huaweicloud-devkit 1.1.7 → 1.1.8-next.1

package/plugins/huaweicloud-core/src/safety-policy.mjs

@@ -67,8 +67,9 @@ export function redactSecrets(value, policy = DEFAULT_POLICY) {
 function stripExecutable(args) {
   if (!args.length) return [];
   let current = args;
-  // Unwrap shell wrappers (bash -c / sh -c 'hcloud ...', sudo hcloud ...) so
-  // wrapped write commands keep their deny classification (#650 D4-16).
+  // Unwrap shell wrappers (bash -c / sh -c 'hcloud ...', sudo hcloud ...,
+  // cmd /c "hcloud ...", powershell -Command "hcloud ...") so wrapped write
+  // commands keep their deny classification (#650 D4-16, #731 / #760).
   for (let depth = 0; depth < 5; depth++) {
     const first = String(current[0]).toLowerCase();
     const isShell = [
@@ -87,6 +88,22 @@ function stripExecutable(args) {
       current = splitSimpleCommand(current[2]);
       continue;
     }
+    // Windows: cmd /c "…" / cmd /k "…" / cmd.exe /c "…"
+    if (first === 'cmd' || first === 'cmd.exe') {
+      const flag = String(current[1] || '').toLowerCase();
+      if ((flag === '/c' || flag === '/k') && current[2]) {
+        current = splitSimpleCommand(current[2]);
+        continue;
+      }
+    }
+    // Windows: powershell -Command "…" / powershell -c "…" / pwsh -Command "…"
+    if (first === 'powershell' || first === 'powershell.exe' || first === 'pwsh' || first === 'pwsh.exe') {
+      const flag = String(current[1] || '').toLowerCase();
+      if ((flag === '-command' || flag === '-c') && current[2]) {
+        current = splitSimpleCommand(current[2]);
+        continue;
+      }
+    }
     if (first === 'sudo' && current.length > 1) {
       current = current.slice(1);
       continue;
@@ -237,7 +254,7 @@ export function classifyHcloudArgs(args, options = {}) {
     };
   }
 
-  if (/secret[_-]?string|secret[_-]?binary|showsecretversion|getsecretvalue/i.test(joined)) {
+  if (/secret[_-]?string|secret[_-]?binary|showsecret|showsecretversion|getsecretvalue/i.test(joined)) {
     return {
       decision: 'deny',
       risk: 'secret',
@@ -381,55 +398,170 @@ function splitSimpleCommand(command) {
   );
 }
 
