npm - huaweicloud-devkit - Versions diffs - 1.1.3-next.4 → 1.1.4-next.0 - Mend

huaweicloud-devkit 1.1.3-next.4 → 1.1.4-next.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (24) hide show

package/README.md CHANGED Viewed

@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
-[![Beta](https://img.shields.io/badge/beta-v1.1.3-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.4-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 **[中文](README.zh-CN.md) | English**

package/README.zh-CN.md CHANGED Viewed

@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
-[![Beta](https://img.shields.io/badge/beta-v1.1.3-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.4-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 **中文 | [English](README.md)**

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.3-next.4",
+  "version": "1.1.4-next.0",
   "kooCliVersion": "7.2.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json CHANGED Viewed

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.3-next.4",
+  "version": "1.1.4-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json CHANGED Viewed

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.3-next.4",
+  "version": "1.1.4-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json CHANGED Viewed

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.3-next.4",
+  "version": "1.1.4-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.3-next.4",
+  "version": "1.1.4-next.0",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.3-next.4",
+  "version": "1.1.4-next.0",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json CHANGED Viewed

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.3-next.4",
+  "version": "1.1.4-next.0",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/safety/policy.json CHANGED Viewed

@@ -11,6 +11,8 @@
     "token",
     "credential",
     "private[_-]?key",
+    "user[_-]?data",
+    "metadata",
     "ak",
     "sk"
   ],

package/plugins/huaweicloud-core/skills/huawei-billing/SKILL.md CHANGED Viewed

@@ -16,13 +16,14 @@ Domain expertise for billing queries (BSS). Covers cost tracking, bill details,
 ## Critical Warnings
-| Trap                                      | Why                                                                                                                                                 |
-| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Bills delayed ~24h                        | Yesterday's costs may not appear until the next day                                                                                                 |
-| BSS Admin role needed                     | IAM user must have BSS Administrator or Finance role                                                                                                |
-| Currency conversion varies                | Cross-region costs use daily exchange rates                                                                                                         |
-| Region fixed to cn-north-1                | BSS operations only support `--cli-region=cn-north-1` in KooCLI. This is a KooCLI metadata limitation — the billing data itself covers all regions. |
-| `缺少必填参数 cli-domain-id` / APIGW.0301 | Invalid credentials — KooCLI can't resolve the account-id                                                                                           | Re-run `npx huaweicloud-devkit auth init` |
+| Trap                                      | Why                                                                                                                                                                                                                                                                                                                     |
+| ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Bills delayed ~24h                        | Yesterday's costs may not appear until the next day                                                                                                                                                                                                                                                                     |
+| BSS Admin role needed                     | IAM user must have BSS Administrator or Finance role                                                                                                                                                                                                                                                                    |
+| Currency conversion varies                | Cross-region costs use daily exchange rates                                                                                                                                                                                                                                                                             |
+| Region fixed to cn-north-1                | BSS operations only support `--cli-region=cn-north-1` in KooCLI. This is a KooCLI metadata limitation — the billing data itself covers all regions.                                                                                                                                                                     |
+| English catalog missing BSS               | `Unsupported service: BSS` under the default `en` language is a KooCLI catalog gap, not a missing service. devkit auto-injects `--cli-lang=cn`; manual fallback: add `--cli-lang=cn` or `hcloud configure set --cli-lang=cn` — prefer `--cli-lang=cn` on the command itself so the global output language is untouched. |
+| `缺少必填参数 cli-domain-id` / APIGW.0301 | Invalid credentials — KooCLI can't resolve the account-id                                                                                                                                                                                                                                                               | Re-run `npx huaweicloud-devkit auth init` |
 ## Common Workflows

