huaweicloud-devkit 1.1.3-next.0 → 1.1.3-next.2

package/.agents/plugins/marketplace.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "interface": {
-    "displayName": "HuaweiCloud Devkit"
+    "displayName": "HuaweiCloud DevKit"
   },
   "plugins": [
     {

package/README.md

@@ -3,7 +3,8 @@
 [![Discussions](https://img.shields.io/badge/Discussions-Join%20the%20discussion-blue)](https://github.com/huaweicloud/huaweicloud-devkit/discussions)
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
-[![Beta](https://img.shields.io/badge/beta-v1.1.0-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.3-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 
 **[中文](README.zh-CN.md) | English**
 
@@ -31,7 +32,18 @@ Supports OpenCode, Codex, CodeArts Agent, WorkBuddy, DeepSeek Harness (DSH), Off
 
 ## Quick Start
 
-> If `--target` is omitted, the installer auto-detects agents on your machine. When multiple agents are detected, **all of them** will be installed. Specify `--target` to control which agent receives the install.
+> If `--target` is omitted, the installer auto-detects agents on your machine:
+>
+> - **None detected**: interactive terminals ask what you want (install to one
+>   explicit target / install to all / wire up a generic MCP agent);
+>   non-interactive shells error out with the supported target list.
+> - **One detected**: installs directly to it.
+> - **Multiple detected**: interactive terminals show a multi-select chooser;
+>   non-interactive shells error and point at `--target <agent>` / `--target all`.
+>   For a one-shot full setup, run `npx --yes huaweicloud-devkit install --target all`
+>   (Codex is skipped when its CLI is missing).
+
+The commands below are global (they act on every agent):
 
 ```bash
 npx --yes huaweicloud-devkit version  # print CLI version and installed plugin versions per agent
@@ -51,7 +63,7 @@ npx --yes huaweicloud-devkit doctor --target opencode
 npx --yes huaweicloud-devkit status --target opencode
 npx --yes huaweicloud-devkit update --target opencode
 npx --yes huaweicloud-devkit uninstall --target opencode
-rm -rf ~/.npm/_npx/  # Linux/macOS only; Windows path TBD
+rm -rf ~/.npm/_npx/  # Linux/macOS; Windows: rmdir /s /q %LOCALAPPDATA%\npm-cache\_npx
 ```
 
 ### Codex
@@ -211,7 +223,7 @@ npx --yes huaweicloud-devkit install --target openclaw
 npx --yes huaweicloud-devkit status --target openclaw
 npx --yes huaweicloud-devkit update --target openclaw
 npx --yes huaweicloud-devkit uninstall --target openclaw
-rm -rf ~/.npm/_npx/  # Linux/macOS only; Windows path TBD
+rm -rf ~/.npm/_npx/  # Linux/macOS; Windows: rmdir /s /q %LOCALAPPDATA%\npm-cache\_npx
 ```
 
 ### AtomCode
@@ -246,7 +258,7 @@ Any agent that supports MCP can use the standard config:
 
 No installation required — `npx` handles everything.
 
-> Set `HW_ACCESS_KEY`/`HW_SECRET_KEY` in the MCP config `env` field for project-level credentials.
+> For manual MCP registrations like this, do not put credentials in the config. `HW_ACCESS_KEY`/`HW_SECRET_KEY` are reserved for **platform/CI-injected** accounts (e.g. a DevSpace-managed default account) — configure your own account via `npx huaweicloud-devkit auth init` (the single entry point), and switch accounts at runtime with the `huaweicloud_auth_init` / `huaweicloud_auth_switch` MCP tools. See `plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md` for the full credential-resolution priority.
 
 #### Connecting over Remote (HTTP)
 
@@ -256,7 +268,7 @@ If your agent supports `type: "remote"` (Streamable HTTP) instead of stdio, star
 npx --yes huaweicloud-devkit-mcp --transport remote
 ```
 
-It listens on `127.0.0.1:9528` by default (no conflict with the IACMCPServer port 9527). Then connect with a remote config (opencode example):
+It listens on `127.0.0.1:9528` by default. Then connect with a remote config (opencode example):
 
 ```jsonc
 {
@@ -284,7 +296,24 @@ npx --yes huaweicloud-devkit install-hcloud
 npx --yes huaweicloud-devkit auth init
 ```
 