+// Extract inner command text from shell wrappers: bash -c "…", sh -c '…',
+// eval "…", $(…), `…`, Windows cmd/powershell. Returns an array of extracted
+// inner strings (may include nested extractions). This lets classifyTextCommand
+// inspect the actual payload instead of the wrapper tokens (#758 D4-16).
+export function extractInnerCommand(text, depth = 0) {
+  if (depth > 3) return [];
+  const t = String(text || '');
+  const results = [];
+  let m;
+
+  // bash -c "…" / sh -c '…' / /bin/bash -c "…" / bash.exe -c '…'
+  const shellWrap = /\b(?:bash|sh|zsh|dash|\/bin\/(?:bash|sh|zsh|dash)|bash\.exe|sh\.exe)\s+-c\s+(["'])([\s\S]*?)\1/gi;
+  while ((m = shellWrap.exec(t)) !== null) {
+    if (m[2]) {
+      results.push(m[2]);
+      results.push(...extractInnerCommand(m[2], depth + 1));
+    }
+  }
+
+  // eval "…" / eval '…'
+  const evalWrap = /\beval\s+(["'])([\s\S]*?)\1/gi;
+  while ((m = evalWrap.exec(t)) !== null) {
+    if (m[2]) {
+      results.push(m[2]);
+      results.push(...extractInnerCommand(m[2], depth + 1));
+    }
+  }
+
+  // $(…) command substitution (single-level; nested parens are a known limitation)
+  const cmdSubst = /\$\(([^)]+)\)/g;
+  while ((m = cmdSubst.exec(t)) !== null) {
+    if (m[1]) {
+      results.push(m[1]);
+      results.push(...extractInnerCommand(m[1], depth + 1));
+    }
+  }
+
+  // `…` backtick command substitution (POSIX sh). Treated the same as $(…):
+  // the inner text is extracted as an independent candidate and recursed
+  // into so that `hcloud ECS DeleteServer …` is classified correctly (#758).
+  const backtickSubst = /`([^`]+)`/g;
+  while ((m = backtickSubst.exec(t)) !== null) {
+    if (m[1]) {
+      results.push(m[1]);
+      results.push(...extractInnerCommand(m[1], depth + 1));
+    }
+  }
+
+  // Windows: cmd /c "…" / cmd /k '…' / cmd.exe /c "…" (#731 / #760).
+  // /c runs and terminates; /k runs and keeps the shell — both can wrap hcloud.
+  const cmdWrap = /\b(?:cmd|cmd\.exe)\s+\/[ck]\s+(["'])([\s\S]*?)\1/gi;
+  while ((m = cmdWrap.exec(t)) !== null) {
+    if (m[2]) {
+      results.push(m[2]);
+      results.push(...extractInnerCommand(m[2], depth + 1));
+    }
+  }
+
+  // Windows: powershell -Command "…" / powershell -c '…' / pwsh -Command "…"
+  // / pwsh.exe -c "…" (#731 / #760). Covers both Windows PowerShell and
+  // PowerShell Core (pwsh). The -Command/-c flag executes the quoted string.
+  const psWrap = /\b(?:powershell|powershell\.exe|pwsh|pwsh\.exe)\s+(?:-Command|-c)\s+(["'])([\s\S]*?)\1/gi;
+  while ((m = psWrap.exec(t)) !== null) {
+    if (m[2]) {
+      results.push(m[2]);
+      results.push(...extractInnerCommand(m[2], depth + 1));
+    }
+  }
+
+  return results;
+}
+
+// Find the hcloud keyword in a command position (string start, after shell
+// separators ; | &, after command-substitution openings $( `, or after sudo).
+// Excludes hcloud mentioned in natural-language/echo text to avoid false-
+// positive deny/write on documentation text (#758 D4-11 P1 fix). Candidates
+// from extractInnerCommand (shell wrappers) start with hcloud directly so
+// ^hcloud still catches wrapped commands and prompt-injections using
+// separators. sudo\s+ preserves the dev-baseline behaviour where
+// `sudo hcloud …` is treated as a real command, not documentation (#760 P0).
+function extractHcloudSubcommand(text) {
+  const t = String(text || '');
+  const match = /(?:^|[;|&]\s*|\$\(\s*|`\s*|sudo\s+)(hcloud(?:\.exe)?\b)/i.exec(t);
+  if (!match) return null;
+  const hcloudIndex = match.index + match[0].length - match[1].length;
+  return t.slice(hcloudIndex);
+}
+
 export function classifyTextCommand(command, options = {}) {
   const policy = options.policy || DEFAULT_POLICY;
   const text = String(command || '');
 
-  if (matchesAny(text, policy.credentialFilePatterns)) {
-    return {
-      decision: 'deny',
-      risk: 'credential',
-      reason:
-        'Reading Huawei Cloud credential or profile files is blocked. Use redacted profile inspection tools instead.',
-    };
+  // Extract inner commands from shell wrappers (bash -c, sh -c, eval, $()).
+  // Each candidate (original + extracted inners) is checked independently so a
+  // wrapped credential dump or hcloud write is caught even when the wrapper
+  // text alone doesn't match (#758 D4-16, also covers #682 env-dump vector).
+  const candidates = [text, ...extractInnerCommand(text)];
+
+  // Credential file reads — check all candidates.
+  for (const candidate of candidates) {
+    if (matchesAny(candidate, policy.credentialFilePatterns)) {
+      return {
+        decision: 'deny',
+        risk: 'credential',
+        reason:
+          'Reading Huawei Cloud credential or profile files is blocked. Use redacted profile inspection tools instead.',
+      };
+    }
   }
 
