huaweicloud-devkit 1.1.4-next.4 → 1.1.4-next.5

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.4-next.4",
+  "version": "1.1.4-next.5",
   "kooCliVersion": "7.2.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.4-next.4",
+  "version": "1.1.4-next.5",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.4-next.4",
+  "version": "1.1.4-next.5",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.4-next.4",
+  "version": "1.1.4-next.5",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.4-next.4",
+  "version": "1.1.4-next.5",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.4-next.4",
+  "version": "1.1.4-next.5",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.4-next.4",
+  "version": "1.1.4-next.5",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md

@@ -41,7 +41,7 @@ Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/ob
 | Three-layer permissions            | IAM > Bucket Policy > ACL. Most restrictive wins                                                                                                   |
 | Versioning is irreversible         | Once enabled, cannot be disabled, only suspended                                                                                                   |
 | OBS uses AK/SK directly            | NOT IAM tokens. Auth errors mean check AK/SK validity                                                                                              |
-| Static website via CLI missing     | KooCLI OBS lacks website config. Use REST API or console                                                                                           |
+| Static website via CLI missing     | KooCLI OBS lacks website config. Use `huaweicloud_obs_set_website_config` MCP tool (handles AWS4 signing internally) or console                    |
 | **OBS needs separate cred config** | `hcloud configure` is NOT enough for OBS. Before any OBS operation, call `huaweicloud_setup_obs_config` to sync credentials from hcloud profile.   |
 | **obsutil interactive prompts**    | `cp`/`rm` without `-f` causes "Please input (y/n)" → Agent hangs (TIMEOUT). Always use `-f` for non-interactive.                                   |
 | **Directory upload adds prefix**   | `cp <dir>/ obs://<bucket>/ -r` puts files under `bucket/<dir>/...`. Use `-flat` for root-level files (static sites). Preview with `-dryRun` first. |
@@ -83,7 +83,7 @@ hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK> -t=token
 See `references/static-website.md` for the full end-to-end workflow:
 Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Configure website (REST API/console)
 
-> KooCLI OBS does NOT support `SetBucketWebsite`. Configure static website hosting via REST API (`PUT /?website`) or the Huawei Cloud console.
+> KooCLI OBS does NOT support `SetBucketWebsite`. Use the `huaweicloud_obs_set_website_config` MCP tool (handles AWS4 signing internally, no manual signature needed) or the Huawei Cloud console.
 
 ## Single-File Quick Share
 

package/plugins/huaweicloud-core/skills/huawei-obs/references/static-website.md

@@ -31,13 +31,9 @@ hcloud OBS chattri obs://my-static-site -acl=public-read
 hcloud OBS chattri obs://my-static-site/ -r -f -acl=public-read
 
 # 5. Configure static website hosting
-# KooCLI OBS does NOT support this. Use one of:
-# Option A — REST API:
-#   PUT /?website HTTP/1.1
-#   Host: my-static-site.obs.cn-north-4.myhuaweicloud.com
-#   Body: {"IndexDocument": {"Suffix": "index.html"}, "ErrorDocument": {"Key": "error.html"}}
-#   (requires AK/SK signature)
-# Option B — Huawei Cloud Console:
+# KooCLI OBS does NOT support this. Use the MCP tool (handles AWS4 signing internally):
+# action=set, bucket=<bucket>, region=<region>, indexDocument=index.html, errorDocument=404.html
+# Or use Huawei Cloud Console:
 #   Console → OBS → Bucket → Basic Settings → Static Website Hosting
 
 # 6. Verify

package/plugins/huaweicloud-core/src/tools.mjs

@@ -4,6 +4,7 @@ import { fileURLToPath } from 'node:url';
 import { homedir, tmpdir } from 'node:os';
 import { spawnSync, execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { createHmac, createHash } from 'node:crypto';
 
