huaweicloud-devkit 1.1.4 → 1.1.6-next.0

package/README.md

@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
-[![Beta](https://img.shields.io/badge/beta-v1.1.4-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.6-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 
 **[中文](README.zh-CN.md) | English**
 

package/README.zh-CN.md

@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
-[![Beta](https://img.shields.io/badge/beta-v1.1.4-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.6-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 
 **中文 | [English](README.md)**
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.4",
+  "version": "1.1.6-next.0",
   "kooCliVersion": "7.2.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.4",
+  "version": "1.1.6-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.4",
+  "version": "1.1.6-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.4",
+  "version": "1.1.6-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.4",
+  "version": "1.1.6-next.0",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.4",
+  "version": "1.1.6-next.0",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.4",
+  "version": "1.1.6-next.0",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -8,6 +8,24 @@ version: 1
 
 **STOP - Do not answer from general knowledge.** Follow the procedure below.
 
+## Target-Selection Gate (MANDATORY — do not skip)
+
+When the developer asks to **deploy / host / publish / 上线 / 部署 / 发布 / 搭建** a website, web app, or static site WITHOUT naming a specific target, you MUST present the target options and obtain an explicit choice BEFORE calling any sandbox lifecycle tool (`huaweicloud_sandbox_check_user`, `huaweicloud_sandbox_connect`, `huaweicloud_sandbox_upload_project`, `huaweicloud_sandbox_deploy_nginx`, etc.).
+
+Use the `question` tool and present, in this exact order:
+
+1. **沙箱 (Sandbox)** — temporary runtime, instant preview URL (recommended for quick preview)
+2. **OBS 静态托管** — long-term static hosting + CDN + custom domain
+3. **ECS** — server-based hosting
+4. **CCE** — container-based hosting
+
+Hard rules:
+
+- **NEVER infer or default the target** when it is unstated. Calling `huaweicloud_sandbox_connect` before this choice is made is a violation.
+- Only skip the question when: (a) the developer already named a target (e.g. "部署到 ECS", "用 OBS"), or (b) the developer explicitly asked for a temporary / sandbox / preview runtime.
+- "部署到华为云" / "deploy to Huawei Cloud" / "上线" alone is NOT a named target — still run the gate.
+- After the choice: sandbox → continue with this skill; OBS → `huawei-obs`; ECS → `huawei-ecs` / `huawei-iac`; CCE → `huawei-cce`.
+
 ## Overview
 
 Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace terminal execution. Covers sandbox lifecycle via hdkitservice API and remote terminal command execution via hwlink protocol.
@@ -15,7 +33,7 @@ Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace t
 ## Activation
 
 - **Proactive offering**: when the developer's task needs a temporary runtime (e.g. "deploy this web app", "run this app and preview it"), offer the sandbox proactively — the developer never has to say "use sandbox". Prompt: "This task can be satisfied by a sandbox — use it?"
-- **Static website hosting — present options, sandbox first**: when the developer asks to deploy/host/publish a static website or web app without naming a target, do NOT silently pick a service. Present the target options in this order: ① 沙箱 (recommended — temporary runtime, instant preview URL) ② OBS 静态托管 (long-term static hosting/CDN) ③ ECS ④ CCE, then follow the developer's choice. Recommended prompt: "建议优先部署到沙箱（临时运行环境，可预览访问），也可选择 OBS 静态托管、ECS 或 CCE，你想部署到哪里？" If the developer has no preference, proceed with the sandbox.
+- **Static website hosting — present options, sandbox first (MANDATORY)**: when the developer asks to deploy/host/publish a static website or web app without naming a target, do NOT silently pick a service and do NOT default to the sandbox. Run the [Target-Selection Gate](#target-selection-gate-mandatory--do-not-skip) via the `question` tool first. Present, in order: ① 沙箱 (recommended — temporary runtime, instant preview URL) ② OBS 静态托管 (long-term static hosting/CDN) ③ ECS ④ CCE. Recommended prompt: "建议优先部署到沙箱（临时运行环境，可预览访问），也可选择 OBS 静态托管、ECS 或 CCE，你想部署到哪里？" Only if the developer, after being asked, expresses no preference may you proceed with the sandbox.
 - **Detect web apps in deploy-a-repo prompts**: prompts like "部署 GitHub - <owner>/<repo>" or "deploy <github repo>" do not say "web app". Clone or inspect the repository first (package.json with dev/serve/build scripts, index.html, frontend framework dependencies such as vue/react/angular/vite, static sites, Dockerfile running a web server). If it is a web application, offer the sandbox first: "检测到该项目是 Web 应用，建议优先使用沙箱部署（临时运行环境，可预览访问），是否使用？"
 - **Clone into the sandbox workspace directory**: always put project code under `/workspace/<repo-name>` (create the directory if missing) — `/workspace` is the sandbox's dedicated workspace mount at the filesystem root, not `$HOME/workspace`. Never use `/tmp` or other ephemeral locations. This keeps the project with the sandbox session, is easy to reference for serving/exposing, and survives session-level restarts of the shell.
 - **Deployment must end with a public URL**: after deploying and exposing the app with DevBridge, always return the tunnel URL to the developer as the final result — a deployment without an accessible link is incomplete.
@@ -86,6 +104,8 @@ Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace t
 
