huaweicloud-devkit 1.1.9-next.4 → 1.1.9-next.6

package/README.md

@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
-[![Beta](https://img.shields.io/badge/beta-v1.1.9-next.4-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.9-next.6-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 
 **[中文](README.zh-CN.md) | English**
 

package/README.zh-CN.md

@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml/badge.svg)](https://github.com/huaweicloud/huaweicloud-devkit/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/huaweicloud-devkit)](https://www.npmjs.com/package/huaweicloud-devkit)
-[![Beta](https://img.shields.io/badge/beta-v1.1.9-next.4-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
+[![Beta](https://img.shields.io/badge/beta-v1.1.9-next.6-orange)](https://github.com/huaweicloud/huaweicloud-devkit)
 
 **中文 | [English](README.md)**
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "huaweicloud-devkit",
   "mcpName": "io.github.huaweicloud/huaweicloud-devkit",
-  "version": "1.1.9-next.4",
+  "version": "1.1.9-next.6",
   "kooCliVersion": "7.3.12",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "type": "module",

package/plugins/huaweicloud-core/.claude-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.9-next.4",
+  "version": "1.1.9-next.6",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Agent toolkit that helps coding agents use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities safely and accurately.",
   "skills": "./skills/",
-  "version": "1.1.9-next.4",
+  "version": "1.1.9-next.6",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.cursor-plugin/plugin.json

@@ -17,7 +17,7 @@
   "mcpServers": "./.mcp.json",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "skills": "./skills/",
-  "version": "1.1.9-next.4",
+  "version": "1.1.9-next.6",
   "author": {
     "name": "HuaweiCloud Mate",
     "url": "https://github.com/huaweicloud"

package/plugins/huaweicloud-core/.hermes-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.9-next.4",
+  "version": "1.1.9-next.6",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "huaweicloud-devkit",
-  "version": "1.1.9-next.4",
+  "version": "1.1.9-next.6",
   "description": "Guide coding agents to use Huawei Cloud Skills, KooCLI, APIs, SDKs, and future MCP capabilities with safer execution and less context.",
   "author": {
     "name": "HuaweiCloud Mate",

package/plugins/huaweicloud-core/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "name": "huaweicloud-devkit",
   "id": "huaweicloud-devkit",
   "displayName": "HuaweiCloud DevKit",
-  "version": "1.1.9-next.4",
+  "version": "1.1.9-next.6",
   "family": "bundle-plugin",
   "bundleFormat": "codex",
   "description": "Guide coding agents to use Huawei Cloud safely — KooCLI, APIs, SDKs, 28 MCP tools, skills, and safety guardrails.",

package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json

@@ -429,6 +429,12 @@
             "field": "text",
             "regex": "\\bfdisk\\b"
           }
+        ],
+        "none": [
+          {
+            "field": "text",
+            "regex": "\\bhcloud\\b"
+          }
         ]
       },
       "message": "The sandbox terminal command is destructively dangerous and could destroy the workspace.",

package/plugins/huaweicloud-core/src/auth/credentials.mjs

@@ -393,6 +393,49 @@ export function resolveCredentialsWithRuntime(options = {}) {
   return resolveCredentials(options);
 }
 
+export function resolveXAuthToken() {
+  const envToken = process.env.HW_X_AUTH_TOKEN;
+  if (present(envToken)) return envToken;
+
+  const parentCwd = getParentCwd();
+  const searchDirs = [process.env.CODEARTS_PROJECT_DIR, parentCwd, process.cwd(), homedir()];
+  for (const dir of searchDirs) {
+    if (!dir) continue;
+    const path = join(dir, '.codeartsdoer', 'mcp', 'mcp_settings.json');
+    try {
+      if (!existsSync(path)) continue;
+      const config = JSON.parse(readFileSync(path, 'utf8'));
+      const server = pickDevkitMcpServer(config?.mcpServers);
+      const token = server?.env?.HW_X_AUTH_TOKEN;
+      if (present(token)) return token;
+    } catch {}
+  }
+
+  const workPaths = [
+    join(homedir(), '.codearts', 'mcp', 'mcp_settings.json'),
+    join(homedir(), '.codeartswork', 'mcp', 'mcp_settings.json'),
+  ];
+  for (const path of workPaths) {
+    try {
+      if (!existsSync(path)) continue;
+      const config = JSON.parse(readFileSync(path, 'utf8'));
+      const server = pickDevkitMcpServer(config?.mcp);
+      const token = server?.environment?.HW_X_AUTH_TOKEN;
+      if (present(token)) return token;
+    } catch {}
+  }
+  return null;
+}
+
+export function resolveXAuthTokenExpiry() {
+  const v = process.env.HW_X_AUTH_TOKEN_EXPIRES_AT;
+  if (!v || typeof v !== 'string' || !v.trim()) return null;
+  const asNum = Number(v.trim());
+  if (Number.isFinite(asNum) && asNum > 0) return asNum > 1e12 ? asNum : asNum * 1000;
+  const t = Date.parse(v.trim());
+  return Number.isFinite(t) ? t : null;
+}
+
 export function lastSyncPath() {
   return join(baseHome(), '.config', 'huaweicloud', '.last_sync');
 }

