huaweicloud-devkit 1.1.7-next.2 → 1.1.8-next.0

package/README.md

@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
-[![Beta](https://img.shields.io/badge/beta-v1.1.7-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.8-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 
 **[中文](README.zh-CN.md) | English**
 
@@ -332,6 +332,18 @@ npx --yes huaweicloud-devkit@latest update --target all
 config. Always keep `@latest` so npm fetches the newest version instead of a
 locally cached older one.
 
+### Configure Proxy
+
+```bash
+npx --yes huaweicloud-devkit proxy init    # configure proxy (interactive)
+npx --yes huaweicloud-devkit proxy show    # show effective proxy settings
+npx --yes huaweicloud-devkit proxy clear   # remove proxy configuration
+```
+
+Configures HTTP/HTTPS proxy for connections to Huawei Cloud services (e.g. enterprise intranet environments). Settings are saved to `~/.config/huaweicloud/proxy.json`.
+
+Environment variables `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` take precedence over the file configuration — use `proxy show` to inspect the effective settings.
+
 ## What It Does
 
 - **Guided cloud operations** — agents get step-by-step guidance for 20+ commonly used Huawei Cloud services (ECS, OBS, VPC, RDS, GaussDB, FunctionGraph, APIG, CCE, and more)

package/README.zh-CN.md

@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
-[![Beta](https://img.shields.io/badge/beta-v1.1.7-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.8-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 
 **中文 | [English](README.md)**
 
@@ -326,6 +326,18 @@ npx --yes huaweicloud-devkit@latest update --target all
 
 `update` 是增量更新——只刷新已安装的文件，不动配置文件。请务必保留 `@latest`，确保 npm 获取最新版本而非本地缓存的旧版本。
 
+### 配置代理
+
+```bash
+npx --yes huaweicloud-devkit proxy init    # 配置代理（交互式）
+npx --yes huaweicloud-devkit proxy show    # 查看生效的代理设置
+npx --yes huaweicloud-devkit proxy clear   # 删除代理配置
+```
+
+为连接华为云服务配置 HTTP/HTTPS 代理（如企业内网环境）。配置保存在 `~/.config/huaweicloud/proxy.json`。
+
+环境变量 `HTTPS_PROXY`、`HTTP_PROXY`、`NO_PROXY` 优先级高于文件配置——可使用 `proxy show` 查看最终生效的设置。
+
 ## 功能特性
 
 - **引导式云操作** — Agent 获得 20+ 常用华为云服务的分步操作指引（ECS、OBS、VPC、RDS、GaussDB、FunctionGraph、APIG、CCE 等）

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.7-next.2",
+  "version": "1.1.8-next.0",
   "kooCliVersion": "7.2.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
@@ -9,6 +9,7 @@
     "cordis.patch.yml",
     "bin",
     ".agents",
+    "rules",
     "plugins/huaweicloud-core",
     "integrations/hermes",
     "integrations/opencode",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.7-next.2",
+  "version": "1.1.8-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.7-next.2",
+  "version": "1.1.8-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.7-next.2",
+  "version": "1.1.8-next.0",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.7-next.2",
+  "version": "1.1.8-next.0",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.7-next.2",
+  "version": "1.1.8-next.0",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/hooks/huaweicloud-safety.py

@@ -51,7 +51,23 @@ def load_policy():
 load_policy()
 