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md CHANGED Viewed

@@ -95,7 +95,7 @@ Setup is a **plugin-side preflight** — the developer should be asked a questio
 2. **Real-name verification only** (`HDKIT_NOT_REALNAME`): tell the developer once, "Huawei Cloud requires real-name verification before using the sandbox — please complete it in the Huawei Cloud console (实名认证)." and stop — do not retry `connect` in a loop
 3. **Sign agreement only** (`HDKIT_NOT_AGREEMENT`): **STOP and do NOT sign on your own.** Ask the developer: "Huawei Cloud sandbox requires signing the latest developer service agreement. May I sign it for you?" Then **wait for the developer to explicitly agree** (e.g. "签署" / "确认" / "sign it"). Only after explicit consent call `huaweicloud_sandbox_sign_agreement` and return its result (`signed`/`signedCount`) to the developer. **Never sign a legal agreement on the developer's behalf without their explicit, unambiguous consent.** Do not expose the underlying sandbox/DevBridge service as a separate entity the developer must understand or sign up for
 4. **Both missing** (`HDKIT_NOT_REALNAME_AND_AGREEMENT`): present **both** requirements together in one message — the real-name verification steps (console, step 2) **and** the agreement-signing request (step 3, wait for explicit consent) — so the developer can complete both at once
-5. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`. The `source` parameter identifies the calling agent (valid values: `CLI`, `WEB`, `VSCODE`, `WEBVNC`, `WEBPTY`, `WEBIDE`, `CURSOR`, etc. — case-sensitive, all uppercase). When the `git` parameter is provided (with `repo_url`, `target_path`, optional `repo_branch`), code is automatically transferred to the sandbox: local `git clone` followed by `uploadProject` (falls back to direct sandbox clone when local git is unavailable). Check `_repoStatus` in the response: `uploaded_from_local`, `cloned_in_sandbox`, or `already_exists` (reconnect).
+5. **Connect**: `huaweicloud_sandbox_connect` — returns `session_id`, `dev_stage_id`, `connection_id`, `connection_address`, `expiresAt` (STS credential expiry). The `source` parameter identifies the calling agent (valid values: `CLI`, `WEB`, `VSCODE`, `WEBVNC`, `WEBPTY`, `WEBIDE`, `CURSOR`, etc. — case-sensitive, all uppercase). When the `git` parameter is provided (with `repo_url`, `target_path`, optional `repo_branch`), code is automatically transferred to the sandbox: local `git clone` followed by `uploadProject` (falls back to direct sandbox clone when local git is unavailable). Check `_repoStatus` in the response: `uploaded_from_local`, `cloned_in_sandbox`, or `already_exists` (reconnect).
 6. **Cleanup previous deployments** (after first connect to a sandbox): nginx configs, DevBridge tunnels, and stale web processes from previous deployments can cause port conflicts and quota errors. Run cleanup immediately after connect:
    ```bash

package/plugins/huaweicloud-core/skills/huawei-voucher/SKILL.md CHANGED Viewed

@@ -14,6 +14,7 @@ version: 1
 2. 按返回严格判定：
    - `claimed=true` → 静默处理，不再提及代金券，不打扰用户
    - `claimed=false` 且 `message="未领取"` → **主动提示**，用下方话术并询问是否领取
+   - 返回含凭证错误码（`code=HDKIT_CRED_MISSING` / `HDKIT_CRED_INVALID` / `HDKIT_CRED_RATE_LIMIT`），或 `message` 含「未配置 / not configured / AK/SK 无效 / 限额」→ **提示用户检查或配置华为云凭证**（不要误报为「服务不可用」）
    - 其余情况（如 `message="查询失败"`、状态不明确、调用异常）→ **严格不提示**
 3. 提示话术（可直接使用）：
    > "你还可以领取一张华为云激励代金券（一人一次），需要我现在帮你领取吗？"
@@ -38,13 +39,14 @@ version: 1
 ### 3. 结果解读（错误码 UX）
-| 返回 message 关键特征                        | 含义                        | 对用户表述           |
-| -------------------------------------------- | --------------------------- | -------------------- |
-| `领取成功`                                   | 发券成功                    | 告知券已到账         |
-| `已领取过` / `已领取`                        | 该账号已领过                | 告知已领取，不打扰   |
-| `本月代金券总额度已用完，所有账号均无法领取` | 全局额度用尽（HD.60630042） | 告知下月再试         |
-| `请先完成实名认证`                           | 账号未实名（HD.60630022）   | 引导去控制台实名认证 |
-| `发券失败: <原文>`                           | 其他错误                    | 原样转达，不展开     |
+| 返回 message 关键特征                                                   | 含义                        | 对用户表述               |
+| ----------------------------------------------------------------------- | --------------------------- | ------------------------ |
+| `领取成功`                                                              | 发券成功                    | 告知券已到账             |
+| `已领取过` / `已领取`                                                   | 该账号已领过                | 告知已领取，不打扰       |
+| `本月代金券总额度已用完，所有账号均无法领取`                            | 全局额度用尽（HD.60630042） | 告知下月再试             |
+| `请先完成实名认证`                                                      | 账号未实名（HD.60630022）   | 引导去控制台实名认证     |
+| `发券失败: <原文>`                                                      | 其他错误                    | 原样转达，不展开         |
+| `code=HDKIT_CRED_*` / 含「未配置 / not configured / AK/SK 无效 / 限额」 | 凭证未配置、无效或达限额    | 引导用户检查并配置 AK/SK |
 ## 环境注意