-Synchronizes AK/SK to KooCLI, OBS, and sandbox APIs in one step.
+Synchronizes AK/SK to KooCLI, OBS, and sandbox APIs in one step — this is the **single entry point**. Never hard-code AK/SK into agent or shell config.
+
+**Account switching at runtime** (within an agent session): use the MCP tools `huaweicloud_auth_init` (in-memory, highest priority) or `huaweicloud_auth_switch` (actions: `temporary` / `persist` / `clear`). In sandbox/DevSpace environments where a default account is injected via `HW_ACCESS_KEY`/`HW_SECRET_KEY`, a plain `auth init` will not override it — use `huaweicloud_auth_switch action=persist` to make the session account win.
+
+**Credential resolution priority** (highest first):
+
+| #   | Source                                                  | Set by                                                                        |
+| --- | ------------------------------------------------------- | ----------------------------------------------------------------------------- |
+| 1   | Runtime (session) credentials                           | `huaweicloud_auth_init` / `huaweicloud_auth_switch action=temporary`          |
+| 2   | S1 global file with `configuredBySession: true`         | `huaweicloud_auth_switch action=persist`                                      |
+| 3   | Environment variables (`HW_ACCESS_KEY`/`HW_SECRET_KEY`) | platform/DevSpace-injected default account                                    |
+| 4   | CodeArts / CodeArts Work                                | `.codeartsdoer/mcp/mcp_settings.json` / `.codeartswork/mcp/mcp_settings.json` |
+| 5   | S1 global file (no session flag)                        | `auth init`                                                                   |
+| 6   | KooCLI profile                                          | `~/.hcloud/config.json` (KooCLI commands only)                                |
+
+> **Security**: never put your own AK/SK into the MCP config `env` field — they'd be stored in plaintext and could leak if the config file is committed to git. `env` is for platform/CI injection only.
+
+Full details: `plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md`.
 
 ### Install All Agents
 
@@ -295,7 +324,7 @@ npx --yes huaweicloud-devkit install --target all
 ### Update All Agents
 
 ```bash
-npx huaweicloud-devkit version
+npx --yes huaweicloud-devkit@latest version
 npx --yes huaweicloud-devkit@latest update --target all
 ```
 
@@ -305,7 +334,7 @@ locally cached older one.
 
 ## What It Does
 
-- **Guided cloud operations** — agents get step-by-step guidance for 20+ Huawei Cloud services (ECS, OBS, VPC, RDS, GaussDB, FunctionGraph, APIG, CCE, and more)
+- **Guided cloud operations** — agents get step-by-step guidance for 20+ commonly used Huawei Cloud services (ECS, OBS, VPC, RDS, GaussDB, FunctionGraph, APIG, CCE, and more)
 - **Safety-first execution** — all write operations require explicit user approval; credentials and secrets are automatically redacted from output
 - **Pre-execution risk checks** — public exposure, credential leaks, and destructive operations are caught before they run
 - **Regional awareness** — auto-discovers available regions and checks service availability before creating resources
@@ -315,6 +344,10 @@ locally cached older one.
 
 ECS, OBS, VPC, IAM, RDS, GaussDB, FunctionGraph, APIG, CCE, SMN/DMS, ModelArts, Cloud Eye, CTS, DEW, Billing, CBR, WAF/AAD, DDS/DCS, Deployment, and Getting Started guides.
 
+> Above is the pre-wired guidance list; the remaining 200+ Huawei Cloud services
+> are still reachable via KooCLI / API / SDK routing (see capability-discovery
+> and cli-and-auth meta-skills).
+
 ## Documentation
 
 - [Architecture](docs/architecture.md)

package/README.zh-CN.md

@@ -1,9 +1,10 @@
 # HuaweiCloud DevKit
 
-[![参与讨论](https://img.shields.io/badge/参与讨论-Join%20the%20discussion-blue)](https://github.com/huaweicloud/huaweicloud-devkit/discussions)
+[![Discussions](https://img.shields.io/badge/Discussions-Join%20the%20discussion-blue)](https://github.com/huaweicloud/huaweicloud-devkit/discussions)
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
-[![Beta](https://img.shields.io/badge/beta-v1.1.0-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.3-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 
 **中文 | [English](README.md)**
 
@@ -31,7 +32,14 @@
 
 ## 快速开始
 
-> 省略 `--target` 时，安装器会自动检测机器上的 agent，检测到多个时**全部安装**。建议始终指定 `--target` 以明确安装目标。
+> 省略 `--target` 时，安装器会自动检测机器上的 agent：
+>
+> - **未检测到**：交互终端会询问你如何继续（指定 target 安装 / 全部安装 / 接入通用 MCP agent）；非交互终端报错并列出支持列表。
+> - **检测到单个**：直接安装到该 agent。
+> - **检测到多个**：交互终端弹出多选；非交互终端报错并提示 `--target <agent>` 或 `--target all`。
+>   需要一步全量安装时执行 `npx --yes huaweicloud-devkit install --target all`（Codex 缺少 CLI 时跳过）。
+
+以下为全局命令（一次性作用于所有 agent）：
 
 ```bash
 npx --yes huaweicloud-devkit version  # 查看 CLI 版本和各 agent 已安装的插件版本
@@ -51,7 +59,7 @@ npx --yes huaweicloud-devkit doctor --target opencode
 npx --yes huaweicloud-devkit status --target opencode
 npx --yes huaweicloud-devkit update --target opencode
 npx --yes huaweicloud-devkit uninstall --target opencode
-rm -rf ~/.npm/_npx/  # 仅 Linux/macOS；Windows 路径待确认
+rm -rf ~/.npm/_npx/  # 仅 Linux/macOS；Windows：rmdir /s /q %LOCALAPPDATA%\npm-cache\_npx
 ```
 
