huaweicloud-devkit 1.1.7 → 1.1.8-next.1

package/README.md

@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
-[![Beta](https://img.shields.io/badge/beta-v1.1.7-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.8-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 
 **[中文](README.zh-CN.md) | English**
 

package/README.zh-CN.md

@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
-[![Beta](https://img.shields.io/badge/beta-v1.1.7-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.8-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 
 **中文 | [English](README.md)**
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.7",
+  "version": "1.1.8-next.1",
   "kooCliVersion": "7.2.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
@@ -9,6 +9,7 @@
     "cordis.patch.yml",
     "bin",
     ".agents",
+    "rules",
     "plugins/huaweicloud-core",
     "integrations/hermes",
     "integrations/opencode",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.7",
+  "version": "1.1.8-next.1",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.7",
+  "version": "1.1.8-next.1",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.7",
+  "version": "1.1.8-next.1",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.7",
+  "version": "1.1.8-next.1",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.7",
+  "version": "1.1.8-next.1",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/hooks/huaweicloud-safety.py

@@ -51,7 +51,23 @@ def load_policy():
 load_policy()
 
 ENV_DUMP_RE = re.compile(
-    r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|OS_)", re.I,
+    r"(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:).*(HUAWEICLOUD|HWC_|HCLOUD|HW_|OS_)", re.I,
+)
+# Credential variable references bypass the env-command gate above: HW_ is
+# the plugin's own documented credential prefix (HW_ACCESS_KEY/HW_SECRET_KEY/
+# HW_SECURITY_TOKEN), cloud environments also expose the AWS-style
+# HUAWEICLOUD_SECRET_ACCESS_KEY name, and `echo $HW_SECRET_KEY` /
+# `printenv HW_ACCESS_KEY` / `echo $HUAWEICLOUD_SECRET_ACCESS_KEY` previously
+# fell through to allow (#561 D4-2, #770 D4-2).
+#
+# The negative lookbehind exempts literal-NAME references — backslash-escaped
+# (\$HW_*) or single-quoted ('$HW_*', which the shell never expands) —
+# while unescaped `$HW_*` is a potential expansion/dump regardless of the
+# command. Aligned with safety-policy.mjs L419-423.
+CRED_VAR_REF_RE = re.compile(
+    r"(?<!['\\])\$\{?(?:HUAWEICLOUD|HWC|HW|OS)_(?:SECRET_ACCESS_KEY|ACCESS_KEY|SECRET_KEY|SECURITY_TOKEN)"
+    r"|(?:^|\s)printenv\s+(?:HUAWEICLOUD|HWC|HW|OS)_(?:SECRET_ACCESS_KEY|ACCESS_KEY|SECRET_KEY|SECURITY_TOKEN)",
+    re.I,
 )
 HCLOUD_RE = re.compile(r"(^|\s)hcloud(\.exe)?\s+", re.I)
 READ_OPERATION_RE = re.compile(r"\b(List|Show|Get|Describe|NovaList|NovaShow)\w*", re.I)
@@ -177,6 +193,8 @@ def evaluate(tool_name, tool_input):
         return "reading Huawei Cloud credential/profile files can expose AK/SK or tokens. Use redacted toolkit tools."
     if ENV_DUMP_RE.search(text):
         return "dumping cloud credential environment variables is not allowed."
+    if CRED_VAR_REF_RE.search(text):
+        return "printing cloud credential environment variables is not allowed."
     if SECRET_READ_RE and SECRET_READ_RE.search(text):
         return "direct secret value retrieval would put plaintext secrets into the agent context."
     denied_rule = first_denied_command_rule(text)

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.7",
+  "version": "1.1.8-next.1",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/safety/policy.json

