huaweicloud-devkit 1.1.2-next.5 → 1.1.2-next.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. package/package.json +1 -1
  2. package/plugins/huaweicloud-core/.claude-plugin/plugin.json +1 -1
  3. package/plugins/huaweicloud-core/.codex-plugin/plugin.json +1 -1
  4. package/plugins/huaweicloud-core/.cursor-plugin/plugin.json +1 -1
  5. package/plugins/huaweicloud-core/.hermes-plugin/plugin.json +1 -1
  6. package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json +1 -1
  7. package/plugins/huaweicloud-core/openclaw.plugin.json +1 -1
  8. package/plugins/huaweicloud-core/skills/huawei-billing/SKILL.md +8 -7
  9. package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md +2 -0
  10. package/plugins/huaweicloud-core/skills/huawei-iac/SKILL.md +6 -2
  11. package/plugins/huaweicloud-core/skills/huawei-iac/references/resource-catalog.md +20 -13
  12. package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md +8 -7
  13. package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md +8 -0
  14. package/plugins/huaweicloud-core/skills/huawei-voucher/SKILL.md +1 -1
  15. package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md +15 -0
  16. package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/SKILL.md +13 -12
  17. package/plugins/huaweicloud-core/src/setup-cli.mjs +17 -2
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "huaweicloud-devkit",
3
3
  "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
4
- "version": "1.1.2-next.5",
4
+ "version": "1.1.2-next.7",
5
5
  "kooCliVersion": "7.2.12",
6
6
  "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
7
7
  "type": "module",
package/plugins/huaweicloud-core/.claude-plugin/plugin.json CHANGED
@@ -17,7 +17,7 @@
17
17
  "mcpServers": "./.mcp.json",
18
18
  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
19
19
  "skills": "./skills/",
20
- "version": "1.1.2-next.5",
20
+ "version": "1.1.2-next.7",
21
21
  "author": {
22
22
  "name": "HuaweiCloud Mate",
23
23
  "url": "https://github.com/huaweicloud"
package/plugins/huaweicloud-core/.codex-plugin/plugin.json CHANGED
@@ -20,7 +20,7 @@
20
20
  "mcpServers": "./.mcp.json",
21
21
  "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
22
22
  "skills": "./skills/",
23
- "version": "1.1.2-next.5",
23
+ "version": "1.1.2-next.7",
24
24
  "author": {
25
25
  "name": "HuaweiCloud Mate",
26
26
  "url": "https://github.com/huaweicloud"
package/plugins/huaweicloud-core/.cursor-plugin/plugin.json CHANGED
@@ -17,7 +17,7 @@
17
17
  "mcpServers": "./.mcp.json",
18
18
  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
19
19
  "skills": "./skills/",
20
- "version": "1.1.2-next.5",
20
+ "version": "1.1.2-next.7",
21
21
  "author": {
22
22
  "name": "HuaweiCloud Mate",
23
23
  "url": "https://github.com/huaweicloud"
package/plugins/huaweicloud-core/.hermes-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "huaweicloud-devkit",
3
- "version": "1.1.2-next.5",
3
+ "version": "1.1.2-next.7",
4
4
  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
5
5
  "author": {
6
6
  "name": "HuaweiCloud Mate",
package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "huaweicloud-devkit",
3
- "version": "1.1.2-next.5",
3
+ "version": "1.1.2-next.7",
4
4
  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
5
5
  "author": {
6
6
  "name": "HuaweiCloud Mate",
package/plugins/huaweicloud-core/openclaw.plugin.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "name": "huaweicloud-devkit",
3
3
  "id": "huaweicloud-devkit",
4
4
  "displayName": "HuaweiCloud DevKit",
5
- "version": "1.1.2-next.5",
5
+ "version": "1.1.2-next.7",
6
6
  "family": "bundle-plugin",
7
7
  "bundleFormat": "codex",
8
8
  "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",
package/plugins/huaweicloud-core/skills/huawei-billing/SKILL.md CHANGED
@@ -16,12 +16,13 @@ Domain expertise for billing queries (BSS). Covers cost tracking, bill details,
16
16
 