 ### Codex
@@ -211,7 +219,7 @@ npx --yes huaweicloud-devkit install --target openclaw
 npx --yes huaweicloud-devkit status --target openclaw
 npx --yes huaweicloud-devkit update --target openclaw
 npx --yes huaweicloud-devkit uninstall --target openclaw
-rm -rf ~/.npm/_npx/  # 仅 Linux/macOS；Windows 路径待确认
+rm -rf ~/.npm/_npx/  # 仅 Linux/macOS；Windows：rmdir /s /q %LOCALAPPDATA%\npm-cache\_npx
 ```
 
 ### AtomCode
@@ -246,7 +254,7 @@ npx --yes huaweicloud-devkit uninstall --target atomcode
 
 无需预安装 — `npx` 自动处理一切。
 
-> 项目级 AK/SK 可通过 MCP 配置的 `env` 字段设置 `HW_ACCESS_KEY`/`HW_SECRET_KEY`。
+> 像上面这种手动 MCP 注册方式，请勿在配置里写凭据。`HW_ACCESS_KEY`/`HW_SECRET_KEY` 是保留给**平台/CI 注入**的账号用的（例如 DevSpace 托管的默认账号）——自己的账号统一通过 `npx huaweicloud-devkit auth init` 配置（唯一入口），会话内切换账号用 `huaweicloud_auth_init` / `huaweicloud_auth_switch` MCP 工具。完整凭据解析优先级见 `plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md`。
 
 #### 通过 Remote（HTTP）连接
 
@@ -256,7 +264,7 @@ npx --yes huaweicloud-devkit uninstall --target atomcode
 npx --yes huaweicloud-devkit-mcp --transport remote
 ```
 
-默认监听 `127.0.0.1:9528`（与预置的 IACMCPServer 端口 9527 不冲突）。随后以远程方式连接（以 opencode 为例）：
+默认监听 `127.0.0.1:9528`。随后以远程方式连接（以 opencode 为例）：
 
 ```jsonc
 {
@@ -284,7 +292,24 @@ npx --yes huaweicloud-devkit install-hcloud
 npx --yes huaweicloud-devkit auth init
 ```
 
-一步同步 AK/SK 到 KooCLI、OBS 和沙箱接口。
+一步同步 AK/SK 到 KooCLI、OBS 和沙箱接口——这是**唯一入口**，切勿把 AK/SK 手写进 Agent 或 shell 配置。
+
+**会话内切换账号**：使用 MCP 工具 `huaweicloud_auth_init`（内存态，优先级最高）或 `huaweicloud_auth_switch`（`temporary` / `persist` / `clear`）。在沙箱/DevSpace 环境中若默认账号经 `HW_ACCESS_KEY`/`HW_SECRET_KEY` 注入，单纯 `auth init` 无法覆盖——需 `huaweicloud_auth_switch action=persist` 让会话账号生效。
+
+**凭据解析优先级**（从高到低）：
+
+| #   | 来源                                          | 由谁设置                                                                      |
+| --- | --------------------------------------------- | ----------------------------------------------------------------------------- |
+| 1   | 运行时（会话）凭据                            | `huaweicloud_auth_init` / `huaweicloud_auth_switch action=temporary`          |
+| 2   | 带 `configuredBySession: true` 的 S1 全局文件 | `huaweicloud_auth_switch action=persist`                                      |
+| 3   | 环境变量（`HW_ACCESS_KEY`/`HW_SECRET_KEY`）   | 平台/DevSpace 注入的默认账号                                                  |
+| 4   | CodeArts / CodeArts Work                      | `.codeartsdoer/mcp/mcp_settings.json` / `.codeartswork/mcp/mcp_settings.json` |
+| 5   | S1 全局文件（无会话标记）                     | `auth init`                                                                   |
+| 6   | KooCLI profile                                | `~/.hcloud/config.json`（仅 KooCLI 命令）                                     |
+
+> **安全**：切勿把自己账号的 AK/SK 写入 MCP 配置的 `env` 字段——会以明文存储，配置文件提交 git 时即泄密；`env` 仅用于平台/CI 注入。
+
+完整说明：`plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md`。
 
 ### 安装所有 Agent
 
@@ -295,7 +320,7 @@ npx --yes huaweicloud-devkit install --target all
 ### 更新所有 Agent
 
 ```bash
-npx huaweicloud-devkit version
+npx --yes huaweicloud-devkit@latest version
 npx --yes huaweicloud-devkit@latest update --target all
 ```
 
@@ -303,7 +328,7 @@ npx --yes huaweicloud-devkit@latest update --target all
 
 ## 功能特性
 
-- **引导式云操作** — Agent 获得 20+ 华为云服务的分步操作指引（ECS、OBS、VPC、RDS、GaussDB、FunctionGraph、APIG、CCE 等）
+- **引导式云操作** — Agent 获得 20+ 常用华为云服务的分步操作指引（ECS、OBS、VPC、RDS、GaussDB、FunctionGraph、APIG、CCE 等）
 - **安全优先执行** — 所有写操作需用户明确批准；凭证和密钥自动脱敏
 - **执行前风险检查** — 公网暴露、凭证泄露、破坏性操作在执行前即被拦截
 - **区域感知** — 自动发现可用区域，创建资源前检查服务可用性
@@ -313,6 +338,8 @@ npx --yes huaweicloud-devkit@latest update --target all
 