-  if (
-    /(^|\s)(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:)/i.test(text) &&
-    /HUAWEICLOUD|HWC_|HCLOUD|OS_/i.test(text)
-  ) {
-    return {
-      decision: 'deny',
-      risk: 'credential',
-      reason: 'Dumping cloud credential environment variables is blocked.',
-    };
+  // Env var dumps — check all candidates (covers bash -c "env | grep HUAWEICLOUD", #682).
+  for (const candidate of candidates) {
+    if (
+      /(^|\s)(env|printenv|Get-ChildItem\s+Env:|gci\s+Env:|dir\s+Env:)/i.test(candidate) &&
+      /HUAWEICLOUD|HWC_|HW_|HCLOUD|OS_/i.test(candidate)
+    ) {
+      return {
+        decision: 'deny',
+        risk: 'credential',
+        reason: 'Dumping cloud credential environment variables is blocked.',
+      };
+    }
   }
 
   // Credential variable references bypass the env-command gate above: HW_ is
   // the plugin's own documented credential prefix (HW_ACCESS_KEY/HW_SECRET_KEY/
-  // HW_SECURITY_TOKEN), and `echo $HW_SECRET_KEY` / `printenv HW_ACCESS_KEY`
-  // previously fell through to allow (#650 D4-2).
+  // HW_SECURITY_TOKEN), cloud environments also expose the AWS-style
+  // HUAWEICLOUD_SECRET_ACCESS_KEY name, and `echo $HW_SECRET_KEY` /
+  // `printenv HW_ACCESS_KEY` / `echo $HUAWEICLOUD_SECRET_ACCESS_KEY` previously
+  // fell through to allow (#650 D4-2, #770 D4-2).
   //
   // The negative lookbehind exempts literal-NAME references — backslash-escaped
   // (`\$HW_*`) or single-quoted (`'$HW_*'`, which the shell never expands) —
   // while unescaped `$HW_*` is a potential expansion/dump regardless of the
   // command. No command-name whitelist, so no false negative (#650 review).
-  if (
-    /(?<!['\\])\$\{?(?:HUAWEICLOUD|HWC|HW|OS)_(?:ACCESS_KEY|SECRET_KEY|SECURITY_TOKEN)/i.test(text) ||
-    /(?:^|\s)printenv\s+(?:HUAWEICLOUD|HWC|HW|OS)_(?:ACCESS_KEY|SECRET_KEY|SECURITY_TOKEN)/i.test(text)
-  ) {
-    return {
-      decision: 'deny',
-      risk: 'credential',
-      reason: 'Printing cloud credential environment variables is blocked.',
-    };
+  for (const candidate of candidates) {
+    if (
+      /(?<!['\\])\$\{?(?:HUAWEICLOUD|HWC|HW|OS)_(?:SECRET_ACCESS_KEY|ACCESS_KEY|SECRET_KEY|SECURITY_TOKEN)/i.test(
+        candidate,
+      ) ||
+      /(?:^|\s)printenv\s+(?:HUAWEICLOUD|HWC|HW|OS)_(?:SECRET_ACCESS_KEY|ACCESS_KEY|SECRET_KEY|SECURITY_TOKEN)/i.test(
+        candidate,
+      )
+    ) {
+      return {
+        decision: 'deny',
+        risk: 'credential',
+        reason: 'Printing cloud credential environment variables is blocked.',
+      };
+    }
   }
 
-  if (/(^|\s)hcloud(\.exe)?\s+/i.test(text)) {
-    return classifyHcloudArgs(splitSimpleCommand(text), { ...options, rawCommand: text });
+  // hcloud command detection — extract the subcommand starting from the hcloud
+  // keyword so prompt-injection prefixes ("Ignore previous instructions and
+  // hcloud …") and shell wrappers ("bash -c \"hcloud …\"") are classified
+  // correctly (#758 D4-16 + D4-11). Check all candidates (original + inners).
+  for (const candidate of candidates) {
+    const hcloudSubcommand = extractHcloudSubcommand(candidate);
+    if (hcloudSubcommand) {
+      return classifyHcloudArgs(splitSimpleCommand(hcloudSubcommand), { ...options, rawCommand: text });
+    }
   }
 
-  if (/ShowSecretVersion|GetSecretValue|secret_string|secret_binary/i.test(text)) {
+  if (/ShowSecretVersion|ShowSecret|GetSecretValue|secret_string|secret_binary/i.test(text)) {
     return {
       decision: 'deny',
       risk: 'secret',

package/plugins/huaweicloud-core/src/sandbox/session-manager.mjs

@@ -198,9 +198,17 @@ export function formatPortDriftWarning(basePort, targetPort) {
   return `Port ${basePort} was occupied — nginx now listens on port ${targetPort}. Any DevBridge tunnel bound to port ${basePort} is detached: run "devbridge port create <tunnelId> -p ${targetPort} --protocol http -a" and restart "devbridge host" for the new port.`;
 }
 