17
17
  ## Critical Warnings
18
18
 
19
- | Trap | Why |
20
- | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
21
- | Bills delayed ~24h | Yesterday's costs may not appear until the next day |
22
- | BSS Admin role needed | IAM user must have BSS Administrator or Finance role |
23
- | Currency conversion varies | Cross-region costs use daily exchange rates |
24
- | Region fixed to cn-north-1 | BSS operations only support `--cli-region=cn-north-1` in KooCLI. This is a KooCLI metadata limitation — the billing data itself covers all regions. |
19
+ | Trap | Why |
20
+ | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
21
+ | Bills delayed ~24h | Yesterday's costs may not appear until the next day |
22
+ | BSS Admin role needed | IAM user must have BSS Administrator or Finance role |
23
+ | Currency conversion varies | Cross-region costs use daily exchange rates |
24
+ | Region fixed to cn-north-1 | BSS operations only support `--cli-region=cn-north-1` in KooCLI. This is a KooCLI metadata limitation — the billing data itself covers all regions. |
25
+ | `缺少必填参数 cli-domain-id` / APIGW.0301 | Invalid credentials — KooCLI can't resolve the account-id | Re-run `npx huaweicloud-devkit auth init` |
25
26
 
26
27
  ## Common Workflows
27
28
 
@@ -31,7 +32,7 @@ Domain expertise for billing queries (BSS). Covers cost tracking, bill details,
31
32
  | List customer bills | `ListCustomerBillsFeeRecords --cli-region=cn-north-1 --project_id=<p>` |
32
33
  | List resource usage | `ListResourceUsage --cli-region=cn-north-1 --project_id=<p>` |
33
34
  | List sub-customers | `ListConsumeSubCustomers --cli-region=cn-north-1 --project_id=<p>` |
34
- | Show account balance | `ShowCustomerAccountBalances --cli-region=cn-north-1 --project_id=<p>` |
35
+ | Show account balance | `ShowCustomerAccountBalances --cli-region=cn-north-1` |
35
36
  | List conversions | `ListConversions --cli-region=cn-north-1 --project_id=<p>` |
36
37
 