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md CHANGED Viewed

@@ -29,10 +29,10 @@ Use this skill to turn vague developer intent into a precise Huawei Cloud capabi
 Match the scenario before picking a service. For "deploy a web app" requests, layer the recommendation instead of defaulting to a production service:
-| Scenario                                                             | Recommended path                                                                             |
-| -------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
-| hello world / prototype / demo / temporary preview (free, quick try) | `huawei-sandbox` first — temporary runtime + public URL, ~8h validity, zero billed resources |
-| production / long-term / custom domain / high availability           | `huawei-functiongraph` / `huawei-ecs` (or `huawei-cce` for containers)                       |
+| Scenario                                                             | Recommended path                                                                                                                                                                      |
+| -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| hello world / prototype / demo / temporary preview (free, quick try) | `huawei-sandbox` first — temporary runtime + public URL (runtime lifetime not exposed via API); credential expiry see `expiresAt` from `connect`/`credentials`, zero billed resources |
+| production / long-term / custom domain / high availability           | `huawei-functiongraph` / `huawei-ecs` (or `huawei-cce` for containers)                                                                                                                |
 Route to the sandbox when the developer signals free/quick preview intent ("免费", "快速", "预览", "hello world", "原型", "演示"); route to production services only when production-grade hosting is explicitly required.