 ENV_DUMP_RE = re.compile(
-    r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I,
+    r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|HW_|OS_)", re.I,
+)
+# Credential variable references bypass the env-command gate above: HW_ is
+# the plugin's own documented credential prefix (HW_ACCESS_KEY/HW_SECRET_KEY/
+# HW_SECURITY_TOKEN), cloud environments also expose the AWS-style
+# HUAWEICLOUD_SECRET_ACCESS_KEY name, and `echo $HW_SECRET_KEY` /
+# `printenv HW_ACCESS_KEY` / `echo $HUAWEICLOUD_SECRET_ACCESS_KEY` previously
+# fell through to allow (#561 D4-2, #770 D4-2).
+#
+# The negative lookbehind exempts literal-NAME references — backslash-escaped
+# (\$HW_*) or single-quoted ('$HW_*', which the shell never expands) —
+# while unescaped `$HW_*` is a potential expansion/dump regardless of the
+# command. Aligned with safety-policy.mjs L419-423.
+CRED_VAR_REF_RE = re.compile(
+    r"(?<!['\\])\$\{?(?:HUAWEICLOUD|HWC|HW|OS)_(?:SECRET_ACCESS_KEY|ACCESS_KEY|SECRET_KEY|SECURITY_TOKEN)"
+    r"|(?:^|\s)printenv\s+(?:HUAWEICLOUD|HWC|HW|OS)_(?:SECRET_ACCESS_KEY|ACCESS_KEY|SECRET_KEY|SECURITY_TOKEN)",
+    re.I,
 )
 HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
 READ_OPERATION_RE = re.compile(r"\b(List|Show|Get|Describe|NovaList|NovaShow)\w*", re.I)
@@ -177,6 +193,8 @@ def evaluate(tool_name, tool_input):
         return "reading Huawei Cloud credential/profile files can expose AK/SK or tokens. Use redacted toolkit tools."
     if ENV_DUMP_RE.search(text):
         return "dumping cloud credential environment variables is not allowed."
+    if CRED_VAR_REF_RE.search(text):
+        return "printing cloud credential environment variables is not allowed."
     if SECRET_READ_RE and SECRET_READ_RE.search(text):
         return "direct secret value retrieval would put plaintext secrets into the agent context."
     denied_rule = first_denied_command_rule(text)

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.7-next.2",
+  "version": "1.1.8-next.0",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/safety/policy.json

@@ -23,7 +23,7 @@
     "huaweicloud[/\\\\](config|credentials)"
   ],
   "blockedConfigureSubcommands": ["show", "get", "list", "export", "init"],
-  "blockedSecretOperations": ["ShowSecretVersion", "DownloadSecret", "GetSecretValue"],
+  "blockedSecretOperations": ["ShowSecret", "ShowSecretVersion", "DownloadSecret", "GetSecretValue"],
   "writeOperationPrefixes": [
     "Create",
     "BatchCreate",

package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json

@@ -36,7 +36,7 @@
           },
           {
             "field": "text",
-            "regex": "(HUAWEICLOUD|HWC_|HCLOUD|OS_)"
+            "regex": "(HUAWEICLOUD|HWC_|HCLOUD|HW_|OS_)"
           }
         ]
       },
@@ -53,7 +53,7 @@
         "any": [
           {
             "field": "text",
-            "regex": "(ShowSecretVersion|DownloadSecret|GetSecretValue)"
+            "regex": "(ShowSecretVersion|ShowSecret|DownloadSecret|GetSecretValue)"
           },
           {
             "field": "text",
@@ -64,6 +64,23 @@
       "message": "The command appears to retrieve plaintext secret values.",
       "remediation": "Use runtime secret references, user-side inspection, or redacted metadata checks instead of returning secret values to the agent."
     },
+    {
+      "id": "hwc-command-adminpass-exposure",
+      "title": "Plaintext adminPass exposure",
+      "category": "secret",
+      "severity": "warn",
+      "stages": ["artifact", "deploy_plan"],
+      "match": {
+        "any": [
+          {
+            "field": "text",
+            "regex": "(adminPass|admin_pass|admin-password)"
+          }
+        ]
+      },
+      "message": "The artifact or plan contains a plaintext adminPass parameter. The password may be exposed in version control, logs, or agent context.",
+      "remediation": "Use userData cloud-init, KMS/CSMS secret references, or encrypted password injection instead of embedding adminPass as plaintext in deployment files."
+    },
     {
       "id": "hwc-command-sts-credential",
       "title": "Temporary credential exposure",
@@ -200,6 +217,23 @@
       "message": "The change appears to grant broad administrator permissions.",
       "remediation": "Use least-privilege service actions, resource constraints, and short-lived credentials for generated application workflows."
     },
+    {
+      "id": "hwc-iam-highrisk-write",
+      "title": "High-risk IAM write operation",
+      "category": "iam",
+      "severity": "warn",
+      "stages": ["command"],
+      "match": {
+        "any": [
+          {
+            "field": "text",
+            "regex": "hcloud\\s+IAM\\s+(CreateUser|CreatePolicy|CreateRole|CreateAgency)\\b"
+          }
+        ]
+      },
+      "message": "This hcloud command creates or modifies IAM principals (users, policies, roles, or agencies). These operations can grant elevated privileges.",
+      "remediation": "Confirm the principal name, scope, and attached permissions with the user before creating IAM users, policies, roles, or agencies."
+    },
     {
       "id": "hwc-destructive-delete-force",
       "title": "Forced destructive operation",
@@ -334,6 +368,27 @@
       "message": "The generated plan may create high-cost or unbounded capacity.",
       "remediation": "Use small preview defaults, explicit quotas, budget labels, and user approval before creating high-cost resources."
     },
+    {
+      "id": "hwc-command-secret-in-arg",
+      "title": "Plaintext secret in command argument",
+      "category": "secret",
+      "severity": "warn",
+      "stages": ["command"],
+      "match": {
+        "all": [
+          {
+            "field": "text",
+            "regex": "\\bhcloud\\b"
+          },
+          {
+            "field": "text",
+            "regex": "(--adminPass|--password|--secret|--token)\\s*[=:]\\s*[^\\s<]"
+          }
+        ]
+      },
+      "message": "The command passes a plaintext password or secret as a direct CLI argument, which may leak into shell history, logs, or process listings.",
+      "remediation": "Use environment variables, DEW secret references, or interactive prompts instead of passing secrets as command-line arguments."
+    },
     {
       "id": "hwc-sandbox-destructive-command",
       "title": "Destructive command in sandbox terminal",

