huaweicloud-devkit 1.1.8 → 1.1.9-next.1

package/plugins/huaweicloud-core/src/sandbox/session-manager.mjs

@@ -1251,17 +1251,33 @@ export function parseDevbridgeAuthOutput(stdout) {
   return { authMode, attempts };
 }
 
+// Tunnel lifetime for expose-created hosts, in hours. The report that motivated
+// #919 uses -e 72 so the shared link survives long after the deploying session
+// ends; the value is surfaced to callers via exposeTunnel's expiresAt field.
+export const DEVBRIDGE_HOST_EXPIRY_HOURS = 72;
+
 // Start (or replace) a devbridge host bound to a single port, extract the public
 // URL, and health-check it. Mirrors the huaweicloud-sandbox skill's Expose flow:
 // pre-clean stale tunnels (quota 10006), start host in background, read
 // "Tunnel URL: ..." from /tmp/host.log, curl-check, retry once on unreachable.
-export function buildDevbridgeExposeScript(port) {
+// The host MUST survive the exec session that started it (#919): setsid detaches
+// it from the session's process group, `< /dev/null` drops the controlling tty
+// stdin, and `disown` removes it from the shell's job table — without all three
+// the host is reaped when the one-shot session ends and the tunnel dies
+// immediately after a green in-session health check (the "假成功" bug).
+export function buildDevbridgeExposeScript(port, expiryHours = DEVBRIDGE_HOST_EXPIRY_HOURS) {
   const hostLog = '/tmp/host.log';
   return [
     `pkill -f "devbridge host" 2>/dev/null || true`,
     `sleep 2`,
     `devbridge delete-all > /dev/null 2>&1 || true`,
-    `nohup devbridge host -p ${port} -e 8 > ${hostLog} 2>&1 &`,
+    // #922 (S8): setsid is unavailable on some sandbox images — fall back to a
+    // bare nohup launch so the host still starts; persistence is then judged by
+    // the independent re-verify below, which emits the 请勿分享 warning in the
+    // non-persistent case. disown is guarded: shells without the builtin must
+    // not abort the script.
+    `if command -v setsid > /dev/null 2>&1; then setsid nohup devbridge host -p ${port} -e ${expiryHours} > ${hostLog} 2>&1 < /dev/null & else nohup devbridge host -p ${port} -e ${expiryHours} > ${hostLog} 2>&1 < /dev/null & fi`,
+    `disown 2>/dev/null || true`,
     `sleep 12`,
     `TUNNEL_URL=$(sed -n 's/.*Tunnel URL: *//p' ${hostLog} | tail -1)`,
     `HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "$TUNNEL_URL" 2>/dev/null || echo "000")`,
@@ -1269,10 +1285,37 @@ export function buildDevbridgeExposeScript(port) {
     `tail -n 5 ${hostLog}`,
     `echo "DB_TUNNEL_URL=$TUNNEL_URL"`,
     `echo "DB_HTTP_CODE=$HTTP_CODE"`,
+    `echo "DB_EXPIRY_HOURS=${expiryHours}"`,
     `echo "DB_QUOTA_ERROR=$(grep -c '10006' ${hostLog} 2>/dev/null || echo 0)"`,
   ].join('\n');
 }
 