-export function formatProxyPortWarning(basePort, targetPort) {
-  if (targetPort === basePort) return undefined;
-  return `Port ${basePort} is in use — the proxy template still listens on port ${basePort}: auto-increment does not apply to proxy configs, so nginx may fail to bind. Free the port or deploy a static/spa build instead.`;
+export async function resolveProxyNodePort(nodePort, nginxListenPort, isPortInUse) {
+  const baseCandidate = nodePort && nodePort !== nginxListenPort ? nodePort : nginxListenPort + 1;
+  let candidate = baseCandidate;
+  for (
+    let attempt = 0;
+    attempt < 10 && (candidate === nginxListenPort || (await isPortInUse(candidate)));
+    attempt += 1
+  ) {
+    candidate += 1;
+  }
+  return candidate;
 }
 
 export function buildExposeRemediation(port) {
@@ -775,7 +783,17 @@ export async function deployNginx(
   }
 
   const effectiveNodePort =
-    nginxType === 'proxy' ? (nodePort && nodePort !== listenPort ? nodePort : listenPort + 1) : undefined;
+    nginxType === 'proxy'
+      ? await resolveProxyNodePort(nodePort, targetPort, async (candidate) => {
+          const portCheck = await execOneShot(
+            workspaceId,
+            `ss -tlnp 2>/dev/null | grep -q ":${candidate} " && echo "IN_USE" || echo "FREE"`,
+            username,
+            10000,
+          );
+          return String(portCheck.stdout || '').includes('IN_USE');
+        })
+      : undefined;
 
   const projectPath = `/workspace/${project}`;
   const outputPath = outputDir.startsWith('/') ? outputDir : `${projectPath}/${outputDir}`;
@@ -803,7 +821,7 @@ fi`;
     }
 }`,
     proxy: `server {
-    listen ${listenPort};
+    listen ${targetPort};
     server_name _;
     large_client_header_buffers 4 32k;
 
@@ -874,6 +892,15 @@ fi`;
     tunnelActive = String(tunnelCheck.stdout || '').includes('ACTIVE');
   } catch {}
 
+  const warnings = [];
+  if (!tunnelActive) {
+    warnings.push('No active DevBridge tunnel — deployment is incomplete. Proceed to Step 7 to expose the app.');
+  }
+  const conflictWarning = formatPortConflictWarning(basePort, targetPort);
+  if (conflictWarning) warnings.push(conflictWarning);
+  const driftWarning = tunnelActive ? formatPortDriftWarning(basePort, targetPort) : undefined;
+  if (driftWarning) warnings.push(driftWarning);
+
   return {
     ok: result.exitCode === 0,
     nginxType,
@@ -884,18 +911,7 @@ fi`;
     exitCode: result.exitCode,
     stdout: result.stdout,
     nextStep: 'expose_via_devbridge',
-    warning:
-      [
-        !tunnelActive
-          ? 'No active DevBridge tunnel — deployment is incomplete. Proceed to Step 7 to expose the app.'
-          : undefined,
-        nginxType === 'proxy'
-          ? formatProxyPortWarning(basePort, targetPort)
-          : formatPortConflictWarning(basePort, targetPort),
-        tunnelActive && nginxType !== 'proxy' ? formatPortDriftWarning(basePort, targetPort) : undefined,
-      ]
-        .filter(Boolean)
-        .join(' ') || undefined,
+    warning: warnings.length > 0 ? warnings.join(' | ') : undefined,
   };
 }
 
@@ -913,17 +929,25 @@ export async function deployCheck(
   const outputPath = outputDir.startsWith('/') ? outputDir : `${projectPath}/${outputDir}`;
   const isCrossPlatform = frameworkType === 'cross-platform';
 