package/plugins/huaweicloud-core/skills/huawei-billing/SKILL.md

@@ -16,25 +16,28 @@ Domain expertise for billing queries (BSS). Covers cost tracking, bill details,
 
 ## Critical Warnings
 
-| Trap                                      | Why                                                                                                                                                                                                                                                                                                                                                           |
-| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Bills delayed ~24h                        | Yesterday's costs may not appear until the next day                                                                                                                                                                                                                                                                                                           |
-| BSS Admin role needed                     | IAM user must have BSS Administrator or Finance role                                                                                                                                                                                                                                                                                                          |
-| Currency conversion varies                | Cross-region costs use daily exchange rates                                                                                                                                                                                                                                                                                                                   |
-| Region fixed to cn-north-1                | BSS operations only support `--cli-region=cn-north-1` in KooCLI. This is a KooCLI metadata limitation — the billing data itself covers all regions.                                                                                                                                                                                                           |
-| English catalog missing BSS               | `Unsupported service: BSS` under the default `en` language is a KooCLI catalog gap, not a missing service. devkit detects it and advises the supported fix `hcloud configure set --cli-lang=cn` (switch is global-only; KooCLI has no per-command `--cli-lang` flag). Running with Chinese mode from the start (see Prerequisites) avoids the issue entirely. |
-| `缺少必填参数 cli-domain-id` / APIGW.0301 | Invalid credentials — KooCLI can't resolve the account-id                                                                                                                                                                                                                                                                                                     | Re-run `npx huaweicloud-devkit auth init` |
+| Trap                                  | Why                                                                                                                                                                                                                                                                                                                                                           |
+| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Bills delayed ~24h                    | Yesterday's costs may not appear until the next day                                                                                                                                                                                                                                                                                                           |
+| BSS Admin role needed                 | IAM user must have BSS Administrator or Finance role                                                                                                                                                                                                                                                                                                          |
+| Currency conversion varies            | Cross-region costs use daily exchange rates                                                                                                                                                                                                                                                                                                                   |
+| Region fixed to cn-north-1            | BSS operations only support `--cli-region=cn-north-1` in KooCLI. This is a KooCLI metadata limitation — the billing data itself covers all regions.                                                                                                                                                                                                           |
+| English catalog missing BSS           | `Unsupported service: BSS` under the default `en` language is a KooCLI catalog gap, not a missing service. devkit detects it and advises the supported fix `hcloud configure set --cli-lang=cn` (switch is global-only; KooCLI has no per-command `--cli-lang` flag). Running with Chinese mode from the start (see Prerequisites) avoids the issue entirely. |
+| Partner vs Customer-level APIs        | BSS splits operations by caller identity. Customer-level APIs (`ShowCustomerAccountBalances`, `ListCustomerBillsFeeRecords`, `ListCustomerCouponChangeRecords`) work with a normal IAM user. Partner-level APIs (`ListQuotaCoupons`, `ListSubCustomerCoupons`) require a partner/dealer identity.                                                             |
+| APIGW.0301 is identity, not domain-id | `APIGW.0301: invalid x-security-token` on a BSS Partner-level API means the caller identity is not a partner — a customer credential is rejected. This is NOT a missing `cli-domain-id` and NOT invalid AK/SK. Switch to the Customer-level API below that matches the current identity.                                                                      |
 