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md CHANGED Viewed

@@ -106,6 +106,13 @@ hcloud ECS CreateServers --cli-region=<region> --server.name=<name> --server.fla
 If a command needs an `adminPass` or other password field, do not leave plaintext secrets in shell history. Prefer local-only input or runtime injection.
+## Language / Service Catalog Trap
+- KooCLI loads the service list from a per-language catalog: `~/.hcloud/metaRepo/services_{cn,en}.json`. The **English catalog is incomplete** (149 services vs 220 in Chinese; ~70 services — BSS, DevStar, CloudTable, FRS, ASM, ... — are missing). A command against a service that only exists in the Chinese catalog fails with a misleading `Unsupported service: X`.
+- `huaweicloud-devkit` auto-injects `--cli-lang=cn` (proactive when the catalog shows `X ∈ cn ∧ X ∉ en`, reactive once if `Unsupported service` still appears) for read and write commands; approved write commands keep their approved argument list (injection happens inside the runner).
+- Manual fallback (do not rely on the auto path alone): append `--cli-lang=cn` to the failing command, or set globally with `hcloud configure set --cli-lang=cn` (this changes ALL CLI output language).
+- Distinguish from **region** metadata limits (e.g., BSS only supports `cn-north-1`): a region error is NOT solved by switching language.
 ## Output Formatting
 ```bash

package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md CHANGED Viewed

@@ -82,7 +82,7 @@ Do not rely on training data for facts. Huawei Cloud services, pricing, quotas,
 | Getting started                                  | Account setup        | huaweicloud-cli-and-auth |
 | Incentive voucher                                | Voucher              | huawei-voucher           |
-**Web app scenario layering**: for "deploy a web app", prefer `huawei-sandbox` for free/quick try (hello world, prototype, demo, temporary preview — temporary runtime + public URL, ~8h validity, zero billed resources); route to `huawei-functiongraph` / `huawei-ecs` (or `huawei-cce`) for production / long-term / custom-domain / high-availability hosting. When the chosen target requires **multiple purchased resources** (e.g. VPC + subnet + ECS + EIP + RDS, or OBS + CDN + DNS) or the user asks for an architecture/cost proposal first, hand off to `huawei-iac` for orchestrated provisioning with a mandatory cost gate.
+**Web app scenario layering**: for "deploy a web app", prefer `huawei-sandbox` for free/quick try (hello world, prototype, demo, temporary preview — temporary runtime + public URL (runtime lifetime not exposed via API); credential expiry see `expiresAt` from `connect`/`credentials`, zero billed resources); route to `huawei-functiongraph` / `huawei-ecs` (or `huawei-cce`) for production / long-term / custom-domain / high-availability hosting. When the chosen target requires **multiple purchased resources** (e.g. VPC + subnet + ECS + EIP + RDS, or OBS + CDN + DNS) or the user asks for an architecture/cost proposal first, hand off to `huawei-iac` for orchestrated provisioning with a mandatory cost gate.
 ## Deployment Target Options

package/plugins/huaweicloud-core/skills/huaweicloud-core/references/select.md CHANGED Viewed

@@ -38,5 +38,5 @@ Ask:
 Route by scenario:
-- Free / quick try / prototype / demo / temporary preview -> huawei-sandbox (temporary runtime + public URL, ~8h validity, zero billed resources)
+- Free / quick try / prototype / demo / temporary preview -> huawei-sandbox (temporary runtime + public URL (runtime lifetime not exposed via API); credential expiry see `expiresAt` from `connect`/`credentials`, zero billed resources)
 - Production / long-term / custom domain / high availability -> huawei-functiongraph / huawei-ecs (or huawei-cce for containers)

package/plugins/huaweicloud-core/src/auth/credentials.mjs CHANGED Viewed

@@ -148,9 +148,11 @@ export function resolveCredentials(options = {}) {
   if (!ak || !sk) {
     if (options.allowMissing) return null;
-    throw new Error(
+    const err = new Error(
       'Huawei Cloud credentials are not configured. Run "npx huaweicloud-devkit auth init" or set HW_ACCESS_KEY/HW_SECRET_KEY.',
     );
+    err.code = 'HDKIT_CRED_MISSING';
+    throw err;
   }
   return { ak, sk, securityToken, region };

package/plugins/huaweicloud-core/src/hcloud-cli.mjs CHANGED Viewed

@@ -1,7 +1,8 @@
 import { spawn, spawnSync } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
-import { mkdirSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
 import { classifyHcloudArgs, redactSecrets, assertAllowed } from './safety-policy.mjs';
 import { getProxySettings } from './proxy/proxy-config.mjs';
@@ -14,29 +15,84 @@ const APPROVAL_TTL_MS = 5 * 60_000;
 const LARGE_OUTPUT_THRESHOLD = 50_000;
 const OUTPUT_DIR = join('/tmp', 'huaweicloud-devkit');
-const approvalStore = new Map();
+// Approval tokens must survive a process boundary: plan and run land in