37
38
  Discover exact parameters with `--help` before executing any command. All BSS operations are read-only.
package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md CHANGED
@@ -69,4 +69,6 @@ hcloud IAM AssociateAgencyWithDomainPermission --agency_id=<id> --domain_id=<id>
69
69
  hcloud FunctionGraph CreateFunction --func_vpc.vpc_id=<vpc> --func_vpc.subnet_id=<subnet> --app_xrole=<name> ...
70
70
  ```
71
71
 
72
+ > The `缺少必填参数 cli-domain-id` error means invalid credentials (APIGW.0301) — re-run `auth init`. `CreateAgency` / `AssociateAgencyWithDomainPermission` need the account-id for their `--agency.domain_id` / `--domain_id` params; get it via `hcloud STS GetCallerIdentity --cli-region=<region>`.
73
+
72
74
  | QuotaExceeded | Max 10 functions per project per region |
package/plugins/huaweicloud-core/skills/huawei-iac/SKILL.md CHANGED
@@ -15,6 +15,7 @@ Always run `hcloud <Service> <Operation> --help` before constructing commands to
15
15
  - This skill orchestrates the **purchase lifecycle of ALL supported resources**: proposal → pricing → provisioning → destroy, across every service in the plugin catalog.
16
16
  - **Web app deployment keeps sandbox as the first choice** (see `huaweicloud-core` Deployment Target Options). Route here only when the user wants billed, long-term, or multi-resource cloud infrastructure, or explicitly asks for an architecture + cost proposal.
17
17
  - Single-resource tasks go directly to the service skill. This skill adds value for **multi-resource orchestration, mandatory cost gating, and ordered destroy**.
18
+ - **A user-specified hosting target (e.g. "部署到 ECS") does NOT exempt the flow**: stages 1-5 (code inspection, cost estimate, balance check, risk warnings) still run in full - the user's target choice only narrows stage 2/3 options, it never skips the gates.
18
19
 
19
20
  ## Workflow (strict order)
20
21
 
@@ -47,7 +48,7 @@ Preconditions - all required:
47
48
  3. The user explicitly names the target deployment. Ambiguous "delete it" → list deployments and ask. Never guess.
48
49
  4. Every delete command still goes through plan → approve → run.
49
50
 
50
- Execution: show the to-be-deleted list for final confirmation → delete in **reverse creation order** → a "resource not found" error counts as already deleted, continue → mark `destroyed`. OBS: upload paths like `assets/style.css` auto-create folder-marker objects that outlive the files - prefer one recursive sweep `hcloud OBS rm obs://<bucket>/ -r -f` over per-object deletes, then delete the bucket (a non-empty bucket fails with 409 `BucketNotEmpty`). CDN: disable then delete. DNS: delete the record set (only if hosted in Huawei Cloud DNS).
51
+ Execution: show the to-be-deleted list for final confirmation → delete in **reverse creation order** → a "resource not found" error counts as already deleted, continue → mark `destroyed`. OBS: recursive sweeps (`OBS rm obs://<bucket>/ -r -f`) are DENIED by the safety rule `hwc-destructive-delete-force` even after manifest approval - do not plan them. Instead list objects (`hcloud OBS ls obs://<bucket>/ -s`) and delete per-object (watch for folder-marker objects like `assets/` that outlive the files), then delete the bucket (a non-empty bucket fails with 409 `BucketNotEmpty`). CDN: disable then delete. DNS: delete the record set (only if hosted in Huawei Cloud DNS).
51
52
 
52
53
  ## Critical Warnings
53
54
 
@@ -63,6 +64,9 @@ Execution: show the to-be-deleted list for final confirmation → delete in **re
63
64
  | Public exposure is auto-blocked | Risk rules deny `0.0.0.0/0` port rules at plan time. For test/dev use a narrower `remote_ip_prefix` (e.g. the VPC CIDR) or get user consent for a documented exception |
64
65
  | ECS CreateServers hidden required params | Besides flavor/image/nics/az it also needs `--server.vpcid` and `--server.root_volume.volumetype` - order submission fails without them |
65
66
  | FunctionGraph runtime/code enums are strict | runtime must be exact (`Node.js18.15`, `Python3.9`, `Go1.x`, ...); inline code is the PAIR `--package=default --code_type=inline` (`--package=inline` → `FSS.1006`); TIMER triggers use `--event_data.schedule_type=Rate --event_data.schedule=1m` (`@every` style → `FSS.1109`); DeleteFunction takes `--function_urn` WITHOUT `:latest` |
67
+ | Keypairs: `NovaCreateKeypair`, not CreateKeypair | `ECS CreateKeypair` does NOT exist - use `hcloud ECS NovaCreateKeypair`; delete takes `--keypair_name` (not `--keypair.name`). The API-generated `private_key` is MASKED in tool output - for SSH access create the keypair in the console or import the user's own public key, then bind with `--server.key_name=<n>` |
68
+ | Long inline args break MCP JSON | Values >~2KB inline (e.g. `--server.user_data=<base64 cloud-init>`) fail JSON parsing silently. Write a local JSON file and pass `--cli-jsonInput=<file>` (see `references/resource-catalog.md` header note) |
69
+ | EIP quota fails at RUN stage, not at plan | `EIP.7905 Quota exceeded` appears only after plan+approval - pre-check quota during stage 5 (and count precisely: `ListPublicips --limit=50` truncates, a "50/50" read on a 59-EIP account is wrong). Released quotas may lag minutes before `EIP.7905` clears |
