urlEncode(s))
+      .join('/') +
+    '/';
+
+  const signedHeaders = securitytoken ? 'host;x-sdk-date;x-security-token' : 'host;x-sdk-date';
+  const canonicalHeaders = securitytoken
+    ? `host:${host}\nx-sdk-date:${ts}\nx-security-token:${securitytoken}\n`
+    : `host:${host}\nx-sdk-date:${ts}\n`;
+
+  const payloadHash = sha256Hex('');
+  const canonicalRequest = ['GET', curi, cqs, canonicalHeaders, signedHeaders, payloadHash].join('\n');
+  const stringToSign = `SDK-HMAC-SHA256\n${ts}\n${sha256Hex(canonicalRequest)}`;
+  const signature = hmacSha256(sk, stringToSign);
+
+  const headers = {
+    host,
+    'x-sdk-date': ts,
+    Authorization: `SDK-HMAC-SHA256 Access=${ak}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
+  };
+  if (securitytoken) {
+    headers['x-security-token'] = securitytoken;
+  }
+  return headers;
+}
+
+function projectForRegion(projects, region) {
+  if (region) {
+    const match = projects.find((p) => p && p.name === region && p.id);
+    if (match) return match.id;
+  }
+  return projects.find((p) => p && p.id)?.id || null;
+}
+
+/**
+ * Validate AK/SK by calling IAM KeystoneListProjects (read-only) with
+ * SDK-HMAC-SHA256 request signing. A wrong SK produces an invalid signature,
+ * which IAM rejects with HTTP 401 before any project data is returned.
+ *
+ * Returns { valid, projectId, error, warning }:
+ * - valid: true when IAM verified the signature (or the rejection is not
+ *   authentication-related), false when the credentials are unusable.
+ * - projectId: first project matching `region`, else the first visible project.
+ * - warning: set when credentials passed but project discovery was denied.
+ */
+export async function validateIamCredentials({ ak, sk, securityToken, region, timeoutMs = 15000 } = {}) {
+  if (!ak || !sk) {
+    return { valid: false, projectId: null, error: 'AK and SK are both required for credential validation.' };
+  }
+
+  const base = iamBaseUrl();
+  const path = '/v3/projects';
+  const query = region ? { name: region } : {};
+  const qs = Object.entries(query)
+    .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
+    .join('&');
+  const url = `${base}${path}${qs ? `?${qs}` : ''}`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+  let resp;
+  try {
+    const headers = signIamRequest(path, query, ak, sk, securityToken);
+    const fetchOpts = { headers, signal: controller.signal };
+    const dispatcher = await getProxyDispatcher(url);
+    if (dispatcher) {
+      fetchOpts.dispatcher = dispatcher;
+      const { fetch: undiciFetch } = await import('undici');
+      resp = await undiciFetch(url, fetchOpts);
+    } else {
+      resp = await fetch(url, fetchOpts);
+    }
+  } catch (error) {
+    return {
+      valid: false,
+      projectId: null,
+      skipped: true,
+      error: `IAM validation request failed (treating credentials as unverified): ${error.message}`,
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+
+  const text = await resp.text();
+  let data = null;
+  try {
+    data = JSON.parse(text);
+  } catch {}
+
+  if (resp.status === 200) {
+    const projects = Array.isArray(data?.projects) ? data.projects : [];
+    return { valid: true, projectId: projectForRegion(projects, region), error: null, warning: null };
+  }
+
+  if (resp.status === 401) {
+    const msg = data?.error?.message || text.slice(0, 200);
+    return {
+      valid: false,
+      projectId: null,
+      error: `IAM rejected the credentials (HTTP 401: ${msg}). The AK/SK is invalid - check the SK for typos or expired security tokens.`,
+    };
+  }
+
+  if (resp.status === 403) {
+    return {
+      valid: true,
+      projectId: null,
+      error: null,
+      warning: `Credentials signed successfully but project listing was denied (HTTP 403). Continuing without project_id.`,
+    };
+  }
+
+  return {
+    valid: false,
+    projectId: null,
+    skipped: true,
+    error: `Unexpected IAM response (HTTP ${resp.status}): ${text.slice(0, 200)}`,
+  };
+}