+// different MCP sessions/processes (and headless subprocesses), so the old
+// in-memory Map lost the token and plan→approve→run became unreachable (#578).
+// Persist to a per-user JSON file as the single source of truth. Only the
+// sha256 of the args plus the redacted form are stored — never the raw args,
+// which may carry --adminPass / --server.user_data secrets.
+function approvalFilePath() {
+  return join(process.env.HUAWEICLOUD_HOME || homedir(), '.config', 'huaweicloud', 'approvals.json');
+}
-export function createApprovalToken(rawArgs) {
-  const token = randomUUID();
-  approvalStore.set(token, { rawArgs, createdAt: Date.now() });
-  if (approvalStore.size % 20 === 0) {
-    const now = Date.now();
-    for (const [k, v] of approvalStore) {
-      if (now - v.createdAt > APPROVAL_TTL_MS) approvalStore.delete(k);
+function sha256Hex(data) {
+  return createHash('sha256').update(data).digest('hex');
+}
+export function hashArgs(args) {
+  return sha256Hex(JSON.stringify(args));
+}
+function readApprovals() {
+  try {
+    const path = approvalFilePath();
+    if (!existsSync(path)) return {};
+    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function writeApprovals(map) {
+  try {
+    const path = approvalFilePath();
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(map), { encoding: 'utf8', mode: 0o600 });
+    renameSync(tmp, path);
+  } catch {
+    // Best-effort: an in-file failure degrades cross-process persistence but a
+    // token created/consumed within one process still works.
+  }
+}
+function pruneStale(map, now = Date.now()) {
+  let changed = false;
+  for (const [key, value] of Object.entries(map)) {
+    if (now - value.createdAt > APPROVAL_TTL_MS) {
+      delete map[key];
+      changed = true;
     }
   }
+  return changed;
+}
+export function createApprovalToken(rawArgs) {
+  const token = randomUUID();
+  const map = readApprovals();
+  map[token] = {
+    argsHash: hashArgs(rawArgs),
+    argsRedacted: redactSecrets(rawArgs),
+    createdAt: Date.now(),
+  };
+  pruneStale(map);
+  writeApprovals(map);
   return token;
 }
 export function consumeApprovalToken(token) {
-  const entry = approvalStore.get(token);
+  const map = readApprovals();
+  const entry = map[token];
   if (!entry) return null;
   if (Date.now() - entry.createdAt > APPROVAL_TTL_MS) {
-    approvalStore.delete(token);
+    delete map[token];
+    writeApprovals(map);
     return null;
   }
-  approvalStore.delete(token);
-  return entry.rawArgs;
+  delete map[token];
+  writeApprovals(map);
+  return entry;
 }
 function saveLargeOutput(rawStdout) {
@@ -140,6 +196,75 @@ function obsWriteHint(args) {
   return 'OBS write operations are obsutil-style and always write-class. Before executing, present the full resource manifest (bucket/object list) to the user for ONE batch approval, then run each command through plan → approve (see huawei-iac skill, Provisioning Rules).';
 }
+const OBS_SUBCOMMANDS = new Set([
+  'help',
+  'ls',
+  'mb',
+  'cp',
+  'mv',
+  'rm',
+  'chattri',
+  'config',
+  'cors',
+  'lifecycle',
+  'policy',
+  'share',
+  'sync',
+  'url',
+  'sign',
+]);
+const CATALOG_TTL_MS = 5 * 60 * 1000;
+let _catalogCache = { dir: null, t: 0, cn: new Set(), en: new Set() };
+export function readServiceCatalogs(metaDir = join(homedir(), '.hcloud', 'metaRepo')) {
+  const now = Date.now();
+  if (_catalogCache.dir === metaDir && now - _catalogCache.t < CATALOG_TTL_MS) return _catalogCache;
+  const load = (f) => {
+    try {
+      const p = join(metaDir, f);
+      if (!existsSync(p)) return { present: false, set: new Set() };
+      const d = JSON.parse(readFileSync(p, 'utf8'));
+      // Normalize to uppercase on load: catalog entries are mixed-case
+      // (DevStar, CloudTable, MapDS, ...) while lookups use uppercase.
+      return {
+        present: true,
+        set: new Set((d.items || []).map((i) => i?.Service?.Text?.toUpperCase()).filter(Boolean)),
+      };
+    } catch {
+      return { present: false, set: new Set() };
+    }
+  };
+  const cn = load('services_cn.json');
+  const en = load('services_en.json');
+  _catalogCache = { dir: metaDir, t: now, cn: cn.set, en: en.set, cnPresent: cn.present, enPresent: en.present };
+  return _catalogCache;
+}
+export function classifyUnsupported(service, metaDir) {
+  const { cn, en, cnPresent, enPresent } = readServiceCatalogs(metaDir);
+  const s = String(service || '').toUpperCase();
+  if (!s) return 'other';
+  if (cnPresent && enPresent) {
+    if (cn.has(s) && !en.has(s)) return 'lang-missing';
+    if (!cn.has(s) && !en.has(s)) return 'not-found';
+    return 'other';
+  }
+  // One or both catalog files are missing locally — we cannot distinguish
+  // "service missing from the en catalog" from "en catalog not downloaded".
+  // Only the reactive fallback may attempt --cli-lang=cn for this case.
+  return 'unknown';
+}
