huaweicloud-devkit 1.1.2-next.6 → 1.1.2-next.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/package.json +1 -1
  2. package/plugins/huaweicloud-core/.claude-plugin/plugin.json +1 -1
  3. package/plugins/huaweicloud-core/.codex-plugin/plugin.json +1 -1
  4. package/plugins/huaweicloud-core/.cursor-plugin/plugin.json +1 -1
  5. package/plugins/huaweicloud-core/.hermes-plugin/plugin.json +1 -1
  6. package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json +1 -1
  7. package/plugins/huaweicloud-core/openclaw.plugin.json +1 -1
  8. package/plugins/huaweicloud-core/skills/huawei-billing/SKILL.md +15 -15
  9. package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md +1 -1
  10. package/plugins/huaweicloud-core/skills/huawei-iac/SKILL.md +1 -1
  11. package/plugins/huaweicloud-core/skills/huawei-iac/references/resource-catalog.md +3 -3
  12. package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md +8 -8
  13. package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md +6 -7
  14. package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/SKILL.md +13 -13
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "huaweicloud-devkit",
3
3
  "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
4
- "version": "1.1.2-next.6",
4
+ "version": "1.1.2-next.7",
5
5
  "kooCliVersion": "7.2.12",
6
6
  "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
7
7
  "type": "module",
package/plugins/huaweicloud-core/.claude-plugin/plugin.json CHANGED
@@ -17,7 +17,7 @@
17
17
  "mcpServers": "./.mcp.json",
18
18
  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
19
19
  "skills": "./skills/",
20
- "version": "1.1.2-next.6",
20
+ "version": "1.1.2-next.7",
21
21
  "author": {
22
22
  "name": "HuaweiCloud Mate",
23
23
  "url": "https://github.com/huaweicloud"
package/plugins/huaweicloud-core/.codex-plugin/plugin.json CHANGED
@@ -20,7 +20,7 @@
20
20
  "mcpServers": "./.mcp.json",
21
21
  "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
22
22
  "skills": "./skills/",
23
- "version": "1.1.2-next.6",
23
+ "version": "1.1.2-next.7",
24
24
  "author": {
25
25
  "name": "HuaweiCloud Mate",
26
26
  "url": "https://github.com/huaweicloud"
package/plugins/huaweicloud-core/.cursor-plugin/plugin.json CHANGED
@@ -17,7 +17,7 @@
17
17
  "mcpServers": "./.mcp.json",
18
18
  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
19
19
  "skills": "./skills/",
20
- "version": "1.1.2-next.6",
20
+ "version": "1.1.2-next.7",
21
21
  "author": {
22
22
  "name": "HuaweiCloud Mate",
23
23
  "url": "https://github.com/huaweicloud"
package/plugins/huaweicloud-core/.hermes-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "huaweicloud-devkit",
3
- "version": "1.1.2-next.6",
3
+ "version": "1.1.2-next.7",
4
4
  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
5
5
  "author": {
6
6
  "name": "HuaweiCloud Mate",
package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "huaweicloud-devkit",
3
- "version": "1.1.2-next.6",
3
+ "version": "1.1.2-next.7",
4
4
  "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
5
5
  "author": {
6
6
  "name": "HuaweiCloud Mate",
package/plugins/huaweicloud-core/openclaw.plugin.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "name": "huaweicloud-devkit",
3
3
  "id": "huaweicloud-devkit",
4
4
  "displayName": "HuaweiCloud DevKit",
5
- "version": "1.1.2-next.6",
5
+ "version": "1.1.2-next.7",
6
6
  "family": "bundle-plugin",
7
7
  "bundleFormat": "codex",
8
8
  "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",
package/plugins/huaweicloud-core/skills/huawei-billing/SKILL.md CHANGED
@@ -16,24 +16,24 @@ Domain expertise for billing queries (BSS). Covers cost tracking, bill details,