-  const checkScript = [
+  const checkScript = buildDeployCheckScript({ port, project, outputPath, isCrossPlatform });
+  const result = await execOneShot(workspaceId, checkScript, username, timeoutMs);
+  const stdout = String(result.stdout || '');
+  return parseDeployCheckOutput(stdout, { port, isCrossPlatform });
+}
+
+export function buildDeployCheckScript({ port, project, outputPath, isCrossPlatform: _isCrossPlatform }) {
+  return [
     `echo "=== DEPLOY CHECK ==="`,
     `PASS=0`,
     `TOTAL=0`,
     ``,
     `TOTAL=$((TOTAL+1))`,
-    `if curl -s -o /dev/null -w "%{http_code}" http://localhost:${port} 2>/dev/null | grep -qE "^(2|3)"; then`,
-    `  echo "nginx_serving:PASS (port ${port})"`,
+    `HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:${port} 2>/dev/null)`,
+    `if [ -n "$HTTP_CODE" ] && [ "$HTTP_CODE" != "000" ]; then`,
+    `  echo "nginx_serving:PASS (port ${port}, HTTP \${HTTP_CODE})"`,
     `  PASS=$((PASS+1))`,
     `else`,
-    `  echo "nginx_serving:FAIL"`,
+    `  echo "nginx_serving:FAIL (port ${port}, no HTTP response)"`,
     `fi`,
     ``,
     `TOTAL=$((TOTAL+1))`,
@@ -972,12 +996,13 @@ export async function deployCheck(
     `TUNNEL_URL="https://\${TUNNEL_ID}-${port}.${DEVBRIDGE_TUNNEL_DOMAIN}"`,
     `probe_tunnel() {`,
     `  local url="$1" code`,
-    `  code=$(curl -s -o /tmp/.dc_tunnel_body -w "%{http_code}" --max-time 10 "$url" 2>/dev/null || echo "000")`,
+    `  code=$(curl -s -o /tmp/.dc_tunnel_body -w "%{http_code}" --max-time 10 "$url" 2>/dev/null)`,
     `  [ "$code" = "000" ] && return 1`,
     `  # A migrated gateway serves a placeholder page with HTTP 200 — treat it as unreachable.`,
     `  if grep -q "${DEVBRIDGE_MIGRATION_MARKER}" /tmp/.dc_tunnel_body 2>/dev/null; then return 1; fi`,
+    `  # Any non-000 HTTP code means the tunnel is connected and nginx is serving`,
+    `  # (404/502 = content issue, not a connectivity issue — consistent with nginx_serving).`,
     `  rm -f /tmp/.dc_tunnel_body`,
-    `  [ "$code" = "200" ] || [ "$code" = "304" ] || return 1`,
     `  return 0`,
     `}`,
     `if [ -n "$TUNNEL_ID" ] && probe_tunnel "$TUNNEL_URL"; then`,
@@ -1031,16 +1056,18 @@ fi
   ]
     .filter(Boolean)
     .join('\n');
+}
 
-  const result = await execOneShot(workspaceId, checkScript, username, timeoutMs);
-  const stdout = String(result.stdout || '');
+export function parseDeployCheckOutput(stdout, { port, isCrossPlatform } = {}) {
   // Strip ANSI escape sequences (CSI color/cursor codes and OSC shell-integration markers)
   // and split on any line-ending style (\r\n, \r, or \n) to handle all terminal outputs.
   // Use new RegExp to avoid ESLint no-control-regex on literal control chars in regex.
   const ESC = '\x1b';
   const csiRe = new RegExp(ESC + '\\[[0-9;]*[a-zA-Z]', 'g');
   const oscRe = new RegExp(ESC + '\\][^' + ESC + '\x07]*(?:\x07|' + ESC + '\\\\)', 'g');
-  const cleanStdout = stdout.replace(csiRe, '').replace(oscRe, '');
+  const cleanStdout = String(stdout || '')
+    .replace(csiRe, '')
+    .replace(oscRe, '');
   const checks = {};
   const lines = cleanStdout.split(new RegExp('\\r\\n|\\r|\\n'));
   for (const line of lines) {
@@ -1086,7 +1113,7 @@ fi
     publicUrl: tunnelMatch ? tunnelMatch[1] : undefined,
     missingSteps: missing.length > 0 ? missing.join(', ') : undefined,
     parseWarning,
-    rawOutput: parseWarning ? stdout.trim() : undefined,
+    rawOutput: parseWarning ? String(stdout || '').trim() : undefined,
     nextStep: nextStepValue,
     remediation: nextStepValue === 'expose_via_devbridge' ? buildExposeRemediation(port) : undefined,
   };
@@ -1104,6 +1131,166 @@ export async function closeSession(workspaceId, username) {
   return true;
 }
 
