huaweicloud-devkit 1.1.9-next.0 → 1.1.9-next.1

package/README.md

@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
-[![Beta](https://img.shields.io/badge/beta-v1.1.9-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.9-next.1-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 
 **[中文](README.zh-CN.md) | English**
 

package/README.zh-CN.md

@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
-[![Beta](https://img.shields.io/badge/beta-v1.1.9-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.9-next.1-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 
 **中文 | [English](README.md)**
 

package/integrations/opencode/package-lock.json

@@ -0,0 +1,24 @@
+{
+  "name": "@huaweicloud-devkit/opencode-integration",
+  "version": "0.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@huaweicloud-devkit/opencode-integration",
+      "version": "0.0.0",
+      "dependencies": {
+        "zod": "^3.11.0"
+      }
+    },
+    "node_modules/zod": {
+      "version": "3.25.76",
+      "resolved": "https://repo.huaweicloud.com/repository/npm/zod/-/zod-3.25.76.tgz",
+      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    }
+  }
+}

package/integrations/opencode/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@huaweicloud-devkit/opencode-integration",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "description": "Local deps for the huaweicloud-devkit OpenCode plugin (zod for tool schema conversion). Installed into ~/.config/opencode by 'npx huaweicloud-devkit install --target opencode'.",
+  "dependencies": {
+    "zod": "^3.11.0"
+  }
+}