package/plugins/huaweicloud-core/src/auth/project-id.mjs

@@ -0,0 +1,68 @@
+import { existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+function hcloudCommand(args) {
+  const bin = process.env.HCLOUD_BIN || 'hcloud';
+  // Test doubles (and exotic setups) may point HCLOUD_BIN at a Node script;
+  // those must be launched through node instead of the shell.
+  if (/\.(mjs|cjs|js)$/i.test(bin) && existsSync(bin)) {
+    return { file: process.execPath, args: [bin, ...args] };
+  }
+  return { file: bin, args };
+}
+
+function runHcloud(args, timeoutMs = 20000) {
+  const { file, args: spawnArgs } = hcloudCommand(args);
+  return spawnSync(file, spawnArgs, {
+    windowsHide: true,
+    stdio: 'pipe',
+    timeout: timeoutMs,
+  });
+}
+
+/**
+ * Resolve the project_id for `region` via IAM KeystoneListProjects using the
+ * credentials already stored in the KooCLI profile, then write it back with
+ * `hcloud configure set --cli-project-id=<id>`. Read-only discovery + local
+ * config write only - no secrets appear in process arguments because the
+ * profile carries the credentials.
+ *
+ * Best-effort by design: any failure returns { ok: false, reason } and never
+ * throws, so callers can stay non-fatal.
+ */
+export function resolveAndApplyProjectId({ region, profile } = {}) {
+  if (!region) return { ok: false, reason: 'region is required' };
+  const profileArgs = profile ? [`--cli-profile=${profile}`] : [];
+  try {
+    const list = runHcloud([
+      'IAM',
+      'KeystoneListProjects',
+      ...profileArgs,
+      `--cli-region=${region}`,
+      `--name=${region}`,
+    ]);
+    if (list.status !== 0) {
+      return { ok: false, reason: `KeystoneListProjects failed (exit ${list.status})` };
+    }
+    let projects = null;
+    try {
+      const parsed = JSON.parse(String(list.stdout || ''));
+      projects = Array.isArray(parsed?.projects) ? parsed.projects : Array.isArray(parsed) ? parsed : null;
+    } catch {
+      return { ok: false, reason: 'could not parse KeystoneListProjects output' };
+    }
+    if (!projects || projects.length === 0) {
+      return { ok: false, reason: `no projects found for region ${region}` };
+    }
+    const match = projects.find((p) => p && p.name === region && p.id) || projects.find((p) => p && p.id);
+    if (!match) return { ok: false, reason: 'project list contained no usable ids' };
+
+    const set = runHcloud(['configure', 'set', ...profileArgs, `--cli-project-id=${match.id}`]);
+    if (set.status !== 0) {
+      return { ok: false, reason: `configure set --cli-project-id failed (exit ${set.status})` };
+    }
+    return { ok: true, projectId: match.id };
+  } catch (error) {
+    return { ok: false, reason: error.message };
+  }
+}

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -1,6 +1,7 @@
 import { existsSync } from 'node:fs';
 
 import { getAgentRegistrationStatuses } from './agent-registration.mjs';
+import { resolveAndApplyProjectId } from './project-id.mjs';
 import {
   globalCredentialsPath,
   obsConfigPath,
@@ -98,9 +99,11 @@ export function syncAuth(target = 'all') {
     };
   }
 
+  const project = resolveAndApplyProjectId({ region: credentials.region, profile });
+
   writeLastSync({ kooCliProfile: profile, s1Fingerprint: fingerprint(credentials.ak, credentials.sk) });
 