16
16
 
17
17
  ## Critical Warnings
18
18
 
19
- | Trap | Why |
20
- | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
21
- | Bills delayed ~24h | Yesterday's costs may not appear until the next day |
22
- | BSS Admin role needed | IAM user must have BSS Administrator or Finance role |
23
- | Currency conversion varies | Cross-region costs use daily exchange rates |
24
- | Region fixed to cn-north-1 | BSS operations only support `--cli-region=cn-north-1` in KooCLI. This is a KooCLI metadata limitation — the billing data itself covers all regions. |
25
- | Global service needs domain-id | BSS is a global service: AK/SK mode requires `--cli-domain-id`. If unknown, run `hcloud STS GetCallerIdentity --cli-region=<region>` and use `account_id` (see `huaweicloud-cli-and-auth`). |
19
+ | Trap | Why |
20
+ | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
21
+ | Bills delayed ~24h | Yesterday's costs may not appear until the next day |
22
+ | BSS Admin role needed | IAM user must have BSS Administrator or Finance role |
23
+ | Currency conversion varies | Cross-region costs use daily exchange rates |
24
+ | Region fixed to cn-north-1 | BSS operations only support `--cli-region=cn-north-1` in KooCLI. This is a KooCLI metadata limitation — the billing data itself covers all regions. |
25
+ | `缺少必填参数 cli-domain-id` / APIGW.0301 | Invalid credentials — KooCLI can't resolve the account-id | Re-run `npx huaweicloud-devkit auth init` |
26
26
 
27
27
  ## Common Workflows
28
28
 
29
- | Task | Operation |
30
- | -------------------- | --------------------------------------------------------------------------------- |
31
- | List costs | `ListCosts --cli-region=cn-north-1 --project_id=<p>` |
32
- | List customer bills | `ListCustomerBillsFeeRecords --cli-region=cn-north-1 --project_id=<p>` |
33
- | List resource usage | `ListResourceUsage --cli-region=cn-north-1 --project_id=<p>` |
34
- | List sub-customers | `ListConsumeSubCustomers --cli-region=cn-north-1 --project_id=<p>` |
35
- | Show account balance | `ShowCustomerAccountBalances --cli-region=cn-north-1 --cli-domain-id=<domain_id>` |
36
- | List conversions | `ListConversions --cli-region=cn-north-1 --project_id=<p>` |
29
+ | Task | Operation |
30
+ | -------------------- | ---------------------------------------------------------------------- |
31
+ | List costs | `ListCosts --cli-region=cn-north-1 --project_id=<p>` |
32
+ | List customer bills | `ListCustomerBillsFeeRecords --cli-region=cn-north-1 --project_id=<p>` |
33
+ | List resource usage | `ListResourceUsage --cli-region=cn-north-1 --project_id=<p>` |
34
+ | List sub-customers | `ListConsumeSubCustomers --cli-region=cn-north-1 --project_id=<p>` |
35
+ | Show account balance | `ShowCustomerAccountBalances --cli-region=cn-north-1` |
36
+ | List conversions | `ListConversions --cli-region=cn-north-1 --project_id=<p>` |
37
37
 
38
38
  Discover exact parameters with `--help` before executing any command. All BSS operations are read-only.
39
39
 
package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md CHANGED
@@ -69,6 +69,6 @@ hcloud IAM AssociateAgencyWithDomainPermission --agency_id=<id> --domain_id=<id>
69
69
  hcloud FunctionGraph CreateFunction --func_vpc.vpc_id=<vpc> --func_vpc.subnet_id=<subnet> --app_xrole=<name> ...
70
70
  ```
71
71
 
72
- > IAM is a global service in KooCLI. If `CreateAgency` / `AssociateAgencyWithDomainPermission` fail with `缺少必填参数 cli-domain-id`, prefer a concrete `--cli-region` (e.g. `cn-north-4`), or discover the domain-id via `hcloud STS GetCallerIdentity --cli-region=<region>` (see `huaweicloud-cli-and-auth`).
