huaweicloud-devkit 1.1.7 → 1.1.8-next.1

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -6,7 +6,7 @@ import { dirname, join } from 'node:path';
 
 import { classifyHcloudArgs, redactSecrets, assertAllowed } from './safety-policy.mjs';
 import { getProxySettings } from './proxy/proxy-config.mjs';
-import { findHcloudBin, resolveHcloudCommand } from './hcloud-probe.mjs';
+import { resolveHcloudCommand } from './hcloud-probe.mjs';
 import { parseStsExpiry, resolveCredentialsWithRuntime } from './auth/credentials.mjs';
 
 const DEFAULT_TIMEOUT_MS = 60_000;
@@ -69,6 +69,17 @@ function pruneStale(map, now = Date.now()) {
   return changed;
 }
 
+// Approval token lifecycle states, surfaced to callers so they can emit the
+// precise JSON contract required by D4-24 (#745):
+//   'valid'            — token exists, not expired, not yet consumed
+//   'expired'          — token exists but createdAt is past APPROVAL_TTL_MS
+//   'already_consumed' — token was consumed on a prior call (tombstone kept)
+//   'not_found'        — token was never created (unknown / typo / pruned)
+const TOKEN_STATE_VALID = 'valid';
+const TOKEN_STATE_EXPIRED = 'expired';
+const TOKEN_STATE_ALREADY_CONSUMED = 'already_consumed';
+const TOKEN_STATE_NOT_FOUND = 'not_found';
+
 export function createApprovalToken(rawArgs) {
   const token = randomUUID();
   const map = readApprovals();
@@ -82,16 +93,36 @@ export function createApprovalToken(rawArgs) {
   return token;
 }
 
+// Inspect a token's lifecycle state WITHOUT consuming it. Used by
+// runApprovedCommand to decide between the 'expired' / 'already_consumed'
+// / 'not_found' JSON shapes. A consumed token leaves a tombstone
+// ({ consumedAt }) until it ages out past APPROVAL_TTL_MS.
+export function inspectApprovalToken(token) {
+  const map = readApprovals();
+  const entry = map[token];
+  if (!entry) return { state: TOKEN_STATE_NOT_FOUND };
+  if (entry.consumedAt !== undefined) return { state: TOKEN_STATE_ALREADY_CONSUMED };
+  if (Date.now() - entry.createdAt > APPROVAL_TTL_MS) return { state: TOKEN_STATE_EXPIRED };
+  return { state: TOKEN_STATE_VALID, entry };
+}
+
+// Backward-compatible single-use consume. Returns the stored entry on first
+// call, then null. After consumption a tombstone ({ consumedAt }) is written
+// so a second call can be distinguished from an unknown token via
+// inspectApprovalToken. Kept for existing tests that assert null on reuse.
 export function consumeApprovalToken(token) {
   const map = readApprovals();
   const entry = map[token];
   if (!entry) return null;
+  if (entry.consumedAt !== undefined) return null;
   if (Date.now() - entry.createdAt > APPROVAL_TTL_MS) {
     delete map[token];
     writeApprovals(map);
     return null;
   }
-  delete map[token];
+  // Mark as consumed (tombstone) instead of deleting outright, so a repeat
+  // call can be classified as already_processed rather than not_found.
+  map[token] = { consumedAt: Date.now(), createdAt: entry.createdAt };
   writeApprovals(map);
   return entry;
 }
@@ -391,6 +422,24 @@ function appendLangHint(result, service, metaDir) {
   };
 }
 
+// Returns true when the current credentials are a TEMPORARY STS set that has
+// already expired (per HW_STS_EXPIRES_AT / token expiry). Lets us fail fast with
+// a clear CREDENTIAL_EXPIRED instead of letting a doomed IAM call return a
+// misleading error. Permanent AK/SK (no token) and unparseable expiry are never
+// treated as expired.
+function isTemporaryStsExpired() {
+  let creds;
+  try {
+    creds = resolveCredentialsWithRuntime({ allowMissing: true });
+  } catch {
+    return false;
+  }
+  if (!creds?.securityToken) return false;
+  const expiry = parseStsExpiry({ securityToken: creds.securityToken });
+  if (expiry === null) return false; // unknown → don't block
+  return expiry <= Date.now();
+}
+
 export async function runHcloud(args, options = {}) {
   const normalizedArgs = Array.isArray(args) ? args.map(String) : [];
   const plan = {
@@ -399,6 +448,21 @@ export async function runHcloud(args, options = {}) {
   };
   assertAllowed(plan.classification);
 
