huaweicloud-devkit 1.1.4-next.3 → 1.1.4-next.5

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.4-next.3",
+  "version": "1.1.4-next.5",
   "kooCliVersion": "7.2.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.4-next.3",
+  "version": "1.1.4-next.5",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.4-next.3",
+  "version": "1.1.4-next.5",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.4-next.3",
+  "version": "1.1.4-next.5",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.4-next.3",
+  "version": "1.1.4-next.5",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.4-next.3",
+  "version": "1.1.4-next.5",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.4-next.3",
+  "version": "1.1.4-next.5",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md

@@ -41,7 +41,7 @@ Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/ob
 | Three-layer permissions            | IAM > Bucket Policy > ACL. Most restrictive wins                                                                                                   |
 | Versioning is irreversible         | Once enabled, cannot be disabled, only suspended                                                                                                   |
 | OBS uses AK/SK directly            | NOT IAM tokens. Auth errors mean check AK/SK validity                                                                                              |
-| Static website via CLI missing     | KooCLI OBS lacks website config. Use REST API or console                                                                                           |
+| Static website via CLI missing     | KooCLI OBS lacks website config. Use `huaweicloud_obs_set_website_config` MCP tool (handles AWS4 signing internally) or console                    |
 | **OBS needs separate cred config** | `hcloud configure` is NOT enough for OBS. Before any OBS operation, call `huaweicloud_setup_obs_config` to sync credentials from hcloud profile.   |
 | **obsutil interactive prompts**    | `cp`/`rm` without `-f` causes "Please input (y/n)" → Agent hangs (TIMEOUT). Always use `-f` for non-interactive.                                   |
 | **Directory upload adds prefix**   | `cp <dir>/ obs://<bucket>/ -r` puts files under `bucket/<dir>/...`. Use `-flat` for root-level files (static sites). Preview with `-dryRun` first. |
@@ -83,7 +83,7 @@ hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK> -t=token
 See `references/static-website.md` for the full end-to-end workflow:
 Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Configure website (REST API/console)
 
-> KooCLI OBS does NOT support `SetBucketWebsite`. Configure static website hosting via REST API (`PUT /?website`) or the Huawei Cloud console.
+> KooCLI OBS does NOT support `SetBucketWebsite`. Use the `huaweicloud_obs_set_website_config` MCP tool (handles AWS4 signing internally, no manual signature needed) or the Huawei Cloud console.
 
 ## Single-File Quick Share
 

package/plugins/huaweicloud-core/skills/huawei-obs/references/static-website.md

@@ -31,13 +31,9 @@ hcloud OBS chattri obs://my-static-site -acl=public-read
 hcloud OBS chattri obs://my-static-site/ -r -f -acl=public-read
 
 # 5. Configure static website hosting
-# KooCLI OBS does NOT support this. Use one of:
-# Option A — REST API:
-#   PUT /?website HTTP/1.1
-#   Host: my-static-site.obs.cn-north-4.myhuaweicloud.com
-#   Body: {"IndexDocument": {"Suffix": "index.html"}, "ErrorDocument": {"Key": "error.html"}}
-#   (requires AK/SK signature)
-# Option B — Huawei Cloud Console:
+# KooCLI OBS does NOT support this. Use the MCP tool (handles AWS4 signing internally):
+# action=set, bucket=<bucket>, region=<region>, indexDocument=index.html, errorDocument=404.html
+# Or use Huawei Cloud Console:
 #   Console → OBS → Bucket → Basic Settings → Static Website Hosting
 
 # 6. Verify

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -58,6 +58,33 @@ export function readGlobalCredentials() {
   }
 }
 