72
+ > The `缺少必填参数 cli-domain-id` error means invalid credentials (APIGW.0301) — re-run `auth init`. `CreateAgency` / `AssociateAgencyWithDomainPermission` need the account-id for their `--agency.domain_id` / `--domain_id` params; get it via `hcloud STS GetCallerIdentity --cli-region=<region>`.
73
73
 
74
74
  | QuotaExceeded | Max 10 functions per project per region |
package/plugins/huaweicloud-core/skills/huawei-iac/SKILL.md CHANGED
@@ -86,7 +86,7 @@ Execution: show the to-be-deleted list for final confirmation → delete in **re
86
86
  - `huaweicloud_run_readonly_command` → discovery (flavors, images, zones, prices)
87
87
  - `huaweicloud_list_regions` / `huaweicloud_get_regional_availability` → region intent
88
88
  - `huaweicloud_hook_check_deploy_plan` → risk-check the plan before approval
89
- - Balance and pricing: `huawei-billing` skill. Balance operation (BSS is pinned to cn-north-1 in KooCLI): `hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1 --cli-domain-id=<domain_id>`. Global services (BSS/IAM) require `--cli-domain-id` per call or in the profile. If unknown, discover it with `hcloud STS GetCallerIdentity --cli-region=<region>` (`account_id` = domain-id); use `tenant_id` from a resource response only as a fallback
89
+ - Balance and pricing: `huawei-billing` skill. Balance operation (BSS is pinned to cn-north-1 in KooCLI): `hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1` (domain-id auto-resolves from the AK/SK). If an IAM business param genuinely needs the account-id, run `hcloud STS GetCallerIdentity --cli-region=<region>`
90
90
 
91
91
  ## Cross-Skill References
92
92
 
package/plugins/huaweicloud-core/skills/huawei-iac/references/resource-catalog.md CHANGED
@@ -100,8 +100,8 @@ hcloud BSS ListOnDemandResourceRatings --project_id=<pid> \
100
100
  - **Balance query may be permission-blocked**: `CBC.0151` = IAM user lacks `billing:balance:view` → degrade to "user self-checks balance" and continue (do not block; `Ecs.7000` at order time is recoverable). domain_id 可从报错信息 `iam::<domain_id>:user:<name>` 提取
101
101
 
102
102
  - Account balance: `hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1 --cli-domain-id=<domain_id>`
103
- - Global services (BSS/IAM/CDN) demand `--cli-domain-id` per call (or in the profile) under AK/SK auth
104
- - If the domain_id is unknown: discover it via `hcloud STS GetCallerIdentity --cli-region=<region>` (`account_id` = domain-id); fall back to `tenant_id` from a resource response or the console
103
+ - domain-id auto-resolves from the AK/SK; `缺少必填参数 cli-domain-id` signals invalid credentials (APIGW.0301), not a missing domain-id
104
+ - If an IAM business param needs the account-id (`--domain_id` etc.), run `hcloud STS GetCallerIdentity --cli-region=<region>` (`account_id` = domain-id); `tenant_id` from a resource response is a fallback
105
105
  - Response shape: `account_balances[].amount` (cash account type=1, voucher account type=5), `debt_amount`, `currency`
106
106
  - Cost gate rule: no deployment without a per-resource cost estimate AND a balance check. Verified failure mode when skipped: ECS creation dies with `Ecs.7000 Insufficient account balance` at order submission
107
107
  - **Quota pre-check (EIP and friends)**: quota errors surface only at RUN stage (`EIP.7905 Quota exceeded` AFTER plan+approval), wasting an approval cycle. Before provisioning, pre-check counts with `hcloud EIP ListPublicips` (⚠️ beware pagination truncation: `--limit=50` on a 59-EIP account showed "50" - the first "50/50 full" verdict was wrong; count precisely, e.g. loop pages or use the console quota page). If quota is exhausted, surface it at the cost gate instead of after approval. Note: after releasing an EIP, quota counting may lag several minutes - `EIP.7905` can persist briefly even under the limit
@@ -111,4 +111,4 @@ hcloud BSS ListOnDemandResourceRatings --project_id=<pid> \
111
111
  - Symptom of a broken profile: every hcloud API returns `APIGW.0301 Incorrect IAM authentication information` while OBS/obsutil keeps working - caused by a stale `securityToken` in the profile