@@ -23,7 +23,7 @@
     "huaweicloud[/\\\\](config|credentials)"
   ],
   "blockedConfigureSubcommands": ["show", "get", "list", "export", "init"],
-  "blockedSecretOperations": ["ShowSecretVersion", "DownloadSecret", "GetSecretValue"],
+  "blockedSecretOperations": ["ShowSecret", "ShowSecretVersion", "DownloadSecret", "GetSecretValue"],
   "writeOperationPrefixes": [
     "Create",
     "BatchCreate",

package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json

@@ -36,7 +36,7 @@
           },
           {
             "field": "text",
-            "regex": "(HUAWEICLOUD|HWC_|HCLOUD|OS_)"
+            "regex": "(HUAWEICLOUD|HWC_|HCLOUD|HW_|OS_)"
           }
         ]
       },
@@ -53,7 +53,7 @@
         "any": [
           {
             "field": "text",
-            "regex": "(ShowSecretVersion|DownloadSecret|GetSecretValue)"
+            "regex": "(ShowSecretVersion|ShowSecret|DownloadSecret|GetSecretValue)"
           },
           {
             "field": "text",
@@ -64,6 +64,23 @@
       "message": "The command appears to retrieve plaintext secret values.",
       "remediation": "Use runtime secret references, user-side inspection, or redacted metadata checks instead of returning secret values to the agent."
     },
+    {
+      "id": "hwc-command-adminpass-exposure",
+      "title": "Plaintext adminPass exposure",
+      "category": "secret",
+      "severity": "warn",
+      "stages": ["artifact", "deploy_plan"],
+      "match": {
+        "any": [
+          {
+            "field": "text",
+            "regex": "(adminPass|admin_pass|admin-password)"
+          }
+        ]
+      },
+      "message": "The artifact or plan contains a plaintext adminPass parameter. The password may be exposed in version control, logs, or agent context.",
+      "remediation": "Use userData cloud-init, KMS/CSMS secret references, or encrypted password injection instead of embedding adminPass as plaintext in deployment files."
+    },
     {
       "id": "hwc-command-sts-credential",
       "title": "Temporary credential exposure",
@@ -200,6 +217,23 @@
       "message": "The change appears to grant broad administrator permissions.",
       "remediation": "Use least-privilege service actions, resource constraints, and short-lived credentials for generated application workflows."
     },
+    {
+      "id": "hwc-iam-highrisk-write",
+      "title": "High-risk IAM write operation",
+      "category": "iam",
+      "severity": "warn",
+      "stages": ["command"],
+      "match": {
+        "any": [
+          {
+            "field": "text",
+            "regex": "hcloud\\s+IAM\\s+(CreateUser|CreatePolicy|CreateRole|CreateAgency)\\b"
+          }
+        ]
+      },
+      "message": "This hcloud command creates or modifies IAM principals (users, policies, roles, or agencies). These operations can grant elevated privileges.",
+      "remediation": "Confirm the principal name, scope, and attached permissions with the user before creating IAM users, policies, roles, or agencies."
+    },
     {
       "id": "hwc-destructive-delete-force",
       "title": "Forced destructive operation",
@@ -334,6 +368,27 @@
       "message": "The generated plan may create high-cost or unbounded capacity.",
       "remediation": "Use small preview defaults, explicit quotas, budget labels, and user approval before creating high-cost resources."
     },
+    {
+      "id": "hwc-command-secret-in-arg",
+      "title": "Plaintext secret in command argument",
+      "category": "secret",
+      "severity": "warn",
+      "stages": ["command"],
+      "match": {
+        "all": [
+          {
+            "field": "text",
+            "regex": "\\bhcloud\\b"
+          },
+          {
+            "field": "text",
+            "regex": "(--adminPass|--password|--secret|--token)\\s*[=:]\\s*[^\\s<]"
+          }
+        ]
+      },
+      "message": "The command passes a plaintext password or secret as a direct CLI argument, which may leak into shell history, logs, or process listings.",
+      "remediation": "Use environment variables, DEW secret references, or interactive prompts instead of passing secrets as command-line arguments."
+    },
     {
       "id": "hwc-sandbox-destructive-command",
       "title": "Destructive command in sandbox terminal",

package/plugins/huaweicloud-core/skills/huawei-billing/SKILL.md

@@ -16,25 +16,28 @@ Domain expertise for billing queries (BSS). Covers cost tracking, bill details,
 