66
70
  | Zero balance blocks order submission | ECS creation fails with `Ecs.7000 Insufficient account balance` when cash + voucher accounts are 0. This is the stage-5 gate materialized: stop, mark `partial`, tell the user pay-by-duration resources need a deposit. Free-tier resources (FunctionGraph, small OBS) DO work at 0 balance - the gate applies to order-submission resources only |
67
71
  | CDN mainland acceleration requires ICP filing | Unregistered domains cannot go live on CDN - check before stage 3. CDN create ALSO requires domain ownership verification first (`CDN.00010185 Verify domain ownership failed` - user must add a DNS record or upload a verification file) |
68
72
  | CDN is a global service in KooCLI | CDN operations only accept `--cli-region=cn-north-1` or `ap-southeast-1` - never the resource region |
@@ -82,7 +86,7 @@ Execution: show the to-be-deleted list for final confirmation → delete in **re
82
86
  - `huaweicloud_run_readonly_command` → discovery (flavors, images, zones, prices)
83
87
  - `huaweicloud_list_regions` / `huaweicloud_get_regional_availability` → region intent
84
88
  - `huaweicloud_hook_check_deploy_plan` → risk-check the plan before approval
85
- - Balance and pricing: `huawei-billing` skill. Balance operation (BSS is pinned to cn-north-1 in KooCLI): `hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1 --cli-domain-id=<domain_id>`. Global services (BSS/IAM) require `--cli-domain-id` per call or in the profile - if unknown, extract it from any resource response's `tenant_id` field (e.g. a VPC create response), or from the profile's domainId once configured
89
+ - Balance and pricing: `huawei-billing` skill. Balance operation (BSS is pinned to cn-north-1 in KooCLI): `hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1` (domain-id auto-resolves from the AK/SK). If an IAM business param genuinely needs the account-id, run `hcloud STS GetCallerIdentity --cli-region=<region>`
86
90
 
87
91
  ## Cross-Skill References
88
92
 
package/plugins/huaweicloud-core/skills/huawei-iac/references/resource-catalog.md CHANGED
@@ -3,10 +3,12 @@
3
3
  Every resource type the orchestration flow can purchase, bind, and destroy. This is the authoritative checklist when composing a deployment plan.
4
4
 
5
5
  > **Operation names below are entry points, not gospel.** Always confirm exact parameters with `hcloud <Service> <Operation> --help` before planning a command. When an operation name is uncertain, run `hcloud <Service> --help` first.
6
+ >
7
+ > **Long parameter values MUST go through a file.** Inline args longer than ~2KB (e.g. `--server.user_data=<base64 cloud-init>`) break MCP JSON parsing and the command silently fails. Write a local JSON file and pass `--cli-jsonInput=<file>` instead (KooCLI-native; the approval gate matches the arg verbatim, so use the same file path in plan and run).
6
8
 
7
9
  ## Networking (foundation - create first, destroy last)
8
10
 
9
- > **v3 API notes (verified by E2E)**: `CreateSecurityGroup` is account-scoped - NO `vpc_id` param. `CreateSecurityGroupRule` uses `multiport=80` (not `port_range_min/max`). `DeleteSubnet` requires `--vpc_id` in addition to `--subnet_id`. Deletion APIs return empty output on success (async 202/204) - confirm via list, not stdout.
11
+ > **v3 API notes (verified by E2E)**: `CreateSecurityGroup` is account-scoped - NO `vpc_id` param. `CreateSecurityGroupRule` uses `multiport=80` (not `port_range_min/max`). `DeleteSubnet` requires `--vpc_id` in addition to `--subnet_id`. Deletion APIs return empty output on success (async 202/204) - confirm via list, not stdout. `ListPorts` uses array-style params (`--device_id.1=<uuid>`, `--network_id.1=<id>`) - flat `--device_id`/`--network_id` fail with USE_ERROR, and `--limit` is not supported.
10
12
 
11
13
  | Resource | Create | Delete | Skill | Depends on |
12
14
  | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -19,18 +21,21 @@ Every resource type the orchestration flow can purchase, bind, and destroy. This
19
21
 
20
22
  ## Compute
21
23
 
22
- | Resource | Create | Delete | Skill | Depends on |
23
- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------ | ---------- | -------------------------------------------------------------------------- |
24
- | ECS instance | `hcloud ECS CreateServers --server.name=<n> --server.flavorRef=<id> --server.imageRef=<id> --server.vpcid=<id> --server.nics.1.subnet_id=<id> --server.security_groups.1.id=<id> --server.availability_zone=<az> --server.root_volume.volumetype=<type>` (hidden required: `vpcid` + `root_volume.volumetype`; check flavor family vs image arch, e.g. kc1 = ARM needs an ARM image) | `hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true` | huawei-ecs | VPC + Subnet + SG. Set both delete flags true on teardown or EIP/disk leak |
25
- | EVS data disk | `hcloud EVS CreateVolume` | `hcloud EVS DeleteVolume` | huawei-ecs | - (attach with `hcloud ECS AttachServerVolume`) |
24