-  return {
+  const result = {
     ok: true,
     profile,
     obs: { configured: true, path: obs.path, endpoint: obs.endpoint },
@@ -109,4 +112,6 @@ export function syncAuth(target = 'all') {
     agents: getAgentRegistrationStatuses(target).agents,
     note: 'OBS credentials were synced from the global credential vault. Agent MCP registration is managed by "npx huaweicloud-devkit install --target <agent>".',
   };
+  if (project.ok) result.projectId = project.projectId;
+  return result;
 }

package/plugins/huaweicloud-core/src/proxy/proxy-agent.mjs

@@ -26,6 +26,13 @@ export async function getProxyDispatcher(targetUrl) {
   return cachedDispatcher;
 }
 
+export async function fetchWithProxy(url, options = {}) {
+  const dispatcher = await getProxyDispatcher(url);
+  if (!dispatcher) return fetch(url, options);
+  const { fetch: undiciFetch } = await import('undici');
+  return undiciFetch(url, { ...options, dispatcher });
+}
+
 export function clearProxyDispatcherCache() {
   cachedDispatcher = undefined;
   cachedDispatcherProxyUrl = null;

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -17,8 +17,9 @@ import { randomUUID } from 'node:crypto';
 import { createRequire } from 'node:module';
 
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
+import { resolveAndApplyProjectId } from './auth/project-id.mjs';
 import { SUPPORTED_AGENT_TARGETS } from './auth/agent-registration.mjs';
-import { fingerprint, resolveManagedProfile } from './auth/reconcile.mjs';
+import { fingerprint, readKooCliProfiles, resolveManagedProfile } from './auth/reconcile.mjs';
 import { redactSecrets } from './safety-policy.mjs';
 import {
   globalCredentialsPath,
@@ -4311,6 +4312,16 @@ async function cmdAuthInit() {
   console.log('  3. 下载凭证文件（内含 AK 和 SK）。');
   console.log('     注意：SK 只在创建密钥时显示一次，请妥善保存该文件。\n');
 
+  try {
+    const kooCli = readKooCliProfiles();
+    const currentProfile = kooCli.profiles?.find((p) => p.name === kooCli.current);
+    if (currentProfile?.accessKeyId) {
+      console.log(
+        `\x1b[33m检测到 KooCLI 已配置 profile "${currentProfile.name}"（AK 已存储）。SK 为加密存储无法导出，请直接输入或通过环境变量提供凭据。\x1b[0m\n`,
+      );
+    }
+  } catch {}
+
   let ak = process.env.HW_ACCESS_KEY || '';
   let sk = process.env.HW_SECRET_KEY || '';
   let securityToken = process.env.HW_SECURITY_TOKEN || '';
@@ -4321,7 +4332,12 @@ async function cmdAuthInit() {
     console.error(
       '\x1b[31mNon-interactive session detected. Provide credentials via environment variables instead:\x1b[0m',
     );
-    console.error('  HW_ACCESS_KEY, HW_SECRET_KEY');
+    console.error(
+      '  export HW_ACCESS_KEY=<ak> HW_SECRET_KEY=<sk>   then re-run "npx huaweicloud-devkit auth init" to continue',
+    );
+    console.error(
+      '  (Agents: prefer huaweicloud_auth_switch mode=import — reads ~/.config/huaweicloud/creds-import.json and wipes it, so the SK never enters the conversation.)',
+    );
     console.error('  (Or run "npx huaweicloud-devkit auth init" in a real terminal.)');
     process.exitCode = 1;
     return;
@@ -4350,6 +4366,18 @@ async function cmdAuthInit() {
   if (findHcloudBin()) {
     const result = configureHcloud({ ak, sk, region });
     if (!result.ok) console.log(`KooCLI update failed: ${result.error || result.code}`);
+    else {
+      const proj = resolveAndApplyProjectId({ region });
+      if (proj.ok) {
+        console.log(`  Project ID auto-set: ${proj.projectId}`);
+      } else {
+        console.log(
+          `\x1b[33m  Project ID not auto-set (${proj.reason}). Sandbox exec may fail with APIGW.0301 until it is configured:\x1b[0m`,
+        );
+        console.log(`    hcloud IAM KeystoneListProjects --cli-region=${region} --name=${region}`);
+        console.log(`    hcloud configure set --cli-project-id=<project_id>`);
+      }
+    }
   } else {
     console.log('KooCLI not found. Run "npx huaweicloud-devkit install-hcloud" and then "auth sync".');
   }
@@ -4552,6 +4580,8 @@ function readInstalledVersion(pluginsDir) {
 }
 