+// Build the script for the SECOND, independent exec session that re-verifies the
+// tunnel with a real GET (#919): the in-session health check inside
+// buildDevbridgeExposeScript cannot prove the host survived session teardown —
+// a GET from a fresh session can. #922 (B2): the response body is kept and
+// checked for the native false-success form — a 200 whose body is "tunnel not
+// found" — and the verdict is emitted as DB_VERIFY_NOT_FOUND so
+// parseDevbridgeVerifyOutput can catch it. The URL is validated (https,
+// URL-safe chars only) before being spliced into the shell command.
+export function buildDevbridgeVerifyScript(tunnelUrl) {
+  const url = String(tunnelUrl || '');
+  if (!/^https:\/\/[A-Za-z0-9:._/-]+$/.test(url)) {
+    throw new Error(
+      `sandbox expose tunnel: invalid tunnel URL ${JSON.stringify(url.slice(0, 80))}. Expected an https:// URL with URL-safe characters (from the expose script's DB_TUNNEL_URL output).`,
+    );
+  }
+  const bodyFile = '/tmp/devbridge_verify_body';
+  return [
+    `VERIFY_CODE=$(curl -s -o ${bodyFile} -w "%{http_code}" --max-time 10 "${url}" 2>/dev/null || echo "000")`,
+    `VERIFY_NOT_FOUND=$(grep -ci 'tunnel not found' ${bodyFile} 2>/dev/null || true)`,
+    `if [ -z "$VERIFY_NOT_FOUND" ]; then VERIFY_NOT_FOUND=0; fi`,
+    `rm -f ${bodyFile} 2>/dev/null || true`,
+    `echo "DB_VERIFY_HTTP_CODE=$VERIFY_CODE"`,
+    `echo "DB_VERIFY_NOT_FOUND=$VERIFY_NOT_FOUND"`,
+  ].join('\n');
+}
+
 // Parse the raw stdout of buildDevbridgeExposeScript into structured fields.
 export function parseDevbridgeExposeOutput(stdout) {
   const text = String(stdout || '');
@@ -1284,7 +1327,25 @@ export function parseDevbridgeExposeOutput(stdout) {
   const httpCode = getField('DB_HTTP_CODE');
   const quotaError = getField('DB_QUOTA_ERROR') === '1' || /10006/.test(text);
   const tunnelId = (tunnelUrl.match(/^https:\/\/([A-Za-z0-9_-]+)-\d+\./) || [])[1] || '';
-  return { tunnelUrl, httpCode, quotaError, tunnelId };
+  const expiryHours = Number(getField('DB_EXPIRY_HOURS')) || undefined;
+  return { tunnelUrl, httpCode, quotaError, tunnelId, expiryHours };
+}
+
+// Parse the raw stdout of buildDevbridgeVerifyScript into structured fields.
+// Dedicated parser (#922 B1): the verify script emits DB_VERIFY_HTTP_CODE /
+// DB_VERIFY_NOT_FOUND keys — the anchored ^DB_HTTP_CODE= lookup in
+// parseDevbridgeExposeOutput never matches them, which used to leave
+// verifyHttpCode empty and persistent always false.
+export function parseDevbridgeVerifyOutput(stdout) {
+  const text = String(stdout || '');
+  const getField = (key) => {
+    const m = text.match(new RegExp(`^${key}=(.*)$`, 'm'));
+    return m ? m[1].trim() : '';
+  };
+  const httpCode = getField('DB_VERIFY_HTTP_CODE');
+  const notFoundCount = Number(getField('DB_VERIFY_NOT_FOUND')) || 0;
+  const notFound = notFoundCount > 0;
+  return { httpCode, notFound };
 }
 