+// R11: Placeholder / masked credential values are treated as "not configured".
+// A vendor/IDE marketplace that pre-fills mcp_settings env with template text
+// (e.g. "<HW_ACCESS_KEY>" or "${SECRET_KEY}") must not shadow the user's real
+// S1 vault. Real AK/SK are >=20 char alphanumeric strings, so none of the
+// template/masked patterns below can match a genuine credential.
+export function isPlaceholder(value) {
+  if (typeof value !== 'string' || value.length === 0) return false;
+  // <HW_ACCESS_KEY> / <your-ak> / <...>
+  if (/^<[^>]*>$/.test(value)) return true;
+  // ${HW_ACCESS_KEY}
+  if (/^\$\{[^}]*\}$/.test(value)) return true;
+  // YOUR_AK / ACCESS_KEY / SECRET_KEY / SECURITY_TOKEN / REGION (bare keyword)
+  if (/^(YOUR_)?(AK|SK|ACCESS[_-]?KEY|SECRET[_-]?KEY|TOKEN|SECURITY[_-]?TOKEN|REGION)$/i.test(value)) return true;
+  // placeholder / replace_me / change.me
+  if (/\b(placeholder|replace[._-]?me|change[._-]?me)\b/i.test(value)) return true;
+  // masked value: short alnum prefix + asterisk run (abc**** / token****) — the
+  // S4 mirror writes the SK slot this way so the secret never lands in plaintext.
+  if (/^[A-Za-z0-9]{3,8}\*+$/.test(value)) return true;
+  // bare asterisks
+  if (/^\*+$/.test(value)) return true;
+  return false;
+}
+
+function present(v) {
+  return typeof v === 'string' && v.length > 0 && !isPlaceholder(v);
+}
+
 export function writeGlobalCredentials(credentials = {}) {
   const path = globalCredentialsPath();
   mkdirSync(dirname(path), { recursive: true });
@@ -99,9 +126,10 @@ export function writeObsConfig(credentials = {}) {
 }
 
 export function resolveCredentials(options = {}) {
-  let ak = process.env.HW_ACCESS_KEY;
-  let sk = process.env.HW_SECRET_KEY;
-  let securityToken = process.env.HW_SECURITY_TOKEN;
+  // R11: placeholder/masked env values are "not configured", never credentials.
+  let ak = present(process.env.HW_ACCESS_KEY) ? process.env.HW_ACCESS_KEY : '';
+  let sk = present(process.env.HW_SECRET_KEY) ? process.env.HW_SECRET_KEY : '';
+  let securityToken = present(process.env.HW_SECURITY_TOKEN) ? process.env.HW_SECURITY_TOKEN : '';
   let region = process.env.HW_REGION || process.env.HUAWEICLOUD_REGION || '';
 
   const codeartsCreds = isCodeArtsContext() ? readCodeArtsCredentials() : null;
@@ -113,36 +141,33 @@ export function resolveCredentials(options = {}) {
 
   const stored = readGlobalCredentials();
   if (stored) {
-    if (!ak && stored.ak) ak = stored.ak;
-    if (!sk && stored.sk) sk = stored.sk;
-    if (!securityToken && stored.securityToken) securityToken = stored.securityToken;
+    // R11: skip placeholder/masked values from the vault too (templates must
+    // not win the truthiness check and shadow another store).
+    if (!ak && present(stored.ak)) ak = stored.ak;
+    if (!sk && present(stored.sk)) sk = stored.sk;
+    if (!securityToken && present(stored.securityToken)) securityToken = stored.securityToken;
     if (!region && stored.region) region = stored.region;
   }
 
   // R9: S1 written by `auth_switch persist` (configuredBySession) is the session's
   // source of truth and wins over env-injected defaults. Plain S1 (`auth init`)
   // still yields to env so devspace-style env injection keeps working.
-  if (stored && stored.configuredBySession === true && stored.ak && stored.sk) {
+  if (stored && stored.configuredBySession === true && present(stored.ak) && present(stored.sk)) {
     ak = stored.ak;
     sk = stored.sk;
-    if (!securityToken) securityToken = stored.securityToken || '';
+    if (!securityToken) securityToken = present(stored.securityToken) ? stored.securityToken : '';
     if (!region) region = stored.region || '';
   }
 