+  // A: fail fast when the platform-injected temporary STS is already expired —
+  // otherwise hcloud would make a doomed IAM round trip and surface a misleading
+  // error (e.g. "缺少 cli-domain-id"). Permanent AK/SK are unaffected.
+  if (isTemporaryStsExpired()) {
+    return {
+      ok: false,
+      code: 'CREDENTIAL_EXPIRED',
+      error:
+        'Temporary STS credentials have expired. Re-login or start a new session so the platform injects fresh credentials, then retry.',
+      stderr: '',
+      stdout: '',
+      plan,
+    };
+  }
+
   // Link B: when the runtime/environment carries live temporary STS credentials
   // (security token set), KooCLI/obsutil would not see them (they read S2/S3 only
   // and R3 forbids writing them to disk). Inject per-command so hcloud actually
@@ -430,6 +494,8 @@ async function runHcloudOnceWithRetries(plan, options) {
     if (result.ok || attempt >= maxRetries || !isRetryableNetworkError(result)) {
       const merged = {
         ...result,
+        ok: result.ok ?? false,
+        exitCode: result.exitCode ?? null,
         retries: attempt,
         attempts: attempt + 1,
       };
@@ -460,15 +526,15 @@ async function runtimeCurrentMismatchWarning() {
   }
 }
 
-function discoverHcloudPath() {
-  return findHcloudBin();
-}
-
 function runHcloudOnce(plan, options) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const forceKillAfterMs = options.forceKillAfterMs ?? DEFAULT_FORCE_KILL_AFTER_MS;
-  const executable = options.executable || options.env?.HCLOUD_BIN || discoverHcloudPath() || 'hcloud';
-  const executableArgs = Array.isArray(options.executableArgs) ? options.executableArgs.map(String) : [];
+  const { executable: resolvedExec, argsPrefix } = resolveHcloudCommand({
+    executable: options.executable || options.env?.HCLOUD_BIN,
+    executableArgs: options.executableArgs,
+  });
+  const executable = resolvedExec || 'hcloud';
+  const executableArgs = argsPrefix;
   const cwd = options.cwd || undefined;
   const stdin = options.stdin ?? 'y\n';
   const childOptions = { ...options };
@@ -540,6 +606,8 @@ function runHcloudOnce(plan, options) {
           ok: false,
           code: 'TIMEOUT',
           error: `hcloud command timed out after ${timeoutMs} ms.`,
+          exitCode: null,
+          signal: null,
           stdout: redactOutput(stdout),
           stderr: redactOutput(stderr),
           plan,
@@ -558,6 +626,8 @@ function runHcloudOnce(plan, options) {
         ok: false,
         code: 'SPAWN_ERROR',
         error: error.message,
+        exitCode: null,
+        signal: null,
         plan,
       });
     });

package/plugins/huaweicloud-core/src/hcloud-probe.mjs

@@ -4,6 +4,7 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 
 import { compareVersion, getKooCliVersion, parseHcloudVersion } from './koocli-version.mjs';
+import { kooCliInstallLogPath } from './preflight.mjs';
 import { redactSecrets } from './safety-policy.mjs';
 
 const VERSION_RE = /KooCLI|Current.*version|当前KooCLI/i;
@@ -13,7 +14,11 @@ export function findHcloudBin() {
   const candidates =
     process.platform === 'win32'
       ? [join(homedir(), 'hcloud', 'hcloud.exe')]
-      : [join(homedir(), '.local', 'bin', 'hcloud'), join(homedir(), 'hcloud', 'hcloud')];
+      : [
+          join(homedir(), '.local', 'bin', 'hcloud'),
+          join(homedir(), 'hcloud', 'hcloud'),
+          join('/', 'usr', 'local', 'bin', 'hcloud'),
+        ];
   const found = candidates.find((candidate) => existsSync(candidate));
   if (found) return found;
 