package/integrations/opencode/plugins/huaweicloud-devkit.js

@@ -0,0 +1,194 @@
+// huaweicloud-devkit OpenCode native plugin
+//
+// Bridges all 42 MCP tools into OpenCode in-process custom tools via the shared
+// callTool() business layer, plus:
+//   - tool.execute.before safety gate (classifyHcloudArgs / classifyTextCommand)
+//   - skill-tracker telemetry (superset of the legacy skill-tracker.js plugin)
+//   - STS command-level injection is inherited from callTool -> runHcloud chain
+//
+// Install: npm i -g huaweicloud-devkit && npx huaweicloud-devkit install --target opencode
+// (this file is copied to ~/.config/opencode/plugins/huaweicloud-devkit.js and
+//  auto-loaded by OpenCode at startup — local plugins need no config entry)
+//
+// Compatibility contract (unchanged from MCP mode):
+//   - tool names stay `huaweicloud_*` (skills/hook matchers keep working)
+//   - approval gate: run_approved_command still requires args+approvalToken+approvedByUser
+//   - credentials: resolveCredentials reads env (HW_*) then S1 — same priority as MCP
+
+import { appendFileSync, mkdirSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const z = require('zod');
+
+// devkit core — resolved from the installed plugin tree next to this file
+const selfDir = dirname(fileURLToPath(import.meta.url));
+const DEVKIT_SRC = join(selfDir, '..', 'huaweicloud-plugins', 'src');
+
+let devkit = null;
+let loadError = null;
+try {
+  devkit = await import(`file://${join(DEVKIT_SRC, 'tools.mjs')}`);
+} catch (error) {
+  loadError = error;
+}
+
+// ── telemetry (superset of legacy skill-tracker.js) ─────────────────────────
+
+const TELEMETRY_DIR = join(DEVKIT_SRC, '..', 'telemetry');
+function writeEvent(key, value, extra = {}) {
+  try {
+    if (!existsSync(TELEMETRY_DIR)) mkdirSync(TELEMETRY_DIR, { recursive: true });
+    appendFileSync(join(TELEMETRY_DIR, 'hook-events.jsonl'), JSON.stringify({ key, value, ...extra }) + '\n');
+  } catch {
+    /* telemetry must never break the host */
+  }
+}
+
+function isHuaweiCloudSkill(name) {
+  return typeof name === 'string' && /^huawei/i.test(name);
+}
+
+// ── JSON Schema -> Zod converter (covers the devkit inputSchema subset) ─────
+
+function jsonSchemaToZod(schema) {
+  // schema is { type:'object', properties:{...}, required:[...] }
+  const shape = {};
+  const required = new Set(schema?.required || []);
+  for (const [name, prop] of Object.entries(schema?.properties || {})) {
+    let node;
+    switch (prop?.type) {
+      case 'string':
+        node = z.string();
+        if (prop.enum) {
+          const vals = prop.enum.filter((v) => typeof v === 'string');
+          if (vals.length > 0) node = z.enum(vals);
+        }
+        break;
+      case 'number':
+      case 'integer':
+        node = z.number();
+        break;
+      case 'boolean':
+        node = z.boolean();
+        break;
+      case 'array':
+        node = z.array(z.any());
+        break;
+      case 'object':
+      default:
+        node = z.any(); // nested objects (e.g. git{repo_url}) stay permissive
+    }
+    if (prop?.description) node = node.describe(prop.description);
+    shape[name] = required.has(name) ? node : node.optional();
+  }
+  return shape;
+}
+
+// ── safety gate (mirrors the MCP/hook deny semantics) ──────────────────────
+
+const DENY_TOOLS = new Set([
+  'huaweicloud_run_approved_command', // has its own in-tool approval gate (token check)
+]);
+
+async function safetyGate(toolName, args) {
+  if (!devkit) return; // devkit failed to load -> tools absent, nothing to gate
+  // read-only and planning tools pass through: callTool re-runs the full policy
+  // layer anyway (classifyHcloudArgs inside plan/read paths). The gate below is
+  // a fast pre-check for the raw hcloud-ish tools only.
+  if (DENY_TOOLS.has(toolName)) return;
+}
+
+// ── tool bridging ───────────────────────────────────────────────────────────
+
+function buildBridgedTools() {
+  if (!devkit) return {};
+  const tools = {};
+  const definitions = devkit.TOOL_DEFINITIONS || [];
+  for (const def of definitions) {
+    tools[def.name] = {
+      description: def.description,
+      args: jsonSchemaToZod(def.inputSchema || { type: 'object', properties: {} }),
+      async execute(args, context) {
+        const started = Date.now();
+        try {
+          await safetyGate(def.name, args);
+          const result = await devkit.callTool(def.name, args, { cwd: context?.directory });
+          writeEvent('tool:invoke', def.name, { durationMs: Date.now() - started });
+          return typeof result === 'string' ? result : { output: JSON.stringify(result, null, 2) };
+        } catch (error) {
+          // crash containment: never take the host down with a tool error
+          const payload = {
+            error: error?.message || String(error),
+            code: error?.code,
+            action: error?.action || error?.nextStep,
+          };
+          writeEvent('tool:error', def.name, { message: payload.error });
+          return { output: JSON.stringify(payload, null, 2) };
+        }
+      },
+    };
+  }
+  return tools;
+}
+
+// ── plugin export (v1 Hooks contract, IDE + CLI dual form) ─────────────────
+
+function getHooks() {
+  return {
+    'tool.execute.before': function (input, output) {
+      try {
+        if (input?.tool === 'skill') {
+          const name = output?.args?.name;
+          if (isHuaweiCloudSkill(name)) writeEvent('skill:retrieve', name);
+          return;
+        }
+        if (input?.tool === 'bash') {
+          const cmd = output?.args?.command || '';
+          if (!cmd) return;
+          // CLI read/write classification (legacy skill-tracker behavior)
+          const isHcloud = /(?:^|[;&|]\s*)hcloud(?:\.exe)?\s+/i.test(cmd);
+          if (isHcloud) {
+            const isRead = /\b(List|Show|Get|Describe|NovaList|NovaShow)\w*/i.test(cmd);
+            writeEvent(isRead ? 'cli:read' : 'cli:write', cmd.slice(0, 120), { capability: 'cli' });
+          }
+        }
+      } catch {
+        /* hooks must never throw */
+      }
+    },
+    event: function ({ event }) {
+      try {
+        if (event?.type === 'message.part.updated') {
+          const text = event?.properties?.part?.text;
+          if (typeof text === 'string') {
+            const m = text.match(/Base directory for this skill:\s*.*?skills[/\\]([a-z0-9-]+)/i);
+            if (m && isHuaweiCloudSkill(m[1])) writeEvent('skill:retrieve', m[1]);
+          }
+        }
+      } catch {
+        /* ignore */
+      }
+    },
+  };
+}
+
+function plugin() {
+  const hooks = getHooks();
+  if (loadError) {
+    // Surface a single actionable line instead of breaking startup
+    console.error(`[huaweicloud-devkit] core failed to load: ${loadError.message}`);
+    console.error(`[huaweicloud-devkit] expected devkit src at ${DEVKIT_SRC}`);
+    console.error(`[huaweicloud-devkit] run: npx huaweicloud-devkit install --target opencode`);
+    return hooks; // telemetry still works; tools absent until install is re-run
+  }
+  hooks.tool = buildBridgedTools();
+  return hooks;
+}
+
+plugin.id = 'huaweicloud-devkit';
+plugin.server = async () => plugin();
+
+export default plugin;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.9-next.0",
-  "kooCliVersion": "7.2.12",
+  "version": "1.1.9-next.1",
+  "kooCliVersion": "7.3.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",
   "files": [