 // Parse and validate a TCP port number destined for shell interpolation. Returns
@@ -1303,7 +1364,10 @@ export function validateTunnelPort(port) {
 // Expose a sandbox port to a public DevBridge tunnel URL. `port` MUST be the
 // ACTUAL port reported by deployNginx (deploy_nginx auto-increments on conflict),
 // otherwise the tunnel is bound to a dead port. Returns ok, publicUrl, port,
-// tunnelId, auth mode, and warnings.
+// tunnelId, auth mode, expiresAt (tunnel lifetime from -e), and warnings; the
+// tunnel is re-verified from a second independent exec session (#919) and the
+// result carries verifyHttpCode + persistent so callers can tell a
+// session-surviving URL from one that dies with the deploying session.
 export async function exposeTunnel(workspaceId, { port }, username = 'root', timeoutMs = 90000) {
   if (!workspaceId) {
     throw new Error('sandbox expose tunnel: workspace_id is required.');
@@ -1367,11 +1431,58 @@ export async function exposeTunnel(workspaceId, { port }, username = 'root', tim
     const warnings = [];
     if (parsed.quotaError)
       warnings.push('DevBridge tunnel quota (10006) hit — stale tunnels were cleaned up and the host was retried.');
+
+    // #919: re-verify with a real GET from a SECOND, independent exec session.
+    // The in-session health check above cannot prove the host survived session
+    // teardown (setsid/nohup/disown make that likely, not certain). When the
+    // fresh-session GET fails, the URL will die with the deploying session —
+    // say so explicitly instead of returning a link the visitor cannot open.
+    let verifyHttpCode = '';
+    let verifyNotFound = false;
+    let persistent = undefined;
+    if (parsed.tunnelUrl) {
+      try {
+        const verifyResult = await execOneShot(
+          workspaceId,
+          buildDevbridgeVerifyScript(parsed.tunnelUrl),
+          username,
+          30000,
+        );
+        // #922 (B1): parse with the dedicated verify parser — the
+        // DB_VERIFY_HTTP_CODE key is not visible to parseDevbridgeExposeOutput.
+        const verify = parseDevbridgeVerifyOutput(verifyResult.stdout);
+        verifyHttpCode = verify.httpCode || '';
+        // #922 (B2): a native false-success form answers HTTP 200 with a
+        // "tunnel not found" body — treat it as non-persistent.
+        verifyNotFound = verify.notFound;
+      } catch {}
+      // 000 = the fresh session could not reach the tunnel (host already dead
+      // or gateway not serving); 200 with a "tunnel not found" body = the
+      // gateway answered but the tunnel is gone; anything non-200/304 is
+      // surfaced as-is below.
+      persistent = verifyHttpCode !== '' && verifyHttpCode !== '000' && !verifyNotFound;
+      if (!persistent) {
+        if (verifyNotFound) {
+          warnings.push(
+            '复测返回 HTTP 200 但 body 为 "tunnel not found"（原生假成功形态），隧道实际未生效，请勿分享 (the recheck answered HTTP 200 with a "tunnel not found" body — the tunnel is NOT serving; do NOT share this URL).',
+          );
+        } else {
+          warnings.push(
+            '隧道将在会话结束后失效，请勿分享 (the tunnel did NOT survive an independent exec-session recheck — do NOT share this URL; the host process is not persistent).',
+          );
+        }
+      }
+    }
+
     if (parsed.httpCode !== '200' && parsed.httpCode !== '304') {
       warnings.push(
         `Tunnel reachable check returned HTTP ${parsed.httpCode} (expected 200/304). The URL may not be serving yet.`,
       );
     }
+    const expiresAt =
+      parsed.expiryHours !== undefined
+        ? new Date(Date.now() + parsed.expiryHours * 3_600_000).toISOString()
+        : undefined;
     return {
       ok: true,
       publicUrl: parsed.tunnelUrl || undefined,
@@ -1379,6 +1490,11 @@ export async function exposeTunnel(workspaceId, { port }, username = 'root', tim
       tunnelId: parsed.tunnelId || undefined,
       authMode,
       httpCode: parsed.httpCode,
+      verifyHttpCode: verifyHttpCode || undefined,
+      verifyNotFound: verifyNotFound || undefined,
+      persistent,
+      expiresAt,
+      expiresInHours: parsed.expiryHours,
       warnings: warnings.length > 0 ? warnings.join(' ') : undefined,
       hostLog: String(result.stdout || '').slice(0, 400),
     };

package/plugins/huaweicloud-core/src/setup-cli.mjs

@@ -961,6 +961,21 @@ async function installOpenCode() {
   mkdirSync(opcPlugins, { recursive: true });
   copyFileSync(pluginSrc, join(opcPlugins, 'skill-tracker.js'));
   console.log(`  Plugin -> ${opcPlugins}`);
+  // OpenCode native plugin (#905 OpenCode performance): bridges all 42 MCP tools
+  // into OpenCode in-process custom tools (zod schemas + callTool), plus safety
+  // gate and telemetry. Local plugins are auto-loaded from this directory.
+  const nativePluginSrc = join(PACKAGE_ROOT, 'integrations', 'opencode', 'plugins', 'huaweicloud-devkit.js');
+  if (existsSync(nativePluginSrc)) {
+    copyFileSync(nativePluginSrc, join(opcPlugins, 'huaweicloud-devkit.js'));
+    // Deps for the native plugin (zod) live next to the OpenCode config so the
+    // plugin can require them at load time.
+    const nativePkgSrc = join(PACKAGE_ROOT, 'integrations', 'opencode', 'package.json');
+    const nativePkgDst = join(configRoot('opencode'), 'package.json');
+    if (existsSync(nativePkgSrc) && !existsSync(nativePkgDst)) {
+      copyFileSync(nativePkgSrc, nativePkgDst);
+    }
+    console.log(`  Native plugin -> ${join(opcPlugins, 'huaweicloud-devkit.js')}`);
+  }
   updateOpenCodeConfig(pluginDest);
   installRuntimeDeps(pluginDest);
 }
@@ -994,6 +1009,11 @@ function uninstallOpenCode() {
     removeIfExists(pluginFile);
     console.log('  Removed plugin');
   }
+  const nativePluginFile = join(configRoot('opencode'), 'plugins', 'huaweicloud-devkit.js');
+  if (existsSync(nativePluginFile)) {
+    removeIfExists(nativePluginFile);
+    console.log('  Removed native plugin');
+  }
 