 ECS、OBS、VPC、IAM、RDS、GaussDB、FunctionGraph、APIG、CCE、SMN/DMS、ModelArts、Cloud Eye、CTS、DEW、Billing、CBR、WAF/AAD、DDS/DCS、Deployment，以及入门指南。
 
+> 以上为预置指引的服务列表；其余 200+ 华为云服务仍可通过 KooCLI / API / SDK 路由调用（见 capability-discovery 与 cli-and-auth 元技能）。
+
 ## 文档
 
 - [架构](docs/architecture.md)

package/integrations/opencode/commands/huaweicloud-doctor.md

@@ -2,7 +2,7 @@
 description: Self-check Huawei Cloud DevKit readiness — hcloud, MCP, skills, auth.
 ---
 
-Use HuaweiCloud Devkit tools and skills to perform a comprehensive readiness check:
+Use HuaweiCloud DevKit tools and skills to perform a comprehensive readiness check:
 
 1. Check if KooCLI `hcloud` is installed: `huaweicloud_check_cli`. If not, guide user to install.
 2. Check if hcloud has active credentials: `hcloud configure list` (redacted).

package/integrations/opencode/skills/huaweicloud-core/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huaweicloud-core
-description: OpenCode entry skill for HuaweiCloud Devkit. Use when a developer asks OpenCode to use Huawei Cloud Skills, KooCLI, APIs, SDKs, future MCP tools, or low-priority Terraform guidance.
+description: OpenCode entry skill for HuaweiCloud DevKit. Use when a developer asks OpenCode to use Huawei Cloud Skills, KooCLI, APIs, SDKs, future MCP tools, or low-priority Terraform guidance.
 ---
 
 # Huawei Cloud Core For OpenCode

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.2",
   "kooCliVersion": "7.2.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
@@ -33,10 +33,11 @@
     "test": "node --test \"test/*.test.mjs\"",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "lint:md": "markdownlint-cli2 \"**/*.md\" \"#node_modules\" \"#.git\" \"#test/**\" \"#docs/**\"",
+    "lint:md": "markdownlint-cli2 \"**/*.md\" \"#node_modules\" \"#.git\" \"#test/**\" \"#docs/**\" \"#.superpowers/**\"",
     "lint:js": "eslint .",
     "lint": "npm run lint:md && npm run lint:js",
-    "validate": "node ./scripts/validate-package.mjs",
+    "validate": "node ./scripts/validate-package.mjs && node ./scripts/sync-readme-badge.mjs",
+    "badge:sync": "node ./scripts/sync-readme-badge.mjs --write",
     "pack:verify": "node ./scripts/pack-verify.mjs",
     "postinstall": "node ./bin/dsh-postinstall.cjs"
   },

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "interface": {
-    "displayName": "HuaweiCloud Devkit",
-    "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
-    "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
+    "displayName": "HuaweiCloud DevKit",
+    "shortDescription": "HuaweiCloud DevKit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
+    "longDescription": "HuaweiCloud DevKit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
     "developerName": "HuaweiCloud Mate",
     "category": "Cloud",
     "capabilities": ["Read", "Interactive"],
@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.2",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "interface": {
-    "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
+    "shortDescription": "HuaweiCloud DevKit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
     "developerName": "HuaweiCloud Mate",
     "capabilities": ["Read", "Interactive"],
     "brandColor": "#C7000B",
@@ -13,14 +13,14 @@
       "Check my Huawei Cloud CLI setup safely.",
       "Plan this Huawei Cloud API or SDK task."
     ],
-    "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
+    "longDescription": "HuaweiCloud DevKit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
     "websiteURL": "https://github.com/huaweicloud/HuaweiCloud-Devkit",
-    "displayName": "HuaweiCloud Devkit"
+    "displayName": "HuaweiCloud DevKit"
   },
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.2",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "interface": {
-    "displayName": "HuaweiCloud Devkit",
-    "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
-    "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
+    "displayName": "HuaweiCloud DevKit",
+    "shortDescription": "HuaweiCloud DevKit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
+    "longDescription": "HuaweiCloud DevKit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
     "developerName": "HuaweiCloud Mate",
     "category": "Cloud",
     "capabilities": ["Read", "Interactive"],
@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.2",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.2",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",
@@ -13,9 +13,9 @@
   "skills": "./skills/",
   "mcpServers": "./.mcp.json",
   "interface": {
-    "displayName": "HuaweiCloud Devkit",
-    "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
-    "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
+    "displayName": "HuaweiCloud DevKit",
+    "shortDescription": "HuaweiCloud DevKit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
+    "longDescription": "HuaweiCloud DevKit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
     "developerName": "HuaweiCloud Mate",
     "category": "Cloud",
     "capabilities": ["Read", "Interactive"],

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.2",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",
@@ -13,9 +13,9 @@
   "skills": "./skills/",
   "mcpServers": "./.mcp.json",
   "interface": {
-    "displayName": "HuaweiCloud Devkit",
-    "shortDescription": "HuaweiCloud Devkit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
-    "longDescription": "HuaweiCloud Devkit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
+    "displayName": "HuaweiCloud DevKit",
+    "shortDescription": "HuaweiCloud DevKit - Huawei Cloud guidance, CLI/API/SDK routing, MCP tools, and safety for coding agents.",
+    "longDescription": "HuaweiCloud DevKit helps coding agents choose and use Huawei Cloud Skills, KooCLI, APIs, SDKs, and MCP tools with less context, safer command execution, and more accurate cloud implementation decisions.",
     "developerName": "HuaweiCloud Mate",
     "category": "Cloud",
     "capabilities": ["Read", "Interactive"],