 ## Critical Warnings
 
-| Trap                                      | Why                                                                                                                                                                                                                                                                                                                                                           |
-| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Bills delayed ~24h                        | Yesterday's costs may not appear until the next day                                                                                                                                                                                                                                                                                                           |
-| BSS Admin role needed                     | IAM user must have BSS Administrator or Finance role                                                                                                                                                                                                                                                                                                          |
-| Currency conversion varies                | Cross-region costs use daily exchange rates                                                                                                                                                                                                                                                                                                                   |
-| Region fixed to cn-north-1                | BSS operations only support `--cli-region=cn-north-1` in KooCLI. This is a KooCLI metadata limitation — the billing data itself covers all regions.                                                                                                                                                                                                           |
-| English catalog missing BSS               | `Unsupported service: BSS` under the default `en` language is a KooCLI catalog gap, not a missing service. devkit detects it and advises the supported fix `hcloud configure set --cli-lang=cn` (switch is global-only; KooCLI has no per-command `--cli-lang` flag). Running with Chinese mode from the start (see Prerequisites) avoids the issue entirely. |
-| `缺少必填参数 cli-domain-id` / APIGW.0301 | Invalid credentials — KooCLI can't resolve the account-id                                                                                                                                                                                                                                                                                                     | Re-run `npx huaweicloud-devkit auth init` |
+| Trap                                  | Why                                                                                                                                                                                                                                                                                                                                                           |
+| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Bills delayed ~24h                    | Yesterday's costs may not appear until the next day                                                                                                                                                                                                                                                                                                           |
+| BSS Admin role needed                 | IAM user must have BSS Administrator or Finance role                                                                                                                                                                                                                                                                                                          |
+| Currency conversion varies            | Cross-region costs use daily exchange rates                                                                                                                                                                                                                                                                                                                   |
+| Region fixed to cn-north-1            | BSS operations only support `--cli-region=cn-north-1` in KooCLI. This is a KooCLI metadata limitation — the billing data itself covers all regions.                                                                                                                                                                                                           |
+| English catalog missing BSS           | `Unsupported service: BSS` under the default `en` language is a KooCLI catalog gap, not a missing service. devkit detects it and advises the supported fix `hcloud configure set --cli-lang=cn` (switch is global-only; KooCLI has no per-command `--cli-lang` flag). Running with Chinese mode from the start (see Prerequisites) avoids the issue entirely. |
+| Partner vs Customer-level APIs        | BSS splits operations by caller identity. Customer-level APIs (`ShowCustomerAccountBalances`, `ListCustomerBillsFeeRecords`, `ListCustomerCouponChangeRecords`) work with a normal IAM user. Partner-level APIs (`ListQuotaCoupons`, `ListSubCustomerCoupons`) require a partner/dealer identity.                                                             |
+| APIGW.0301 is identity, not domain-id | `APIGW.0301: invalid x-security-token` on a BSS Partner-level API means the caller identity is not a partner — a customer credential is rejected. This is NOT a missing `cli-domain-id` and NOT invalid AK/SK. Switch to the Customer-level API below that matches the current identity.                                                                      |
 
 ## Common Workflows
 
-| Task                 | Operation                                                              |
-| -------------------- | ---------------------------------------------------------------------- |
-| List costs           | `ListCosts --cli-region=cn-north-1 --project_id=<p>`                   |
-| List customer bills  | `ListCustomerBillsFeeRecords --cli-region=cn-north-1 --project_id=<p>` |
-| List resource usage  | `ListResourceUsage --cli-region=cn-north-1 --project_id=<p>`           |
-| List sub-customers   | `ListConsumeSubCustomers --cli-region=cn-north-1 --project_id=<p>`     |
-| Show account balance | `ShowCustomerAccountBalances --cli-region=cn-north-1`                  |
-| List conversions     | `ListConversions --cli-region=cn-north-1 --project_id=<p>`             |
+| Task                       | Identity | Operation                                                              |
+| -------------------------- | -------- | ---------------------------------------------------------------------- |
+| List costs                 | Customer | `ListCosts --cli-region=cn-north-1 --project_id=<p>`                   |
+| List customer bills        | Customer | `ListCustomerBillsFeeRecords --cli-region=cn-north-1 --project_id=<p>` |
+| Show account balance       | Customer | `ShowCustomerAccountBalances --cli-region=cn-north-1`                  |
+| List coupon change records | Customer | `ListCustomerCouponChangeRecords --cli-region=cn-north-1`              |
+| List resource usage        | Customer | `ListResourceUsage --cli-region=cn-north-1 --project_id=<p>`           |
+| List conversions           | Customer | `ListConversions --cli-region=cn-north-1 --project_id=<p>`             |
+| List sub-customers         | Partner  | `ListConsumeSubCustomers --cli-region=cn-north-1 --project_id=<p>`     |
+| List quota coupons         | Partner  | `ListQuotaCoupons --cli-region=cn-north-1` (APIGW.0301 for customers)  |
 