@@ -148,7 +153,10 @@ export function hcloudProbeNextStep(probe) {
     return 'KooCLI requires accepting its one-time privacy agreement. Run hcloud version in a real terminal and accept the prompt, then restart the agent.';
   }
   if (probe.status === 'not_found') {
-    return 'hcloud executable not found. Set HCLOUD_BIN to the full hcloud path, or install KooCLI: npx huaweicloud-devkit install-hcloud. Then restart the agent.';
+    return (
+      'KooCLI is not installed yet. Background auto-install may be running — please retry shortly instead of assuming failure. To install now: npx huaweicloud-devkit install-hcloud. DevKit picks up the binary from its fixed install dirs (~/.local/bin on Linux, /usr/local/bin on macOS, ~/hcloud on Windows) or HCLOUD_BIN on the next call — no agent restart needed. Install progress: ' +
+      kooCliInstallLogPath()
+    );
   }
   return 'Install Huawei Cloud KooCLI: npx huaweicloud-devkit install-hcloud. Configure credentials outside the agent conversation.';
 }

package/plugins/huaweicloud-core/src/mcp-server.mjs

@@ -9,6 +9,7 @@ import { dispatch } from './mcp-protocol.mjs';
 import { DEFAULT_PORT, DEFAULT_HOST } from './mcp-server-remote.mjs';
 import { getCachedUpdateInfo, readInstalledVersion } from './update-check.mjs';
 import { detectAgent } from './telemetry/agent-detect.mjs';
+import { maybePreinstallKooCli } from './preflight.mjs';
 
 const transportIdx = process.argv.indexOf('--transport');
 const transport = transportIdx > -1 && process.argv[transportIdx + 1] ? process.argv[transportIdx + 1] : 'stdio';
@@ -53,6 +54,14 @@ try {
   if (existsSync(marker)) rmSync(marker, { force: true });
 } catch {}
 
+// First-use UX: if KooCLI is missing, kick off a background install so the first
+// cloud command doesn't hit a bare "command not found". Non-blocking + log-backed.
+// Runs at import time (before the transport branch below) so both the stdio and
+// remote transports benefit, and `HUAWEICLOUD_SKIP_HCLOUD_PREINSTALL=1` disables it.
+try {
+  maybePreinstallKooCli();
+} catch {}
+
 if (transport === 'remote') {
   const { startRemoteServer } = await import('./mcp-server-remote.mjs');
   startRemoteServer({ port: remotePort, host: remoteHost }).catch((error) => {