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.3-next.0",
+  "version": "1.1.3-next.2",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-create.md

@@ -47,3 +47,4 @@ hcloud OBS stat obs://<bucket>
 - Region is immutable after creation
 - ACL does NOT cascade to objects — set both bucket-level and object-level access
 - OBS uses separate credentials (`~/.obsutilconfig`, configure via `hcloud OBS config -i`)
+- **Return code is unreliable for `mb`**: it can exit non-zero (e.g. 6) while the bucket is actually created (output still carries a request id). Confirm with `stat obs://<bucket>` / `OBS ls` instead of the exit code; re-running `mb` on the same name is idempotent.

package/plugins/huaweicloud-core/skills/huawei-obs/references/static-website.md

@@ -54,3 +54,5 @@ curl http://my-static-site.obs-website.cn-north-4.myhuaweicloud.com
 - **Always use `-f`**: Without `-f`, obsutil prompts "Please input (y/n)" on large uploads — Agent hangs (TIMEOUT).
 - **Use `-flat` for root files**: Without `-flat`, `dist/` becomes `bucket/dist/` prefix. Static sites need files at bucket root.
 - **Objects don't inherit bucket ACL**: Setting bucket to public-read does NOT make individual objects public. You must also set object-level ACL with `chattri obs://<bucket>/ -r -f -acl=public-read` or use `-acl=public-read` during upload.
+- **`mb` may return a non-zero exit code even on success**: `hcloud OBS mb` occasionally exits with code 6 (or other non-zero) while the bucket is actually created — the output still contains a request id and subsequent `cp`/`chattri` succeed. Judge success by the response text (request id) and confirm with `hcloud OBS ls` / `stat obs://<bucket>`, NOT the exit code alone. `mb` is idempotent, so re-issuing the same bucket name is harmless.
+- **Website endpoint is eventually consistent (~1 min)**: after `PUT /?website` returns 200, the website endpoint (`http://<bucket>.obs-website.<region>.myhuaweicloud.com`) may return 404 `NoSuchWebsiteConfiguration` for up to ~1 minute. This is propagation delay, NOT a configuration failure. Verify immediately via the object URL (`https://<bucket>.obs.<region>.myhuaweicloud.com/index.html`, works before the website endpoint), then poll the website endpoint with a short backoff until it returns 200 before reporting success.

package/plugins/huaweicloud-core/src/auth/reconcile.mjs

@@ -45,15 +45,27 @@ export function readKooCliProfiles() {
     const current = String(raw.current || 'default');
     const profiles = Array.isArray(raw.profiles) ? raw.profiles : [];
     const mtimeMs = statSync(configPath).mtimeMs;
+    // KooCLI 7.x stores AK/SK encrypted (authEncrypt=true): the on-disk values
+    // are ciphertext, so a fingerprint computed from them can never match the
+    // plaintext S1/S3 stores. Blind the comparable fields instead of treating
+    // ciphertext as a real credential and misreporting a S2 drift (#533).
+    // KooCLI serializes the flag as the string "true", not a boolean.
+    const encrypted = raw.authEncrypt === true || raw.authEncrypt === 'true';
     return {
       current,
       mtimeMs,
       configPath,
-      profiles: profiles.map((p) => ({
-        name: String(p.name || ''),
-        fingerprint: fingerprint(p.accessKeyId, p.secretAccessKey),
-        accessKeyId: p.accessKeyId || '',
-      })),
+      authEncrypt: encrypted,
+      profiles: profiles.map((p) =>
+        encrypted
+          ? { name: String(p.name || ''), fingerprint: '', accessKeyId: '', encrypted: true }
+          : {
+              name: String(p.name || ''),
+              fingerprint: fingerprint(p.accessKeyId, p.secretAccessKey),
+              accessKeyId: p.accessKeyId || '',
+              encrypted: false,
+            },
+      ),
     };
   } catch {
     return { error: 'KooCLI config parse failed' };
@@ -138,6 +150,9 @@ export function scanState() {
       runtimeFingerprint,
     },
     kooCliCurrent: kooCli.error ? null : kooCli.current,
+    // S2 is encrypted storage (authEncrypt) → its fingerprint is unavailable,
+    // so the S2-current drift check is intentionally skipped (#533).
+    s2Encrypted: Boolean(!kooCli.error && kooCli.authEncrypt),
     inconsistencies,
     hasRuntime,
     runtimeFingerprint,

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -1047,7 +1047,7 @@ async function installCodexDesktop() {
 
   // Register in personal marketplace (Codex discovers plugins from ~/.agents/plugins/marketplace.json)
   ensureCodexMarketplaceEntry();
-  console.log('  \x1b[33m请到插件 → 个人 → HuaweiCloud Devkit → 安装\x1b[0m');
+  console.log('  \x1b[33m请到插件 → 个人 → HuaweiCloud DevKit → 安装\x1b[0m');
 