 function cmdVersion() {
+  console.log(`HuaweiCloud DevKit CLI: ${pkgVersion}`);
+
   const agents = [
     ['OpenCode', opencodePluginsDir()],
     ['Codex Desktop', codexDesktopPluginsDir()],
@@ -4564,16 +4594,24 @@ function cmdVersion() {
     ['Hermes', hermesPluginsDir()],
     ['AtomCode', atomcodePluginsDir()],
   ];
-  let found = 0;
+  const installed = [];
   for (const [label, dir] of agents) {
     const v = dir ? readInstalledVersion(dir) : null;
     if (!v) continue;
-    console.log(`${label}: ${v}`);
-    found += 1;
+    installed.push([label, v]);
   }
-  if (found === 0) {
+
+  if (installed.length === 0) {
+    console.log('');
     console.log('No Huawei Cloud DevKit plugin installed. Run `npx huaweicloud-devkit install --target <agent>`.');
+    return;
+  }
+
+  console.log('\nInstalled agent plugins:');
+  for (const [label, version] of installed) {
+    console.log(`${label}: ${version}`);
   }
+  console.log('\nRun `npx huaweicloud-devkit update --target <agent>` to refresh installed agent plugins.');
 }
 
 async function main() {
@@ -4636,13 +4674,13 @@ async function main() {
       console.log('  install-hcloud  Show KooCLI install commands for your OS');
       console.log('  auth         Manage unified auth: init | sync | status | reconcile');
       console.log('  proxy        Manage proxy config: init | show | clear');
-      console.log('  version      Print installed plugin version per agent');
+      console.log('  version      Print CLI version and installed plugin version per agent');
       console.log('  help         Show this help');
       console.log('\nOptions:');
       console.log(
         '  --target     Target agent: opencode (default), codex, codearts, codearts-work, workbuddy, dsh, officeace, hermes, openclaw, atomcode, all',
       );
-      console.log('  --version    Print installed plugin version per agent');
+      console.log('  --version    Print CLI version and installed plugin version per agent');
       console.log('  --clean-kocli   (with: uninstall --target all) also remove KooCLI');
       console.log('  --clean-obs     (with: uninstall --target all) also remove OBS config');
       console.log('  --clean-global  (with: uninstall --target all) also remove KooCLI + OBS config');

package/plugins/huaweicloud-core/src/telemetry/agent-detect.mjs

@@ -7,7 +7,7 @@ import { AGENTS, matchAgent, detectVersion, installSegment } from './agent-regis
 export function detectAgentHarness(clientInfo = {}) {
   if (process.env.AGENT_HARNESS) return process.env.AGENT_HARNESS;
   for (const agent of AGENTS) {
-    if (matchAgent(agent)) return agent.id;
+    if (matchAgent(agent, clientInfo)) return agent.id;
   }
   return clientInfo.name || null;
 }
@@ -22,7 +22,7 @@ export function detectAgent(clientInfo = {}) {
   }
 
   for (const agent of AGENTS) {
-    if (matchAgent(agent)) {
+    if (matchAgent(agent, clientInfo)) {
       return {
         harness: agent.id,
         version: detectVersion(agent.version) || clientInfo.version || '0.0.0',