+ | Resource | Create | Delete | Skill | Depends on |
25
+ | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------- | ---------- | -------------------------------------------------------------------------- |
26
+ | ECS instance | `hcloud ECS CreateServers --server.name=<n> --server.flavorRef=<id> --server.imageRef=<id> --server.vpcid=<id> --server.nics.1.subnet_id=<id> --server.security_groups.1.id=<id> --server.availability_zone=<az> --server.root_volume.volumetype=<type>` (hidden required: `vpcid` + `root_volume.volumetype`; check flavor family vs image arch, e.g. kc1 = ARM needs an ARM image) | `hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true` | huawei-ecs | VPC + Subnet + SG. Set both delete flags true on teardown or EIP/disk leak |
27
+ | ECS keypair | `hcloud ECS NovaCreateKeypair --keypair.name=<n>` (⚠️ `ECS CreateKeypair` does NOT exist; `NovaCreateKeypair` with a `public_key` field imports your own pubkey, otherwise the API generates one) | `hcloud ECS NovaDeleteKeypair --keypair_name=<n>` (param is `--keypair_name`, NOT `--keypair.name`) | huawei-ecs | - |
28
+ | EVS data disk | `hcloud EVS CreateVolume` | `hcloud EVS DeleteVolume` | huawei-ecs | - (attach with `hcloud ECS AttachServerVolume`) |
29
+
30
+ > **Keypair private_key is NOT retrievable via CLI**: the API-created keypair returns `private_key` once, but the tool output redaction masks it - the agent can never read it back. For SSH access, either guide the user to create the keypair in the console, or have them bring their own public key (import via `NovaCreateKeypair` `public_key` field, then reference with `--server.key_name=<n>` at ECS create).
26
31
 
27
32
  ## Databases
28
33
 
29
- | Resource | Create | Delete | Skill | Depends on |
30
- | --------------------------- | --------------------------------------------------------- | ------------------------------------------------------- | -------------- | ------------ |
31
- | RDS (MySQL/PG/SQLServer) | discover with `hcloud RDS --help` (CreateInstance family) | discover with `hcloud RDS --help` | huawei-rds | VPC + Subnet |
32
- | GaussDB | discover with `hcloud GaussDB --help` | discover with `hcloud GaussDB --help` | huawei-gaussdb | VPC + Subnet |
33
- | DDS (MongoDB) / DCS (Redis) | discover with `hcloud DDS --help` / `hcloud DCS --help` | discover with `hcloud DDS --help` / `hcloud DCS --help` | huawei-dds-dcs | VPC + Subnet |
34
+ | Resource | Create | Delete | Skill | Depends on |
35
+ | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | -------------- | ------------ |
36
+ | RDS (MySQL/PG/SQLServer) | `hcloud RDS CreateInstance` — `flavor_ref` MUST be the **spec-code string** (e.g. `rds.mysql.n1.large.2`), NOT the UUID from `ListFlavors` (UUID → `DBS.280434 Invalid specification code`); single-instance mode may omit the `ha` block; x1 series are dedicated-ish flavors - prefer n1 for general accounts | discover with `hcloud RDS --help` | huawei-rds | VPC + Subnet |
37
+ | GaussDB | discover with `hcloud GaussDB --help` | discover with `hcloud GaussDB --help` | huawei-gaussdb | VPC + Subnet |
38
+ | DDS (MongoDB) / DCS (Redis) | DCS `CreateInstance`: `available_zones` takes **AZ IDs** (passing AZ codes fails with `DCS.4042`) | DCS delete: `hcloud DCS BatchDeleteInstances --instances.1=<id>` (`DeleteInstances` does NOT exist); DDS discover with `hcloud DDS --help` | huawei-dds-dcs | VPC + Subnet |
34
39
 
35
40
  ## Storage / Delivery
36
41
 
@@ -90,18 +95,20 @@ hcloud BSS ListOnDemandResourceRatings --project_id=<pid> \
90
95
  - `usage_measure_id=4` = hour; `usage_value=730` = one month. Response: `amount` (CNY) per product label
91
96
  - **ECS codes verified**: service `hws.service.type.ec2`, resource `hws.resource.type.vm`, spec = `<flavor>.linux` (or `.win`); monthly price for kc1.small.1 = 87.60 CNY (official, cn-north-4)
92
97
  - **EIP codes NOT usable (verified)**: `hws.service.type.vpc` + `19_bgp` fails with `CBC.6074` - use official website prices as static estimates and label them 估算
98
+ - **RDS / DCS codes NOT usable (verified 2026-09-08)**: RDS combos fail with `CBC.6074`, DCS with `CBC.6006`; the metadata discovery path is unusable - `ListServiceTypes` returns 895 entries with no filter param and `ListResourceTypes` has no service filter either. Degrade to official website prices as static estimates and label them 估算
93
99
  - **Other services**: codes are per-service and MUST be looked up via BSS metadata APIs (`ListServiceTypes` / `ListResourceTypes` / `ListUsageTypes`) or docs - a wrong combination fails with `CBC.6074`. Never guess
94
100
  - **Balance query may be permission-blocked**: `CBC.0151` = IAM user lacks `billing:balance:view` → degrade to "user self-checks balance" and continue (do not block; `Ecs.7000` at order time is recoverable). domain_id 可从报错信息 `iam::<domain_id>:user:<name>` 提取
95
101
 
96
102
  - Account balance: `hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1 --cli-domain-id=<domain_id>`
97
- - Global services (BSS/IAM/CDN) demand `--cli-domain-id` per call (or in the profile) under AK/SK auth
98