 import { evaluateArtifacts, evaluateCommandRisk, evaluateDeployPlan } from './risk-rule-engine.mjs';
 import { classifyTextCommand, redactSecrets } from './safety-policy.mjs';
@@ -48,6 +49,7 @@ import {
   resolveCredentialsWithRuntime,
 } from './auth/credentials.mjs';
 import { trackToolInvoke, trackSkillRetrieve, clearUserHash } from './telemetry/telemetry.mjs';
+import { fetchWithProxy } from './proxy/proxy-agent.mjs';
 import { fingerprint, runHcloudConfigure, resolveManagedProfile } from './auth/reconcile.mjs';
 import {
   getCachedUpdateInfo,
@@ -846,6 +848,32 @@ export const TOOL_DEFINITIONS = [
       },
     },
   },
+  {
+    name: 'huaweicloud_obs_set_website_config',
+    description:
+      '配置 OBS 桶的静态网站托管。KooCLI OBS 不支持 SetBucketWebsite API，此工具内部实现 AWS4 签名调用 OBS REST API，屏蔽签名细节。支持 set（配置）、get（查询）、delete（删除）三种操作。操作前需确保桶已创建且已设置 public-read ACL。',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        action: {
+          type: 'string',
+          enum: ['set', 'get', 'delete'],
+          description: '操作类型：set=配置静态网站托管，get=查询当前配置，delete=删除配置',
+        },
+        bucket: { type: 'string', description: 'OBS 桶名称' },
+        region: { type: 'string', description: 'OBS 桶所在区域，如 cn-north-4' },
+        indexDocument: {
+          type: 'string',
+          description: '首页文件名（action=set 时必填），如 index.html',
+        },
+        errorDocument: {
+          type: 'string',
+          description: '错误页面文件名（action=set 时可选），如 404.html 或 error.html',
+        },
+      },
+      required: ['action', 'bucket', 'region'],
+    },
+  },
 ];
 
 function toolInvokeValue(name, args) {
@@ -1448,19 +1476,26 @@ export async function callTool(name, rawArgs = {}, opts = {}) {
     case 'huaweicloud_voucher_claim':
       return await hdkitVoucherClaim(args.domain_id);
     case 'huaweicloud_check_update':
-      return await handleCheckUpdate(args, { sessionId: opts?.sessionId });
+      return await handleCheckUpdate(args, { sessionId: opts?.sessionId, doQuery: opts?.doQuery });
     case 'huaweicloud_upgrade':
       return await handleUpgrade(args, { sessionId: opts?.sessionId });
+    case 'huaweicloud_obs_set_website_config':
+      return await handleObsWebsiteConfig(args);
     default:
       throw new Error(`Unknown tool: ${name}`);
   }
 }
 
 async function handleCheckUpdate(args = {}, opts = {}) {
-  const sessionId = opts?.sessionId || null;
+  const { sessionId = null, doQuery } = opts;
   const current = readInstalledVersion() || '0.0.0';
   if (args.dismiss === true) {
-    const distTags = await getUpdateDistTags(current, { sessionId });
+    const distTags = await getUpdateDistTags(current, { sessionId, doQuery });
+    if (!distTags) {
+      // 查询失败：不降级为 current 冷却、不写 skip，返回 check_failed。
+      // 不调 invalidateUpdateCache()，以保留 failedAt 的 5 分钟失败节流。
+      return judgeUpdate(current, null, null);
+    }
     const target = determineTarget(current, distTags);
     const dismissedVersion =
       typeof args.dismissVersion === 'string' && args.dismissVersion ? args.dismissVersion : target || current;
@@ -1468,7 +1503,7 @@ async function handleCheckUpdate(args = {}, opts = {}) {
     invalidateUpdateCache();
     return judgeUpdate(current, distTags, state);
   }
-  return getCachedUpdateInfo(current, { sessionId });
+  return getCachedUpdateInfo(current, { sessionId, doQuery });
 }
 