+export function shouldInjectLang(args, metaDir) {
+  const arr = Array.isArray(args) ? args.map(String) : [];
+  if (arr.some((a) => /^--cli-lang=/.test(a))) return false;
+  const s = (arr[0] || '').toUpperCase();
+  if (!s) return false;
+  if (s === 'OBS' && OBS_SUBCOMMANDS.has((arr[1] || '').toLowerCase())) return false;
+  return classifyUnsupported(s, metaDir) === 'lang-missing';
+}
 export function planHcloudCommand(args, options = {}) {
   const normalizedArgs = Array.isArray(args) ? args.map(String) : [];
   const classification = classifyHcloudArgs(normalizedArgs, options);
@@ -171,6 +296,38 @@ export function planHcloudCommand(args, options = {}) {
   };
 }
+const UNSUPPORTED_SERVICE_RE = /Unsupported service:\s*([A-Za-z0-9_-]+)/i;
+function appendLangHint(result, service, metaDir) {
+  const cause = classifyUnsupported(service, metaDir);
+  if (cause === 'lang-missing' || cause === 'unknown') {
+    const nextStep = 'Re-run with --cli-lang=cn, or set hcloud configure set --cli-lang=cn.';
+    return {
+      ...result,
+      langCause: cause,
+      langHint: `Unsupported service: ${service}. ${nextStep}`,
+      langNextStep: nextStep,
+    };
+  }
+  const nextStep = 'Check the service name, or refresh KooCLI metadata (hcloud upgrade / configure).';
+  return {
+    ...result,
+    langCause: cause,
+    langHint: `Unsupported service: ${service}. ${nextStep}`,
+    langNextStep: nextStep,
+  };
+}
+function isObsUtilStyle(args) {
+  const s = String(args[0] || '').toUpperCase();
+  return s === 'OBS' && OBS_SUBCOMMANDS.has(String(args[1] || '').toLowerCase());
+}
+function canRetryLang(service, metaDir) {
+  const cause = classifyUnsupported(service, metaDir);
+  return cause === 'lang-missing' || cause === 'unknown';
+}
 export async function runHcloud(args, options = {}) {
   const normalizedArgs = Array.isArray(args) ? args.map(String) : [];
   const plan = {
@@ -179,6 +336,52 @@ export async function runHcloud(args, options = {}) {
   };
   assertAllowed(plan.classification);
+  const metaDir = options.metaDir;
+  const langGiven = normalizedArgs.some((a) => /^--cli-lang=/.test(a));
+  const injectedArgs =
+    !langGiven && shouldInjectLang(normalizedArgs, metaDir) ? [...normalizedArgs, '--cli-lang=cn'] : null;
+  if (injectedArgs) {
+    const result = await runHcloudOnceWithRetries(
+      {
+        ...plan,
+        rawArgs: injectedArgs,
+      },
+      options,
+    );
+    const tagged = {
+      ...result,
+      autoRetried: true,
+      injection: 'proactive',
+      injectedLang: 'cn',
+    };
+    if (tagged.ok) return tagged;
+    const match = `${result.stderr || ''}\n${result.stdout || ''}`.match(UNSUPPORTED_SERVICE_RE);
+    return match ? appendLangHint(tagged, match[1], metaDir) : tagged;
+  }
+  const result = await runHcloudOnceWithRetries(plan, options);
+  const text = `${result.stderr || ''}\n${result.stdout || ''}`;
+  const match = text.match(UNSUPPORTED_SERVICE_RE);
+  if (match && !langGiven && !result.ok && canRetryLang(match[1], metaDir) && !isObsUtilStyle(normalizedArgs)) {
+    const retry = await runHcloudOnceWithRetries(
+      {
+        ...plan,
+        rawArgs: [...normalizedArgs, '--cli-lang=cn'],
+      },
+      options,
+    );
+    return retry.ok
+      ? { ...retry, autoRetried: true, reactiveFallback: true, injection: 'reactive', injectedLang: 'cn' }
+      : appendLangHint(retry, match[1], metaDir);
+  }
+  if (match && !result.ok) {
+    return appendLangHint(result, match[1], metaDir);
+  }
+  return result;
+}
+async function runHcloudOnceWithRetries(plan, options) {
   const maxRetries = options.maxRetries ?? DEFAULT_MAX_RETRIES;
   for (let attempt = 0; attempt <= maxRetries; attempt += 1) {
     const result = await runHcloudOnce(plan, options);
@@ -226,6 +429,9 @@ function runHcloudOnce(plan, options) {
   const executableArgs = Array.isArray(options.executableArgs) ? options.executableArgs.map(String) : [];
   const cwd = options.cwd || undefined;
   const stdin = options.stdin ?? 'y\n';
+  const childOptions = { ...options };
+  delete childOptions.metaDir;
+  const childEnv = { ...process.env, ...childOptions.env };
   return new Promise((resolve) => {
     const proxySettings = getProxySettings();
@@ -242,7 +448,7 @@ function runHcloudOnce(plan, options) {
       env: {
         ...process.env,
         ...proxyEnv,
-        ...options.env,
+        ...childEnv,
       },
     });
     if (stdin) {
@@ -418,7 +624,7 @@ function validateRequiredParams(args) {
   return { valid: missing.length === 0, missing, hints };
 }
-function extractApiError(stdout) {
+export function extractApiError(stdout) {
   let text = String(stdout || '');
   // Strip KooCLI multi-version prefix lines (e.g. "ListVpcs有多个版本,默认使用该API版本v3…")
   const bracketIdx = text.indexOf('{');

package/plugins/huaweicloud-core/src/safety-policy.mjs CHANGED Viewed

@@ -22,7 +22,7 @@ function isSecretKeyName(key, policy = DEFAULT_POLICY) {