+// Build a shell snippet that authenticates devbridge by probing the binary build:
+// image builds (2026-09+) keep `--access-key/--secret-key`, release builds accept
+// only `--api-key`. Uses injected files written by huaweicloud_sandbox_credentials
+// (/tmp/hw_creds.sh for AK/SK, /tmp/hw_api_key for the long-lived API Key).
+export function buildDevbridgeAuthProbe() {
+  return [
+    `export PATH="$HOME/.huawei/bin:$PATH"`,
+    `source /tmp/hw_creds.sh 2>/dev/null`,
+    `if devbridge auth login --help 2>&1 | grep -q -- '--access-key'; then`,
+    `  echo "DB_AUTH_MODE=AKSK_SUPPORTED"`,
+    `  devbridge auth login --access-key "$HW_ACCESS_KEY" --secret-key "$HW_SECRET_KEY" > /tmp/db_auth.log 2>&1`,
+    `else`,
+    `  echo "DB_AUTH_MODE=API_KEY_ONLY"`,
+    `  source /tmp/hw_api_key 2>/dev/null`,
+    `  if [ -n "$HW_API_KEY" ]; then`,
+    `    devbridge auth login --api-key "$HW_API_KEY" > /tmp/db_auth.log 2>&1`,
+    `  else`,
+    `    echo "DB_AUTH_MODE=NO_API_KEY"`,
+    `  fi`,
+    `fi`,
+    `devbridge auth status > /tmp/db_status.log 2>&1 || true`,
+  ].join('\n');
+}
+
+// Start (or replace) a devbridge host bound to a single port, extract the public
+// URL, and health-check it. Mirrors the huaweicloud-sandbox skill's Expose flow:
+// pre-clean stale tunnels (quota 10006), start host in background, read
+// "Tunnel URL: ..." from /tmp/host.log, curl-check, retry once on unreachable.
+export function buildDevbridgeExposeScript(port) {
+  const hostLog = '/tmp/host.log';
+  return [
+    `pkill -f "devbridge host" 2>/dev/null || true`,
+    `sleep 2`,
+    `devbridge delete-all > /dev/null 2>&1 || true`,
+    `nohup devbridge host -p ${port} -e 8 > ${hostLog} 2>&1 &`,
+    `sleep 12`,
+    `TUNNEL_URL=$(sed -n 's/.*Tunnel URL: *//p' ${hostLog} | tail -1)`,
+    `HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "$TUNNEL_URL" 2>/dev/null || echo "000")`,
+    `echo "DB_HOST_LOG="`,
+    `tail -n 5 ${hostLog}`,
+    `echo "DB_TUNNEL_URL=$TUNNEL_URL"`,
+    `echo "DB_HTTP_CODE=$HTTP_CODE"`,
+    `echo "DB_QUOTA_ERROR=$(grep -c '10006' ${hostLog} 2>/dev/null || echo 0)"`,
+  ].join('\n');
+}
+
+// Parse the raw stdout of buildDevbridgeExposeScript into structured fields.
+export function parseDevbridgeExposeOutput(stdout) {
+  const text = String(stdout || '');
+  const getField = (key) => {
+    const m = text.match(new RegExp(`^${key}=(.*)$`, 'm'));
+    return m ? m[1].trim() : '';
+  };
+  const tunnelUrl = getField('DB_TUNNEL_URL') || (text.match(/TUNNEL_URL:(https:\/\/[^\s]+)/) || [])[1] || '';
+  const httpCode = getField('DB_HTTP_CODE');
+  const quotaError = getField('DB_QUOTA_ERROR') === '1' || /10006/.test(text);
+  const tunnelId = (tunnelUrl.match(/^https:\/\/([A-Za-z0-9_-]+)-\d+\./) || [])[1] || '';
+  return { tunnelUrl, httpCode, quotaError, tunnelId };
+}
+
+// Parse and validate a TCP port number destined for shell interpolation. Returns
+// the integer when 1..65535; throws otherwise. Guards the `-p ${port}` shell
+// splice in buildDevbridgeExposeScript against non-numeric / out-of-range input.
+export function validateTunnelPort(port) {
+  const n = Number(port);
+  if (!Number.isSafeInteger(n) || n < 1 || n > 65535) {
+    throw new Error(
+      `sandbox expose tunnel: invalid port ${JSON.stringify(port)}. Expected an integer between 1 and 65535 (use the "port" value returned by sandbox_deploy_nginx).`,
+    );
+  }
+  return n;
+}
+
+// Expose a sandbox port to a public DevBridge tunnel URL. `port` MUST be the
+// ACTUAL port reported by deployNginx (deploy_nginx auto-increments on conflict),