package/plugins/huaweicloud-core/src/preflight.mjs

@@ -0,0 +1,125 @@
+import { spawn } from 'node:child_process';
+import { createWriteStream, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { findHcloudBin } from './hcloud-probe.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// Cross-process install lock so concurrent MCP processes / sessions don't all
+// spawn `install-hcloud` at cold start. A stale lock (older than TTL) is
+// reclaimed; a live lock makes this process yield to the in-flight installer.
+const INSTALL_LOCK_TTL_MS = 15 * 60 * 1000;
+const INSTALL_LOG_MAX_BYTES = 1024 * 1024;
+
+export function kooCliInstallLogPath() {
+  return join(homedir(), '.config', 'huaweicloud', 'logs', 'koocli-install.log');
+}
+
+export function kooCliInstallLockPath() {
+  return join(homedir(), '.config', 'huaweicloud', '.koocli-install.lock');
+}
+
+// Atomically acquire the cross-process install lock (exclusive create). Reclaims
+// a stale lock. Returns { acquired: true } or { acquired: false, reason }.
+export function acquireInstallLock(lockPath = kooCliInstallLockPath()) {
+  try {
+    mkdirSync(dirname(lockPath), { recursive: true });
+    let replace = false;
+    try {
+      const ts = Number(String(readFileSync(lockPath, 'utf8')).trim());
+      if (Number.isFinite(ts) && Date.now() - ts > INSTALL_LOCK_TTL_MS) replace = true;
+    } catch {}
+    if (replace) {
+      try {
+        rmSync(lockPath, { force: true });
+      } catch (error) {
+        return { acquired: false, reason: `stale lock cleanup failed: ${error.message}` };
+      }
+    }
+    writeFileSync(lockPath, String(Date.now()), { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    return { acquired: true };
+  } catch (error) {
+    return {
+      acquired: false,
+      reason: error.code === 'EEXIST' ? 'another process is installing' : `lock error: ${error.message}`,
+    };
+  }
+}
+
+export function releaseInstallLock(lockPath = kooCliInstallLockPath()) {
+  try {
+    rmSync(lockPath, { force: true });
+  } catch {}
+}
+
+// Open the install log, rotating (reset) once it exceeds INSTALL_LOG_MAX_BYTES
+// and pinning 0600 so the path holds no sensitive mount-down rights for others.
+export function openKooCliInstallLog(logPath = kooCliInstallLogPath()) {
+  try {
+    const st = existsSync(logPath) ? statSync(logPath) : null;
+    if (st && st.size > INSTALL_LOG_MAX_BYTES) rmSync(logPath, { force: true });
+    mkdirSync(dirname(logPath), { recursive: true });
+  } catch {}
+  return createWriteStream(logPath, { flags: 'a', mode: 0o600 });
+}
+
+// Entry that dispatches `install-hcloud` into this file's own `main()` on import,
+// exactly like bin/setup.cjs — but resolved as a sibling (src/setup-cli.mjs) so it
+// works in copied install trees where the repo-top bin/ directory is absent.
+export function resolvePreinstallCliEntry() {
+  return join(__dirname, 'setup-cli.mjs');
+}
+
+let installStarted = false;
+
+// Starts a one-shot background install of KooCLI when it is missing. Never throws
+// and never blocks: on failure the child's output is captured in the log file and
+// the session continues normally (the friendly not_found hint will point at the log).
+//
+// Trust boundary (P4): this runs `install-hcloud` unattended, i.e. it downloads and
+// executes the official HTTPS installer without checksum verification. Only enable
+// on trusted networks / over HTTPS; do not bypass with proxies you don't control.
+export function maybePreinstallKooCli({ force = false } = {}) {
+  if (installStarted && !force) return { launched: false, reason: 'already_launched' };
+  if (process.env.HUAWEICLOUD_SKIP_HCLOUD_PREINSTALL === '1') {
+    return { launched: false, reason: 'disabled_by_env' };
+  }
+  if (findHcloudBin()) {
+    return { launched: false, reason: 'already installed' };
+  }
+
+  const lock = acquireInstallLock();
+  if (!lock.acquired) {
+    return { launched: false, reason: lock.reason };
+  }
+
+  installStarted = true;
+  const entryPath = resolvePreinstallCliEntry();
+  if (!existsSync(entryPath)) {
+    releaseInstallLock();
+    console.error(`[preflight] install entry missing: ${entryPath}`);
+    return { launched: false, reason: `install entry missing: ${entryPath}` };
+  }
+  const entry = pathToFileURL(entryPath).href;
+  const log = openKooCliInstallLog();
+  log.on('error', () => {});
+  const release = () => {
+    log.end();
+    releaseInstallLock();
+  };
+  const child = spawn(process.execPath, [entry, 'install-hcloud'], {
+    stdio: ['ignore', log, log],
+    detached: true,
+    windowsHide: true,
+  });
+  child.unref();
+  child.on('error', (err) => {
+    log.write(`[preflight] spawn failed: ${err.message}\n`);
+    release();
+  });
+  child.on('close', () => release());
+  return { launched: true, reason: 'background install started' };
+}