     .toLowerCase()
     .replace(/[^a-z0-9]/g, '');
   if (
-    /access.*key|secret.*key|security.*token|xauth.*token|authorization|password|passwd|adminpass|credential|private.*key/.test(
+    /access.*key|secret.*key|security.*token|xauth.*token|authorization|password|passwd|adminpass|credential|private.*key|userdata|metadata/.test(
       normalized,
     )
   ) {
@@ -32,12 +32,18 @@ function isSecretKeyName(key, policy = DEFAULT_POLICY) {
 }
 function redactString(text) {
-  return String(text)
-    .replace(
-      /((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|authorization|password|passwd|adminPass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
-      '$1<redacted>',
-    )
-    .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>');
+  return (
+    String(text)
+      // Opaque blob keys (cloud-init user_data, metadata, private_key) carry
+      // base64/scripts that may embed SSH keys, DB passwords, bootstrap tokens.
+      // Redact the ENTIRE value of this arg — not just the first whitespace token.
+      .replace(/((?:user[_-]?data|metadata|private[_-]?key)\s*[:=]\s*).*/gi, '$1<redacted>')
+      .replace(
+        /((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|authorization|password|passwd|adminPass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
+        '$1<redacted>',
+      )
+      .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>')
+  );
 }
 export function redactSecrets(value, policy = DEFAULT_POLICY) {

package/plugins/huaweicloud-core/src/sandbox/hdkitservice-api.mjs CHANGED Viewed

@@ -115,7 +115,11 @@ export async function hdkitVoucherStatus(domainId) {
     const path = domainId ? `voucher/status?domain_id=${encodeURIComponent(domainId)}` : 'voucher/status';
     return await hdkitRequest('GET', path, undefined, 30000);
   } catch (error) {
-    return { claimed: false, message: 'Incentive service unavailable, please try again later' };
+    return {
+      claimed: false,
+      message: error?.message || 'Incentive service unavailable, please try again later',
+      code: error?.code,
+    };
   }
 }
@@ -124,6 +128,10 @@ export async function hdkitVoucherClaim(domainId) {
     const body = domainId ? { domain_id: domainId } : {};
     return await hdkitRequest('POST', 'voucher/claim', body);
   } catch (error) {
-    return { claimed: false, message: 'Incentive service unavailable, please try again later' };
+    return {
+      claimed: false,
+      message: error?.message || 'Incentive service unavailable, please try again later',
+      code: error?.code,
+    };
   }
 }

package/plugins/huaweicloud-core/src/sandbox/session-manager.mjs CHANGED Viewed

@@ -984,15 +984,23 @@ fi
   const result = await execOneShot(workspaceId, checkScript, username, timeoutMs);
   const stdout = String(result.stdout || '');
+  // Strip ANSI escape sequences (CSI color/cursor codes and OSC shell-integration markers)
+  // and split on any line-ending style (\r\n, \r, or \n) to handle all terminal outputs.
+  // Use new RegExp to avoid ESLint no-control-regex on literal control chars in regex.
+  const ESC = '\x1b';
+  const csiRe = new RegExp(ESC + '\\[[0-9;]*[a-zA-Z]', 'g');
+  const oscRe = new RegExp(ESC + '\\][^' + ESC + '\x07]*(?:\x07|' + ESC + '\\\\)', 'g');
+  const cleanStdout = stdout.replace(csiRe, '').replace(oscRe, '');
   const checks = {};
-  const lines = stdout.split('\n');
+  const lines = cleanStdout.split(new RegExp('\\r\\n|\\r|\\n'));
   for (const line of lines) {
-    const m = line.match(/^(\w+):(\w+)\b(.*)/);
+    const trimmed = line.trim();
+    const m = trimmed.match(/^(\w+):(PASS|FAIL|SKIP)\b(.*)/);
     if (m) checks[m[1]] = { status: m[2], detail: (m[3] || '').trim() };
   }
-  const scoreMatch = stdout.match(/SCORE:(\d+)\/(\d+)/);
-  const tunnelMatch = stdout.match(/TUNNEL_URL:(https:\/\/[^\s]+)/);
-  const complete = /VERDICT:COMPLETE/.test(stdout);
+  const scoreMatch = cleanStdout.match(/SCORE:(\d+)\/(\d+)/);
+  const tunnelMatch = cleanStdout.match(/TUNNEL_URL:(https:\/\/[^\s]+)/);
+  const complete = /VERDICT:COMPLETE/.test(cleanStdout);
   const missing = [];
   if (!complete) {
@@ -1001,6 +1009,12 @@ fi
     }
   }
+  // If checks is empty but score was found, parsing failed — return raw output for debugging
+  const parseWarning =
+    Object.keys(checks).length === 0 && scoreMatch
+      ? 'Check output parsing failed — individual check results could not be extracted. See rawOutput for details.'
+      : undefined;
   return {
     ok: true,
     complete,
@@ -1009,6 +1023,8 @@ fi
     score: scoreMatch ? { pass: parseInt(scoreMatch[1], 10), total: parseInt(scoreMatch[2], 10) } : null,
     publicUrl: tunnelMatch ? tunnelMatch[1] : undefined,
     missingSteps: missing.length > 0 ? missing.join(', ') : undefined,
+    parseWarning,
+    rawOutput: parseWarning ? stdout.trim() : undefined,
     nextStep: !complete