+// otherwise the tunnel is bound to a dead port. Returns ok, publicUrl, port,
+// tunnelId, auth mode, and warnings.
+export async function exposeTunnel(workspaceId, { port }, username = 'root', timeoutMs = 90000) {
+  if (!workspaceId) {
+    throw new Error('sandbox expose tunnel: workspace_id is required.');
+  }
+  const validatedPort = validateTunnelPort(port);
+
+  const authScript = buildDevbridgeAuthProbe();
+  const authResult = await execOneShot(workspaceId, authScript, username, 30000);
+  const authModes = String(authResult.stdout || '').match(/DB_AUTH_MODE=([A-Z_]+)/g) || [];
+  const authMode = authModes.length > 0 ? authModes[authModes.length - 1].split('=')[1] : '';
+
+  if (authMode === 'NO_API_KEY' || (!authMode && !String(authResult.stdout || '').includes('AKSK_SUPPORTED'))) {
+    const loginOutput = String(authResult.stdout || '') + String(authResult.stderr || '');
+    return {
+      ok: false,
+      error: 'DevBridge authentication failed: the release build requires an API Key that has not been injected.',
+      authMode: authMode || 'UNKNOWN',
+      hint:
+        'Create an API Key at https://devstation.connect.huaweicloud.com/space/devbridge/apikey, set it locally via ' +
+        '`export HW_API_KEY=<key>`, then re-run huaweicloud_sandbox_credentials so it is injected into the sandbox. ' +
+        'Then call huaweicloud_sandbox_expose_tunnel again.',
+      loginOutput,
+    };
+  }
+
+  let result = null;
+  let attempt = 0;
+  const maxAttempts = 2;
+  while (attempt < maxAttempts) {
+    attempt += 1;
+    const exposeScript = buildDevbridgeExposeScript(validatedPort);
+    result = await execOneShot(workspaceId, exposeScript, username, timeoutMs);
+    const parsed = parseDevbridgeExposeOutput(result.stdout);
+
+    // 10006 quota exceeded: clean up stale tunnels and retry.
+    if (parsed.quotaError && attempt < maxAttempts) {
+      continue;
+    }
+    // Unreachable (000) or a migrated-gateway placeholder: one retry.
+    const unreachable = parsed.httpCode === '000' || parsed.httpCode === '';
+    const migration = /服务已迁移/.test(String(result.stdout || ''));
+    if (unreachable || migration) {
+      if (attempt === 1) {
+        try {
+          await execOneShot(
+            workspaceId,
+            `pkill -f "devbridge host" 2>/dev/null || true; sleep 2; devbridge delete-all > /dev/null 2>&1 || true`,
+            username,
+            20000,
+          );
+        } catch {}
+        continue;
+      }
+    }
+
+    const warnings = [];
+    if (parsed.quotaError)
+      warnings.push('DevBridge tunnel quota (10006) hit — stale tunnels were cleaned up and the host was retried.');
+    if (parsed.httpCode !== '200' && parsed.httpCode !== '304') {
+      warnings.push(
+        `Tunnel reachable check returned HTTP ${parsed.httpCode} (expected 200/304). The URL may not be serving yet.`,
+      );
+    }
+    return {
+      ok: true,
+      publicUrl: parsed.tunnelUrl || undefined,
+      port: validatedPort,
+      tunnelId: parsed.tunnelId || undefined,
+      authMode,
+      httpCode: parsed.httpCode,
+      warnings: warnings.length > 0 ? warnings.join(' ') : undefined,
+      hostLog: String(result.stdout || '').slice(0, 400),
+    };
+  }
+
+  return {
+    ok: false,
+    error: 'Failed to expose a working DevBridge tunnel after retries.',
+    authMode,
+    hostLog: String(result?.stdout || '').slice(0, 400),
+  };
+}
+
 export async function closeAllSessions() {
   for (const [key, session] of sessions) {
     sessions.delete(key);