 async function handleUpgrade(args = {}, opts = {}) {
@@ -2255,3 +2290,112 @@ async function getRegionalAvailability(service, region) {
 export function classifyRawCommand(command) {
   return classifyTextCommand(command);
 }
+
+// ── OBS Static Website Hosting (AWS4 signed REST API) ──
+
+async function handleObsWebsiteConfig(args) {
+  const { action, bucket, region, indexDocument, errorDocument } = args;
+  if (!bucket || !region) {
+    throw new Error('bucket and region are required');
+  }
+  const creds = resolveCredentialsWithRuntime({});
+  if (!creds?.ak || !creds?.sk) {
+    throw new Error('OBS website config requires AK/SK credentials. Run huaweicloud_auth_init first.');
+  }
+
+  const host = `${bucket}.obs.${region}.myhuaweicloud.com`;
+  const endpoint = `https://${host}`;
+
+  if (action === 'get') {
+    const res = await obsSignedRequest('GET', endpoint, '/?website', '', creds, region);
+    return { ok: res.status === 200, status: res.status, body: res.body };
+  }
+
+  if (action === 'delete') {
+    const res = await obsSignedRequest('DELETE', endpoint, '/?website', '', creds, region);
+    return { ok: res.status === 204, status: res.status };
+  }
+
+  if (action === 'set') {
+    if (!indexDocument) {
+      throw new Error('indexDocument is required for action=set');
+    }
+    const xmlParts = ['<WebsiteConfiguration>', `  <IndexDocument><Suffix>${indexDocument}</Suffix></IndexDocument>`];
+    if (errorDocument) {
+      xmlParts.push(`  <ErrorDocument><Key>${errorDocument}</Key></ErrorDocument>`);
+    }
+    xmlParts.push('</WebsiteConfiguration>');
+    const body = xmlParts.join('\n');
+    const res = await obsSignedRequest('PUT', endpoint, '/?website', body, creds, region);
+    const websiteUrl = `http://${bucket}.obs-website.${region}.myhuaweicloud.com`;
+    return {
+      ok: res.status === 200,
+      status: res.status,
+      websiteUrl,
+      message:
+        res.status === 200
+          ? `Static website hosting configured. Website URL: ${websiteUrl} (may take ~1 min to propagate)`
+          : `Failed to configure website: HTTP ${res.status}`,
+    };
+  }
+
+  throw new Error(`Unknown action: ${action}. Use set, get, or delete.`);
+}
+
+async function obsSignedRequest(method, endpoint, pathAndQuery, body, creds, region) {
+  const now = new Date();
+  const dateStamp = now.toISOString().slice(0, 10).replace(/-/g, '');
+  const amzDate = dateStamp + 'T' + now.toISOString().slice(11, 19).replace(/:/g, '') + 'Z';
+  const payloadHash = createHash('sha256').update(body).digest('hex');
+
+  const url = new URL(endpoint + pathAndQuery);
+  const canonicalUri = '/';
+  const canonicalQueryString = 'website=';
+  const canonicalHeaders = `host:${url.host}\n` + `x-amz-content-sha256:${payloadHash}\n` + `x-amz-date:${amzDate}\n`;
+  const signedHeaders = 'host;x-amz-content-sha256;x-amz-date';
+  const canonicalRequest = [
+    method,
+    canonicalUri,
+    canonicalQueryString,
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash,
+  ].join('\n');
+
+  const credentialScope = `${dateStamp}/${region}/s3/aws4_request`;
+  const stringToSign = [
+    'AWS4-HMAC-SHA256',
+    amzDate,
+    credentialScope,
+    createHash('sha256').update(canonicalRequest).digest('hex'),
+  ].join('\n');
+
+  const kDate = createHmac('sha256', 'AWS4' + creds.sk)
+    .update(dateStamp)
+    .digest();
+  const kRegion = createHmac('sha256', kDate).update(region).digest();
+  const kService = createHmac('sha256', kRegion).update('s3').digest();
+  const kSigning = createHmac('sha256', kService).update('aws4_request').digest();
+  const signature = createHmac('sha256', kSigning).update(stringToSign).digest('hex');
+
+  const authorization =
+    `AWS4-HMAC-SHA256 Credential=${creds.ak}/${credentialScope}, ` +
+    `SignedHeaders=${signedHeaders}, Signature=${signature}`;
+
+  const headers = {
+    Host: url.host,
+    'x-amz-content-sha256': payloadHash,
+    'x-amz-date': amzDate,
+    Authorization: authorization,
+  };
+  if (body) headers['Content-Type'] = 'application/xml';
+  if (creds.securityToken) headers['x-amz-security-token'] = creds.securityToken;
+
+  const res = await fetchWithProxy(endpoint + pathAndQuery, {
+    method,
+    headers,
+    body: body || undefined,
+  });
+  const resBody = await res.text();
+  return { status: res.status, body: resBody };
+}

package/plugins/huaweicloud-core/src/update-check.mjs

@@ -114,6 +114,10 @@ export function judgeUpdate(current, distTags, skipState, now = Date.now()) {
   if (!distTags) {
     return buildResult(current, null, { result: 'check_failed', note: '检测失败，不影响使用' });
   }
+  // truthy 但无有效版本（如 failure 折叠后的 { latest:null, next:null }）同样视为检测失败
+  if (!distTags.latest && !distTags.next) {
+    return buildResult(current, null, { result: 'check_failed', note: '检测失败，不影响使用' });
+  }
   const target = determineTarget(current, distTags);
   if (!target || semverCompare(target, current) <= 0) {
     return buildResult(current, distTags, { result: 'up_to_date', target: target ?? null });
@@ -348,9 +352,9 @@ export function peekCachedUpdateInfo() {
   return lastHint && lastHint.updateAvailable && lastHint.targetVersion ? lastHint : null;
 }
 
-export async function getUpdateDistTags(current, { sessionId = null } = {}) {
-  const result = await getCachedUpdateInfo(current, { sessionId });
-  if (!result) return null;
+export async function getUpdateDistTags(current, { sessionId = null, doQuery } = {}) {
+  const result = await getCachedUpdateInfo(current, { sessionId, doQuery });
+  if (!result || result.result === 'check_failed') return null;
   return { latest: result.latestStable ?? null, next: result.latestNext ?? null };
 }