   // Clean up old install locations from pre-marketplace era
   removeIfExists(join(homedir(), '.agents', 'skills'));
@@ -3009,7 +3009,7 @@ function opencodeStatus() {
   }
 }
 
-function autoDetectTarget() {
+function detectAgents() {
   const checks = [
     ['opencode', () => existsSync(join(homedir(), '.config', 'opencode'))],
     ['codex-desktop', () => existsSync(join(homedir(), '.codex'))],
@@ -3028,7 +3028,11 @@ function autoDetectTarget() {
     ['openclaw', () => existsSync(join(homedir(), '.openclaw'))],
     ['atomcode', () => existsSync(atomcodeHome())],
   ];
-  const detected = checks.filter(([, check]) => check()).map(([name]) => name);
+  return checks.filter(([, check]) => check()).map(([name]) => name);
+}
+
+function autoDetectTarget() {
+  const detected = detectAgents();
   if (detected.length === 0) {
     console.error('No supported agent detected.');
     console.error(`Supported: ${SUPPORTED_AGENT_TARGETS.join(', ')} (or "all")`);
@@ -3039,6 +3043,208 @@ function autoDetectTarget() {
   return 'all';
 }
 
+const AGENT_LABELS = {
+  opencode: 'OpenCode',
+  'codex-desktop': 'Codex Desktop',
+  codearts: 'CodeArts',
+  'codearts-work': 'CodeArts Work',
+  workbuddy: 'WorkBuddy',
+  dsh: 'DSH',
+  officeace: 'OfficeAce',
+  hermes: 'Hermes',
+  openclaw: 'OpenClaw',
+  atomcode: 'AtomCode',
+};
+
+function promptSelectAgents(detected) {
+  if (!process.stdin.isTTY) {
+    console.error(
+      `Multiple agents detected (${detected.join(', ')}). Cannot prompt in a non-interactive shell — ` +
+        'specify `--target <agent>` or `--target all`.',
+    );
+    return Promise.resolve(null);
+  }
+  const question = [
+    'Multiple agents detected. Select which to install (multi-select):',
+    ...detected.map((name, i) => `  ${i + 1}) ${AGENT_LABELS[name] || name}`),
+    'Enter numbers separated by commas/spaces, "all" for every detected, Enter to install all detected, or "0" to cancel: ',
+  ].join('\n');
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(question, (a) => {
+      rl.close();
+      const answer = (a || '').trim().toLowerCase();
+      if (answer === '0' || answer === 'n' || answer === 'no' || answer === 'q') {
+        resolve(null);
+        return;
+      }
+      if (answer === '' || answer === 'all') {
+        resolve(detected.slice());
+        return;
+      }
+      const parts = answer.split(/[\s,，]+/).filter(Boolean);
+      const indices = new Set();
+      for (const part of parts) {
+        const n = Number(part);
+        if (Number.isSafeInteger(n) && n >= 1 && n <= detected.length) {
+          indices.add(n - 1);
+        } else {
+          console.error(`Invalid selection: "${part}". Installing all detected.`);
+          resolve(detected.slice());
+          return;
+        }
+      }
+      resolve([...indices].map((i) => detected[i]));
+    });
+  });
+}
+
+const MCP_ENTRY = {
+  command: 'npx',
+  args: ['-y', '-p', 'huaweicloud-devkit', 'huaweicloud-devkit-mcp'],
+};
+
+function promptZeroDetect() {
+  if (!process.stdin.isTTY) {
+    console.error('No supported agent detected.');
+    console.error(`Supported: ${SUPPORTED_AGENT_TARGETS.join(', ')} (or "all")`);
+    console.error('Use --target <agent> to specify.');
+    return Promise.resolve({ abort: true });
+  }
+  const question = [
+    'No supported agent detected.',
+    'What would you like to do?',
+    '  1) Install to a specific agent (e.g. codex)',
+    '  2) Install to all supported agents (--target all)',
+    '  3) Wire up a generic MCP agent (Claude Code / Cursor / custom MCP client)',
+    '  0) Exit',
+    'Enter choice: ',
+  ].join('\n');
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const ask = () => {
+      rl.question(question, (a) => {
+        const answer = (a || '').trim().toLowerCase();
+        if (answer === '1') {
+          rl.question('Enter agent target (e.g. codex): ', (t) => {
+            const val = (t || '').trim().toLowerCase();
+            rl.close();
+            if (val === 'all' || SUPPORTED_AGENT_TARGETS.includes(val)) {
+              resolve({ explicit: true, target: val });
+            } else {
+              console.error(`Unknown target: ${val}`);
+              console.error(`Supported: ${SUPPORTED_AGENT_TARGETS.join(', ')} (or "all")`);
+              resolve({ abort: true });
+            }
+          });
+          return;
+        }
+        if (answer === '2') {
+          rl.close();
+          resolve({ explicit: true, target: 'all' });
+          return;
+        }
+        if (answer === '3') {
+          rl.close();
+          resolve({ mcp: true });
+          return;
+        }