package/plugins/huaweicloud-core/src/search-market.mjs

@@ -152,6 +152,44 @@ function truncate(desc, limit = 150) {
   return desc.length > limit ? desc.slice(0, limit) + '...' : desc;
 }
 
+// Build a git-free install command: download the skills repo ZIP over HTTP,
+// extract it, locate the skill folder by name, and copy it into the caller's
+// agent skills directory. `npx skills add ...` requires git on PATH, which is
+// absent on stripped Windows Server / sandbox environments (#F). When even HTTP
+// download fails the returned fallback notes guide a manual download instead of
+// trying to install git.
+export function buildSkillInstallCommand(skill, skillsDirHint = '<your-agent-skills-dir>') {
+  const esc = (s) =>
+    String(s || '')
+      .replace(/\./g, '-')
+      .replace(/[^A-Za-z0-9_-]/g, '-');
+  const name = esc(skill.name);
+  const rel = skill.category && skill.service ? `skills/${esc(skill.category)}/${esc(skill.service)}/${name}` : null;
+  const findSrc = rel
+    ? `SKILL_SRC="/tmp/hw-skills-net/huaweicloud-skills-master/${rel}"`
+    : `SKILL_SRC=$(find /tmp/hw-skills-net/huaweicloud-skills-master/skills -type d -name "${name}" 2>/dev/null | head -1)`;
+  // P4: the skills-dir hint is caller-supplied and spliced into shell — quote it
+  // and strip shell metacharacters so a hostile/broken hint cannot inject args.
+  const dirEsc = String(skillsDirHint || '').replace(/[^A-Za-z0-9_./~-]/g, '-');
+  const targetDir = dirEsc === '' ? '<your-agent-skills-dir>' : dirEsc;
+  return [
+    '(curl -fsSL https://gitcode.com/huaweicloud/huaweicloud-skills/-/archive/master/huaweicloud-skills-master.zip -o /tmp/hw-skills.zip && unzip -oq /tmp/hw-skills.zip -d /tmp/hw-skills-net) || (curl -fsSL https://github.com/huaweicloud/huaweicloud-skills/archive/refs/heads/master.zip -o /tmp/hw-skills.zip && unzip -oq /tmp/hw-skills.zip -d /tmp/hw-skills-net)',
+    `&& ${findSrc}`,
+    // P5: short-circuit the && chain on a missing / non-skill folder — `echo`
+    // exits 0, so the branch must end with `false` or cp -r would still run.
+    `&& (test -d "$SKILL_SRC" || { echo "SKILL_SRC_NOT_FOUND"; false; })`,
+    `&& (test -f "$SKILL_SRC/SKILL.md" || { echo "SKILL_SRC_NOT_FOUND"; false; })`,
+    `&& mkdir -p "${targetDir}" && cp -r "$SKILL_SRC" "${targetDir}/${name}"`,
+  ].join(' ');
+}
+
+const INSTALL_DOWNLOAD_HINT =
+  'No git required — installs by downloading the repo ZIP over HTTP and copying the skill folder. ' +
+  'If the command reports SKILL_SRC_NOT_FOUND, replace <your-agent-skills-dir> with this agent\u2019s skills directory ' +
+  '(Claude Code ~/.claude/skills, OpenCode ~/.config/opencode/skills, Cursor ~/.cursor/skills) and re-run. ' +
+  'If HTTP download itself fails, download https://github.com/huaweicloud/huaweicloud-skills/archive/refs/heads/master.zip ' +
+  'manually, extract it, copy the skill folder, and tell the user how the skill was installed.';
+
 export async function searchMarketplace(query = '', category = '') {
   const idx = await loadIndex();
   const cnEnMap = await loadCnEnMap();
@@ -171,7 +209,8 @@ export async function searchMarketplace(query = '', category = '') {
       description: truncate(skill.description),
       triggers: (skill.triggers || []).slice(0, 5),
       matched,
-      installCommand: `npx skills add huaweicloud/huaweicloud-skills --skill ${skill.name}`,
+      installCommand: buildSkillInstallCommand(skill),
+      installHint: INSTALL_DOWNLOAD_HINT,
     });
   }
   results.sort((a, b) => b.score - a.score);