 ## Common Workflows
 
-| Task                 | Operation                                                              |
-| -------------------- | ---------------------------------------------------------------------- |
-| List costs           | `ListCosts --cli-region=cn-north-1 --project_id=<p>`                   |
-| List customer bills  | `ListCustomerBillsFeeRecords --cli-region=cn-north-1 --project_id=<p>` |
-| List resource usage  | `ListResourceUsage --cli-region=cn-north-1 --project_id=<p>`           |
-| List sub-customers   | `ListConsumeSubCustomers --cli-region=cn-north-1 --project_id=<p>`     |
-| Show account balance | `ShowCustomerAccountBalances --cli-region=cn-north-1`                  |
-| List conversions     | `ListConversions --cli-region=cn-north-1 --project_id=<p>`             |
+| Task                       | Identity | Operation                                                              |
+| -------------------------- | -------- | ---------------------------------------------------------------------- |
+| List costs                 | Customer | `ListCosts --cli-region=cn-north-1 --project_id=<p>`                   |
+| List customer bills        | Customer | `ListCustomerBillsFeeRecords --cli-region=cn-north-1 --project_id=<p>` |
+| Show account balance       | Customer | `ShowCustomerAccountBalances --cli-region=cn-north-1`                  |
+| List coupon change records | Customer | `ListCustomerCouponChangeRecords --cli-region=cn-north-1`              |
+| List resource usage        | Customer | `ListResourceUsage --cli-region=cn-north-1 --project_id=<p>`           |
+| List conversions           | Customer | `ListConversions --cli-region=cn-north-1 --project_id=<p>`             |
+| List sub-customers         | Partner  | `ListConsumeSubCustomers --cli-region=cn-north-1 --project_id=<p>`     |
+| List quota coupons         | Partner  | `ListQuotaCoupons --cli-region=cn-north-1` (APIGW.0301 for customers)  |
 
 Discover exact parameters with `--help` before executing any command. All BSS operations are read-only.
 

package/plugins/huaweicloud-core/skills/huawei-modelarts/SKILL.md

@@ -69,5 +69,5 @@ Discover operation parameters with `--help` before executing any write operation
 For advanced workflows (notebook lifecycle, training job diagnosis,
 hyperparameter tuning), search the marketplace:
 `huaweicloud_search_marketplace` query="ModelArts notebook/training/diagnosis"
-→ install via `npx skills add huaweicloud/huaweicloud-skills --skill <name> -y -g`
+→ install via the marketplace tool's `installCommand` (HTTP ZIP download, no git required) and its `installHint` on failure.
 → load and execute.

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -852,6 +852,10 @@ If the status code is not 2xx/3xx:
 
 ### Step 7: Expose via DevBridge [REQUIRED — deployment incomplete without this]
 
+**Preferred: call `huaweicloud_sandbox_expose_tunnel` with the ACTUAL port returned by `deploy_nginx` (`{"port": <port>}`)** — it authenticates automatically (probing AK/SK vs API-Key builds), pre-cleans stale tunnels, starts the host, extracts the public URL, and health-checks it before returning. If it reports `ok: false` with an API-Key hint, create the key and re-run `sandbox_credentials`, then call it again. The tool's returned `publicUrl` is the deployment result.
+
+**Manual fallback** (only when the tool is unavailable or must be debugged by hand): follow [Expose the deployed app](#expose-the-deployed-app-public-url) below.
+
 When `deploy_check` returns `nextStep: expose_via_devbridge`, it also returns an executable `remediation` string — run those devbridge commands in the sandbox (after `source /tmp/hw_creds.sh`). Until a tunnel exists, `deploy_check` returns no `publicUrl`; do not fabricate a URL.
 