+        if (answer === '' || answer === '0' || answer === 'n' || answer === 'no' || answer === 'q') {
+          rl.close();
+          resolve({ abort: true });
+          return;
+        }
+        console.error(`Invalid choice: "${answer}"`);
+        ask();
+      });
+    };
+    ask();
+  });
+}
+
+function printMCPConfigSnippet(reason) {
+  console.log(`  ${reason}`);
+  console.log('  Add this to your agent MCP config (stdio):');
+  const snippet = JSON.stringify({ mcpServers: { 'huaweicloud-devkit': MCP_ENTRY } }, null, 2)
+    .split('\n')
+    .map((line) => `    ${line}`)
+    .join('\n');
+  console.log(snippet);
+  console.log('  Or run the remote server and use a remote (Streamable HTTP) config:');
+  console.log('    npx --yes huaweicloud-devkit-mcp --transport remote   # listens on 127.0.0.1:9528');
+  console.log('  See README → "Other Agents" for details.');
+}
+
+function configureMCPAgent(targetFile, agentLabel) {
+  let config = {};
+  let existed = false;
+  if (existsSync(targetFile)) {
+    existed = true;
+    try {
+      config = JSON.parse(readFileSync(targetFile, 'utf8'));
+    } catch {
+      console.error(`  [${agentLabel}] ${targetFile} is not valid JSON; leaving it untouched.`);
+      return false;
+    }
+  }
+  config.mcpServers = config.mcpServers || {};
+  if (config.mcpServers['huaweicloud-devkit']) {
+    console.log(`  [${agentLabel}] mcpServers.huaweicloud-devkit already configured; skipping.`);
+    return true;
+  }
+  if (existed) copyFileSync(targetFile, `${targetFile}.bak`);
+  config.mcpServers['huaweicloud-devkit'] = { ...MCP_ENTRY };
+  mkdirSync(dirname(targetFile), { recursive: true });
+  writeFileSync(targetFile, JSON.stringify(config, null, 2), 'utf8');
+  console.log(`  [${agentLabel}] MCP server configured in ${targetFile}. Restart the session to apply.`);
+  return true;
+}
+
+function configureGenericMCP() {
+  console.log('Configuring a generic MCP agent (MCP tools only; skills/hooks are not installed)...');
+  const targets = [];
+  const claudeFile = process.env.CLAUDE_CONFIG_DIR
+    ? join(process.env.CLAUDE_CONFIG_DIR, '.claude.json')
+    : join(homedir(), '.claude.json');
+  if (existsSync(claudeFile)) targets.push(['Claude Code', claudeFile]);
+  const cursorFile = join(homedir(), '.cursor', 'mcp.json');
+  if (existsSync(cursorFile) || existsSync(join(homedir(), '.cursor'))) {
+    targets.push(['Cursor', cursorFile]);
+  }
+
+  if (targets.length === 0) {
+    printMCPConfigSnippet('No known MCP agent detected; here is a config snippet you can paste:');
+    return false;
+  }
+  let anyConfigured = false;
+  for (const [label, file] of targets) {
+    if (configureMCPAgent(file, label)) anyConfigured = true;
+  }
+  if (!anyConfigured) {
+    console.log('  Nothing to configure for the detected MCP agents.');
+  }
+  return anyConfigured;
+}
+
+async function resolveInstallTarget() {
+  const idx = process.argv.indexOf('--target');
+  if (idx >= 0) {
+    const val = (process.argv[idx + 1] || '').toLowerCase();
+    if (val === 'all' || SUPPORTED_AGENT_TARGETS.includes(val)) {
+      return { explicit: true, target: val };
+    }
+    console.error(`Unknown target: ${val}`);
+    console.error(`Supported: ${SUPPORTED_AGENT_TARGETS.join(', ')} (or "all")`);
+    process.exit(1);
+  }
+  const detected = detectAgents();
+  if (detected.length === 1) return { explicit: true, target: detected[0] };
+  if (detected.length === 0) return promptZeroDetect();
+  const chosen = await promptSelectAgents(detected);
+  if (!chosen) return { abort: true };
+  return { explicit: false, subset: chosen };
+}
+
 function parseTarget() {
   const idx = process.argv.indexOf('--target');
   if (idx < 0) return autoDetectTarget();
@@ -3084,13 +3290,37 @@ function writeInstallMarker(target) {
 }
 
 async function cmdInstall() {
-  const target = parseTarget();
   console.log(BANNER);
-  console.log(`Installing HuaweiCloud DevKit${target !== 'opencode' ? ` for ${target}` : ''}...\n`);
+  const plan = await resolveInstallTarget();
+  if (plan.abort) {
+    process.exitCode = 1;
+    return;
+  }
+  if (plan.mcp) {
+    const ok = configureGenericMCP();
+    process.exitCode = ok ? 0 : 1;
+    return;
+  }
+  const hasExplicitTarget = plan.explicit;
+  const target = plan.explicit ? plan.target : null;
+  const selected = new Set(plan.explicit ? [] : plan.subset);
+
+  if (hasExplicitTarget) {
+    console.log(`Installing HuaweiCloud DevKit for ${target}...\n`);
+  } else {
+    console.log(`Installing HuaweiCloud DevKit to ${[...selected].join(', ')}...\n`);
+  }
+
   checkNode();
   checkForUpdate();
   const installFailures = [];
 