- - If the domain_id is unknown: extract it from ANY resource response's `tenant_id` field (e.g. a VPC create response) or from the console (My Credentials page)
103
+ - domain-id auto-resolves from the AK/SK; `缺少必填参数 cli-domain-id` signals invalid credentials (APIGW.0301), not a missing domain-id
104
+ - If an IAM business param needs the account-id (`--domain_id` etc.), run `hcloud STS GetCallerIdentity --cli-region=<region>` (`account_id` = domain-id); `tenant_id` from a resource response is a fallback
99
105
  - Response shape: `account_balances[].amount` (cash account type=1, voucher account type=5), `debt_amount`, `currency`
100
106
  - Cost gate rule: no deployment without a per-resource cost estimate AND a balance check. Verified failure mode when skipped: ECS creation dies with `Ecs.7000 Insufficient account balance` at order submission
107
+ - **Quota pre-check (EIP and friends)**: quota errors surface only at RUN stage (`EIP.7905 Quota exceeded` AFTER plan+approval), wasting an approval cycle. Before provisioning, pre-check counts with `hcloud EIP ListPublicips` (⚠️ beware pagination truncation: `--limit=50` on a 59-EIP account showed "50" - the first "50/50 full" verdict was wrong; count precisely, e.g. loop pages or use the console quota page). If quota is exhausted, surface it at the cost gate instead of after approval. Note: after releasing an EIP, quota counting may lag several minutes - `EIP.7905` can persist briefly even under the limit
101
108
 
102
109
  ## Auth Bootstrapping (prerequisite for every command above)
103
110
 
104
111
  - Symptom of a broken profile: every hcloud API returns `APIGW.0301 Incorrect IAM authentication information` while OBS/obsutil keeps working - caused by a stale `securityToken` in the profile
105
112
  - Fix: `hcloud configure delete --cli-profile=default`, then re-run `npx huaweicloud-devkit auth init` with permanent AK/SK only (no token). `configure set` refuses empty values, so the token cannot be cleared in place
106
113
  - project_id is auto-discovered once signing works - no need to configure it manually
107
- - VPC/OBS create responses expose `tenant_id` (= domain_id) - the reliable fallback source when BSS/IAM discovery is blocked
114
+ - VPC/OBS create responses expose `tenant_id` (= domain_id) - a fallback source for the account-id
package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md CHANGED
@@ -16,13 +16,14 @@ Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers u
16
16
 
17
17
  ## Critical Warnings
18
18
 
19
- | Trap | Why |
20
- | --------------------------------- | --------------------------------------------------------------- |
21
- | NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
22
- | NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
23
- | Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
24
- | Agency trust is powerful | Agencies let services assume roles. Always add conditions |
25
- | Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
19
+ | Trap | Why |
20
+ | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
21
+ | NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
22
+ | NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
23
+ | Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
24
+ | Agency trust is powerful | Agencies let services assume roles. Always add conditions |
25
+ | Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
26
+ | `缺少必填参数 cli-domain-id` = invalid creds | KooCLI's account-id lookup failed (APIGW.0301). Re-run `auth init`. Domain-level params (`--domain_id`, `--agency.domain_id`) are separate — get the account-id via `hcloud STS GetCallerIdentity --cli-region=<region>` when needed |
26
27
 
27
28
  ## Policy Structure
28
29
 
package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md CHANGED
@@ -365,6 +365,14 @@ git -c http.sslVerify=false clone <repo-url>
365
365
 
366
366
  Then retry the clone. This bypasses SSL verification only for this single clone.
367
367
 
368
+ **index.html overwritten by the platform landing page**: when a repo is cloned **inside** the sandbox (fallback path, used only when the operator machine has no git), the DevStation portal-template init may asynchronously write a default GitCode/AtomGit landing page over the repo's `index.html`, leaving a blank page after deploy. Symptoms: `git show HEAD:index.html` shows the user's original page but `/workspace/<repo>/index.html` is a Vue SPA shell referencing `cdn-static.gitcode.com`. Recovery:
369
+
370
+ ```bash
371
+ cd /workspace/<repo> && git checkout HEAD -- index.html
372
+ ```
373
+
374
+ Prevention: `sandbox_connect` clones locally and uploads the finished tree by default (`_repoStatus: 'uploaded_from_local'`), which never triggers this race — keep local git available so the fallback in-sandbox clone is not used. The overwrite itself is DevStation platform behavior; report persistent occurrences to the platform team.
375
+
368
376
  #### 3b: Install nginx (before project upload)
369
377
 
370
378
  ```bash
package/plugins/huaweicloud-core/skills/huawei-voucher/SKILL.md CHANGED
@@ -49,7 +49,7 @@ version: 1
49
49
  ## 环境注意
50
50
 