package/plugins/huaweicloud-core/src/auth/token-exchange.mjs

@@ -0,0 +1,100 @@
+import { fetchWithProxy } from '../proxy/proxy-agent.mjs';
+
+const DEFAULT_DURATION_SECONDS = 900;
+const DEFAULT_IAM_ENDPOINT = 'https://iam.myhuaweicloud.com';
+
+export async function exchangeTokenForCredentials(token, options = {}) {
+  const durationSeconds = options.durationSeconds ?? DEFAULT_DURATION_SECONDS;
+  const iamEndpoint = options.iamEndpoint || process.env.HW_TOKEN_IAM_ENDPOINT || DEFAULT_IAM_ENDPOINT;
+  const fetchImpl = options.fetchImpl;
+
+  const body = {
+    auth: {
+      identity: {
+        methods: ['token'],
+        token: { id: token, duration_seconds: durationSeconds },
+      },
+    },
+  };
+
+  const fetchOpts = {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json;charset=utf8' },
+    body: JSON.stringify(body),
+  };
+
+  const url = `${iamEndpoint}/v3.0/OS-CREDENTIAL/securitytokens`;
+
+  let resp;
+  try {
+    resp = fetchImpl ? await fetchImpl(url, fetchOpts) : await fetchWithProxy(url, fetchOpts);
+  } catch (error) {
+    const err = new Error(`Token exchange request failed: ${error.message}`);
+    err.code = 'TOKEN_EXCHANGE_FAILED';
+    throw err;
+  }
+
+  if (resp.status === 401 || resp.status === 403) {
+    const err = new Error('X-Auth-Token is invalid or expired.');
+    err.code = 'TOKEN_INVALID';
+    throw err;
+  }
+  if (resp.status !== 201) {
+    const err = new Error(`Token exchange returned unexpected status ${resp.status}.`);
+    err.code = 'TOKEN_EXCHANGE_FAILED';
+    throw err;
+  }
+
+  let data;
+  try {
+    data = await resp.json();
+  } catch (error) {
+    const err = new Error(`Token exchange returned malformed JSON: ${error.message}`);
+    err.code = 'TOKEN_EXCHANGE_FAILED';
+    throw err;
+  }
+  const cred = data?.credential;
+  if (!cred?.access || !cred?.secret || !cred?.securitytoken) {
+    const err = new Error('Token exchange response missing credential fields.');
+    err.code = 'TOKEN_EXCHANGE_FAILED';
+    throw err;
+  }
+  // IAM always returns expires_at; if it is absent (or unparseable) we store
+  // expiresAt:null, which never satisfies the `cached.expiresAt && …` guard in
+  // getTokenCredentials — so the cache is always a miss and we deliberately
+  // re-exchange on every call rather than risk caching credentials forever.
+  const expiresAt = cred.expires_at ? Date.parse(cred.expires_at) : NaN;
+  return {
+    ak: cred.access,
+    sk: cred.secret,
+    securityToken: cred.securitytoken,
+    expiresAt: Number.isFinite(expiresAt) ? expiresAt : null,
+  };
+}
+
+const GRACE_MS = 60 * 1000;
+
+let cached = null; // { ak, sk, securityToken, expiresAt }
+let inflight = null; // Promise 单飞
+
+export function __resetTokenCache() {
+  cached = null;
+  inflight = null;
+}
+
+export async function getTokenCredentials(token, options = {}) {
+  const now = Date.now();
+  if (cached && cached.expiresAt && cached.expiresAt - GRACE_MS > now) {
+    return cached;
+  }
+  if (inflight) return inflight;
+  inflight = (async () => {
+    try {
+      cached = await exchangeTokenForCredentials(token, options);
+      return cached;
+    } finally {
+      inflight = null;
+    }
+  })();
+  return inflight;
+}