 Follow the standard [Expose the deployed app](#expose-the-deployed-app-public-url) procedure. The app is already running on the detected port — only DevBridge tunnel setup is needed.
@@ -860,6 +864,8 @@ Use `exec_with_session` to background DevBridge. For SSR, DevBridge tunnels the
 
 **Pre-flight**: always run `devbridge delete-all` before creating a new tunnel to prevent `10006: quota exceeded` from accumulated stale tunnels. If you still get quota error, list tunnels with `devbridge list` (0.2.x plain table; 0.1.x legacy `-j` JSON), delete stale ones, and retry.
 
+> **Concurrency warning**: `devbridge delete-all` and `pkill -f "devbridge host"` are GLOBAL operations scoped to the whole sandbox — if multiple sessions share the same sandbox, pre-cleaning can kill tunnels published by other sessions and invalidate URLs you handed out earlier. For shared sandboxes, prefer `devbridge list` and delete only stale/your-own tunnels instead of blanket `delete-all`, and re-expose only after confirming the target port is still served.
+
 Extract the tunnel URL from DevBridge output. The public URL has the form `https://<id>-<port>.devbridge-s2.hwtunnel.com`. **Return this URL to the developer as the deployment result.**
 
 #### Cross-platform H5 QR code

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md

@@ -21,7 +21,7 @@ Use this skill to turn vague developer intent into a precise Huawei Cloud capabi
 8. Treat Terraform as a secondary V1 path for reviewed IaC, not the default.
 9. When no built-in devkit skill matches:
    a. Search: use `huaweicloud_search_marketplace` to find a matching skill in the community marketplace
-   b. Install: run `npx skills add huaweicloud/huaweicloud-skills --skill <skill-name> -y -g`
+   b. Install: use the `installCommand` returned by the marketplace tool — it downloads the skill repo ZIP over HTTP and copies the skill folder into the agent skills directory. **No git is required** (`npx skills add` needs git on PATH, which is often absent on Windows Server/sandbox environments). Replace the `<your-agent-skills-dir>` placeholder with this agent's skills directory (Claude Code `~/.claude/skills`, OpenCode `~/.config/opencode/skills`, Cursor `~/.cursor/skills`) before running. If the command reports `SKILL_SRC_NOT_FOUND` (mis-pathed skill location) or the HTTP download itself fails, follow the returned `installHint`: download `https://github.com/huaweicloud/huaweicloud-skills/archive/refs/heads/master.zip` manually, extract it, copy the skill folder, and confirm to the user how it was installed. Never auto-install git just to fetch a skill.
    c. Execute: load the installed skill and follow its procedure
 10. When the deliverable is a PPT, architecture diagram (draw.io), or frontend page that needs official Huawei Cloud service logos, use the `huaweicloud_get_service_icon` MCP tool to get logo URLs from the official Icons library instead of guessing or hotlinking unofficial images.
 