 ## Workflow
 
+**Step 0 — Target-Selection Gate (MANDATORY)**: before any sandbox lifecycle tool, confirm the target. If the developer asked to deploy/host/publish a site without naming a target, STOP and run the [Target-Selection Gate](#target-selection-gate-mandatory--do-not-skip) first; do NOT call `huaweicloud_sandbox_connect` until it is resolved. Proceed with this workflow only if the target is already confirmed as sandbox (or a temporary runtime).
+
 Setup is a **plugin-side preflight** — the developer should be asked a question only once, when the agreement actually needs signing:
 
 1. **Check user** (transparent): `huaweicloud_sandbox_check_user` — returns `realnameVerified`/`agreementSigned` (200) when all good, OR throws a 403 error with one of these codes:
@@ -836,6 +856,7 @@ Returns `complete: true/false`, `score`, and `nextStep` to fix missing items.
 
 | Trap                                 | Why                                                                                                                                                                                                                                     |
 | ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Target not confirmed                 | "部署到华为云" without a named target is NOT a go signal. You MUST run the Target-Selection Gate and get an explicit choice before calling any sandbox lifecycle tool. Skipping it and defaulting to the sandbox is a violation.        |
 | Agreement required first             | `sandbox_connect` fails if the agreement isn't signed; the `sandbox_check_user` preflight detects this, so surface it to the developer only when signing is needed                                                                      |
 | Real-name required                   | `sandbox_connect` fails if `realnameVerified=false`; tell the developer once and stop, don't loop on connect                                                                                                                            |
 | Never expose tunnel details          | Do not mention "DevBridge"/"tunnel"/"devbridge" to the developer — say "正在生成访问地址..." and hand over only the URL                                                                                                                 |

package/plugins/huaweicloud-core/src/mcp-protocol.mjs

@@ -1,25 +1,9 @@
-import { readFileSync } from 'node:fs';
-import { resolve, dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
 import { TOOL_DEFINITIONS, callTool } from './tools.mjs';
-import { peekCachedUpdateInfo, applyUpdateHint } from './update-check.mjs';
+import { peekCachedUpdateInfo, applyUpdateHint, readInstalledVersion } from './update-check.mjs';
 import { initTelemetry } from './telemetry/telemetry.mjs';
 import { detectAgent } from './telemetry/agent-detect.mjs';
 
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const pluginRoot = resolve(__dirname, '..');
-const packageRoot = resolve(pluginRoot, '..', '..');
-let pkgVersion = '0.0.0';
-for (const base of [pluginRoot, packageRoot]) {
-  try {
-    const version = JSON.parse(readFileSync(join(base, 'package.json'), 'utf8')).version;
-    if (version) {
-      pkgVersion = version;
-      break;
-    }
-  } catch {}
-}
+const pkgVersion = readInstalledVersion() || '0.0.0';
 
 // 会话内首个非 check/upgrade 工具调用附加 _updateInfo，只消费一次。
 // 按会话隔离：同进程内不同会话(A/B)各自首次提示；stdio 用固定 'stdin'。
@@ -92,5 +76,9 @@ export async function dispatch(method, params, opts = {}) {
     return { resources: [] };
   }
 