package/plugins/huaweicloud-core/src/hcloud-cli.mjs

@@ -7,7 +7,13 @@ import { dirname, join } from 'node:path';
 import { classifyHcloudArgs, redactSecrets, assertAllowed } from './safety-policy.mjs';
 import { getProxySettings } from './proxy/proxy-config.mjs';
 import { resolveHcloudCommand } from './hcloud-probe.mjs';
-import { parseStsExpiry, resolveCredentialsWithRuntime } from './auth/credentials.mjs';
+import {
+  parseStsExpiry,
+  resolveCredentialsWithRuntime,
+  resolveXAuthToken,
+  resolveXAuthTokenExpiry,
+} from './auth/credentials.mjs';
+import { getTokenCredentials } from './auth/token-exchange.mjs';
 
 const DEFAULT_TIMEOUT_MS = 60_000;
 const DEFAULT_FORCE_KILL_AFTER_MS = 2_000;
@@ -297,7 +303,7 @@ export function redactArgsWithObs(rawArgs) {
   return redactSecrets(out);
 }
 
-export function resolveStsInjectArgs(rawArgs) {
+export async function resolveStsInjectArgs(rawArgs) {
   const normalized = Array.isArray(rawArgs) ? rawArgs.map(String) : [];
   if (normalized.length === 0) return [];
   const flat = normalized.map(String);
@@ -350,7 +356,25 @@ export function resolveStsInjectArgs(rawArgs) {
   } catch {
     return [];
   }
-  if (!creds || !creds.ak || !creds.sk || !creds.securityToken) return [];
+  if (!creds || !creds.ak || !creds.sk) {
+    const token = resolveXAuthToken();
+    if (token) {
+      const expiry = resolveXAuthTokenExpiry();
+      if (expiry !== null && expiry - 60000 <= Date.now()) {
+        const err = new Error('X-Auth-Token 已过期，请重启进程重新注入凭证。');
+        err.code = 'TOKEN_EXPIRED';
+        throw err;
+      }
+      const temp = await getTokenCredentials(token);
+      return [
+        '--cli-access-key=' + temp.ak,
+        '--cli-secret-key=' + temp.sk,
+        '--cli-security-token=' + temp.securityToken,
+      ];
+    }
+    return [];
+  }
+  if (!creds.securityToken) return [];
 
   // R3: if we can derive an expiry and the token is already at/within 60s of
   // expiring, skip injection — using a dead token would make a doomed IAM round
@@ -468,7 +492,22 @@ export async function runHcloud(args, options = {}) {
   // and R3 forbids writing them to disk). Inject per-command so hcloud actually
   // authenticates with the platform-provided STS. Injection args are appended to
   // the EXECUTED args only; classification/approval used the original args.
-  const stsInject = resolveStsInjectArgs(normalizedArgs);
+  let stsInject;
+  try {
+    stsInject = await resolveStsInjectArgs(normalizedArgs);
+  } catch (error) {
+    if (error?.code === 'TOKEN_INVALID' || error?.code === 'TOKEN_EXCHANGE_FAILED' || error?.code === 'TOKEN_EXPIRED') {
+      return {
+        ok: false,
+        code: error.code,
+        error: error.message,
+        stderr: '',
+        stdout: '',
+        plan,
+      };
+    }
+    throw error;
+  }
   if (stsInject.length > 0) {
     plan.rawArgs = [...plan.rawArgs, ...stsInject];
   }

package/plugins/huaweicloud-core/src/risk-rule-engine.mjs

@@ -19,7 +19,7 @@ export function loadRiskRules(options = {}) {
 function redactEvidence(text) {
   return String(text)
     .replace(
-      /((?:access[_-]?key|secret[_-]?key|secret|security[_-]?token|x[_-]?auth[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
+      /((?:access[_-]?key|secret[_-]?key|secret|security[_-]?token|x[_-]?auth[_-]?token|x[_-]?subject[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
       '$1<redacted>',
     )
     .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>');

package/plugins/huaweicloud-core/src/safety-policy.mjs

@@ -39,7 +39,7 @@ function redactString(text) {
       // Redact the ENTIRE value of this arg — not just the first whitespace token.
       .replace(/((?:user[_-]?data|metadata|private[_-]?key)\s*[:=]\s*).*/gi, '$1<redacted>')
       .replace(
-        /((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
+        /((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|x[_-]?subject[_-]?token|token|authorization|password|passwd|admin[_-]?pass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi,
         '$1<redacted>',
       )
       .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>')