   // Sandbox/platform-injected temporary STS credentials (env vars carrying a
   // security token) must not shadow the user's explicit permanent credentials
   // from `auth init`. Prefer the stored file when both exist.
-  if (
-    process.env.HW_ACCESS_KEY &&
-    process.env.HW_SECRET_KEY &&
-    process.env.HW_SECURITY_TOKEN &&
-    stored &&
-    stored.ak &&
-    stored.sk
-  ) {
+  const envHasFullTriplet =
+    present(process.env.HW_ACCESS_KEY) && present(process.env.HW_SECRET_KEY) && present(process.env.HW_SECURITY_TOKEN);
+  if (envHasFullTriplet && stored && present(stored.ak) && present(stored.sk)) {
     ak = stored.ak;
     sk = stored.sk;
-    securityToken = stored.securityToken || '';
+    securityToken = present(stored.securityToken) ? stored.securityToken : '';
     region = stored.region || region;
   }
 
@@ -189,16 +214,16 @@ export function readCodeArtsCredentials() {
     try {
       if (!existsSync(path)) continue;
       const config = JSON.parse(readFileSync(path, 'utf8'));
-      const server = config?.mcpServers?.['huaweicloud-devkit'];
+      const server = config?.mcpServers?.['huaweicloud-devkit'] || config?.mcpServers?.['HuaweiCloud DevKit'];
       if (!server?.env) continue;
 
       const ak = server.env.HW_ACCESS_KEY;
       const sk = server.env.HW_SECRET_KEY;
-      if (ak && sk) {
+      if (present(ak) && present(sk)) {
         return {
           ak,
           sk,
-          securityToken: server.env.HW_SECURITY_TOKEN || '',
+          securityToken: present(server.env.HW_SECURITY_TOKEN) ? server.env.HW_SECURITY_TOKEN : '',
           region: server.env.HW_REGION || server.env.HUAWEICLOUD_REGION || '',
         };
       }
@@ -213,15 +238,15 @@ export function readCodeArtsCredentials() {
     try {
       if (existsSync(path)) {
         const config = JSON.parse(readFileSync(path, 'utf8'));
-        const server = config?.mcp?.['huaweicloud-devkit'];
+        const server = config?.mcp?.['huaweicloud-devkit'] || config?.mcp?.['HuaweiCloud DevKit'];
         if (server?.environment) {
           const ak = server.environment.HW_ACCESS_KEY;
           const sk = server.environment.HW_SECRET_KEY;
-          if (ak && sk) {
+          if (present(ak) && present(sk)) {
             return {
               ak,
               sk,
-              securityToken: server.environment.HW_SECURITY_TOKEN || '',
+              securityToken: present(server.environment.HW_SECURITY_TOKEN) ? server.environment.HW_SECURITY_TOKEN : '',
               region: server.environment.HW_REGION || server.environment.HUAWEICLOUD_REGION || '',
             };
           }

package/plugins/huaweicloud-core/src/auth/reconcile.mjs

@@ -6,6 +6,7 @@ import { spawnSync } from 'node:child_process';
 
 import {
   hasRuntimeCredentials,
+  isPlaceholder,
   obsConfigPath,
   readGlobalCredentials,
   readLastSync,
@@ -104,10 +105,13 @@ function s2CurrentMatchesLastDevkitSync(kooCli, s1, s1Fingerprint) {
 
 export function scanState() {
   const s1 = readGlobalCredentials() || {};
-  const envAk = process.env.HW_ACCESS_KEY || '';
-  const envSk = process.env.HW_SECRET_KEY || '';
+  const envAk = isPlaceholder(process.env.HW_ACCESS_KEY) ? '' : process.env.HW_ACCESS_KEY || '';
+  const envSk = isPlaceholder(process.env.HW_SECRET_KEY) ? '' : process.env.HW_SECRET_KEY || '';
   const kooCli = readKooCliProfiles();
   const inconsistencies = [];
+  const envIsPlaceholder =
+    Boolean(process.env.HW_ACCESS_KEY && isPlaceholder(process.env.HW_ACCESS_KEY)) ||
+    Boolean(process.env.HW_SECRET_KEY && isPlaceholder(process.env.HW_SECRET_KEY));
 