-  throw new Error(`Unsupported method: ${method}`);
+  // JSON-RPC 2.0: unknown methods must surface as -32601 (Method not found),
+  // not the generic -32603 internal error (#650 D9-2).
+  const methodError = new Error(`Method not found: ${method}`);
+  methodError.code = -32601;
+  throw methodError;
 }

package/plugins/huaweicloud-core/src/mcp-server-remote.mjs

@@ -60,7 +60,7 @@ export async function startRemoteServer({ port = DEFAULT_PORT, host = DEFAULT_HO
       response = {
         jsonrpc: '2.0',
         id: message.id,
-        error: { code: -32603, message: error.message },
+        error: { code: Number.isSafeInteger(error.code) ? error.code : -32603, message: error.message },
       };
     }
 

package/plugins/huaweicloud-core/src/mcp-server.mjs

@@ -166,7 +166,7 @@ function runStdioServer() {
         jsonrpc: '2.0',
         id: message.id,
         error: {
-          code: -32603,
+          code: Number.isSafeInteger(error.code) ? error.code : -32603,
           message: error.message,
         },
       });

package/plugins/huaweicloud-core/src/officeace-paths.mjs

@@ -0,0 +1,51 @@
+// Shared OfficeAce config-root resolution used by both the installer
+// (setup-cli.mjs) and the MCP runtime (tools.mjs), so skills are installed
+// to and read from the same location (#559).
+//
+// OfficeAce exposes no API for the plugin to query the current user or
+// install directory, so the root is located by probing. The probe result is
+// persisted in a marker file so a non-standard directory (entered via prompt,
+// whose OFFICE_CLAW_CONFIG_ROOT env does not survive across processes) is
+// still found by later uninstall/update runs.
+
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join, resolve, dirname } from 'node:path';
+import { homedir } from 'node:os';
+
+function markerPath() {
+  return join(process.env.HUAWEICLOUD_HOME || homedir(), '.config', 'huaweicloud', 'devkit-officeace-root.json');
+}
+
+function sqliteSibling(dir) {
+  return join(resolve(dir, '..'), 'data', 'mcp-connectors.sqlite');
+}
+
+// A directory is a usable OfficeAce config root when it exists and carries
+// OfficeAce evidence — capabilities.json, the connector DB, or DevKit's own
+// installed artifacts. Deliberately more lenient than "capabilities.json must
+// exist" so uninstall/update still find the root after it was removed.
+export function isUsableOfficeaceRoot(dir) {
+  if (!dir || !existsSync(dir)) return false;
+  return (
+    existsSync(join(dir, 'capabilities.json')) ||
+    existsSync(sqliteSibling(dir)) ||
+    existsSync(join(dir, 'skills')) ||
+    existsSync(join(dir, 'huaweicloud-plugins'))
+  );
+}
+
+export function readOfficeaceRootMarker() {
+  try {
+    const marker = JSON.parse(readFileSync(markerPath(), 'utf8'));
+    return isUsableOfficeaceRoot(marker.root) ? marker.root : null;
+  } catch {
+    return null;
+  }
+}
+
+export function writeOfficeaceRootMarker(root) {
+  try {
+    mkdirSync(dirname(markerPath()), { recursive: true });
+    writeFileSync(markerPath(), JSON.stringify({ root, savedAt: new Date().toISOString() }, null, 2));
+  } catch {}
+}