package/plugins/huaweicloud-core/src/telemetry/agent-registry.mjs

@@ -43,6 +43,7 @@ export const AGENTS = [
     id: 'codex',
     pathPatterns: null,
     envVars: ['CODEX_SESSION_ID', 'CODEX_CLI_VERSION', 'CODEX_SANDBOX', 'CODEX_THREAD_ID'],
+    clientNames: ['codex-mcp-client'],
     version: null,
   },
   {
@@ -67,6 +68,7 @@ export const AGENTS = [
     id: 'officeace',
     pathPatterns: ['/.office-claw/', '/.officeace/'],
     envVars: ['OFFICEACE_SESSION_ID', 'OFFICE_CLAW_CONFIG_ROOT'],
+    clientNames: ['office-claw-mcp-connector-probe'],
     version: { type: 'officeace' },
   },
   {
@@ -85,6 +87,7 @@ export const AGENTS = [
     id: 'openclaw',
     pathPatterns: ['/.openclaw/', '/.agents/huaweicloud-plugins/'],
     envVars: ['OPENCLAW_SESSION_ID', 'OPENCLAW_CONFIG_ROOT'],
+    clientNames: ['openclaw-bundle-mcp'],
     version: null,
   },
   {
@@ -161,9 +164,14 @@ export const AGENTS = [
   },
 ];
 
-export function matchAgent(agent) {
+export function matchAgent(agent, clientInfo = {}) {
   if (agent.pathPatterns && agent.pathPatterns.some((p) => selfPath.includes(p))) return true;
   if (agent.envVars && agent.envVars.some((v) => process.env[v])) return true;
+  const name = clientInfo.name;
+  if (!name) return false;
+  const lower = String(name).toLowerCase();
+  if (agent.id.toLowerCase() === lower) return true;
+  if (agent.clientNames && agent.clientNames.some((n) => n.toLowerCase() === lower)) return true;
   return false;
 }
 

package/plugins/huaweicloud-core/src/telemetry/telemetry.mjs

@@ -13,6 +13,8 @@ import { homedir, hostname, type as osType, networkInterfaces, release as osRele
 import { createHash, randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 
+import { fetchWithProxy } from '../proxy/proxy-agent.mjs';
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const PLUGIN_DIR = join(__dirname, '..', '..');
@@ -56,6 +58,8 @@ const MAX_QUEUE_SIZE = 500;
 const FLUSH_INTERVAL_MS = 60_000;
 const BATCH_SIZE = 100;
 const FETCH_TIMEOUT_MS = 5000;
+const MAX_VALUE_LENGTH = 255;
+const MAX_RETRIES = 3;
 
 const DEFAULT_ENDPOINT = 'https://devkit.huaweicloud.com/rest/developer/server/hdkitservice/telemetry/events';
 
@@ -178,10 +182,19 @@ function capabilityFromKey(key) {
   return undefined;
 }
 
+export function sanitizeValue(value) {
+  if (typeof value !== 'string') value = value == null ? '' : String(value);
+  value = value.replace(/[\r\n\t]+/g, ' ').trim();
+  if (value.length > MAX_VALUE_LENGTH) {
+    value = value.slice(0, MAX_VALUE_LENGTH - 3) + '...';
+  }
+  return value;
+}
+
 function buildEvent(raw) {
   const event = {
     key: raw.key,
-    value: raw.value,
+    value: sanitizeValue(raw.value),
     installId: installId,
     userHash: userHash,
     version: PLUGIN_VERSION,
@@ -300,6 +313,13 @@ export function cacheUserHash(hash) {
   writeTextFile(USER_HASH_PATH, hash);
 }
 
+export function clearUserHash() {
+  userHash = null;
+  try {
+    unlinkSync(USER_HASH_PATH);
+  } catch {}
+}
+
 function flushEvents() {
   if (isFlushing) return;
   if (eventQueue.length === 0) return;
@@ -315,10 +335,10 @@ function flushEvents() {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
 