   if (removeIfExists(opencodePluginsDir())) {
     console.log('  Removed MCP server and safety policy');
@@ -1041,6 +1061,17 @@ async function updateOpenCode() {
   mkdirSync(opcPlugins, { recursive: true });
   copyFileSync(pluginSrc, join(opcPlugins, 'skill-tracker.js'));
   console.log(`  Plugin updated -> ${opcPlugins}`);
+  // Native plugin refresh (#905 OpenCode performance) — overwrite in place.
+  const nativePluginSrc = join(PACKAGE_ROOT, 'integrations', 'opencode', 'plugins', 'huaweicloud-devkit.js');
+  if (existsSync(nativePluginSrc)) {
+    copyFileSync(nativePluginSrc, join(opcPlugins, 'huaweicloud-devkit.js'));
+    const nativePkgSrc = join(PACKAGE_ROOT, 'integrations', 'opencode', 'package.json');
+    const nativePkgDst = join(configRoot('opencode'), 'package.json');
+    if (existsSync(nativePkgSrc) && !existsSync(nativePkgDst)) {
+      copyFileSync(nativePkgSrc, nativePkgDst);
+    }
+    console.log(`  Native plugin updated -> ${join(opcPlugins, 'huaweicloud-devkit.js')}`);
+  }
   updateOpenCodeConfig(pluginDest);
   mkdirSync(pluginDest, { recursive: true });
   writeFileSync(join(pluginDest, '.installed'), new Date().toISOString());
@@ -4873,6 +4904,53 @@ function configureHcloud(credentials) {
   };
 }
 
+function resetHcloudProfile() {
+  const hcloudBin = findHcloudBin() || process.env.HCLOUD_BIN || 'hcloud';
+  const r = spawnSync(hcloudBin, ['configure', 'delete', `--cli-profile=${configuredProfileName()}`], {
+    shell: false,
+    windowsHide: true,
+    stdio: 'pipe',
+    timeout: 30000,
+  });
+  return {
+    ok: r.status === 0,
+    error: redactSecrets(
+      String(r.stderr || '')
+        .trim()
+        .slice(0, 240),
+    ),
+  };
+}
+
+// Verify that the freshly written KooCLI profile can actually authenticate
+// (#920): a stale/expired security token in the profile survives
+// `configure set` (it refuses empty values) and poisons every hcloud call with
+// APIGW.0301 — while the setup output still claims success. Probe with a real
+// `hcloud STS GetCallerIdentity` and only report synchronized when it passes.
+function verifyHcloudIdentity(region) {
+  const hcloudBin = findHcloudBin() || process.env.HCLOUD_BIN || 'hcloud';
+  // #922 (S2): an empty region must be omitted entirely — `--cli-region=`
+  // sends a literal empty value that KooCLI rejects as an invalid region.
+  const args = ['STS', 'GetCallerIdentity'];
+  if (region) args.push(`--cli-region=${region}`);
+  const r = spawnSync(hcloudBin, args, {
+    shell: false,
+    windowsHide: true,
+    stdio: 'pipe',
+    timeout: 30000,
+  });
+  const output = `${r.stdout || ''}${r.stderr || ''}`;
+  return {
+    ok: r.status === 0 && !/APIGW\.0301|Incorrect IAM authentication/i.test(output),
+    code: r.status,
+    error: redactSecrets(
+      String(r.stderr || r.stdout || '')
+        .trim()
+        .slice(0, 240),
+    ),
+  };
+}
+
 function printAuthAgents(agents = {}) {
   for (const [agent, info] of Object.entries(agents)) {
     console.log(`  ${agent}: ${info.configured ? '[OK]' : '[MISSING]'}`);
@@ -4951,6 +5029,12 @@ async function cmdAuthInit() {
   }
 