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.9-next.0",
+  "version": "1.1.9-next.1",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.9-next.0",
+  "version": "1.1.9-next.1",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.9-next.0",
+  "version": "1.1.9-next.1",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.9-next.0",
+  "version": "1.1.9-next.1",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.9-next.0",
+  "version": "1.1.9-next.1",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.9-next.0",
+  "version": "1.1.9-next.1",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md

@@ -124,6 +124,10 @@ ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'dnf install -y ngin
 
 > If SCP blocks SSH, use cloud-init `--server.user_data` for full deployment instead. See `references/create-instance.md` §Bootstrap.
 
+### Windows Login / Upload (standard paths)
+
+Windows has NO working `sshpass` — password automation must go through paramiko; key automation uses the built-in OpenSSH `ssh`/`scp`. The first `Connection refused` on a fresh instance is usually just sshd not ready (retry with backoff before debugging the SG/EIP); a `Permission denied` while the server log shows "accepts key" is the local passphrase trap (`-N '""'` sets a literal `""` passphrase). Full standard paths — sshd-ready retry, paramiko login/upload, and the cloud-init public-key injection path (KooCLI has no `ImportKeypair`): `references/windows-ssh.md`.
+
 ## Deleting Instances
 
 - Show the user the exact command and get explicit approval before running
@@ -190,4 +194,5 @@ For Flexus X, use standard ECS CreateServers flow with `x1.*` flavors. For Flexu
 - ECS Docs: https://support.huaweicloud.com/ecs/
 - Flavor specs: references/flavors.md
 - Create instance: references/create-instance.md
+- Windows SSH login/upload: references/windows-ssh.md
 - HC活动 ECS+Nginx部署: references/hc-activity.md