 Discover exact parameters with `--help` before executing any command. All BSS operations are read-only.
 

package/plugins/huaweicloud-core/skills/huawei-modelarts/SKILL.md

@@ -69,5 +69,5 @@ Discover operation parameters with `--help` before executing any write operation
 For advanced workflows (notebook lifecycle, training job diagnosis,
 hyperparameter tuning), search the marketplace:
 `huaweicloud_search_marketplace` query="ModelArts notebook/training/diagnosis"
-→ install via `npx skills add huaweicloud/huaweicloud-skills --skill <name> -y -g`
+→ install via the marketplace tool's `installCommand` (HTTP ZIP download, no git required) and its `installHint` on failure.
 → load and execute.

package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md

@@ -785,7 +785,7 @@ check_port <nodePort>
 | SPA/SSG/Cross-platform | nginx port (from `framework.detect`) | Kill old process, then configure nginx |
 | SSR                    | nginx public port + Node app port    | Kill old processes on both ports       |
 
-If the port cannot be freed (different user/process), increment to the next available port: `<port>+1`, update all subsequent nginx config and DevBridge references accordingly.
+If the port cannot be freed (different user/process), the `deploy_nginx` tool auto-increments to the next available port (up to 10 attempts). For SSR (proxy) mode, nginx listens on the resolved `targetPort`, and the Node app follows the returned `nodePort` field — bind the Node process to the `nodePort` that `deploy_nginx` returns, and update all subsequent nginx config and DevBridge references accordingly.
 
 #### Configure Nginx
 
@@ -806,7 +806,7 @@ Use `huaweicloud_sandbox_deploy_nginx` to write the correct template, fix direct
 - `port` — listen port from framework detection
 - `project` — project dir name under `/workspace`
 - `output_dir` — build output dir relative to `/workspace/<project>`
-- `node_port` — Node.js app port for SSR proxy. Defaults to `<port> + 1` if omitted, and the result includes `nodePort` so you know which port to bind the Node process to.
+- `node_port` — Node.js app port for SSR proxy. When omitted it defaults to the resolved nginx listen port plus one (`targetPort + 1`), and the result includes `nodePort` so you know which port to bind the Node process to. When the nginx port auto-increments, `nodePort` follows it.
 - `public_port` — public listen port for SSR proxy (optional, defaults to `port`)
 
 The tool automatically handles:
@@ -834,7 +834,7 @@ If the status code is not 2xx/3xx:
 ### Step 6: Start the App [REQUIRED]
 
 - **Static (SPA/SSG/cross-platform)**: nginx is already serving. Skip.
-- **SSR**: `PORT=<nodePort>` prefix is REQUIRED before `<serveCmd>`. nginx `proxy_pass` targets `<nodePort>`, not `<port>` — the two must differ. `deployNginx` returns `nodePort` in its result (defaults to `<port> + 1` for proxy type).
+- **SSR**: `PORT=<nodePort>` prefix is REQUIRED before `<serveCmd>`. nginx `proxy_pass` targets `<nodePort>`, not `<port>` — the two must differ. `deployNginx` returns `nodePort` in its result (defaults to the resolved `targetPort + 1` for proxy type). Always use the returned `port`/`nodePort` values — they follow any auto-increment.
 
   **Runtime environment variables**: SSR apps often need `DATABASE_URL`, `NEXTAUTH_URL`, `NEXTAUTH_SECRET`, etc. at runtime. Before starting, verify env vars from Step 4a are still loaded, and re-source `.env` if the shell session was reset:
 
@@ -852,6 +852,10 @@ If the status code is not 2xx/3xx:
 