package/plugins/huaweicloud-core/src/risk-rule-engine.mjs

@@ -108,15 +108,57 @@ function evaluate(stage, inputs, options = {}) {
   };
 }
 
+function isNonEmptyString(value) {
+  return typeof value === 'string' && value.trim().length > 0;
+}
+
+function isNonEmptyContainer(value) {
+  if (Array.isArray(value)) return value.length > 0;
+  if (value && typeof value === 'object') return Object.keys(value).length > 0;
+  return false;
+}
+
+// A risk check that could not inspect its input must never report "allow"
+// (fail-open) — it reports deny with an `invalid` risk and a synthetic finding
+// so the reason is visible through the tool response (#564).
+function invalidRiskResult(stage, reason) {
+  return {
+    decision: 'deny',
+    risk: 'invalid',
+    findings: [
+      {
+        ruleId: 'invalid-input',
+        title: 'Invalid input for risk check',
+        category: 'invalid',
+        severity: 'deny',
+        message: reason,
+        remediation: 'Provide a valid, non-empty input before re-running the check.',
+        source: stage,
+        evidence: '',
+      },
+    ],
+  };
+}
+
 export function evaluateCommandRisk(command, options = {}) {
+  if (!isNonEmptyString(command)) {
+    return invalidRiskResult('command', 'command must be a non-empty string.');
+  }
   return evaluate('command', { command }, options);
 }
 
 export function evaluateArtifacts(artifacts, options = {}) {
-  return evaluate('artifact', Array.isArray(artifacts) ? artifacts : [], options);
+  if (!Array.isArray(artifacts) || artifacts.length === 0) {
+    return invalidRiskResult('artifact', 'artifacts must be a non-empty array.');
+  }
+  return evaluate('artifact', artifacts, options);
 }
 
 export function evaluateDeployPlan(plan, options = {}) {
+  const valid = isNonEmptyString(plan) || (plan != null && typeof plan === 'object' && isNonEmptyContainer(plan));
+  if (!valid) {
+    return invalidRiskResult('deploy_plan', 'plan must be a non-empty object, array, or string.');
+  }
   return evaluate('deploy_plan', { plan }, options);
 }
 

package/plugins/huaweicloud-core/src/safety-policy.mjs

@@ -66,11 +66,38 @@ export function redactSecrets(value, policy = DEFAULT_POLICY) {
 
 function stripExecutable(args) {
   if (!args.length) return [];
-  const first = String(args[0]).toLowerCase();
+  let current = args;
+  // Unwrap shell wrappers (bash -c / sh -c 'hcloud ...', sudo hcloud ...) so
+  // wrapped write commands keep their deny classification (#650 D4-16).
+  for (let depth = 0; depth < 5; depth++) {
+    const first = String(current[0]).toLowerCase();
+    const isShell = [
+      'bash',
+      'sh',
+      'zsh',
+      'dash',
+      'bash.exe',
+      'sh.exe',
+      '/bin/bash',
+      '/bin/sh',
+      '/bin/zsh',
+      '/bin/dash',
+    ].includes(first);
+    if (isShell && String(current[1]).toLowerCase() === '-c' && current[2]) {
+      current = splitSimpleCommand(current[2]);
+      continue;
+    }
+    if (first === 'sudo' && current.length > 1) {
+      current = current.slice(1);
+      continue;
+    }
+    break;
+  }
+  const first = String(current[0]).toLowerCase();
   if (first === 'hcloud' || first.endsWith('/hcloud') || first.endsWith('\\hcloud') || first === 'hcloud.exe') {
-    return args.slice(1);
+    return current.slice(1);
   }
-  return args;
+  return current;
 }
 
 function commandOperation(args) {
@@ -123,8 +150,44 @@ function applyRawCommandRiskRules(base, command, options = {}) {
   return mergeRiskDecision(base, risk);
 }
 