package/plugins/huaweicloud-core/src/proxy/proxy-config.mjs

@@ -39,7 +39,96 @@ export function clearProxyConfig() {
   return true;
 }
 
-function shouldBypassProxy(hostname, noProxyList) {
+function ipv4ToInt(ip) {
+  const parts = ip.split('.');
+  if (parts.length !== 4) return null;
+  let n = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const v = Number(part);
+    if (v > 255) return null;
+    n = n * 256 + v;
+  }
+  return BigInt(n);
+}
+
+function ipv6ToBigInt(ip) {
+  let addr = ip.toLowerCase();
+  if (addr === '::') addr = '0:0:0:0:0:0:0:0';
+  const [head, tail] = addr.split('::');
+  const headGroups = head ? head.split(':').filter(Boolean) : [];
+  const tailGroups = tail ? tail.split(':').filter(Boolean) : [];
+  if (addr.includes('::')) {
+    const missing = 8 - headGroups.length - tailGroups.length;
+    if (missing < 0) return null;
+    const groups = [...headGroups, ...Array(missing).fill('0'), ...tailGroups];
+    if (groups.length !== 8) return null;
+    return groupsToBigInt(groups);
+  }
+  const groups = head ? head.split(':') : [];
+  if (groups.length !== 8) return null;
+  return groupsToBigInt(groups);
+}
+
+function groupsToBigInt(groups) {
+  let n = 0n;
+  for (const g of groups) {
+    if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+    n = (n << 16n) | BigInt(parseInt(g, 16));
+  }
+  return n;
+}
+
+function ipv4MappedV6ToBigInt(ip) {
+  // ::ffff:a.b.c.d — IPv4-mapped IPv6. Compare against IPv4 CIDR too.
+  const m = ip.match(/^::ffff:([0-9.]+)$/i);
+  if (!m) return null;
+  const v4 = ipv4ToInt(m[1]);
+  if (v4 === null) return null;
+  return v4;
+}
+
+function parseCidr(pattern) {
+  const slash = pattern.lastIndexOf('/');
+  if (slash < 0) return null;
+  const ipPart = pattern.slice(0, slash);
+  const maskPart = pattern.slice(slash + 1);
+  if (!/^\d{1,3}$/.test(maskPart)) return null;
+  const prefix = Number(maskPart);
+  if (ipPart.includes(':')) {
+    const mapped = ipv4MappedV6ToBigInt(ipPart);
+    if (mapped !== null) {
+      if (prefix < 0 || prefix > 32) return null;
+      const mask = prefix === 0 ? 0n : ((1n << 32n) - 1n) ^ ((1n << (32n - BigInt(prefix))) - 1n);
+      return { bits: 32n, base: mapped, mask };
+    }
+    const base = ipv6ToBigInt(ipPart);
+    if (base === null) return null;
+    if (prefix < 0 || prefix > 128) return null;
+    const mask = prefix === 0 ? 0n : ((1n << 128n) - 1n) ^ ((1n << (128n - BigInt(prefix))) - 1n);
+    return { bits: 128n, base, mask };
+  }
+  const base = ipv4ToInt(ipPart);
+  if (base === null) return null;
+  if (prefix < 0 || prefix > 32) return null;
+  const mask = prefix === 0 ? 0n : ((1n << 32n) - 1n) ^ ((1n << (32n - BigInt(prefix))) - 1n);
+  return { bits: 32n, base, mask };
+}
+
+function ipInCidr(hostname, cidr) {
+  if (cidr.bits === 32n) {
+    const v4 = ipv4ToInt(hostname);
+    if (v4 !== null) return (v4 & cidr.mask) === (cidr.base & cidr.mask);
+    const mapped = ipv4MappedV6ToBigInt(hostname);
+    if (mapped !== null) return (mapped & cidr.mask) === (cidr.base & cidr.mask);
+    return false;
+  }
+  const v6 = ipv6ToBigInt(hostname);
+  if (v6 !== null) return (v6 & cidr.mask) === (cidr.base & cidr.mask);
+  return false;
+}
+
+export function shouldBypassProxy(hostname, noProxyList) {
   if (!noProxyList.length) return false;
   const lower = hostname.toLowerCase();
   for (const pattern of noProxyList) {
@@ -47,6 +136,10 @@ function shouldBypassProxy(hostname, noProxyList) {
     if (!p) continue;
     if (p === lower) return true;
     if (p === '*') return true;
+    if (p.includes('/')) {
+      const cidr = parseCidr(p);
+      if (cidr && ipInCidr(lower, cidr)) return true;
+    }
     if (p.startsWith('*.')) {
       const domain = p.slice(1);
       if (lower.endsWith(domain) || lower === p.slice(2)) return true;

package/plugins/huaweicloud-core/src/risk-rule-engine.mjs

@@ -19,7 +19,7 @@ export function loadRiskRules(options = {}) {
 function redactEvidence(text) {
   return String(text)
     .replace(
-      /((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
+      /((?:access[_-]?key|secret[_-]?key|secret|security[_-]?token|x[_-]?auth[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
       '$1<redacted>',
     )
     .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>');