 ### Step 7: Expose via DevBridge [REQUIRED — deployment incomplete without this]
 
+**Preferred: call `huaweicloud_sandbox_expose_tunnel` with the ACTUAL port returned by `deploy_nginx` (`{"port": <port>}`)** — it authenticates automatically (probing AK/SK vs API-Key builds), pre-cleans stale tunnels, starts the host, extracts the public URL, and health-checks it before returning. If it reports `ok: false` with an API-Key hint, create the key and re-run `sandbox_credentials`, then call it again. The tool's returned `publicUrl` is the deployment result.
+
+**Manual fallback** (only when the tool is unavailable or must be debugged by hand): follow [Expose the deployed app](#expose-the-deployed-app-public-url) below.
+
 When `deploy_check` returns `nextStep: expose_via_devbridge`, it also returns an executable `remediation` string — run those devbridge commands in the sandbox (after `source /tmp/hw_creds.sh`). Until a tunnel exists, `deploy_check` returns no `publicUrl`; do not fabricate a URL.
 
 Follow the standard [Expose the deployed app](#expose-the-deployed-app-public-url) procedure. The app is already running on the detected port — only DevBridge tunnel setup is needed.
@@ -860,6 +864,8 @@ Use `exec_with_session` to background DevBridge. For SSR, DevBridge tunnels the
 
 **Pre-flight**: always run `devbridge delete-all` before creating a new tunnel to prevent `10006: quota exceeded` from accumulated stale tunnels. If you still get quota error, list tunnels with `devbridge list` (0.2.x plain table; 0.1.x legacy `-j` JSON), delete stale ones, and retry.
 
+> **Concurrency warning**: `devbridge delete-all` and `pkill -f "devbridge host"` are GLOBAL operations scoped to the whole sandbox — if multiple sessions share the same sandbox, pre-cleaning can kill tunnels published by other sessions and invalidate URLs you handed out earlier. For shared sandboxes, prefer `devbridge list` and delete only stale/your-own tunnels instead of blanket `delete-all`, and re-expose only after confirming the target port is still served.
+
 Extract the tunnel URL from DevBridge output. The public URL has the form `https://<id>-<port>.devbridge-s2.hwtunnel.com`. **Return this URL to the developer as the deployment result.**
 
 #### Cross-platform H5 QR code

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md

@@ -21,7 +21,7 @@ Use this skill to turn vague developer intent into a precise Huawei Cloud capabi
 8. Treat Terraform as a secondary V1 path for reviewed IaC, not the default.
 9. When no built-in devkit skill matches:
    a. Search: use `huaweicloud_search_marketplace` to find a matching skill in the community marketplace
-   b. Install: run `npx skills add huaweicloud/huaweicloud-skills --skill <skill-name> -y -g`
+   b. Install: use the `installCommand` returned by the marketplace tool — it downloads the skill repo ZIP over HTTP and copies the skill folder into the agent skills directory. **No git is required** (`npx skills add` needs git on PATH, which is often absent on Windows Server/sandbox environments). Replace the `<your-agent-skills-dir>` placeholder with this agent's skills directory (Claude Code `~/.claude/skills`, OpenCode `~/.config/opencode/skills`, Cursor `~/.cursor/skills`) before running. If the command reports `SKILL_SRC_NOT_FOUND` (mis-pathed skill location) or the HTTP download itself fails, follow the returned `installHint`: download `https://github.com/huaweicloud/huaweicloud-skills/archive/refs/heads/master.zip` manually, extract it, copy the skill folder, and confirm to the user how it was installed. Never auto-install git just to fetch a skill.
    c. Execute: load the installed skill and follow its procedure
 10. When the deliverable is a PPT, architecture diagram (draw.io), or frontend page that needs official Huawei Cloud service logos, use the `huaweicloud_get_service_icon` MCP tool to get logo URLs from the official Icons library instead of guessing or hotlinking unofficial images.
 