+// Find hcloud command segments split by shell operators (; && || |) so a write
+// command in the middle of a concatenated string keeps its deny classification
+// (#650 review edge 1).
+function findHcloudCommandSegments(text) {
+  return String(text)
+    .split(/(?:\|\||&&|;|\|)/)
+    .map((segment) => segment.trim())
+    .filter(Boolean)
+    .map((segment) => splitSimpleCommand(segment))
+    .filter((tokens) => {
+      const first = String(tokens[0] || '').toLowerCase();
+      return first === 'hcloud' || first.endsWith('/hcloud') || first.endsWith('\\hcloud') || first === 'hcloud.exe';
+    });
+}
+
 export function classifyHcloudArgs(args, options = {}) {
   const policy = options.policy || DEFAULT_POLICY;
+  // Second pass for shell-wrapped input (#650 D4-16 review edge 1): when the
+  // leading command is not hcloud but a concatenated segment contains one,
+  // classify every hcloud segment and merge to the most severe decision.
+  const unwrappedTokens = stripExecutable(Array.isArray(args) ? args.map(String) : []);
+  const unwrappedFirst = String(unwrappedTokens[0] || '').toLowerCase();
+  const unwrappedIsHcloud =
+    unwrappedFirst === 'hcloud' ||
+    unwrappedFirst.endsWith('/hcloud') ||
+    unwrappedFirst.endsWith('\\hcloud') ||
+    unwrappedFirst === 'hcloud.exe';
+  if (!unwrappedIsHcloud && !options._segmentDepth) {
+    const hcloudSegments = findHcloudCommandSegments(unwrappedTokens.join(' '));
+    if (hcloudSegments.length > 0) {
+      const results = hcloudSegments.map((segment) => classifyHcloudArgs(segment, { ...options, _segmentDepth: 1 }));
+      return (
+        results.find((result) => result.decision === 'deny') ||
+        results.find((result) => ['write', 'execution', 'secret', 'credential'].includes(result.risk)) ||
+        results[0]
+      );
+    }
+  }
   const { service, operation, args: normalizedArgs } = commandOperation(args);
   const joined = normalizedArgs.join(' ');
 
@@ -342,6 +405,26 @@ export function classifyTextCommand(command, options = {}) {
     };
   }
 
+  // Credential variable references bypass the env-command gate above: HW_ is
+  // the plugin's own documented credential prefix (HW_ACCESS_KEY/HW_SECRET_KEY/
+  // HW_SECURITY_TOKEN), and `echo $HW_SECRET_KEY` / `printenv HW_ACCESS_KEY`
+  // previously fell through to allow (#650 D4-2).
+  //
+  // The negative lookbehind exempts literal-NAME references — backslash-escaped
+  // (`\$HW_*`) or single-quoted (`'$HW_*'`, which the shell never expands) —
+  // while unescaped `$HW_*` is a potential expansion/dump regardless of the
+  // command. No command-name whitelist, so no false negative (#650 review).
+  if (
+    /(?<!['\\])\$\{?(?:HUAWEICLOUD|HWC|HW|OS)_(?:ACCESS_KEY|SECRET_KEY|SECURITY_TOKEN)/i.test(text) ||
+    /(?:^|\s)printenv\s+(?:HUAWEICLOUD|HWC|HW|OS)_(?:ACCESS_KEY|SECRET_KEY|SECURITY_TOKEN)/i.test(text)
+  ) {
+    return {
+      decision: 'deny',
+      risk: 'credential',
+      reason: 'Printing cloud credential environment variables is blocked.',
+    };
+  }
+
   if (/(^|\s)hcloud(\.exe)?\s+/i.test(text)) {
     return classifyHcloudArgs(splitSimpleCommand(text), { ...options, rawCommand: text });
   }

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -37,7 +37,8 @@ import {
 } from './proxy/proxy-config.mjs';
 import { removeKooCli, removeObsConfig } from './sandbox/uninstall-cleanup.mjs';
 import { mergeCommandStyle, mergeArgsStyle, extractUserDelta, applyUserDelta } from './mcp-config-merge.mjs';
-import { saveAgentDelta, takeAgentDelta, purgeBackup } from './mcp-config-backup.mjs';
+import { readAgentDelta, saveAgentDelta, takeAgentDelta, purgeBackup } from './mcp-config-backup.mjs';
+import { isUsableOfficeaceRoot, readOfficeaceRootMarker, writeOfficeaceRootMarker } from './officeace-paths.mjs';
 import { queryDistTagsFetch, determineTarget, semverCompare } from './update-check.mjs';
 import { getKooCliVersion, compareVersion, kooCliDownloadBase, KOO_CLI_BASE } from './koocli-version.mjs';
 import { findHcloudBin, hcloudProbeNextStep, probeHcloud } from './hcloud-probe.mjs';
@@ -185,11 +186,13 @@ function readOfficeaceRegistryInstallDir() {
 