   const s1Fingerprint = fingerprint(s1.ak, s1.sk);
   const currentFp = currentFingerprintFromHcloud(kooCli);
@@ -153,6 +157,9 @@ export function scanState() {
       runtimeFingerprint,
     },
     kooCliCurrent: kooCli.error ? null : kooCli.current,
+    // R11: env carries placeholder/masked values → surface that explicitly so
+    // diagnostics don't show a bogus fingerprint derived from template text.
+    envIsPlaceholder,
     // S2 is encrypted storage (authEncrypt) → its fingerprint is unavailable,
     // so the S2-current drift check is intentionally skipped (#533).
     s2Encrypted: Boolean(!kooCli.error && kooCli.authEncrypt),

package/plugins/huaweicloud-core/src/tools.mjs

@@ -4,6 +4,7 @@ import { fileURLToPath } from 'node:url';
 import { homedir, tmpdir } from 'node:os';
 import { spawnSync, execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { createHmac, createHash } from 'node:crypto';
 
 import { evaluateArtifacts, evaluateCommandRisk, evaluateDeployPlan } from './risk-rule-engine.mjs';
 import { classifyTextCommand, redactSecrets } from './safety-policy.mjs';
@@ -48,6 +49,7 @@ import {
   resolveCredentialsWithRuntime,
 } from './auth/credentials.mjs';
 import { trackToolInvoke, trackSkillRetrieve, clearUserHash } from './telemetry/telemetry.mjs';
+import { fetchWithProxy } from './proxy/proxy-agent.mjs';
 import { fingerprint, runHcloudConfigure, resolveManagedProfile } from './auth/reconcile.mjs';
 import {
   getCachedUpdateInfo,
@@ -846,6 +848,32 @@ export const TOOL_DEFINITIONS = [
       },
     },
   },
+  {
+    name: 'huaweicloud_obs_set_website_config',
+    description:
+      '配置 OBS 桶的静态网站托管。KooCLI OBS 不支持 SetBucketWebsite API，此工具内部实现 AWS4 签名调用 OBS REST API，屏蔽签名细节。支持 set（配置）、get（查询）、delete（删除）三种操作。操作前需确保桶已创建且已设置 public-read ACL。',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        action: {
+          type: 'string',
+          enum: ['set', 'get', 'delete'],
+          description: '操作类型：set=配置静态网站托管，get=查询当前配置，delete=删除配置',
+        },
+        bucket: { type: 'string', description: 'OBS 桶名称' },
+        region: { type: 'string', description: 'OBS 桶所在区域，如 cn-north-4' },
+        indexDocument: {
+          type: 'string',
+          description: '首页文件名（action=set 时必填），如 index.html',
+        },
+        errorDocument: {
+          type: 'string',
+          description: '错误页面文件名（action=set 时可选），如 404.html 或 error.html',
+        },
+      },
+      required: ['action', 'bucket', 'region'],
+    },
+  },
 ];
 
 function toolInvokeValue(name, args) {
@@ -1448,19 +1476,26 @@ export async function callTool(name, rawArgs = {}, opts = {}) {
     case 'huaweicloud_voucher_claim':
       return await hdkitVoucherClaim(args.domain_id);
     case 'huaweicloud_check_update':
-      return await handleCheckUpdate(args, { sessionId: opts?.sessionId });
+      return await handleCheckUpdate(args, { sessionId: opts?.sessionId, doQuery: opts?.doQuery });
     case 'huaweicloud_upgrade':
       return await handleUpgrade(args, { sessionId: opts?.sessionId });
+    case 'huaweicloud_obs_set_website_config':
+      return await handleObsWebsiteConfig(args);
     default:
       throw new Error(`Unknown tool: ${name}`);
   }
 }
 