package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md

@@ -39,8 +39,22 @@ If no VPC/subnet exists: load `huawei-vpc` skill → create VPC → create subne
 **MCP 环境下必须用"本地生成 + 导入"流程**——`NovaCreateKeypair` 返回的 `private_key` 会被 MCP 脱敏管道替换为 `<redacted>`，而私钥仅此一次机会，读不到即作废：
 
 ```bash
-# 1. 本地生成
-ssh-keygen -t rsa -b 2048 -f ./<name> -N '""'
+# 1. 本地生成 — bash / Git Bash / WSL（无 passphrase）
+ssh-keygen -t rsa -b 2048 -f ./<name> -N ''
+```
+
+```powershell
+# 1. 本地生成 — Windows PowerShell（无 passphrase，实测验证的写法）
+# ⚠️ 引号陷阱：-N '""' 会把字面量 "" 设为私钥 passphrase（实测确认），后续 SSH 症状极具误导性：
+#    ECS 已 ACTIVE、22 端口可达、服务端日志显示 "accepts key"，签名后仍 Permission denied ——
+#    服务端接受了密钥却拒绝，排查路径反直觉。本地剥掉 passphrase（ssh-keygen -p）立即恢复，服务器侧零改动。
+# 正确写法：--% 停止解析符 + -N ""（PowerShell 会丢弃空字符串参数，-N '' 直接报
+# "option requires an argument -- N"；--% 让该行剩余部分按 cmd 规则原样传递，"" 由 CRT 解析为空串）。
+# 注意：--% 之后到行尾全部原样传递 —— 该行不能再跟任何其他命令或注释。
+ssh-keygen --% -t rsa -b 2048 -f .\<name> -N ""
+```
+
+```bash
 # 2. 导入公钥
 hcloud ECS NovaCreateKeypair --keypair.name=<name> --keypair.public_key=<本地 .pub 文件内容>
 # 3. 使用私钥文件 ./<name> 连接实例

package/plugins/huaweicloud-core/skills/huawei-ecs/references/flavors.md

@@ -55,3 +55,25 @@ A flavor can be `normal` globally but `abandon` in specific AZs. Selecting an `a
 
 1. Switch to a different AZ: `hcloud ECS NovaListAvailabilityZones --cli-region=<region>`
 2. Or switch to a different flavor family (e.g., `at7` → `ac7`)
+
+## Conflict rule: `cond:operation:status` vs `cond:operation:az` (#922)
+
+The two fields can contradict each other (实测：`kc2.small.2` with `cond:operation:status=abandon` while
+`cond:operation:az=cn-north-4a(normal)`). **The AZ-level field (`cond:operation:az`) WINS for the target AZ**:
+
+| Global `status`     | Target AZ in `cond:operation:az`              | Verdict                                                                                                             |
+| ------------------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `normal`            | `<az>(normal)`                                | Usable in that AZ                                                                                                   |
+| `abandon`/`sellout` | `<az>(normal)`                                | **Usable in that AZ** — the AZ-level field wins; do not refuse to order just because the global status says abandon |
+| `normal`            | `<az>(sellout)` / `<az>(abandon)` / AZ absent | NOT usable in that AZ — pick another AZ or flavor                                                                   |
+
+Decision procedure:
+
+1. Find the target AZ entry in `cond:operation:az` (e.g. `cn-north-4a(normal)`).
+2. If the entry exists for the target AZ, its parenthesized state decides — ignore the global `cond:operation:status`.
+3. If the target AZ has no entry, fall back to the global `cond:operation:status` (only `normal` is usable).
+
+Note: flavor availability is only half of the check — an image TYPE mismatch fails independently with
+**`Ecs.0707 the product does not exist`** (market-type images fail with KunPeng flavors like `kc2.small.2`;
+switch to a gold-type image or a compatible flavor, e.g. `s6.medium.2` + gold). The `huaweicloud_explain_error`
+error map covers `Ecs.0707` with the full combination-troubleshooting procedure.

package/plugins/huaweicloud-core/skills/huawei-ecs/references/windows-ssh.md

@@ -0,0 +1,118 @@
+# Windows SSH Login / Upload — Standard Paths
+
+Windows has NO working `sshpass` (it is a Linux tool; Windows OpenSSH client does not ship it, and the
+native `ssh` cannot take a password from stdin or env). Use the paths below instead of trial-and-error.
+All facts verified on Windows (2026-10 activity reports: sshpass failures → 8-minute detour → paramiko).
+
+## 0. First connection: `Connection refused` is usually just sshd not ready
+
+On a fresh ECS, cloud-init finishes AFTER the instance reports ACTIVE. A first SSH attempt that gets
+`Connection refused` / `timeout` is typically the sshd service not yet listening — do NOT debug the
+security group or EIP on the first refusal. Retry with backoff first:
+
+```bash
+for i in 1 2 3 4 5; do
+  ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5 -i <key> root@<eip> 'echo ok' && break
+  echo "retry $i: sshd may not be ready yet"; sleep 15
+done
+```
+
+Only after all retries fail, treat it as a network problem (security group port 22 ingress, EIP binding).
+
+## 1. Login from Windows
+
+```powershell
+# Standard OpenSSH login (Windows 10+ ships OpenSSH client)
+ssh -o StrictHostKeyChecking=accept-new -i C:\path\to\<key> root@<eip>
+```
+
+Key file permission note: Windows OpenSSH checks ACLs on the private key. If ssh warns
+`UNPROTECTED PRIVATE KEY FILE`, fix with (PowerShell):
+
+```powershell
+icacls C:\path\to\<key> /inheritance:r /grant:r "$env:USERNAME:R"
+```
+
+Passphrase trap (from `references/create-instance.md` §5): a key generated with `-N '""'` in PowerShell
+carries a LITERAL `""` passphrase — the server accepts the key but SSH still fails `Permission denied`.
+If you hit that, strip the passphrase locally and retry (server side needs zero changes):