   if (findHcloudBin()) {
+    // #920: `configure set` refuses empty --cli-security-token values, so a
+    // stale token already in the profile survives the write. When auth init
+    // runs WITHOUT a token, delete the profile first (documented manual
+    // bypass) so the recreated profile cannot keep poisoning calls with
+    // APIGW.0301. A missing profile ("nothing to clean") is not an error.
+    if (!securityToken) resetHcloudProfile();
     const result = configureHcloud({ ak, sk, region });
     if (!result.ok) console.log(`KooCLI update failed: ${result.error || result.code}`);
     else {
@@ -4958,21 +5042,40 @@ async function cmdAuthInit() {
       if (proj.ok) {
         console.log(`  Project ID auto-set: ${proj.projectId}`);
       } else {
-        console.log(
-          `\x1b[33m  Project ID not auto-set (${proj.reason}). Sandbox exec may fail with APIGW.0301 until it is configured:\x1b[0m`,
+        // #920: an unconfigured project_id is an ERROR, not a warning — most
+        // hcloud calls fail with APIGW.0301 until it is set.
+        console.error(
+          `\x1b[31m  ERROR: Project ID not auto-set (${proj.reason}). hcloud API calls (ECS/VPC/OBS API paths, sandbox exec) will fail with APIGW.0301 Incorrect IAM authentication information until it is configured. Recover with:\x1b[0m`,
         );
-        console.log(`    hcloud IAM KeystoneListProjects --cli-region=${region} --name=${region}`);
-        console.log(`    hcloud configure set --cli-project-id=<project_id>`);
+        console.error(`    hcloud IAM KeystoneListProjects --cli-region=${region} --name=${region}`);
+        console.error(`    hcloud configure set --cli-project-id=<project_id>`);
+        console.error(`    (or re-run "npx huaweicloud-devkit auth init", which auto-sets it)`);
+      }
+
+      // #920: verify the profile can actually authenticate before claiming
+      // success — a poisoned profile must never print "synchronized".
+      const identity = verifyHcloudIdentity(region);
+      if (identity.ok) {
+        console.log('\nCredentials synchronized.');
+      } else {
+        console.error(
+          `\x1b[31m  ERROR: credentials were written but the KooCLI profile FAILED the hcloud STS GetCallerIdentity verification (exit ${identity.code}). hcloud calls will fail with APIGW.0301 — "Credentials synchronized" is NOT confirmed. Typical cause: a stale/expired security token in the profile or wrong AK/SK. Recover with:\x1b[0m`,
+        );
+        console.error(`    hcloud configure delete --cli-profile=${configuredProfileName()}`);
+        console.error(`    then re-run "npx huaweicloud-devkit auth init" with AK/SK only (no token)`);
+        console.error(`    Last error: ${identity.error || 'unknown'}`);
+        process.exitCode = 1;
       }
     }
   } else {
     console.log('KooCLI not found. Run "npx huaweicloud-devkit install-hcloud" and then "auth sync".');
   }
 
-  console.log('\nCredentials synchronized.');
-  console.log('\nNext steps:');
-  console.log('  npx huaweicloud-devkit install --target all');
-  console.log('  Restart your agent sessions.');
+  if (process.exitCode !== 1) {
+    console.log('\nNext steps:');
+    console.log('  npx huaweicloud-devkit install --target all');
+    console.log('  Restart your agent sessions.');
+  }
 }
 