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -84,7 +84,13 @@ Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `
 2. **KooCLI first-run privacy agreement**: On a fresh KooCLI install, `hcloud` blocks with `同意并继续使用(y)/不同意并退出(N)` and fails with `[USE_ERROR]您输入的是无效字符` in non-interactive mode. Detection: check command output for these strings. Ask the user: "KooCLI needs to accept its privacy agreement. May I accept it on your behalf?" If the user agrees, run `huaweicloud_run_readonly_command` with `args=["version"]` and `stdin="y\n"`. This accepts the agreement once, after which hcloud works normally.
 3. Ask the user to configure credentials outside the agent conversation when setup is needed.
 4. Inspect profile and region only through redacted tooling.
-5. Discover exact operation names with `hcloud <Service> --help` before guessing. Example: ECS instance listing is commonly `ECS ListServersDetails`; ECS creation is commonly `ECS CreateServers`; image lookup may be under `IMS GlanceShowImage`.
+5. **Always discover exact operation names and parameters with `--help` BEFORE constructing the command.** Never guess from general knowledge — parameter names change across API versions. The discovery chain is:
+   1. `hcloud --help` → available services
+   2. `hcloud <Service> --help` → operations (use `huaweicloud_list_operations` or step 2/3 directly)
+   3. `hcloud <Service> <Operation> --help` → exact parameter names, required flags, and value formats
+   4. Execute only after the help text confirms the operation and its parameters
+   - Service skills may skip steps 1-2 when they already provide the correct service and operation names, but step 3 (`<Operation> --help`) is never skippable before planning a write operation or a command with parameters.
+   - Example: ECS instance listing is commonly `ECS ListServersDetails`; ECS creation is commonly `ECS CreateServers`; image lookup may be under `IMS GlanceShowImage`.
 6. Use `--cli-output=json` for machine-readable responses when supported.
 7. For resource operations, include `--cli-region`, `--cli-profile`, and service-specific project information when required.
 8. Classify every command before running it:

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -8,8 +8,10 @@ import {
   globalCredentialsPath,
   isPlaceholder,
   obsConfigPath,
+  parseStsExpiry,
   readCodeArtsCredentials,
   readGlobalCredentials,
+  resolveCredentialsWithRuntime,
   writeLastSync,
   writeObsConfig,
 } from './credentials.mjs';
@@ -162,18 +164,52 @@ export function computeOnboarding({ credentials, reconciled } = {}) {
   return { needsSetup: true, scenario, reason, message, steps, accountHint };
 }
 
+// Compute temporary-STS expiry info for auth_status. Permanent AK/SK creds carry
+// no security token and therefore have no expiry — we return null so callers only
+// see expiry for the platform-injected temporary STS case.
+function computeStsExpiry() {
+  let creds;
+  try {
+    creds = resolveCredentialsWithRuntime({ allowMissing: true });
+  } catch {
+    creds = null;
+  }
+  if (!creds?.ak || !creds?.sk || !creds.securityToken) return null;
+  const expiresAt = parseStsExpiry({ securityToken: creds.securityToken });
+  if (expiresAt === null) return { status: 'unknown', expiresAt: null };
+  const remainingMs = expiresAt - Date.now();
+  const expiresAtUtc = new Date(expiresAt).toISOString();
+  const expiresAtLocal = new Date(expiresAt).toString();
+  let status = 'valid';
+  if (remainingMs <= 0) status = 'expired';
+  else if (remainingMs <= 5 * 60 * 1000) status = 'expiring_soon';
+  return { expiresAt, expiresAtUtc, expiresAtLocal, remainingMs, status };
+}
+
 export function getAuthStatus(target = 'all') {
   const credentials = readGlobalCredentials();
   const reconciled = { ...exportStateForStatus(), runtimeActive: hasRuntimeCredentials() };
   const hcloud = probeHcloud();
   const s4Creds = readCodeArtsCredentials();
   const onboarding = computeOnboarding({ credentials, reconciled });
+  const stsExpiry = computeStsExpiry();
+  const credentialPanel = {
+    sts: stsExpiry, // 临时 STS（MCP==沙箱同源）
+    s1: {
+      configured: Boolean(credentials?.ak && credentials?.sk),
+      fingerprint: credentials?.ak ? fingerprint(credentials.ak, credentials.sk) : null,
+      persistent: true, // 永久，无过期
+    },
+    activeSource: stsExpiry ? 'temporary-sts' : credentials?.ak ? 's1-persistent' : 'none',
+  };
   return {
     target,
     credentialsConfigured: Boolean(credentials?.ak && credentials?.sk),
     credentialsPath: globalCredentialsPath(),
     mcpSettingsConfigured: Boolean(s4Creds?.ak && s4Creds?.sk),
     mcpSettingsSource: s4Creds ? 'codearts' : null,
+    stsExpiry,
+    credentialPanel,
     obsConfigured: existsSync(obsConfigPath()),
     obsConfigPath: obsConfigPath(),
     kooCliInstalled: hcloud.installed,