 function officeaceCapabilitiesDir() {
   const configRoot = process.env.OFFICE_CLAW_CONFIG_ROOT;
-  if (configRoot && existsSync(join(configRoot, 'capabilities.json'))) return configRoot;
+  if (isUsableOfficeaceRoot(configRoot)) return configRoot;
+  const markerRoot = readOfficeaceRootMarker();
+  if (markerRoot) return markerRoot;
   const regDir = readOfficeaceRegistryInstallDir();
   if (regDir) {
     const dir = join(regDir, '.office-claw');
-    if (existsSync(join(dir, 'capabilities.json'))) return dir;
+    if (isUsableOfficeaceRoot(dir)) return dir;
   }
   if (platform() === 'win32') {
     const bases = [process.env.ProgramFiles, 'C:\\Program Files', 'D:\\Program Files'];
@@ -197,7 +200,7 @@ function officeaceCapabilitiesDir() {
     for (const base of bases) {
       if (!base) continue;
       const dir = join(base, 'OfficeAce', '.office-claw');
-      if (existsSync(join(dir, 'capabilities.json'))) return dir;
+      if (isUsableOfficeaceRoot(dir)) return dir;
     }
   }
   return null;
@@ -242,7 +245,7 @@ function ensureOfficeaceMcpInSqlite() {
   if (!existsSync(dbPath)) {
     console.log(`  \x1b[31mOfficeAce database not found: ${dbPath}\x1b[0m`);
     console.log(`  \x1b[33mPlease ensure OfficeAce is installed and has been launched at least once.\x1b[0m`);
-    return false;
+    return 'db-missing';
   }
 
   const mcpPath = join(officeacePluginsDir(), 'src', 'mcp-server.mjs').replace(/\\/g, '/');
@@ -281,21 +284,27 @@ function ensureOfficeaceMcpInSqlite() {
       if (existing.command === 'node' && existing.args_json === nextArgsJson && existing.env_json === nextEnvJson) {
         console.log(`  MCP config unchanged: ${dbPath}`);
         db.close();
-        return true;
+        return 'ok';
       }
       db.prepare(
         'UPDATE mcp_connectors SET command = ?, args_json = ?, env_json = ?, updated_at = ?, status = ?, enabled = 1 WHERE id = ?',
       ).run('node', nextArgsJson, nextEnvJson, now, 'disconnected', existing.id);
       console.log(`  MCP config merged (user fields preserved): ${dbPath}`);
     } else {
-      const ownerUserId = officeaceGetOwnerUserId();
+      // Restore user identity + args saved by a previous uninstall (#559).
+      // owner_user_id has no queryable source: we copy it from an existing
+      // row, and fall back to the value backed up before a prior uninstall so
+      // an emptied table does not make registration permanently impossible.
+      const officeaceDelta = readAgentDelta('officeace');
+      const ownerUserId = officeaceGetOwnerUserId() || (officeaceDelta && officeaceDelta.ownerUserId);
       if (!ownerUserId) {
-        console.log(`  \x1b[31mCannot determine owner_user_id from database\x1b[0m`);
+        console.log(`  \x1b[31mCannot determine owner_user_id for the huaweicloud-devkit connector.\x1b[0m`);
+        console.log(
+          `  \x1b[33mThe OfficeAce connector database has no rows to copy the user id from and no prior registration is backed up. Open OfficeAce, add/enable any connector once, then re-run the install.\x1b[0m`,
+        );
         db.close();
-        return false;
+        return 'owner-missing';
       }
-      // Restore user args saved by a previous uninstall (issue #615).
-      const officeaceDelta = takeAgentDelta('officeace');
       const insertArgsJson =
         officeaceDelta && Array.isArray(officeaceDelta.argsExtra)
           ? JSON.stringify([mcpPath, ...officeaceDelta.argsExtra])
@@ -304,10 +313,12 @@ function ensureOfficeaceMcpInSqlite() {
         `INSERT INTO mcp_connectors (id, owner_user_id, type, name, normalized_name, transport, timeout_ms, command, args_json, env_json, enabled, status, created_at, updated_at, version, seeded)
          VALUES (?, ?, 'custom', 'huaweicloud-devkit', 'huaweicloud-devkit', 'stdio', 60000, 'node', ?, ?, 1, 'disconnected', ?, ?, 1, 0)`,
       ).run(randomUUID(), ownerUserId, insertArgsJson, envJson, now, now);
+      // Consume the backup only after a successful insert so a DB failure keeps it for the next retry.
+      takeAgentDelta('officeace');
       console.log(`  MCP config created: ${dbPath}`);
     }
     db.close();
-    return true;
+    return 'ok';
   } catch (error) {
     if (db) {
       try {
@@ -315,7 +326,7 @@ function ensureOfficeaceMcpInSqlite() {
       } catch {}
     }
     console.log(`  \x1b[31mFailed to write MCP config: ${error.message}\x1b[0m`);
-    return false;
+    return 'error';
   }
 }
 