 async function cmdAuthReconcile() {

package/plugins/huaweicloud-core/src/tools.mjs

@@ -53,7 +53,7 @@ import {
 } from './auth/credentials.mjs';
 import { trackToolInvoke, trackSkillRetrieve, clearUserHash } from './telemetry/telemetry.mjs';
 import { fetchWithProxy } from './proxy/proxy-agent.mjs';
-import { fingerprint, runHcloudConfigure, resolveManagedProfile } from './auth/reconcile.mjs';
+import { fingerprint, runHcloudConfigure, runHcloudProfileDelete, resolveManagedProfile } from './auth/reconcile.mjs';
 import {
   getCachedUpdateInfo,
   getUpdateDistTags,
@@ -65,7 +65,7 @@ import {
   resolveSkipFilePath,
   upgradePackage,
 } from './update-check.mjs';
-import { hcloudProbeNextStep, probeHcloud } from './hcloud-probe.mjs';
+import { hcloudProbeNextStep, hcloudProbeRaw, probeHcloud } from './hcloud-probe.mjs';
 import { isUsableOfficeaceRoot, readOfficeaceRootMarker } from './officeace-paths.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -1090,7 +1090,20 @@ function persistCredentials(ak, sk, securityToken, region) {
   if (!profile) {
     hcloud = { ok: false, reason: 'KooCLI current profile unresolved' };
   } else {
+    // #920: `configure set` refuses an empty --cli-security-token, so a stale
+    // token already in the profile survives the write and poisons every hcloud
+    // call with APIGW.0301 — while the tool still reports "synchronized". When
+    // persisting WITHOUT a token, walk the documented manual bypass
+    // (delete the profile, then re-configure) so the on-disk profile truly
+    // matches the incoming credentials. The delete is best-effort: a missing
+    // profile ("nothing to clean") must not fail the persist.
+    let profileReset = false;
+    if (!String(securityToken || '')) {
+      const deleted = runHcloudProfileDelete(profile);
+      profileReset = deleted.ok || /not (exist|found)/i.test(deleted.error || '');
+    }
     hcloud = runHcloudConfigure(profile, ak, sk, region);
+    hcloud.profileReset = profileReset;
   }
   if (hcloud.ok) {
     writeLastSync({ kooCliProfile: profile, s1Fingerprint: fingerprint(ak, sk) });
@@ -1101,7 +1114,7 @@ function persistCredentials(ak, sk, securityToken, region) {
     backedUp: Boolean(before),
     obs: obs.ok ? { configured: true } : { configured: false, error: obs.error },
     hcloud,
-    note: 'S1 written with configuredBySession (R9), which now takes priority over env-injected credentials; S2(current profile) and S3 synced. Note: running `auth init` later clears the configuredBySession flag and env credentials regain priority.',
+    note: 'S1 written with configuredBySession (R9), which now takes priority over env-injected credentials; S2(current profile) and S3 synced. Persisting without a security token resets the target profile first (delete + recreate) so a stale token cannot survive the write (#920). Note: running `auth init` later clears the configuredBySession flag and env credentials regain priority.',
   };
 }
 
@@ -1662,6 +1675,7 @@ export async function runVersionCheck(options = {}) {
     installedVersion: result.installedVersion || undefined,
     versionMismatch: Boolean(result.versionMismatch),
     nextStep: hcloudProbeNextStep(result),
+    raw: hcloudProbeRaw(result),
     authHint:
       'If hcloud is installed but commands fail with "配置文件中不存在配置项", run `npx huaweicloud-devkit auth init` outside agent chat to configure credentials.',
   };
@@ -2263,6 +2277,8 @@ function explainError({ service = 'unknown', errorCode = '', message = '', reque
   const SERVICE_ALIASES = {
     functiongraph: 'FSS',
     fgs: 'FSS',
+    ecs: 'Ecs',
+    ECS: 'Ecs',
   };
   const patternKey = SERVICE_ALIASES[svc] || service;
 
@@ -2290,6 +2306,10 @@ function explainError({ service = 'unknown', errorCode = '', message = '', reque
     VPC: {
       'VPC.0301': 'Bandwidth name is required for PER type EIPs, even though --help marks it optional.',
     },
+    Ecs: {
+      'Ecs.0707':
+        'The flavor + image-type combination does not exist ("the product does not exist") — the error does not say which side is wrong, so check BOTH (#922): (1) the flavor is abandoned/sellout in this region/AZ (check os_extra_specs.cond:operation:status and cond:operation:az; see the huawei-ecs skill references/flavors.md for the AZ-vs-global-status conflict rule); (2) the image TYPE is incompatible with the flavor — market-type images fail with KunPeng flavors (kc1/kc2 etc.). Fix: switch the image to a gold-type image or switch to a compatible general-purpose flavor (verified: kc2.small.2 + market Ubuntu → Ecs.0707; s6.medium.2 + gold Ubuntu works), re-listing with hcloud ECS ListFlavors / hcloud IMS ListImages --__imagetype=gold first.',
+    },
     APIGW: {
       'APIGW.0301':
         'Incorrect IAM authentication information. The AK/SK is invalid (check the SK for typos), the security token is missing or expired, or the profile lacks project_id. Fix: re-run "npx huaweicloud-devkit auth init" (it auto-sets project_id), or set it manually: hcloud configure set --cli-project-id=<project_id> after finding it via hcloud IAM KeystoneListProjects --cli-region=<region> --name=<region>.',