-  fetch(endpoint, {
+  fetchWithProxy(endpoint, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(batch),
+    body: JSON.stringify(batch.map(({ _retries, ...rest }) => rest)),
     signal: controller.signal,
   })
     .then((resp) => {
@@ -330,19 +350,35 @@ function flushEvents() {
           if (event.key === 'plugin:install') touchFile(installStampPath());
           if (event.key === 'plugin:first_use') touchFile(firstUseStampPath());
         }
+      } else if (resp.status >= 400 && resp.status < 500) {
+        debugLog(`POST status=${resp.status} dropping ${batch.length} events (client error)`);
       } else {
-        eventQueue = [...batch, ...eventQueue];
+        requeueEvents(batch);
       }
       isFlushing = false;
     })
     .catch((error) => {
       clearTimeout(timer);
       debugLog(`POST FAIL err=${error.message} events=${batch.length}`);
-      eventQueue = [...batch, ...eventQueue];
+      requeueEvents(batch);
       isFlushing = false;
     });
 }
 
+function requeueEvents(batch) {
+  const kept = [];
+  for (const event of batch) {
+    const retries = event._retries || 0;
+    if (retries >= MAX_RETRIES) {
+      debugLog(`DROP event key=${event.key} after ${MAX_RETRIES} retries`);
+      continue;
+    }
+    event._retries = retries + 1;
+    kept.push(event);
+  }
+  if (kept.length > 0) eventQueue = [...kept, ...eventQueue];
+}
+
 export function initTelemetry({ harness, version }) {
   installId = generateOrRecoverInstallId();
   agentHarness = harness || 'unknown';

package/plugins/huaweicloud-core/src/tools.mjs

@@ -29,9 +29,11 @@ import {
   hdkitCredentials,
   hdkitVoucherStatus,
   hdkitVoucherClaim,
+  hdkitGenerateUserHash,
 } from './sandbox/hdkitservice-api.mjs';
 import { getCredentials } from './sandbox/hwlink-api.mjs';
 import { getAuthStatus, syncAuth } from './auth/service.mjs';
+import { validateIamCredentials } from './auth/credential-validator.mjs';
 import {
   readGlobalCredentials,
   writeGlobalCredentials,
@@ -43,8 +45,9 @@ import {
   writeLastSync,
   readCodeArtsCredentials,
   globalCredentialsPath,
+  resolveCredentialsWithRuntime,
 } from './auth/credentials.mjs';
-import { trackToolInvoke, trackSkillRetrieve } from './telemetry/telemetry.mjs';
+import { trackToolInvoke, trackSkillRetrieve, clearUserHash } from './telemetry/telemetry.mjs';
 import { fingerprint, runHcloudConfigure, resolveManagedProfile } from './auth/reconcile.mjs';
 import {
   getCachedUpdateInfo,
@@ -771,13 +774,18 @@ export const TOOL_DEFINITIONS = [
   {
     name: 'huaweicloud_sandbox_credentials',
     description:
-      'Configure temporary AK/SK for a sandbox via hdkitservice. Injects temporary credentials into the sandbox. The sandbox must be in RUNNING state.',
+      'Configure temporary AK/SK for a sandbox via hdkitservice. Validates the current AK/SK against IAM before injecting (invalid SK is rejected here instead of failing later with APIGW.0301 during exec), then injects temporary credentials into the sandbox. The sandbox must be in RUNNING state.',
     inputSchema: {
       type: 'object',
       properties: {
         session_id: { type: 'string', description: 'Session ID from huaweicloud_sandbox_connect' },
         dev_stage_id: { type: 'string', description: 'DevStation environment ID (alternative to session_id)' },
         enable_sts: { type: 'boolean', description: 'Whether to enable STS temporary AK/SK (default: true)' },
+        region: {
+          type: 'string',
+          description:
+            'Region used for IAM credential validation and project_id resolution (defaults to the configured region)',
+        },
       },
     },
   },
@@ -997,6 +1005,13 @@ function persistCredentials(ak, sk, securityToken, region) {
   };
 }
 