112
112
  - Fix: `hcloud configure delete --cli-profile=default`, then re-run `npx huaweicloud-devkit auth init` with permanent AK/SK only (no token). `configure set` refuses empty values, so the token cannot be cleared in place
113
113
  - project_id is auto-discovered once signing works - no need to configure it manually
114
- - VPC/OBS create responses expose `tenant_id` (= domain_id) - a fallback when `STS GetCallerIdentity` discovery is unavailable
114
+ - VPC/OBS create responses expose `tenant_id` (= domain_id) - a fallback source for the account-id
package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md CHANGED
@@ -16,14 +16,14 @@ Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers u
16
16
 
17
17
  ## Critical Warnings
18
18
 
19
- | Trap | Why |
20
- | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
21
- | NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
22
- | NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
23
- | Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
24
- | Agency trust is powerful | Agencies let services assume roles. Always add conditions |
25
- | Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
26
- | IAM is a global service in KooCLI | `--cli-region=cn-north-1` routes to the global endpoint and then AK/SK mode needs `--cli-domain-id`. Prefer a concrete region (e.g. `cn-north-4`); if you hit `缺少必填参数 cli-domain-id`, discover it via `hcloud STS GetCallerIdentity --cli-region=<region>` |
19
+ | Trap | Why |
20
+ | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
21
+ | NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
22
+ | NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
23
+ | Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
24
+ | Agency trust is powerful | Agencies let services assume roles. Always add conditions |
25
+ | Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
26
+ | `缺少必填参数 cli-domain-id` = invalid creds | KooCLI's account-id lookup failed (APIGW.0301). Re-run `auth init`. Domain-level params (`--domain_id`, `--agency.domain_id`) are separate — get the account-id via `hcloud STS GetCallerIdentity --cli-region=<region>` when needed |
27
27
 
28
28
  ## Policy Structure
29
29
 
package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md CHANGED
@@ -139,19 +139,18 @@ When switching accounts within the same Agent session, use `huaweicloud_auth_ini
139
139
 
140
140
  ## Global Services & domain-id
141
141
 
142
- Global services (BSS, and IAM routed via the `cn-north-1` global endpoint) require `--cli-domain-id` under AK/SK auth. When it is missing, KooCLI fails with `[USE_ERROR]...缺少必填参数cli-domain-id`.
142
+ KooCLI resolves the account/domain-id automatically from a valid AK/SK, so global services (BSS, IAM, CDN) normally do **not** need an explicit `--cli-domain-id`.
143
143
 
144
- Do **not** ask the user to run `hcloud configure set --cli-domain-id=...`. Discover the domain-id yourself:
144
+ If a command fails with `[USE_ERROR]...缺少必填参数 cli-domain-id`, the real cause is almost always **invalid or expired credentials** (`APIGW.0301 Incorrect IAM authentication information`): KooCLI's internal account-id lookup failed and it misreports that as a missing domain-id. Fix the credentials instead (`npx huaweicloud-devkit auth init`).
145
+
146
+ Some IAM operations take a genuine business parameter for the account-id (e.g. `--domain_id`, `--agency.domain_id`, `--agency.trust_domain_id`, `--agency_urn`). Discover those with `--help`; get the account-id value with:
145
147
 
146
148
  ```bash
147
- hcloud STS GetCallerIdentity --cli-region=<region>
148
- # → account_id IS the domain-id; retry the original call with --cli-domain-id=<account_id>
149
+ hcloud STS GetCallerIdentity --cli-region=<region> # account_id = the account/domain-id
149
150
  ```
150
151
 
151
- - `<region>` is the profile's current region. **STS is not deployed in `cn-north-1`** — if the profile region is `cn-north-1`, use another region (e.g. `cn-north-4`).