       ? missing.includes('devbridge_tunnel') || missing.includes('tunnel_url_accessible')
         ? 'expose_via_devbridge'
@@ -1016,7 +1032,9 @@ fi
           ? 'configure_nginx'
           : missing.includes('qr_code')
             ? 'generate_qr_code'
-            : 'review_checks'
+            : parseWarning
+              ? 'review_raw_output'
+              : 'review_checks'
       : 'complete',
   };
 }

package/plugins/huaweicloud-core/src/setup-cli.mjs CHANGED Viewed

@@ -702,9 +702,22 @@ function uninstallCodex() {
 }
 function codexStatus() {
-  const r = spawnSync('codex plugin list', [], { shell: true, windowsHide: true, stdio: 'pipe' });
+  // Parse the structured output instead of substring-matching the table: the
+  // plugin's SOURCE path (…/plugins/huaweicloud-devkit) also contains the name,
+  // so a naive includes() reports "installed" even when the status column says
+  // "not installed".
+  const r = spawnSync('codex plugin list --json', [], { shell: true, windowsHide: true, stdio: 'pipe' });
   const out = r.stdout ? r.stdout.toString() : '';
-  return out.includes(getCodexPluginName()) || out.includes('huaweicloud-core');
+  const name = getCodexPluginName();
+  try {
+    const data = JSON.parse(out);
+    const installed = Array.isArray(data?.installed) ? data.installed : [];
+    return installed.some(
+      (p) => p && (p.name === name || (typeof p.pluginId === 'string' && p.pluginId.startsWith(`${name}@`))),
+    );
+  } catch {
+    return false;
+  }
 }
 async function installOpenCode() {
@@ -2417,12 +2430,14 @@ function officeaceStatus() {
 // ── Hermes Agent ──
+// Home directory resolution precedence:
+// 1. HERMES_HOME env var — explicit override, highest priority
+// 2. homedir() fallback — respects USERPROFILE (Windows) / HOME (Unix)
+// Default: ~/.hermes (i.e., join(homedir(), '.hermes'))
+// No --home CLI option exists; home redirection is via env vars only.
+// This matches the pattern used by other agents (ATOMCODE_HOME, DSH_HOME, etc.)
 function hermesHomeDir() {
   if (process.env.HERMES_HOME) return process.env.HERMES_HOME;
-  // Hermes on Windows stores under LOCALAPPDATA, not ~/.hermes
-  if (platform() === 'win32' && process.env.LOCALAPPDATA) {
-    return join(process.env.LOCALAPPDATA, 'hermes');
-  }
   return join(homedir(), '.hermes');
 }

package/plugins/huaweicloud-core/src/tools.mjs CHANGED Viewed

@@ -7,7 +7,7 @@ import { promisify } from 'node:util';
 import { evaluateArtifacts, evaluateCommandRisk, evaluateDeployPlan } from './risk-rule-engine.mjs';
 import { classifyTextCommand, redactSecrets } from './safety-policy.mjs';
-import { planHcloudCommand, runHcloud, consumeApprovalToken } from './hcloud-cli.mjs';
+import { planHcloudCommand, runHcloud, consumeApprovalToken, hashArgs } from './hcloud-cli.mjs';
 import { searchMarketplace } from './search-market.mjs';
 import { getServiceIcon } from './icon-library.mjs';
 import { detectFramework } from './detect-framework.mjs';
@@ -745,7 +745,7 @@ export const TOOL_DEFINITIONS = [
   {
     name: 'huaweicloud_sandbox_connect',
     description:
-      'Connect to a sandbox via hdkitservice. One user one instance - reuses existing sandbox if available, otherwise creates a new one. Returns session_id, dev_stage_id, connection_id, and connection_address.',
+      'Connect to a sandbox via hdkitservice. One user one instance - reuses existing sandbox if available, otherwise creates a new one. Returns session_id, dev_stage_id, connection_id, connection_address, and expiresAt (STS credential expiry).',
     inputSchema: {
       type: 'object',
       properties: {
@@ -1674,15 +1674,15 @@ async function runApprovedCommand(args = {}) {
     throw new Error('approvedByUser must be true after explicit user approval for this exact command.');
   }
   const token = String(args.approvalToken || '');
-  const storedArgs = consumeApprovalToken(token);
-  if (!storedArgs || storedArgs.length === 0) {
+  const stored = consumeApprovalToken(token);
+  if (!stored) {
     throw new Error('Invalid or expired approval token. Please re-plan the command.');
   }
   const providedArgs = Array.isArray(args.args) ? args.args.map(String) : [];
-  if (JSON.stringify(storedArgs) !== JSON.stringify(providedArgs)) {
-    const redactedStored = redactSecrets(storedArgs);
-    const redactedProvided = redactSecrets(providedArgs);
-    if (JSON.stringify(redactedStored) !== JSON.stringify(redactedProvided)) {
+  if (hashArgs(providedArgs) !== stored.argsHash) {
+    const redactedStored = JSON.stringify(stored.argsRedacted);
+    const redactedProvided = JSON.stringify(redactSecrets(providedArgs));
+    if (redactedStored !== redactedProvided) {
       throw new Error(
         'Provided args do not match the approved plan. Use the exact args from the plan. ' +
           'If the plan shows <redacted> for passwords or secrets, replace <redacted> with the actual values in approvedCommand.',