 async function handleCheckUpdate(args = {}, opts = {}) {
-  const sessionId = opts?.sessionId || null;
+  const { sessionId = null, doQuery } = opts;
   const current = readInstalledVersion() || '0.0.0';
   if (args.dismiss === true) {
-    const distTags = await getUpdateDistTags(current, { sessionId });
+    const distTags = await getUpdateDistTags(current, { sessionId, doQuery });
+    if (!distTags) {
+      // 查询失败：不降级为 current 冷却、不写 skip，返回 check_failed。
+      // 不调 invalidateUpdateCache()，以保留 failedAt 的 5 分钟失败节流。
+      return judgeUpdate(current, null, null);
+    }
     const target = determineTarget(current, distTags);
     const dismissedVersion =
       typeof args.dismissVersion === 'string' && args.dismissVersion ? args.dismissVersion : target || current;
@@ -1468,7 +1503,7 @@ async function handleCheckUpdate(args = {}, opts = {}) {
     invalidateUpdateCache();
     return judgeUpdate(current, distTags, state);
   }
-  return getCachedUpdateInfo(current, { sessionId });
+  return getCachedUpdateInfo(current, { sessionId, doQuery });
 }
 
 async function handleUpgrade(args = {}, opts = {}) {
@@ -2255,3 +2290,112 @@ async function getRegionalAvailability(service, region) {
 export function classifyRawCommand(command) {
   return classifyTextCommand(command);
 }
+
+// ── OBS Static Website Hosting (AWS4 signed REST API) ──
+
+async function handleObsWebsiteConfig(args) {
+  const { action, bucket, region, indexDocument, errorDocument } = args;
+  if (!bucket || !region) {
+    throw new Error('bucket and region are required');
+  }
+  const creds = resolveCredentialsWithRuntime({});
+  if (!creds?.ak || !creds?.sk) {
+    throw new Error('OBS website config requires AK/SK credentials. Run huaweicloud_auth_init first.');
+  }
+
+  const host = `${bucket}.obs.${region}.myhuaweicloud.com`;
+  const endpoint = `https://${host}`;
+
+  if (action === 'get') {
+    const res = await obsSignedRequest('GET', endpoint, '/?website', '', creds, region);
+    return { ok: res.status === 200, status: res.status, body: res.body };
+  }
+
+  if (action === 'delete') {
+    const res = await obsSignedRequest('DELETE', endpoint, '/?website', '', creds, region);
+    return { ok: res.status === 204, status: res.status };
+  }
+
+  if (action === 'set') {
+    if (!indexDocument) {
+      throw new Error('indexDocument is required for action=set');
+    }
+    const xmlParts = ['<WebsiteConfiguration>', `  <IndexDocument><Suffix>${indexDocument}</Suffix></IndexDocument>`];
+    if (errorDocument) {
+      xmlParts.push(`  <ErrorDocument><Key>${errorDocument}</Key></ErrorDocument>`);
+    }
+    xmlParts.push('</WebsiteConfiguration>');
+    const body = xmlParts.join('\n');
+    const res = await obsSignedRequest('PUT', endpoint, '/?website', body, creds, region);
+    const websiteUrl = `http://${bucket}.obs-website.${region}.myhuaweicloud.com`;
+    return {
+      ok: res.status === 200,
+      status: res.status,
+      websiteUrl,
+      message:
+        res.status === 200
+          ? `Static website hosting configured. Website URL: ${websiteUrl} (may take ~1 min to propagate)`
+          : `Failed to configure website: HTTP ${res.status}`,
+    };
+  }
+
+  throw new Error(`Unknown action: ${action}. Use set, get, or delete.`);
+}
+
+async function obsSignedRequest(method, endpoint, pathAndQuery, body, creds, region) {