+function refreshUserHashAfterAuthChange({ regenerate = true } = {}) {
+  clearUserHash();
+  if (regenerate) {
+    hdkitGenerateUserHash().catch(() => {});
+  }
+}
+
 export async function callTool(name, args = {}) {
   const toolValue = toolInvokeValue(name, args);
   trackToolInvoke(name, toolValue);
@@ -1055,22 +1070,28 @@ export async function callTool(name, args = {}) {
       return setupObsConfig(args.profile);
     case 'huaweicloud_auth_status':
       return getAuthStatus(args.target || 'all');
-    case 'huaweicloud_auth_sync':
-      return syncAuth(args.target || 'all');
+    case 'huaweicloud_auth_sync': {
+      const result = syncAuth(args.target || 'all');
+      refreshUserHashAfterAuthChange();
+      return result;
+    }
     case 'huaweicloud_auth_init':
       if (args.clear) {
         clearRuntimeCredentials();
+        refreshUserHashAfterAuthChange({ regenerate: false });
         return { status: 'cleared', message: 'Runtime credentials cleared. Fallback to env/file.' };
       }
       if (!args.ak || !args.sk) {
         throw new Error('ak and sk are required. Set clear=true to clear runtime credentials.');
       }
       setRuntimeCredentials(args.ak, args.sk, undefined, args.region);
+      refreshUserHashAfterAuthChange();
       return { status: 'ok', message: 'Runtime credentials set for this MCP session.' };
     case 'huaweicloud_auth_switch': {
       const action = args.action || 'temporary';
       if (action === 'clear') {
         clearRuntimeCredentials();
+        refreshUserHashAfterAuthChange({ regenerate: false });
         return { status: 'cleared', message: 'Runtime credentials cleared. Fallback to env/file/S1.' };
       }
 
@@ -1100,6 +1121,7 @@ export async function callTool(name, args = {}) {
 
       if (action === 'temporary') {
         setRuntimeCredentials(ak, sk, securityToken || undefined, region);
+        refreshUserHashAfterAuthChange();
         return {
           status: 'ok',
           scope: 'temporary',
@@ -1131,7 +1153,9 @@ export async function callTool(name, args = {}) {
         };
       }
 
