huaweicloud-devkit 1.1.4-next.2 → 1.1.4-next.4

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.4-next.2",
+  "version": "1.1.4-next.4",
   "kooCliVersion": "7.2.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.4-next.2",
+  "version": "1.1.4-next.4",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.4-next.2",
+  "version": "1.1.4-next.4",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.4-next.2",
+  "version": "1.1.4-next.4",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.4-next.2",
+  "version": "1.1.4-next.4",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.4-next.2",
+  "version": "1.1.4-next.4",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.4-next.2",
+  "version": "1.1.4-next.4",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -58,6 +58,33 @@ export function readGlobalCredentials() {
   }
 }
 
+// R11: Placeholder / masked credential values are treated as "not configured".
+// A vendor/IDE marketplace that pre-fills mcp_settings env with template text
+// (e.g. "<HW_ACCESS_KEY>" or "${SECRET_KEY}") must not shadow the user's real
+// S1 vault. Real AK/SK are >=20 char alphanumeric strings, so none of the
+// template/masked patterns below can match a genuine credential.
+export function isPlaceholder(value) {
+  if (typeof value !== 'string' || value.length === 0) return false;
+  // <HW_ACCESS_KEY> / <your-ak> / <...>
+  if (/^<[^>]*>$/.test(value)) return true;
+  // ${HW_ACCESS_KEY}
+  if (/^\$\{[^}]*\}$/.test(value)) return true;
+  // YOUR_AK / ACCESS_KEY / SECRET_KEY / SECURITY_TOKEN / REGION (bare keyword)
+  if (/^(YOUR_)?(AK|SK|ACCESS[_-]?KEY|SECRET[_-]?KEY|TOKEN|SECURITY[_-]?TOKEN|REGION)$/i.test(value)) return true;
+  // placeholder / replace_me / change.me
+  if (/\b(placeholder|replace[._-]?me|change[._-]?me)\b/i.test(value)) return true;
+  // masked value: short alnum prefix + asterisk run (abc**** / token****) — the
+  // S4 mirror writes the SK slot this way so the secret never lands in plaintext.
+  if (/^[A-Za-z0-9]{3,8}\*+$/.test(value)) return true;
+  // bare asterisks
+  if (/^\*+$/.test(value)) return true;
+  return false;
+}
+
+function present(v) {
+  return typeof v === 'string' && v.length > 0 && !isPlaceholder(v);
+}
+
 export function writeGlobalCredentials(credentials = {}) {
   const path = globalCredentialsPath();
   mkdirSync(dirname(path), { recursive: true });
@@ -99,9 +126,10 @@ export function writeObsConfig(credentials = {}) {
 }
 
 export function resolveCredentials(options = {}) {
-  let ak = process.env.HW_ACCESS_KEY;
-  let sk = process.env.HW_SECRET_KEY;
-  let securityToken = process.env.HW_SECURITY_TOKEN;
+  // R11: placeholder/masked env values are "not configured", never credentials.
+  let ak = present(process.env.HW_ACCESS_KEY) ? process.env.HW_ACCESS_KEY : '';
+  let sk = present(process.env.HW_SECRET_KEY) ? process.env.HW_SECRET_KEY : '';
+  let securityToken = present(process.env.HW_SECURITY_TOKEN) ? process.env.HW_SECURITY_TOKEN : '';
   let region = process.env.HW_REGION || process.env.HUAWEICLOUD_REGION || '';
 
   const codeartsCreds = isCodeArtsContext() ? readCodeArtsCredentials() : null;
@@ -113,36 +141,33 @@ export function resolveCredentials(options = {}) {
 
   const stored = readGlobalCredentials();
   if (stored) {
-    if (!ak && stored.ak) ak = stored.ak;
-    if (!sk && stored.sk) sk = stored.sk;
-    if (!securityToken && stored.securityToken) securityToken = stored.securityToken;
+    // R11: skip placeholder/masked values from the vault too (templates must
+    // not win the truthiness check and shadow another store).
+    if (!ak && present(stored.ak)) ak = stored.ak;
+    if (!sk && present(stored.sk)) sk = stored.sk;
+    if (!securityToken && present(stored.securityToken)) securityToken = stored.securityToken;
     if (!region && stored.region) region = stored.region;
   }
 