152
+ - `<region>` is the profile's current region. STS is not deployed in `cn-north-1` — use another region if needed.
152
153
  - Temporary credentials (AK/SK + security token) work too: add `--cli-security-token=<token>`.
153
- - Prefer `STS GetCallerIdentity` over `IAM KeystoneListAuthDomains` — the latter only works with permanent credentials and outside `cn-north-1`; it fails under temporary credentials.
154
- - `cli-domain-id` is a KooCLI CLI requirement, not a Huawei Cloud API requirement: the raw `GET /v3/auth/domains` can be signed with just AK/SK.
155
154
 
156
155
  ## Preferred Toolkit Tools
157
156
 
package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/SKILL.md CHANGED
@@ -50,19 +50,19 @@ Use evidence before fixes. Do not guess service behavior when request IDs, regio
50
50
 
51
51
  ## Common Error Codes
52
52
 
53
- | Error | Likely Cause | Fix |
54
- | --------------------------------------- | ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- |
55
- | AuthFailure / 401 | AK/SK invalid or expired | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init` |
56
- | AccessDenied / 403 | IAM permission missing | Check `huawei-iam` skill, add required policy action |
57
- | NoSuchKey / 404 | Resource not found | Verify resource ID, region, and project_id |
58
- | QuotaExceeded | Account limit reached | Request quota increase in console |
59
- | [USE_ERROR] 不正确的参数 | Wrong param name | Run `--help`, check `--param=value` format and nested prefix |
60
- | `[USE_ERROR]缺少必填参数 cli-domain-id` | Global service (BSS / IAM global endpoint) under AK/SK | Run `hcloud STS GetCallerIdentity --cli-region=<region>` → `account_id`, retry with `--cli-domain-id=<account_id>` (see `huaweicloud-cli-and-auth`) |
61
- | Ecs.0005 | Flavor-image mismatch | Check image `__support_*` against flavor virtualization type |
62
- | FSS.0400 | FunctionGraph latest version error | Strip `:latest` from function URN |
63
- | FSS.1417 | DEDICATEDGATEWAY missing params | Add instance_id, group_id, protocol, env_name, env_id |
64
- | APIC.7201 | Missing security_group_id | Add `--security_group_id` param for APIG CreateInstanceV2 |
65
- | [NETWORK_ERROR] | Transient network failure | Retry with `maxRetries` param or wait and retry |
53
+ | Error | Likely Cause | Fix |
54
+ | --------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
55
+ | AuthFailure / 401 | AK/SK invalid or expired | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init` |
56
+ | AccessDenied / 403 | IAM permission missing | Check `huawei-iam` skill, add required policy action |
57
+ | NoSuchKey / 404 | Resource not found | Verify resource ID, region, and project_id |
58
+ | QuotaExceeded | Account limit reached | Request quota increase in console |
59
+ | [USE_ERROR] 不正确的参数 | Wrong param name | Run `--help`, check `--param=value` format and nested prefix |
60
+ | `[USE_ERROR]缺少必填参数 cli-domain-id` | Invalid/expired credentials — KooCLI's account-id lookup failed (APIGW.0301) | Re-run `npx huaweicloud-devkit auth init`; KooCLI auto-resolves domain-id once creds are valid |
61
+ | Ecs.0005 | Flavor-image mismatch | Check image `__support_*` against flavor virtualization type |
62
+ | FSS.0400 | FunctionGraph latest version error | Strip `:latest` from function URN |
63
+ | FSS.1417 | DEDICATEDGATEWAY missing params | Add instance_id, group_id, protocol, env_name, env_id |
64
+ | APIC.7201 | Missing security_group_id | Add `--security_group_id` param for APIG CreateInstanceV2 |
65
+ | [NETWORK_ERROR] | Transient network failure | Retry with `maxRetries` param or wait and retry |
66
66
 
67
67
  ## KooCLI Error Types
68
68