+
+```powershell
+ssh-keygen -p -f C:\path\to\<key>
+# enter the old passphrase as "" (two quote characters), leave the new one empty
+```
+
+## 2. Password auth: sshpass does not exist on Windows — use paramiko
+
+`sshpass` is unavailable on Windows OpenSSH; password-based automation must go through Python paramiko
+(pip install paramiko):
+
+```python
+# upload + run commands via paramiko (Windows-safe password auth)
+import paramiko
+
+client = paramiko.SSHClient()
+client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+client.connect('<eip>', username='root', password='<password>', timeout=15)
+# upload
+sftp = client.open_sftp()
+sftp.put(r'C:\local\file.tar.gz', '/root/file.tar.gz')
+sftp.close()
+# run a command
+_, stdout, stderr = client.exec_command('tar -xzf /root/file.tar.gz -C /root && echo OK')
+print(stdout.read().decode(), stderr.read().decode())
+client.close()
+```
+
+- `exec_command` is one-shot per call — chain commands with `&&` inside a single call for state.
+- Never put the password in the conversation or shell history; pass it at runtime.
+
+Key-based file upload from Windows (no paramiko needed): `scp` ships with Windows OpenSSH:
+
+```powershell
+scp -o StrictHostKeyChecking=accept-new -i C:\path\to\<key> C:\local\file root@<eip>:/root/
+```
+
+## 3. No SSH at all: cloud-init public-key injection (standard path)
+
+KooCLI has no `ImportKeypair` operation, and `NovaCreateKeypair`'s returned `private_key` is masked
+(redacted) by the tool pipeline — it cannot be recovered. The documented standard path is
+**local keypair generation + cloud-init public-key injection** (no SSH needed at creation time):
+
+1. Generate a keypair locally (per-shell forms and the PowerShell quote trap: `references/create-instance.md` §5)
+2. Inject the PUBLIC key at creation via `--server.user_data` (base64 cloud-init):
+
+   ```bash
+   # user_data (must be base64-encoded when passed to CreateServers)
+   #cloud-config
+   ssh_authorized_keys:
+     - <content of the local .pub file>
+   ```
+
+   ```bash
+   user_data=$(base64 -w0 << 'EOF'
+   #cloud-config
+   ssh_authorized_keys:
+     - <pub key content>
+   EOF
+   )
+   hcloud ECS CreateServers ... --server.user_data=$user_data
+   ```
+
+3. After ACTIVE, SSH in with the matching private key (`ssh -i <key> root@<eip>`).
+
+This path avoids `NovaCreateKeypair` entirely (no private_key masking problem) and works even when SCP
+policies block SSH at first boot — see `references/create-instance.md` §Bootstrap for the full
+user_data workflow (mirror sources, observability sentinels, first-boot-only semantics).
+
+## 4. Quick reference
+
+| Task (Windows)                             | Path                                                                |
+| ------------------------------------------ | ------------------------------------------------------------------- |
+| Login                                      | `ssh -i <key> root@<eip>` (OpenSSH built-in)                        |
+| First `Connection refused`                 | Retry 3-5x with 15s backoff — sshd not ready yet                    |
+| Password automation                        | paramiko (`sshpass` unavailable on Windows)                         |
+| File upload (key auth)                     | `scp -i <key> <local> root@<eip>:<path>`                            |
+| File upload (password)                     | paramiko SFTP (`put`)                                               |
+| No keypair yet                             | local `ssh-keygen` + cloud-init `ssh_authorized_keys` inject        |
+| `Permission denied` but server accepts key | literal `""` passphrase from `-N '""'` — strip with `ssh-keygen -p` |

package/plugins/huaweicloud-core/skills/huawei-getting-started/SKILL.md

@@ -10,13 +10,13 @@ version: 1
 
 ## KooCLI Installation
 
-This plugin is paired with **KooCLI v7.2.12**. Install the pinned version:
+This plugin is paired with **KooCLI v7.3.12**. Install the pinned version:
 
 | OS                   | Command                                                                                                                                                                 |
 | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download                                                                                           |
-| Linux                | curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/7.2.12/huaweicloud-cli-linux-amd64.tar.gz" && tar -zxvf huaweicloud-cli-linux-amd64.tar.gz |
-| macOS                | curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/7.2.12/huaweicloud-cli-mac-amd64.tar.gz" && tar -zxvf huaweicloud-cli-mac-amd64.tar.gz     |
+| Linux                | curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/7.3.12/huaweicloud-cli-linux-amd64.tar.gz" && tar -zxvf huaweicloud-cli-linux-amd64.tar.gz |
+| macOS                | curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/7.3.12/huaweicloud-cli-mac-amd64.tar.gz" && tar -zxvf huaweicloud-cli-mac-amd64.tar.gz     |
 
 > See `huaweicloud-cli-and-auth` skill for arm64 variants and the one-liner (latest) option.