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -65,7 +65,14 @@ One-liner (installs `latest`, may drift from v7.2.12):
 curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
 ```
 
-Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `hcloud`, restart after updating `PATH`, or set `HCLOUD_BIN`.
+**No restart needed after install**: DevKit locates `hcloud` dynamically on every
+call — it checks `HCLOUD_BIN`, then the fixed install dirs (`~/.local/bin/hcloud`
+on Linux, `/usr/local/bin/hcloud` on macOS, `~/hcloud/hcloud.exe` on Windows),
+then PATH. Once `install-hcloud` or the background auto-install writes the binary
+to one of those dirs, the very next `check_cli` / `run_*` call uses it. Do not
+tell users to restart the agent.
+
+Agent processes find executables through `PATH`; `HCLOUD_BIN` overrides it. DevKit re-locates hcloud from its **fixed install dirs** on every call, so a freshly installed binary (`~/.local/bin` on Linux, `/usr/local/bin` on macOS, `~/hcloud` on Windows) or a re-set `HCLOUD_BIN` is picked up by the next `check_cli` / `run_*` call without restarting the agent. A custom `PATH` entry is only honored via `HCLOUD_BIN` or the PATH locator fallback, and shell `PATH` changes take effect only for processes started after the update.
 
 ## Configure Credentials Outside Chat
 
@@ -84,7 +91,13 @@ Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `
 2. **KooCLI first-run privacy agreement**: On a fresh KooCLI install, `hcloud` blocks with `同意并继续使用(y)/不同意并退出(N)` and fails with `[USE_ERROR]您输入的是无效字符` in non-interactive mode. Detection: check command output for these strings. Ask the user: "KooCLI needs to accept its privacy agreement. May I accept it on your behalf?" If the user agrees, run `huaweicloud_run_readonly_command` with `args=["version"]` and `stdin="y\n"`. This accepts the agreement once, after which hcloud works normally.
 3. Ask the user to configure credentials outside the agent conversation when setup is needed.
 4. Inspect profile and region only through redacted tooling.
-5. Discover exact operation names with `hcloud <Service> --help` before guessing. Example: ECS instance listing is commonly `ECS ListServersDetails`; ECS creation is commonly `ECS CreateServers`; image lookup may be under `IMS GlanceShowImage`.
+5. **Always discover exact operation names and parameters with `--help` BEFORE constructing the command.** Never guess from general knowledge — parameter names change across API versions. The discovery chain is:
+   1. `hcloud --help` → available services
+   2. `hcloud <Service> --help` → operations (use `huaweicloud_list_operations` or step 2/3 directly)
+   3. `hcloud <Service> <Operation> --help` → exact parameter names, required flags, and value formats
+   4. Execute only after the help text confirms the operation and its parameters
+   - Service skills may skip steps 1-2 when they already provide the correct service and operation names, but step 3 (`<Operation> --help`) is never skippable before planning a write operation or a command with parameters.
+   - Example: ECS instance listing is commonly `ECS ListServersDetails`; ECS creation is commonly `ECS CreateServers`; image lookup may be under `IMS GlanceShowImage`.
 6. Use `--cli-output=json` for machine-readable responses when supported.
 7. For resource operations, include `--cli-region`, `--cli-profile`, and service-specific project information when required.
 8. Classify every command before running it:

package/plugins/huaweicloud-core/src/auth/service.mjs

@@ -8,8 +8,10 @@ import {
   globalCredentialsPath,
   isPlaceholder,
   obsConfigPath,
+  parseStsExpiry,
   readCodeArtsCredentials,
   readGlobalCredentials,
+  resolveCredentialsWithRuntime,
   writeLastSync,
   writeObsConfig,
 } from './credentials.mjs';
@@ -162,18 +164,52 @@ export function computeOnboarding({ credentials, reconciled } = {}) {