+  function shouldInstall(name) {
+    if (name === 'codex') return hasExplicitTarget && (target === 'codex' || target === 'all');
+    if (hasExplicitTarget) return target === name || target === 'all';
+    return selected.has(name);
+  }
+
   async function runInstallStep(stepTarget, title, fn) {
     console.log(title);
     try {
@@ -3108,37 +3338,37 @@ async function cmdInstall() {
     }
   }
 
-  if (target === 'opencode' || target === 'all') {
+  if (shouldInstall('opencode')) {
     await runInstallStep('opencode', '[OpenCode]', installOpenCode);
   }
-  if (target === 'codex-desktop' || target === 'all') {
+  if (shouldInstall('codex-desktop')) {
     await runInstallStep('codex-desktop', '\n[Codex Desktop]', installCodexDesktop);
   }
-  if (target === 'codearts' || target === 'all') {
+  if (shouldInstall('codearts')) {
     await runInstallStep('codearts', '\n[CodeArts]', installCodeArts);
   }
-  if (target === 'codearts-work' || target === 'all') {
+  if (shouldInstall('codearts-work')) {
     await runInstallStep('codearts-work', '\n[CodeArts Work]', installCodeArtsWork);
   }
-  if (target === 'workbuddy' || target === 'all') {
+  if (shouldInstall('workbuddy')) {
     await runInstallStep('workbuddy', '\n[WorkBuddy]', installWorkBuddy);
   }
-  if (target === 'dsh' || target === 'all') {
+  if (shouldInstall('dsh')) {
     await runInstallStep('dsh', '\n[DSH]', installDsh);
   }
-  if (target === 'officeace' || target === 'all') {
+  if (shouldInstall('officeace')) {
     await runInstallStep('officeace', '\n[OfficeAce]', installOfficeAce);
   }
-  if (target === 'hermes' || target === 'all') {
+  if (shouldInstall('hermes')) {
     await runInstallStep('hermes', '\n[Hermes Agent]', installHermes);
   }
-  if (target === 'openclaw' || target === 'all') {
+  if (shouldInstall('openclaw')) {
     await runInstallStep('openclaw', '\n[OpenClaw]', installOpenClaw);
   }
-  if (target === 'atomcode' || target === 'all') {
+  if (shouldInstall('atomcode')) {
     await runInstallStep('atomcode', '\n[AtomCode]', installAtomCode);
   }
-  if (target === 'codex' || target === 'all') {
+  if (shouldInstall('codex')) {
     await runInstallStep('codex', '\n[Codex]', () => {
       if (!hasCodexCLI()) {
         if (target === 'codex') {
@@ -4068,6 +4298,10 @@ async function cmdReinstall() {
 let confirmed = false;
 async function confirm(msg) {
   if (confirmed) return true;
+  if (!process.stdin.isTTY) {
+    console.log('Non-interactive shell: skipping confirmation (declined).');
+    return false;
+  }
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((ok) => {
     rl.question(`${msg} [y/N] `, (a) => {

package/plugins/huaweicloud-core/src/tools.mjs

@@ -1012,7 +1012,31 @@ function refreshUserHashAfterAuthChange({ regenerate = true } = {}) {
   }
 }
 
-export async function callTool(name, args = {}) {
+// Reject invalid numeric args up front instead of silently coercing them to
+// NaN (which downstream defaults would absorb as "no timeout set") — see #530.
+const NUMERIC_ARG_KEYS = ['timeoutMs', 'maxRetries', 'timeout_ms'];
+
+function normalizeNumericArgs(args) {
+  const out = { ...args };
+  for (const key of NUMERIC_ARG_KEYS) {
+    const value = out[key];
+    if (value === undefined || value === null) continue;
+    const num = Number(value);
+    // timeouts must be positive; maxRetries may be 0 (means "no retries").
+    const isRetries = key === 'maxRetries';
+    const valid = Number.isFinite(num) && (isRetries ? Number.isSafeInteger(num) && num >= 0 : num > 0);
+    if (!valid) {
+      throw new Error(
+        `Invalid parameter "${key}": expected a ${isRetries ? 'non-negative integer' : 'positive number'}, received ${JSON.stringify(value)}.`,
+      );
+    }
+    out[key] = num;
+  }
+  return out;
+}
+
+export async function callTool(name, rawArgs = {}) {
+  const args = normalizeNumericArgs(rawArgs);
   const toolValue = toolInvokeValue(name, args);
   trackToolInvoke(name, toolValue);
 

package/plugins/huaweicloud-core/src/update-check.mjs

@@ -323,7 +323,9 @@ export async function upgradePackage({ target = 'all', version = 'latest' } = {}
     return { success: false, error: 'version 参数仅支持 latest。目标版本由插件自动判定。' };
   }
   const { doQuery = queryDistTags, spawnFn = defaultSpawn } = options;
-  const previousVersion = readInstalledVersion();
+  // Tests inject currentVersion explicitly - the repo package.json version changes
+  // between prerelease and stable lines, which must not flip the upgrade-tag logic.
+  const previousVersion = options.currentVersion || readInstalledVersion();
   let distTags;
   try {
     distTags = await doQuery();