   // R9: S1 written by `auth_switch persist` (configuredBySession) is the session's
   // source of truth and wins over env-injected defaults. Plain S1 (`auth init`)
   // still yields to env so devspace-style env injection keeps working.
-  if (stored && stored.configuredBySession === true && stored.ak && stored.sk) {
+  if (stored && stored.configuredBySession === true && present(stored.ak) && present(stored.sk)) {
     ak = stored.ak;
     sk = stored.sk;
-    if (!securityToken) securityToken = stored.securityToken || '';
+    if (!securityToken) securityToken = present(stored.securityToken) ? stored.securityToken : '';
     if (!region) region = stored.region || '';
   }
 
   // Sandbox/platform-injected temporary STS credentials (env vars carrying a
   // security token) must not shadow the user's explicit permanent credentials
   // from `auth init`. Prefer the stored file when both exist.
-  if (
-    process.env.HW_ACCESS_KEY &&
-    process.env.HW_SECRET_KEY &&
-    process.env.HW_SECURITY_TOKEN &&
-    stored &&
-    stored.ak &&
-    stored.sk
-  ) {
+  const envHasFullTriplet =
+    present(process.env.HW_ACCESS_KEY) && present(process.env.HW_SECRET_KEY) && present(process.env.HW_SECURITY_TOKEN);
+  if (envHasFullTriplet && stored && present(stored.ak) && present(stored.sk)) {
     ak = stored.ak;
     sk = stored.sk;
-    securityToken = stored.securityToken || '';
+    securityToken = present(stored.securityToken) ? stored.securityToken : '';
     region = stored.region || region;
   }
 
@@ -189,16 +214,16 @@ export function readCodeArtsCredentials() {
     try {
       if (!existsSync(path)) continue;
       const config = JSON.parse(readFileSync(path, 'utf8'));
-      const server = config?.mcpServers?.['huaweicloud-devkit'];
+      const server = config?.mcpServers?.['huaweicloud-devkit'] || config?.mcpServers?.['HuaweiCloud DevKit'];
       if (!server?.env) continue;
 
       const ak = server.env.HW_ACCESS_KEY;
       const sk = server.env.HW_SECRET_KEY;
-      if (ak && sk) {
+      if (present(ak) && present(sk)) {
         return {
           ak,
           sk,
-          securityToken: server.env.HW_SECURITY_TOKEN || '',
+          securityToken: present(server.env.HW_SECURITY_TOKEN) ? server.env.HW_SECURITY_TOKEN : '',
           region: server.env.HW_REGION || server.env.HUAWEICLOUD_REGION || '',
         };
       }
@@ -213,15 +238,15 @@ export function readCodeArtsCredentials() {
     try {
       if (existsSync(path)) {
         const config = JSON.parse(readFileSync(path, 'utf8'));
-        const server = config?.mcp?.['huaweicloud-devkit'];
+        const server = config?.mcp?.['huaweicloud-devkit'] || config?.mcp?.['HuaweiCloud DevKit'];
         if (server?.environment) {
           const ak = server.environment.HW_ACCESS_KEY;
           const sk = server.environment.HW_SECRET_KEY;
-          if (ak && sk) {
+          if (present(ak) && present(sk)) {
             return {
               ak,
               sk,
-              securityToken: server.environment.HW_SECURITY_TOKEN || '',
+              securityToken: present(server.environment.HW_SECURITY_TOKEN) ? server.environment.HW_SECURITY_TOKEN : '',
               region: server.environment.HW_REGION || server.environment.HUAWEICLOUD_REGION || '',
             };
           }

package/plugins/huaweicloud-core/src/auth/reconcile.mjs

@@ -6,6 +6,7 @@ import { spawnSync } from 'node:child_process';
 
 import {
   hasRuntimeCredentials,
+  isPlaceholder,
   obsConfigPath,
   readGlobalCredentials,
   readLastSync,
@@ -104,10 +105,13 @@ function s2CurrentMatchesLastDevkitSync(kooCli, s1, s1Fingerprint) {
 
 export function scanState() {
   const s1 = readGlobalCredentials() || {};
-  const envAk = process.env.HW_ACCESS_KEY || '';
-  const envSk = process.env.HW_SECRET_KEY || '';
+  const envAk = isPlaceholder(process.env.HW_ACCESS_KEY) ? '' : process.env.HW_ACCESS_KEY || '';
+  const envSk = isPlaceholder(process.env.HW_SECRET_KEY) ? '' : process.env.HW_SECRET_KEY || '';
   const kooCli = readKooCliProfiles();
   const inconsistencies = [];
+  const envIsPlaceholder =
+    Boolean(process.env.HW_ACCESS_KEY && isPlaceholder(process.env.HW_ACCESS_KEY)) ||
+    Boolean(process.env.HW_SECRET_KEY && isPlaceholder(process.env.HW_SECRET_KEY));
 