   return { needsSetup: true, scenario, reason, message, steps, accountHint };
 }
 
+// Compute temporary-STS expiry info for auth_status. Permanent AK/SK creds carry
+// no security token and therefore have no expiry — we return null so callers only
+// see expiry for the platform-injected temporary STS case.
+function computeStsExpiry() {
+  let creds;
+  try {
+    creds = resolveCredentialsWithRuntime({ allowMissing: true });
+  } catch {
+    creds = null;
+  }
+  if (!creds?.ak || !creds?.sk || !creds.securityToken) return null;
+  const expiresAt = parseStsExpiry({ securityToken: creds.securityToken });
+  if (expiresAt === null) return { status: 'unknown', expiresAt: null };
+  const remainingMs = expiresAt - Date.now();
+  const expiresAtUtc = new Date(expiresAt).toISOString();
+  const expiresAtLocal = new Date(expiresAt).toString();
+  let status = 'valid';
+  if (remainingMs <= 0) status = 'expired';
+  else if (remainingMs <= 5 * 60 * 1000) status = 'expiring_soon';
+  return { expiresAt, expiresAtUtc, expiresAtLocal, remainingMs, status };
+}
+
 export function getAuthStatus(target = 'all') {
   const credentials = readGlobalCredentials();
   const reconciled = { ...exportStateForStatus(), runtimeActive: hasRuntimeCredentials() };
   const hcloud = probeHcloud();
   const s4Creds = readCodeArtsCredentials();
   const onboarding = computeOnboarding({ credentials, reconciled });
+  const stsExpiry = computeStsExpiry();
+  const credentialPanel = {
+    sts: stsExpiry, // 临时 STS（MCP==沙箱同源）
+    s1: {
+      configured: Boolean(credentials?.ak && credentials?.sk),
+      fingerprint: credentials?.ak ? fingerprint(credentials.ak, credentials.sk) : null,
+      persistent: true, // 永久，无过期
+    },
+    activeSource: stsExpiry ? 'temporary-sts' : credentials?.ak ? 's1-persistent' : 'none',
+  };
   return {
     target,
     credentialsConfigured: Boolean(credentials?.ak && credentials?.sk),
     credentialsPath: globalCredentialsPath(),
     mcpSettingsConfigured: Boolean(s4Creds?.ak && s4Creds?.sk),
     mcpSettingsSource: s4Creds ? 'codearts' : null,
+    stsExpiry,
+    credentialPanel,
     obsConfigured: existsSync(obsConfigPath()),
     obsConfigPath: obsConfigPath(),
     kooCliInstalled: hcloud.installed,

package/plugins/huaweicloud-core/src/data/icons-manifest.v1.json

@@ -5,7 +5,7 @@
   "icons": [
     {
       "id": "codeartsdoer",
-      "name": "华为云码道（CodeArts）代码智能体",
+      "name": "华为云码道CodeArts代码智能体",
       "category": "人工智能",
       "subcategory": "智能体",
       "description": "更懂你编码需求的AI研发专家",
@@ -41,13 +41,13 @@
     },
     {
       "id": "modelarts",
-      "name": "魔坊（ModelArts）模型训推平台",
+      "name": "魔坊（ModelArts）",
       "category": "人工智能",
       "subcategory": "模型开发平台",
       "description": "“数-训-推-强”，一站式AI开发平台",
       "product_url": "https://www.huaweicloud.com/product/modelarts.html",
       "logo": {
-        "source_url": "https://res-static.hc-cdn.cn/cloudbu-site/public/new-product-icon/AI/ModelArts.png",
+        "source_url": "https://res-static.hc-cdn.cn/cloudbu-site/public/%E6%96%B0%E7%89%88/CF057503-AE1E-48CA-E8C1-1919F51A1261.png",
         "local_path": "icons/assets/logo/modelarts.png"
       },
       "architecture": {
@@ -155,8 +155,8 @@
       "description": "高效敏捷安全的一站式企业级智能体平台",
       "product_url": "https://www.huaweicloud.com/product/agentarts.html",
       "logo": {
-        "source_url": "https://res-static.hc-cdn.cn/cloudbu-site/public/new-product-icon/aPaaS/Versatile.svg",
-        "local_path": "icons/assets/logo/agentarts.svg"
+        "source_url": "https://res-static.hc-cdn.cn/cloudbu-site/china/zh-cn/%E6%99%BA%E6%9E%9CAgentArts/AgentArts-%E5%AE%98%E7%BD%91%E4%BA%A7%E5%93%81%E9%A1%B5%E5%88%87%E5%9B%BE/bannerlogo.png",
+        "local_path": "icons/assets/logo/agentarts.png"
       },
       "architecture": {
         "status": "planned",
@@ -165,6 +165,24 @@
       "aliases": ["agentarts"],