+  const now = new Date();
+  const dateStamp = now.toISOString().slice(0, 10).replace(/-/g, '');
+  const amzDate = dateStamp + 'T' + now.toISOString().slice(11, 19).replace(/:/g, '') + 'Z';
+  const payloadHash = createHash('sha256').update(body).digest('hex');
+
+  const url = new URL(endpoint + pathAndQuery);
+  const canonicalUri = '/';
+  const canonicalQueryString = 'website=';
+  const canonicalHeaders = `host:${url.host}\n` + `x-amz-content-sha256:${payloadHash}\n` + `x-amz-date:${amzDate}\n`;
+  const signedHeaders = 'host;x-amz-content-sha256;x-amz-date';
+  const canonicalRequest = [
+    method,
+    canonicalUri,
+    canonicalQueryString,
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash,
+  ].join('\n');
+
+  const credentialScope = `${dateStamp}/${region}/s3/aws4_request`;
+  const stringToSign = [
+    'AWS4-HMAC-SHA256',
+    amzDate,
+    credentialScope,
+    createHash('sha256').update(canonicalRequest).digest('hex'),
+  ].join('\n');
+
+  const kDate = createHmac('sha256', 'AWS4' + creds.sk)
+    .update(dateStamp)
+    .digest();
+  const kRegion = createHmac('sha256', kDate).update(region).digest();
+  const kService = createHmac('sha256', kRegion).update('s3').digest();
+  const kSigning = createHmac('sha256', kService).update('aws4_request').digest();
+  const signature = createHmac('sha256', kSigning).update(stringToSign).digest('hex');
+
+  const authorization =
+    `AWS4-HMAC-SHA256 Credential=${creds.ak}/${credentialScope}, ` +
+    `SignedHeaders=${signedHeaders}, Signature=${signature}`;
+
+  const headers = {
+    Host: url.host,
+    'x-amz-content-sha256': payloadHash,
+    'x-amz-date': amzDate,
+    Authorization: authorization,
+  };
+  if (body) headers['Content-Type'] = 'application/xml';
+  if (creds.securityToken) headers['x-amz-security-token'] = creds.securityToken;
+
+  const res = await fetchWithProxy(endpoint + pathAndQuery, {
+    method,
+    headers,
+    body: body || undefined,
+  });
+  const resBody = await res.text();
+  return { status: res.status, body: resBody };
+}

package/plugins/huaweicloud-core/src/update-check.mjs

@@ -114,6 +114,10 @@ export function judgeUpdate(current, distTags, skipState, now = Date.now()) {
   if (!distTags) {
     return buildResult(current, null, { result: 'check_failed', note: '检测失败，不影响使用' });
   }
+  // truthy 但无有效版本（如 failure 折叠后的 { latest:null, next:null }）同样视为检测失败
+  if (!distTags.latest && !distTags.next) {
+    return buildResult(current, null, { result: 'check_failed', note: '检测失败，不影响使用' });
+  }
   const target = determineTarget(current, distTags);
   if (!target || semverCompare(target, current) <= 0) {
     return buildResult(current, distTags, { result: 'up_to_date', target: target ?? null });
@@ -348,9 +352,9 @@ export function peekCachedUpdateInfo() {
   return lastHint && lastHint.updateAvailable && lastHint.targetVersion ? lastHint : null;
 }
 
-export async function getUpdateDistTags(current, { sessionId = null } = {}) {
-  const result = await getCachedUpdateInfo(current, { sessionId });
-  if (!result) return null;
+export async function getUpdateDistTags(current, { sessionId = null, doQuery } = {}) {
+  const result = await getCachedUpdateInfo(current, { sessionId, doQuery });
+  if (!result || result.result === 'check_failed') return null;
   return { latest: result.latestStable ?? null, next: result.latestNext ?? null };
 }