   const s1Fingerprint = fingerprint(s1.ak, s1.sk);
   const currentFp = currentFingerprintFromHcloud(kooCli);
@@ -153,6 +157,9 @@ export function scanState() {
       runtimeFingerprint,
     },
     kooCliCurrent: kooCli.error ? null : kooCli.current,
+    // R11: env carries placeholder/masked values → surface that explicitly so
+    // diagnostics don't show a bogus fingerprint derived from template text.
+    envIsPlaceholder,
     // S2 is encrypted storage (authEncrypt) → its fingerprint is unavailable,
     // so the S2-current drift check is intentionally skipped (#533).
     s2Encrypted: Boolean(!kooCli.error && kooCli.authEncrypt),

package/plugins/huaweicloud-core/src/mcp-protocol.mjs

@@ -22,21 +22,29 @@ for (const base of [pluginRoot, packageRoot]) {
 }
 
 // 会话内首个非 check/upgrade 工具调用附加 _updateInfo，只消费一次。
-let hintConsumed = false;
-function decorateResult(name, result) {
-  if (hintConsumed) return result;
+// 按会话隔离：同进程内不同会话(A/B)各自首次提示；stdio 用固定 'stdin'。
+const consumedBySession = new Map();
+export function _decorateResult(sessionId, name, result) {
+  if (consumedBySession.get(sessionId)) return result;
   try {
     const hint = peekCachedUpdateInfo();
     if (!hint) return result;
     const decorated = applyUpdateHint(result, name, hint);
-    if (decorated !== result) hintConsumed = true;
+    if (decorated !== result) consumedBySession.set(sessionId, true);
     return decorated;
   } catch {
     return result; // 兜底装饰失败绝不影响工具调用
   }
 }
+export function _resetHintConsumption() {
+  consumedBySession.clear();
+}
+export function _isHintConsumed(sessionId) {
+  return Boolean(consumedBySession.get(sessionId));
+}
 
-export async function dispatch(method, params) {
+export async function dispatch(method, params, opts = {}) {
+  const sessionId = opts?.sessionId || 'default';
   if (method === 'initialize') {
     const ci = params.clientInfo || {};
 
@@ -68,7 +76,7 @@ export async function dispatch(method, params) {
 
   if (method === 'tools/call') {
     const result = await callTool(params.name, params.arguments || {});
-    const decorated = decorateResult(params.name, result);
+    const decorated = _decorateResult(sessionId, params.name, result);
     return {
       content: [
         {

package/plugins/huaweicloud-core/src/mcp-server-remote.mjs

@@ -50,7 +50,8 @@ export async function startRemoteServer({ port = DEFAULT_PORT, host = DEFAULT_HO
 
     let response;
     try {
-      const result = await dispatch(message.method, message.params || {});
+      const sessionId = (req.headers['mcp-session-id'] || '').trim() || 'default';
+      const result = await dispatch(message.method, message.params || {}, { sessionId });
       response = { jsonrpc: '2.0', id: message.id, result };
       if (message.method === 'initialize') {
         res.setHeader('MCP-Protocol-Version', result.protocolVersion || '2024-11-05');

package/plugins/huaweicloud-core/src/mcp-server.mjs

@@ -159,7 +159,7 @@ function runStdioServer() {
       return;
     }
     try {
-      const result = await dispatch(message.method, message.params || {});
+      const result = await dispatch(message.method, message.params || {}, { sessionId: 'stdin' });
       writeMessage({ jsonrpc: '2.0', id: message.id, result });
     } catch (error) {
       writeMessage({

package/plugins/huaweicloud-core/src/tools.mjs

@@ -1049,7 +1049,7 @@ function normalizeNumericArgs(args) {
   return out;
 }
 
-export async function callTool(name, rawArgs = {}) {
+export async function callTool(name, rawArgs = {}, opts = {}) {
   const args = normalizeNumericArgs(rawArgs);
   const toolValue = toolInvokeValue(name, args);
   trackToolInvoke(name, toolValue);
@@ -1448,33 +1448,35 @@ export async function callTool(name, rawArgs = {}) {
     case 'huaweicloud_voucher_claim':
       return await hdkitVoucherClaim(args.domain_id);
     case 'huaweicloud_check_update':
-      return await handleCheckUpdate(args);
+      return await handleCheckUpdate(args, { sessionId: opts?.sessionId });
     case 'huaweicloud_upgrade':
-      return await handleUpgrade(args);
+      return await handleUpgrade(args, { sessionId: opts?.sessionId });
     default:
       throw new Error(`Unknown tool: ${name}`);
   }
 }
 
