huaweicloud-devkit 1.1.3-next.0 → 1.1.3-next.1

package/README.md

@@ -3,7 +3,7 @@
 [![Discussions](https://img.shields.io/badge/Discussions-Join%20the%20discussion-blue)](https://github.com/huaweicloud/huaweicloud-devkit/discussions)
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
-[![Beta](https://img.shields.io/badge/beta-v1.1.0-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
 
 **[中文](README.zh-CN.md) | English**
 
@@ -246,7 +246,7 @@ Any agent that supports MCP can use the standard config:
 
 No installation required — `npx` handles everything.
 
-> Set `HW_ACCESS_KEY`/`HW_SECRET_KEY` in the MCP config `env` field for project-level credentials.
+> For manual MCP registrations like this, do not put credentials in the config. `HW_ACCESS_KEY`/`HW_SECRET_KEY` are reserved for **platform/CI-injected** accounts (e.g. a DevSpace-managed default account) — configure your own account via `npx huaweicloud-devkit auth init` (the single entry point), and switch accounts at runtime with the `huaweicloud_auth_init` / `huaweicloud_auth_switch` MCP tools. See `plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md` for the full credential-resolution priority.
 
 #### Connecting over Remote (HTTP)
 
@@ -284,7 +284,24 @@ npx --yes huaweicloud-devkit install-hcloud
 npx --yes huaweicloud-devkit auth init
 ```
 
-Synchronizes AK/SK to KooCLI, OBS, and sandbox APIs in one step.
+Synchronizes AK/SK to KooCLI, OBS, and sandbox APIs in one step — this is the **single entry point**. Never hard-code AK/SK into agent or shell config.
+
+**Account switching at runtime** (within an agent session): use the MCP tools `huaweicloud_auth_init` (in-memory, highest priority) or `huaweicloud_auth_switch` (actions: `temporary` / `persist` / `clear`). In sandbox/DevSpace environments where a default account is injected via `HW_ACCESS_KEY`/`HW_SECRET_KEY`, a plain `auth init` will not override it — use `huaweicloud_auth_switch action=persist` to make the session account win.
+
+**Credential resolution priority** (highest first):
+
+| #   | Source                                                  | Set by                                                                        |
+| --- | ------------------------------------------------------- | ----------------------------------------------------------------------------- |
+| 1   | Runtime (session) credentials                           | `huaweicloud_auth_init` / `huaweicloud_auth_switch action=temporary`          |
+| 2   | S1 global file with `configuredBySession: true`         | `huaweicloud_auth_switch action=persist`                                      |
+| 3   | Environment variables (`HW_ACCESS_KEY`/`HW_SECRET_KEY`) | platform/DevSpace-injected default account                                    |
+| 4   | CodeArts / CodeArts Work                                | `.codeartsdoer/mcp/mcp_settings.json` / `.codeartswork/mcp/mcp_settings.json` |
+| 5   | S1 global file (no session flag)                        | `auth init`                                                                   |
+| 6   | KooCLI profile                                          | `~/.hcloud/config.json` (KooCLI commands only)                                |
+
+> **Security**: never put your own AK/SK into the MCP config `env` field — they'd be stored in plaintext and could leak if the config file is committed to git. `env` is for platform/CI injection only.
+
+Full details: `plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md`.
 
 ### Install All Agents
 

package/README.zh-CN.md

@@ -3,7 +3,7 @@
 [![参与讨论](https://img.shields.io/badge/参与讨论-Join%20the%20discussion-blue)](https://github.com/huaweicloud/huaweicloud-devkit/discussions)
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
-[![Beta](https://img.shields.io/badge/beta-v1.1.0-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
 
 **中文 | [English](README.md)**
 
@@ -246,7 +246,7 @@ npx --yes huaweicloud-devkit uninstall --target atomcode
 
 无需预安装 — `npx` 自动处理一切。
 
-> 项目级 AK/SK 可通过 MCP 配置的 `env` 字段设置 `HW_ACCESS_KEY`/`HW_SECRET_KEY`。
+> 像上面这种手动 MCP 注册方式，请勿在配置里写凭据。`HW_ACCESS_KEY`/`HW_SECRET_KEY` 是保留给**平台/CI 注入**的账号用的（例如 DevSpace 托管的默认账号）——自己的账号统一通过 `npx huaweicloud-devkit auth init` 配置（唯一入口），会话内切换账号用 `huaweicloud_auth_init` / `huaweicloud_auth_switch` MCP 工具。完整凭据解析优先级见 `plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md`。
 
 #### 通过 Remote（HTTP）连接
 
@@ -284,7 +284,24 @@ npx --yes huaweicloud-devkit install-hcloud
 npx --yes huaweicloud-devkit auth init
 ```
 