51
51
  - 生产环境：`voucher_status` / `voucher_claim` 无需传 `domain_id`，后端从 IAM 自动解析账号。
52
- - 测试环境：需传 `domain_id`（华为云账号 ID）；未传时返回 `测试环境需提供 domain_id`，此时可用 `hcloud IAM KeystoneListAuthDomains` 查询账号 ID 后补传。
52
+ - 测试环境：需传 `domain_id`（华为云账号 ID）；未传时返回 `测试环境需提供 domain_id`。
53
53
 
54
54
  ## 注意事项
55
55
 
package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md CHANGED
@@ -137,6 +137,21 @@ Credentials are resolved in this order (highest priority first):
137
137
 
138
138
  When switching accounts within the same Agent session, use `huaweicloud_auth_init` to set runtime credentials (overrides all sources for the current MCP process), or `huaweicloud_auth_switch action=persist`, which writes S1 with `configuredBySession: true` so the session-configured account outranks `HW_ACCESS_KEY` / `HW_SECRET_KEY`. Note: running `auth init` clears the configuredBySession flag.
139
139
 
140
+ ## Global Services & domain-id
141
+
142
+ KooCLI resolves the account/domain-id automatically from a valid AK/SK, so global services (BSS, IAM, CDN) normally do **not** need an explicit `--cli-domain-id`.
143
+
144
+ If a command fails with `[USE_ERROR]...缺少必填参数 cli-domain-id`, the real cause is almost always **invalid or expired credentials** (`APIGW.0301 Incorrect IAM authentication information`): KooCLI's internal account-id lookup failed and it misreports that as a missing domain-id. Fix the credentials instead (`npx huaweicloud-devkit auth init`).
145
+
146
+ Some IAM operations take a genuine business parameter for the account-id (e.g. `--domain_id`, `--agency.domain_id`, `--agency.trust_domain_id`, `--agency_urn`). Discover those with `--help`; get the account-id value with:
147
+
148
+ ```bash
149
+ hcloud STS GetCallerIdentity --cli-region=<region> # account_id = the account/domain-id
150
+ ```
151
+
152
+ - `<region>` is the profile's current region. STS is not deployed in `cn-north-1` — use another region if needed.
153
+ - Temporary credentials (AK/SK + security token) work too: add `--cli-security-token=<token>`.
154
+
140
155
  ## Preferred Toolkit Tools
141
156
 
142
157
  - `huaweicloud_auth_init`
package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/SKILL.md CHANGED
@@ -50,18 +50,19 @@ Use evidence before fixes. Do not guess service behavior when request IDs, regio
50
50
 