package/plugins/huaweicloud-core/src/detect-framework.mjs

@@ -282,7 +282,8 @@ export function detectFramework(projectPath) {
   if (
     existsSync(join(projectPath, 'next.config.js')) ||
     existsSync(join(projectPath, 'next.config.mjs')) ||
-    existsSync(join(projectPath, 'next.config.ts'))
+    existsSync(join(projectPath, 'next.config.ts')) ||
+    existsSync(join(projectPath, 'next.config.cjs'))
   ) {
     return frameworkResult(FRAMEWORKS.nextjs, pm, projectPath);
   }
@@ -290,7 +291,9 @@ export function detectFramework(projectPath) {
   if (
     existsSync(join(projectPath, 'nuxt.config.js')) ||
     existsSync(join(projectPath, 'nuxt.config.mjs')) ||
-    existsSync(join(projectPath, 'nuxt.config.ts'))
+    existsSync(join(projectPath, 'nuxt.config.ts')) ||
+    existsSync(join(projectPath, 'nuxt.config.cjs')) ||
+    existsSync(join(projectPath, 'nuxt.config.mts'))
   ) {
     return frameworkResult(FRAMEWORKS.nuxt, pm, projectPath);
   }
@@ -315,7 +318,8 @@ export function detectFramework(projectPath) {
   if (
     existsSync(join(projectPath, 'docusaurus.config.js')) ||
     existsSync(join(projectPath, 'docusaurus.config.ts')) ||
-    existsSync(join(projectPath, 'docusaurus.config.mjs'))
+    existsSync(join(projectPath, 'docusaurus.config.mjs')) ||
+    existsSync(join(projectPath, 'docusaurus.config.cjs'))
   ) {
     return frameworkResult(FRAMEWORKS.docusaurus, pm, projectPath);
   }
@@ -336,7 +340,9 @@ export function detectFramework(projectPath) {
   if (
     existsSync(join(projectPath, 'vite.config.js')) ||
     existsSync(join(projectPath, 'vite.config.mjs')) ||
-    existsSync(join(projectPath, 'vite.config.ts'))
+    existsSync(join(projectPath, 'vite.config.ts')) ||
+    existsSync(join(projectPath, 'vite.config.cjs')) ||
+    existsSync(join(projectPath, 'vite.config.mts'))
   ) {
     return frameworkResult(FRAMEWORKS.vite, pm, projectPath);
   }
@@ -358,9 +364,39 @@ export function detectFramework(projectPath) {
     }
   }
 
-  if (existsSync(join(projectPath, 'index.html'))) {
+  if (
+    existsSync(join(projectPath, 'index.html')) ||
+    existsSync(join(projectPath, 'public', 'index.html')) ||
+    existsSync(join(projectPath, 'src', 'index.html'))
+  ) {
     return frameworkResult(FRAMEWORKS.static, pm, projectPath);
   }
 
+  if (pkg) {
+    const entryPoints = [
+      'src/main.js',
+      'src/main.ts',
+      'src/main.jsx',
+      'src/main.tsx',
+      'src/App.vue',
+      'src/app.vue',
+      'src/main.vue',
+      'src/index.js',
+      'src/index.ts',
+    ];
+    const hasEntry = entryPoints.some((p) => existsSync(join(projectPath, p)));
+    if (hasEntry) {
+      if ('vue' in deps || '@vue/cli-service' in deps) {
+        return frameworkResult(FRAMEWORKS.vueCli, pm, projectPath);
+      }
+      if ('react-scripts' in deps) {
+        return frameworkResult(FRAMEWORKS.cra, pm, projectPath);
+      }
+      if ('svelte' in deps || 'solid-js' in deps) {
+        return frameworkResult(FRAMEWORKS.vite, pm, projectPath);
+      }
+    }
+  }
+
   return null;
 }

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -6,7 +6,7 @@ import { dirname, join } from 'node:path';
 
 import { classifyHcloudArgs, redactSecrets, assertAllowed } from './safety-policy.mjs';
 import { getProxySettings } from './proxy/proxy-config.mjs';
-import { findHcloudBin, resolveHcloudCommand } from './hcloud-probe.mjs';
+import { resolveHcloudCommand } from './hcloud-probe.mjs';
 import { parseStsExpiry, resolveCredentialsWithRuntime } from './auth/credentials.mjs';
 
 const DEFAULT_TIMEOUT_MS = 60_000;
@@ -391,6 +391,24 @@ function appendLangHint(result, service, metaDir) {
   };
 }
 