-      return persistCredentials(ak, sk, securityToken, region);
+      const persisted = persistCredentials(ak, sk, securityToken, region);
+      refreshUserHashAfterAuthChange();
+      return persisted;
     }
     case 'huaweicloud_auth_confirm': {
       const pending = pendingConfirms.get(args.token);
@@ -1140,7 +1164,9 @@ export async function callTool(name, args = {}) {
       if (args.decision === 's1') {
         return { status: 'ok', outcome: 'aborted', message: '保持 S1 现有账号，未覆盖。' };
       }
-      return persistCredentials(pending.newAk, pending.newSk, pending.newSecurityToken, pending.newRegion);
+      const confirmed = persistCredentials(pending.newAk, pending.newSk, pending.newSecurityToken, pending.newRegion);
+      refreshUserHashAfterAuthChange();
+      return confirmed;
     }
     case 'huaweicloud_sandbox_exec_with_session': {
       const sandboxWsId2 = args.workspace_id || getCurrentWorkspaceId();
@@ -1300,6 +1326,32 @@ export async function callTool(name, args = {}) {
     }
     case 'huaweicloud_sandbox_credentials': {
       const devStageId = args.dev_stage_id || getCurrentWorkspaceId();
+      let resolved;
+      try {
+        resolved = resolveCredentialsWithRuntime();
+      } catch {
+        resolved = null;
+      }
+      if (!resolved?.ak || !resolved?.sk) {
+        return {
+          ok: false,
+          error: 'Huawei Cloud credentials are not configured. Nothing was injected into the sandbox.',
+          hint: 'Run "npx huaweicloud-devkit auth init" or set HW_ACCESS_KEY/HW_SECRET_KEY, then retry.',
+        };
+      }
+      const validation = await validateIamCredentials({
+        ak: resolved.ak,
+        sk: resolved.sk,
+        securityToken: resolved.securityToken,
+        region: args.region || resolved.region,
+      });
+      if (!validation.valid && !validation.skipped) {
+        return {
+          ok: false,
+          error: 'Credential validation failed before injection: ' + validation.error,
+          hint: 'Credentials were NOT injected into the sandbox. Fix AK/SK first: run "npx huaweicloud-devkit auth init" or correct HW_ACCESS_KEY/HW_SECRET_KEY, then retry.',
+        };
+      }
       const credResult = await hdkitCredentials(args.session_id, devStageId, args.enable_sts !== false);
       const sandboxWsIdCred = args.dev_stage_id || getCurrentWorkspaceId();
       if (sandboxWsIdCred) {
@@ -1310,6 +1362,7 @@ export async function callTool(name, args = {}) {
             `export HW_SECRET_KEY='${sk}'`,
             securitytoken ? `export HW_SECURITY_TOKEN='${securitytoken}'` : '',
             securitytoken ? `export X_HW_SECURITY_TOKEN='${securitytoken}'` : '',
+            validation.projectId ? `export HW_PROJECT_ID='${validation.projectId}'` : '',
           ]
             .filter(Boolean)
             .join('\n');
@@ -1323,7 +1376,14 @@ export async function callTool(name, args = {}) {
           await execWithSession(sandboxWsIdCred, `source ${credsFile} && echo "CREDS_SOURCED"`, 'root', 15000);
         } catch {}
       }
-      return credResult;
+      const result = {
+        ...credResult,
+        credentialValidation: validation.warning ? 'passed-with-warning' : 'passed',
+      };
+      if (validation.projectId) result.projectId = validation.projectId;
+      if (validation.warning) result.warning = validation.warning;
+      if (validation.skipped) result.warning = validation.error;
+      return result;
     }
     case 'huaweicloud_voucher_status':
       return await hdkitVoucherStatus(args.domain_id);
@@ -1806,6 +1866,8 @@ function explainError({ service = 'unknown', errorCode = '', message = '', reque
       'VPC.0301': 'Bandwidth name is required for PER type EIPs, even though --help marks it optional.',
     },
     APIGW: {
+      'APIGW.0301':
+        'Incorrect IAM authentication information. The AK/SK is invalid (check the SK for typos), the security token is missing or expired, or the profile lacks project_id. Fix: re-run "npx huaweicloud-devkit auth init" (it auto-sets project_id), or set it manually: hcloud configure set --cli-project-id=<project_id> after finding it via hcloud IAM KeystoneListProjects --cli-region=<region> --name=<region>.',
       'APIGW.0802':
         'The current IAM user has no permissions in the requested region. Go to IAM console → Users → Permissions → add the target region, or switch to a different region.',
     },
@@ -1836,7 +1898,9 @@ function explainError({ service = 'unknown', errorCode = '', message = '', reque
         ': API Gateway layer error. ' +
         (errorCode === 'APIGW.0802'
           ? 'IAM user has no region permissions — check IAM console → User → Permissions → add target region.'
-          : 'Verify the API request, region endpoint, and IAM permissions.'),
+          : errorCode === 'APIGW.0301'
+            ? 'Incorrect IAM authentication information — verify AK/SK (SK typos are the usual cause), security token expiry, and that project_id is configured (auth init auto-sets it).'
+            : 'Verify the API request, region endpoint, and IAM permissions.'),
     );
   }
   if (/region|endpoint|project/i.test(combined)) {