-async function handleCheckUpdate(args = {}) {
+async function handleCheckUpdate(args = {}, opts = {}) {
+  const sessionId = opts?.sessionId || null;
   const current = readInstalledVersion() || '0.0.0';
   if (args.dismiss === true) {
-    const distTags = await getUpdateDistTags(current);
+    const distTags = await getUpdateDistTags(current, { sessionId });
     const target = determineTarget(current, distTags);
     const dismissedVersion =
       typeof args.dismissVersion === 'string' && args.dismissVersion ? args.dismissVersion : target || current;
-    const state = writeSkipState(resolveSkipFilePath(), dismissedVersion);
+    const state = writeSkipState(resolveSkipFilePath(sessionId), dismissedVersion);
     invalidateUpdateCache();
     return judgeUpdate(current, distTags, state);
   }
-  return getCachedUpdateInfo(current);
+  return getCachedUpdateInfo(current, { sessionId });
 }
 
-async function handleUpgrade(args = {}) {
+async function handleUpgrade(args = {}, opts = {}) {
+  const sessionId = opts?.sessionId || null;
   const target = typeof args.target === 'string' && args.target ? args.target : 'all';
   const version = typeof args.version === 'string' && args.version ? args.version : 'latest';
   const current = readInstalledVersion() || '0.0.0';
-  const info = await getCachedUpdateInfo(current);
+  const info = await getCachedUpdateInfo(current, { sessionId });
   if (info && info.result === 'up_to_date') {
     return {
       success: false,

package/plugins/huaweicloud-core/src/update-check.mjs

@@ -152,12 +152,26 @@ export function fallbackSkipFilePath() {
   return join(base, '.config', 'huaweicloud', 'devkit-skip.json');
 }
 
+// 会话化 skip 文件：remote 多会话按 sessionId 拆分，stdio/默认保持原文件(向后兼容)。
+function sanitizeSessionId(sessionId) {
+  return String(sessionId || '').replace(/[^0-9a-zA-Z-]/g, '_');
+}
+
 // A1 定稿: 标准 agent 用插件目录副本(有 package.json); codex 等无副本时回退共享文件
-export function resolveSkipFilePath() {
+export function resolveSkipFilePath(sessionId = null) {
+  let base;
   try {
-    if (existsSync(join(dirname(skipFilePath()), 'package.json'))) return skipFilePath();
-  } catch {}
-  return fallbackSkipFilePath();
+    if (existsSync(join(dirname(skipFilePath()), 'package.json'))) {
+      base = skipFilePath();
+    } else {
+      base = fallbackSkipFilePath();
+    }
+  } catch {
+    base = fallbackSkipFilePath();
+  }
+  // stdio / 默认 / 无 session → 原文件（保持向后兼容）
+  if (!sessionId || sessionId === 'default' || sessionId === 'stdin') return base;
+  return `${base}.${sanitizeSessionId(sessionId)}`;
 }
 
 export function readSkipState(file) {
@@ -293,12 +307,15 @@ function cacheValid(now = Date.now()) {
   return Boolean(cachedDistTags) && now - cachedAt <= TTL_MS;
 }
 
-export async function getCachedUpdateInfo(current, { doQuery = queryDistTags, now = Date.now() } = {}) {
+export async function getCachedUpdateInfo(
+  current,
+  { doQuery = queryDistTags, now = Date.now(), sessionId = null } = {},
+) {
   if (process.env.HUAWEICLOUD_DEVKIT_SKIP_UPDATE === '1') {
     lastHint = judgeUpdate(current, null, undefined, now);
     return lastHint;
   }
-  const skipState = readSkipState(resolveSkipFilePath());
+  const skipState = readSkipState(resolveSkipFilePath(sessionId));
   if (!cacheValid(now)) {
     if (!cachedDistTags && now - failedAt < FAIL_THROTTLE_MS) {
       lastHint = judgeUpdate(current, null, skipState, now);
@@ -331,8 +348,8 @@ export function peekCachedUpdateInfo() {
   return lastHint && lastHint.updateAvailable && lastHint.targetVersion ? lastHint : null;
 }
 
-export async function getUpdateDistTags(current) {
-  const result = await getCachedUpdateInfo(current);
+export async function getUpdateDistTags(current, { sessionId = null } = {}) {
+  const result = await getCachedUpdateInfo(current, { sessionId });
   if (!result) return null;
   return { latest: result.latestStable ?? null, next: result.latestNext ?? null };
 }