       "tags": ["人工智能", "智能体平台", "agentarts"]
     },
+    {
+      "id": "officeace",
+      "name": "果办OfficeAce 办公智能体",
+      "category": "人工智能",
+      "subcategory": "智能体",
+      "description": "专业办公级AI助手，PPT一键生成、专家团研讨，安全高效随时待命",
+      "product_url": "https://www.huaweicloud.com/product/agentarts/officeace.html",
+      "logo": {
+        "source_url": "https://res-static.hc-cdn.cn/cloudbu-site/china/zh-cn/yunying/product/OfficeAce-v2.svg",
+        "local_path": "icons/assets/logo/officeace.svg"
+      },
+      "architecture": {
+        "status": "planned",
+        "local_path": "icons/assets/architecture/officeace.svg"
+      },
+      "aliases": ["officeace", "office-ace"],
+      "tags": ["人工智能", "智能体", "办公", "officeace"]
+    },
     {
       "id": "pangu-nlp",
       "name": "LLM大模型",

package/plugins/huaweicloud-core/src/detect-framework.mjs

@@ -282,7 +282,8 @@ export function detectFramework(projectPath) {
   if (
     existsSync(join(projectPath, 'next.config.js')) ||
     existsSync(join(projectPath, 'next.config.mjs')) ||
-    existsSync(join(projectPath, 'next.config.ts'))
+    existsSync(join(projectPath, 'next.config.ts')) ||
+    existsSync(join(projectPath, 'next.config.cjs'))
   ) {
     return frameworkResult(FRAMEWORKS.nextjs, pm, projectPath);
   }
@@ -290,7 +291,9 @@ export function detectFramework(projectPath) {
   if (
     existsSync(join(projectPath, 'nuxt.config.js')) ||
     existsSync(join(projectPath, 'nuxt.config.mjs')) ||
-    existsSync(join(projectPath, 'nuxt.config.ts'))
+    existsSync(join(projectPath, 'nuxt.config.ts')) ||
+    existsSync(join(projectPath, 'nuxt.config.cjs')) ||
+    existsSync(join(projectPath, 'nuxt.config.mts'))
   ) {
     return frameworkResult(FRAMEWORKS.nuxt, pm, projectPath);
   }
@@ -315,7 +318,8 @@ export function detectFramework(projectPath) {
   if (
     existsSync(join(projectPath, 'docusaurus.config.js')) ||
     existsSync(join(projectPath, 'docusaurus.config.ts')) ||
-    existsSync(join(projectPath, 'docusaurus.config.mjs'))
+    existsSync(join(projectPath, 'docusaurus.config.mjs')) ||
+    existsSync(join(projectPath, 'docusaurus.config.cjs'))
   ) {
     return frameworkResult(FRAMEWORKS.docusaurus, pm, projectPath);
   }
@@ -336,7 +340,9 @@ export function detectFramework(projectPath) {
   if (
     existsSync(join(projectPath, 'vite.config.js')) ||
     existsSync(join(projectPath, 'vite.config.mjs')) ||
-    existsSync(join(projectPath, 'vite.config.ts'))
+    existsSync(join(projectPath, 'vite.config.ts')) ||
+    existsSync(join(projectPath, 'vite.config.cjs')) ||
+    existsSync(join(projectPath, 'vite.config.mts'))
   ) {
     return frameworkResult(FRAMEWORKS.vite, pm, projectPath);
   }
@@ -358,9 +364,39 @@ export function detectFramework(projectPath) {
     }
   }
 
-  if (existsSync(join(projectPath, 'index.html'))) {
+  if (
+    existsSync(join(projectPath, 'index.html')) ||
+    existsSync(join(projectPath, 'public', 'index.html')) ||
+    existsSync(join(projectPath, 'src', 'index.html'))
+  ) {
     return frameworkResult(FRAMEWORKS.static, pm, projectPath);
   }
 
+  if (pkg) {
+    const entryPoints = [
+      'src/main.js',
+      'src/main.ts',
+      'src/main.jsx',
+      'src/main.tsx',
+      'src/App.vue',
+      'src/app.vue',
+      'src/main.vue',
+      'src/index.js',
+      'src/index.ts',
+    ];
+    const hasEntry = entryPoints.some((p) => existsSync(join(projectPath, p)));
+    if (hasEntry) {
+      if ('vue' in deps || '@vue/cli-service' in deps) {
+        return frameworkResult(FRAMEWORKS.vueCli, pm, projectPath);
+      }
+      if ('react-scripts' in deps) {
+        return frameworkResult(FRAMEWORKS.cra, pm, projectPath);
+      }
+      if ('svelte' in deps || 'solid-js' in deps) {
+        return frameworkResult(FRAMEWORKS.vite, pm, projectPath);
+      }
+    }
+  }
+
   return null;
 }