-一步同步 AK/SK 到 KooCLI、OBS 和沙箱接口。
+一步同步 AK/SK 到 KooCLI、OBS 和沙箱接口——这是**唯一入口**，切勿把 AK/SK 手写进 Agent 或 shell 配置。
+
+**会话内切换账号**：使用 MCP 工具 `huaweicloud_auth_init`（内存态，优先级最高）或 `huaweicloud_auth_switch`（`temporary` / `persist` / `clear`）。在沙箱/DevSpace 环境中若默认账号经 `HW_ACCESS_KEY`/`HW_SECRET_KEY` 注入，单纯 `auth init` 无法覆盖——需 `huaweicloud_auth_switch action=persist` 让会话账号生效。
+
+**凭据解析优先级**（从高到低）：
+
+| #   | 来源                                          | 由谁设置                                                                      |
+| --- | --------------------------------------------- | ----------------------------------------------------------------------------- |
+| 1   | 运行时（会话）凭据                            | `huaweicloud_auth_init` / `huaweicloud_auth_switch action=temporary`          |
+| 2   | 带 `configuredBySession: true` 的 S1 全局文件 | `huaweicloud_auth_switch action=persist`                                      |
+| 3   | 环境变量（`HW_ACCESS_KEY`/`HW_SECRET_KEY`）   | 平台/DevSpace 注入的默认账号                                                  |
+| 4   | CodeArts / CodeArts Work                      | `.codeartsdoer/mcp/mcp_settings.json` / `.codeartswork/mcp/mcp_settings.json` |
+| 5   | S1 全局文件（无会话标记）                     | `auth init`                                                                   |
+| 6   | KooCLI profile                                | `~/.hcloud/config.json`（仅 KooCLI 命令）                                     |
+
+> **安全**：切勿把自己账号的 AK/SK 写入 MCP 配置的 `env` 字段——会以明文存储，配置文件提交 git 时即泄密；`env` 仅用于平台/CI 注入。
+
+完整说明：`plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md`。
 
 ### 安装所有 Agent
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.1",
   "kooCliVersion": "7.2.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.1",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.1",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.1",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.1",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.1",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.1",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-create.md

@@ -47,3 +47,4 @@ hcloud OBS stat obs://<bucket>
 - Region is immutable after creation
 - ACL does NOT cascade to objects — set both bucket-level and object-level access
 - OBS uses separate credentials (`~/.obsutilconfig`, configure via `hcloud OBS config -i`)
+- **Return code is unreliable for `mb`**: it can exit non-zero (e.g. 6) while the bucket is actually created (output still carries a request id). Confirm with `stat obs://<bucket>` / `OBS ls` instead of the exit code; re-running `mb` on the same name is idempotent.

package/plugins/huaweicloud-core/skills/huawei-obs/references/static-website.md

@@ -54,3 +54,5 @@ curl http://my-static-site.obs-website.cn-north-4.myhuaweicloud.com
 - **Always use `-f`**: Without `-f`, obsutil prompts "Please input (y/n)" on large uploads — Agent hangs (TIMEOUT).
 - **Use `-flat` for root files**: Without `-flat`, `dist/` becomes `bucket/dist/` prefix. Static sites need files at bucket root.
 - **Objects don't inherit bucket ACL**: Setting bucket to public-read does NOT make individual objects public. You must also set object-level ACL with `chattri obs://<bucket>/ -r -f -acl=public-read` or use `-acl=public-read` during upload.
+- **`mb` may return a non-zero exit code even on success**: `hcloud OBS mb` occasionally exits with code 6 (or other non-zero) while the bucket is actually created — the output still contains a request id and subsequent `cp`/`chattri` succeed. Judge success by the response text (request id) and confirm with `hcloud OBS ls` / `stat obs://<bucket>`, NOT the exit code alone. `mb` is idempotent, so re-issuing the same bucket name is harmless.
+- **Website endpoint is eventually consistent (~1 min)**: after `PUT /?website` returns 200, the website endpoint (`http://<bucket>.obs-website.<region>.myhuaweicloud.com`) may return 404 `NoSuchWebsiteConfiguration` for up to ~1 minute. This is propagation delay, NOT a configuration failure. Verify immediately via the object URL (`https://<bucket>.obs.<region>.myhuaweicloud.com/index.html`, works before the website endpoint), then poll the website endpoint with a short backoff until it returns 200 before reporting success.