@@ -325,17 +336,28 @@ function removeOfficeaceMcpFromSqlite() {
   let db;
   try {
     db = openOfficeaceDb();
-    // Back up user args before deleting the connector row (issue #615).
+    // Back up user identity + args before deleting the connector row:
+    // owner_user_id is copied from existing rows on reinstall, so an empty
+    // table after this delete would make registration impossible (#559).
     try {
-      const row = db.prepare("SELECT args_json FROM mcp_connectors WHERE name = 'huaweicloud-devkit'").get();
-      const parsed = row ? JSON.parse(row.args_json || '[]') : [];
-      if (Array.isArray(parsed) && parsed.length > 1) {
-        saveAgentDelta('officeace', { argsExtra: parsed.slice(1) });
-      }
+      const row = db
+        .prepare("SELECT owner_user_id, args_json FROM mcp_connectors WHERE name = 'huaweicloud-devkit'")
+        .get();
+      const delta = {};
+      if (row?.owner_user_id) delta.ownerUserId = row.owner_user_id;
+      try {
+        const parsed = row ? JSON.parse(row.args_json || '[]') : [];
+        if (Array.isArray(parsed) && parsed.length > 1) delta.argsExtra = parsed.slice(1);
+      } catch {}
+      if (Object.keys(delta).length > 0) saveAgentDelta('officeace', delta);
+    } catch {}
+    // mcp_connector_tools may not exist on minimal installs — deleting it must
+    // not abort deleting the connector row itself.
+    try {
+      db.prepare(
+        "DELETE FROM mcp_connector_tools WHERE connector_id IN (SELECT id FROM mcp_connectors WHERE name = 'huaweicloud-devkit')",
+      ).run();
     } catch {}
-    db.prepare(
-      "DELETE FROM mcp_connector_tools WHERE connector_id IN (SELECT id FROM mcp_connectors WHERE name = 'huaweicloud-devkit')",
-    ).run();
     const result2 = db.prepare("DELETE FROM mcp_connectors WHERE name = 'huaweicloud-devkit'").run();
     if (result2.changes > 0) {
       console.log(`  MCP config removed: ${dbPath}`);
@@ -2377,8 +2399,17 @@ async function installOfficeAce() {
   console.log(`  Safety Policy -> ${join(pluginDest, 'safety')}`);
 
   installRuntimeDeps(pluginDest);
-  ensureOfficeaceMcpInSqlite();
+  if (ensureOfficeaceMcpInSqlite() === 'owner-missing') {
+    throw new Error(
+      'OfficeAce MCP connector registration failed (owner_user_id unavailable). ' +
+        'Open OfficeAce, add/enable any connector once, then re-run install.',
+    );
+  }
   registerOfficeaceSkillEntries();
+  // Persist the resolved root so a later uninstall/update (new process, no
+  // OFFICE_CLAW_CONFIG_ROOT env) still targets the same directory (#559).
+  const resolvedRoot = officeaceCapabilitiesDir();
+  if (resolvedRoot) writeOfficeaceRootMarker(resolvedRoot);
 }
 