51
51
  ## Common Error Codes
52
52
 
53
- | Error | Likely Cause | Fix |
54
- | ------------------------ | ---------------------------------- | ------------------------------------------------------------ |
55
- | AuthFailure / 401 | AK/SK invalid or expired | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init` |
56
- | AccessDenied / 403 | IAM permission missing | Check `huawei-iam` skill, add required policy action |
57
- | NoSuchKey / 404 | Resource not found | Verify resource ID, region, and project_id |
58
- | QuotaExceeded | Account limit reached | Request quota increase in console |
59
- | [USE_ERROR] 不正确的参数 | Wrong param name | Run `--help`, check `--param=value` format and nested prefix |
60
- | Ecs.0005 | Flavor-image mismatch | Check image `__support_*` against flavor virtualization type |
61
- | FSS.0400 | FunctionGraph latest version error | Strip `:latest` from function URN |
62
- | FSS.1417 | DEDICATEDGATEWAY missing params | Add instance_id, group_id, protocol, env_name, env_id |
63
- | APIC.7201 | Missing security_group_id | Add `--security_group_id` param for APIG CreateInstanceV2 |
64
- | [NETWORK_ERROR] | Transient network failure | Retry with `maxRetries` param or wait and retry |
53
+ | Error | Likely Cause | Fix |
54
+ | --------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
55
+ | AuthFailure / 401 | AK/SK invalid or expired | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init` |
56
+ | AccessDenied / 403 | IAM permission missing | Check `huawei-iam` skill, add required policy action |
57
+ | NoSuchKey / 404 | Resource not found | Verify resource ID, region, and project_id |
58
+ | QuotaExceeded | Account limit reached | Request quota increase in console |
59
+ | [USE_ERROR] 不正确的参数 | Wrong param name | Run `--help`, check `--param=value` format and nested prefix |
60
+ | `[USE_ERROR]缺少必填参数 cli-domain-id` | Invalid/expired credentials — KooCLI's account-id lookup failed (APIGW.0301) | Re-run `npx huaweicloud-devkit auth init`; KooCLI auto-resolves domain-id once creds are valid |
61
+ | Ecs.0005 | Flavor-image mismatch | Check image `__support_*` against flavor virtualization type |
62
+ | FSS.0400 | FunctionGraph latest version error | Strip `:latest` from function URN |
63
+ | FSS.1417 | DEDICATEDGATEWAY missing params | Add instance_id, group_id, protocol, env_name, env_id |
64
+ | APIC.7201 | Missing security_group_id | Add `--security_group_id` param for APIG CreateInstanceV2 |
65
+ | [NETWORK_ERROR] | Transient network failure | Retry with `maxRetries` param or wait and retry |
65
66
 
66
67
  ## KooCLI Error Types
67
68
 
package/plugins/huaweicloud-core/src/setup-cli.mjs CHANGED
@@ -19,7 +19,7 @@ import { createRequire } from 'node:module';
19
19
  import { getAuthStatus, syncAuth } from './auth/service.mjs';
20
20
  import { resolveAndApplyProjectId } from './auth/project-id.mjs';
21
21
  import { SUPPORTED_AGENT_TARGETS } from './auth/agent-registration.mjs';
22
- import { fingerprint, resolveManagedProfile } from './auth/reconcile.mjs';
22
+ import { fingerprint, readKooCliProfiles, resolveManagedProfile } from './auth/reconcile.mjs';
23
23
  import { redactSecrets } from './safety-policy.mjs';
24
24
  import {
25
25
  globalCredentialsPath,
@@ -4312,6 +4312,16 @@ async function cmdAuthInit() {
4312
4312
  console.log(' 3. 下载凭证文件（内含 AK 和 SK）。');
4313
4313
  console.log(' 注意：SK 只在创建密钥时显示一次，请妥善保存该文件。\n');
4314
4314
 
4315
+ try {
4316
+ const kooCli = readKooCliProfiles();
4317
+ const currentProfile = kooCli.profiles?.find((p) => p.name === kooCli.current);
4318
+ if (currentProfile?.accessKeyId) {
4319
+ console.log(
4320
+ `\x1b[33m检测到 KooCLI 已配置 profile "${currentProfile.name}"（AK 已存储）。SK 为加密存储无法导出，请直接输入或通过环境变量提供凭据。\x1b[0m\n`,
4321
+ );
4322
+ }
4323
+ } catch {}
4324
+
4315
4325
  let ak = process.env.HW_ACCESS_KEY || '';
4316
4326
  let sk = process.env.HW_SECRET_KEY || '';
4317
4327
  let securityToken = process.env.HW_SECURITY_TOKEN || '';
@@ -4322,7 +4332,12 @@ async function cmdAuthInit() {
4322
4332
  console.error(
4323
4333
  '\x1b[31mNon-interactive session detected. Provide credentials via environment variables instead:\x1b[0m',
4324
4334
  );
4325
- console.error(' HW_ACCESS_KEY, HW_SECRET_KEY');
4335
+ console.error(
4336
+ ' export HW_ACCESS_KEY=<ak> HW_SECRET_KEY=<sk> then re-run "npx huaweicloud-devkit auth init" to continue',
4337
+ );
4338
+ console.error(
4339
+ ' (Agents: prefer huaweicloud_auth_switch mode=import — reads ~/.config/huaweicloud/creds-import.json and wipes it, so the SK never enters the conversation.)',
4340
+ );
4326
4341
  console.error(' (Or run "npx huaweicloud-devkit auth init" in a real terminal.)');
4327
4342
  process.exitCode = 1;
4328
4343
  return;