package/plugins/huaweicloud-core/src/auth/reconcile.mjs

@@ -45,15 +45,27 @@ export function readKooCliProfiles() {
     const current = String(raw.current || 'default');
     const profiles = Array.isArray(raw.profiles) ? raw.profiles : [];
     const mtimeMs = statSync(configPath).mtimeMs;
+    // KooCLI 7.x stores AK/SK encrypted (authEncrypt=true): the on-disk values
+    // are ciphertext, so a fingerprint computed from them can never match the
+    // plaintext S1/S3 stores. Blind the comparable fields instead of treating
+    // ciphertext as a real credential and misreporting a S2 drift (#533).
+    // KooCLI serializes the flag as the string "true", not a boolean.
+    const encrypted = raw.authEncrypt === true || raw.authEncrypt === 'true';
     return {
       current,
       mtimeMs,
       configPath,
-      profiles: profiles.map((p) => ({
-        name: String(p.name || ''),
-        fingerprint: fingerprint(p.accessKeyId, p.secretAccessKey),
-        accessKeyId: p.accessKeyId || '',
-      })),
+      authEncrypt: encrypted,
+      profiles: profiles.map((p) =>
+        encrypted
+          ? { name: String(p.name || ''), fingerprint: '', accessKeyId: '', encrypted: true }
+          : {
+              name: String(p.name || ''),
+              fingerprint: fingerprint(p.accessKeyId, p.secretAccessKey),
+              accessKeyId: p.accessKeyId || '',
+              encrypted: false,
+            },
+      ),
     };
   } catch {
     return { error: 'KooCLI config parse failed' };
@@ -138,6 +150,9 @@ export function scanState() {
       runtimeFingerprint,
     },
     kooCliCurrent: kooCli.error ? null : kooCli.current,
+    // S2 is encrypted storage (authEncrypt) → its fingerprint is unavailable,
+    // so the S2-current drift check is intentionally skipped (#533).
+    s2Encrypted: Boolean(!kooCli.error && kooCli.authEncrypt),
     inconsistencies,
     hasRuntime,
     runtimeFingerprint,

package/plugins/huaweicloud-core/src/tools.mjs

@@ -1012,7 +1012,31 @@ function refreshUserHashAfterAuthChange({ regenerate = true } = {}) {
   }
 }
 
-export async function callTool(name, args = {}) {
+// Reject invalid numeric args up front instead of silently coercing them to
+// NaN (which downstream defaults would absorb as "no timeout set") — see #530.
+const NUMERIC_ARG_KEYS = ['timeoutMs', 'maxRetries', 'timeout_ms'];
+
+function normalizeNumericArgs(args) {
+  const out = { ...args };
+  for (const key of NUMERIC_ARG_KEYS) {
+    const value = out[key];
+    if (value === undefined || value === null) continue;
+    const num = Number(value);
+    // timeouts must be positive; maxRetries may be 0 (means "no retries").
+    const isRetries = key === 'maxRetries';
+    const valid = Number.isFinite(num) && (isRetries ? Number.isSafeInteger(num) && num >= 0 : num > 0);
+    if (!valid) {
+      throw new Error(
+        `Invalid parameter "${key}": expected a ${isRetries ? 'non-negative integer' : 'positive number'}, received ${JSON.stringify(value)}.`,
+      );
+    }
+    out[key] = num;
+  }
+  return out;
+}
+
+export async function callTool(name, rawArgs = {}) {
+  const args = normalizeNumericArgs(rawArgs);
   const toolValue = toolInvokeValue(name, args);
   trackToolInvoke(name, toolValue);
 

package/plugins/huaweicloud-core/src/update-check.mjs

@@ -323,7 +323,9 @@ export async function upgradePackage({ target = 'all', version = 'latest' } = {}
     return { success: false, error: 'version 参数仅支持 latest。目标版本由插件自动判定。' };
   }
   const { doQuery = queryDistTags, spawnFn = defaultSpawn } = options;
-  const previousVersion = readInstalledVersion();
+  // Tests inject currentVersion explicitly - the repo package.json version changes
+  // between prerelease and stable lines, which must not flip the upgrade-tag logic.
+  const previousVersion = options.currentVersion || readInstalledVersion();
   let distTags;
   try {
     distTags = await doQuery();