 async function updateOfficeAce() {
@@ -2395,8 +2426,15 @@ async function updateOfficeAce() {
   copyDir(safetyDir, join(pluginDest, 'safety'));
   console.log(`  Safety Policy updated -> ${join(pluginDest, 'safety')}`);
   installRuntimeDeps(pluginDest);
-  ensureOfficeaceMcpInSqlite();
+  if (ensureOfficeaceMcpInSqlite() === 'owner-missing') {
+    console.log(
+      `  \x1b[31m[WARN]\x1b[0m OfficeAce MCP connector registration failed (owner_user_id unavailable). ` +
+        `The connector may stay disconnected until you add/enable any connector once in OfficeAce and re-run update.`,
+    );
+  }
   registerOfficeaceSkillEntries();
+  const resolvedRoot = officeaceCapabilitiesDir();
+  if (resolvedRoot) writeOfficeaceRootMarker(resolvedRoot);
   mkdirSync(pluginDest, { recursive: true });
   writeFileSync(join(pluginDest, '.installed'), new Date().toISOString());
 }

package/plugins/huaweicloud-core/src/tools.mjs

@@ -63,6 +63,7 @@ import {
   upgradePackage,
 } from './update-check.mjs';
 import { hcloudProbeNextStep, probeHcloud } from './hcloud-probe.mjs';
+import { isUsableOfficeaceRoot, readOfficeaceRootMarker } from './officeace-paths.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const SKILLS_ROOT_DEV = join(__dirname, '..', 'skills');
@@ -104,7 +105,14 @@ function readOfficeaceRegistryInstallDir() {
 
 function officeaceSkillsRoot() {
   const configRoot = process.env.OFFICE_CLAW_CONFIG_ROOT;
-  if (configRoot && existsSync(join(configRoot, 'capabilities.json'))) return join(configRoot, 'skills');
+  // Same lenient probe as the installer (isUsableOfficeaceRoot) so env pointing
+  // at "skills present but capabilities.json absent" resolves identically at
+  // install and at runtime (#559 review).
+  if (configRoot && isUsableOfficeaceRoot(configRoot)) return join(configRoot, 'skills');
+  // Same persisted root used by the installer keeps install-time and
+  // runtime skill discovery consistent (#559).
+  const markerRoot = readOfficeaceRootMarker();
+  if (markerRoot) return join(markerRoot, 'skills');
   const regDir = readOfficeaceRegistryInstallDir();
   if (regDir) {
     const dir = join(regDir, '.office-claw', 'skills');
@@ -2015,8 +2023,15 @@ function explainError({ service = 'unknown', errorCode = '', message = '', reque
   }
   if (!suggestions.length) {
     suggestions.push(
-      'Collect service name, operation, region, project_id, request_id, and the full redacted error message.',
+      'No known error-code pattern matched. Re-run the failing command with --debug to capture ' +
+        'X-Request-Id from the response headers, then re-call explain_error with service, operation, ' +
+        'region, the full redacted message, and requestId.',
     );
+    if (errorCode) {
+      suggestions.push(
+        `Search the error code "${errorCode}" in the Huawei Cloud error center (support.huaweicloud.com) for the authoritative cause.`,
+      );
+    }
   }
 
   if (requestId) {

package/plugins/huaweicloud-core/src/update-check.mjs

@@ -135,6 +135,19 @@ function selfDir() {
   return dirname(fileURLToPath(import.meta.url));
 }
 
+// Plugin manifests also carry the version and are kept in sync with package.json
+// by `npm run validate`. Codex marketplace installs (`.codex/plugins/cache/...`)
+// contain only the plugin directory — no package.json — so fall back to these
+// manifests when neither candidate package.json exists (#576).
+const VERSION_MANIFEST_RELS = [
+  '.codex-plugin/plugin.json',
+  '.claude-plugin/plugin.json',
+  '.cursor-plugin/plugin.json',
+  '.workbuddy-plugin/plugin.json',
+  '.hermes-plugin/plugin.json',
+  'openclaw.plugin.json',
+];
+
 export function readInstalledVersion() {
   const pluginRoot = resolve(selfDir(), '..');
   const packageRoot = resolve(pluginRoot, '..', '..');
@@ -144,6 +157,12 @@ export function readInstalledVersion() {
       if (typeof version === 'string' && version) return version;
     } catch {}
   }
+  for (const rel of VERSION_MANIFEST_RELS) {
+    try {
+      const version = JSON.parse(readFileSync(join(pluginRoot, rel), 'utf8')).version;
+      if (typeof version === 'string' && version) return version;
+    } catch {}
+  }
   return null;
 }