+// Returns true when the current credentials are a TEMPORARY STS set that has
+// already expired (per HW_STS_EXPIRES_AT / token expiry). Lets us fail fast with
+// a clear CREDENTIAL_EXPIRED instead of letting a doomed IAM call return a
+// misleading error. Permanent AK/SK (no token) and unparseable expiry are never
+// treated as expired.
+function isTemporaryStsExpired() {
+  let creds;
+  try {
+    creds = resolveCredentialsWithRuntime({ allowMissing: true });
+  } catch {
+    return false;
+  }
+  if (!creds?.securityToken) return false;
+  const expiry = parseStsExpiry({ securityToken: creds.securityToken });
+  if (expiry === null) return false; // unknown → don't block
+  return expiry <= Date.now();
+}
+
 export async function runHcloud(args, options = {}) {
   const normalizedArgs = Array.isArray(args) ? args.map(String) : [];
   const plan = {
@@ -399,6 +417,21 @@ export async function runHcloud(args, options = {}) {
   };
   assertAllowed(plan.classification);
 
+  // A: fail fast when the platform-injected temporary STS is already expired —
+  // otherwise hcloud would make a doomed IAM round trip and surface a misleading
+  // error (e.g. "缺少 cli-domain-id"). Permanent AK/SK are unaffected.
+  if (isTemporaryStsExpired()) {
+    return {
+      ok: false,
+      code: 'CREDENTIAL_EXPIRED',
+      error:
+        'Temporary STS credentials have expired. Re-login or start a new session so the platform injects fresh credentials, then retry.',
+      stderr: '',
+      stdout: '',
+      plan,
+    };
+  }
+
   // Link B: when the runtime/environment carries live temporary STS credentials
   // (security token set), KooCLI/obsutil would not see them (they read S2/S3 only
   // and R3 forbids writing them to disk). Inject per-command so hcloud actually
@@ -430,6 +463,8 @@ async function runHcloudOnceWithRetries(plan, options) {
     if (result.ok || attempt >= maxRetries || !isRetryableNetworkError(result)) {
       const merged = {
         ...result,
+        ok: result.ok ?? false,
+        exitCode: result.exitCode ?? null,
         retries: attempt,
         attempts: attempt + 1,
       };
@@ -460,15 +495,15 @@ async function runtimeCurrentMismatchWarning() {
   }
 }
 
-function discoverHcloudPath() {
-  return findHcloudBin();
-}
-
 function runHcloudOnce(plan, options) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const forceKillAfterMs = options.forceKillAfterMs ?? DEFAULT_FORCE_KILL_AFTER_MS;
-  const executable = options.executable || options.env?.HCLOUD_BIN || discoverHcloudPath() || 'hcloud';
-  const executableArgs = Array.isArray(options.executableArgs) ? options.executableArgs.map(String) : [];
+  const { executable: resolvedExec, argsPrefix } = resolveHcloudCommand({
+    executable: options.executable || options.env?.HCLOUD_BIN,
+    executableArgs: options.executableArgs,
+  });
+  const executable = resolvedExec || 'hcloud';
+  const executableArgs = argsPrefix;
   const cwd = options.cwd || undefined;
   const stdin = options.stdin ?? 'y\n';
   const childOptions = { ...options };
@@ -540,6 +575,8 @@ function runHcloudOnce(plan, options) {
           ok: false,
           code: 'TIMEOUT',
           error: `hcloud command timed out after ${timeoutMs} ms.`,
+          exitCode: null,
+          signal: null,
           stdout: redactOutput(stdout),
           stderr: redactOutput(stderr),
           plan,
@@ -558,6 +595,8 @@ function runHcloudOnce(plan, options) {
         ok: false,
         code: 'SPAWN_ERROR',
         error: error.message,
+        exitCode: null,
+        signal: null,
         plan,
       });
     });