/hetzner-storage-box

name: hetzner-storage-box
description: "Read and operate Hetzner Storage Boxes through Hetzner API management calls and WebDAV file requests with gateway-injected credentials."
user-invocable: true
requires:
  bins:
    - node
credentials:
  - id: hetzner-api-token
    kind: bearer
    required: true
    secret_ref:
      source: store
      id: HETZNER_API_TOKEN
    scope: "api.hetzner.com/v1/storage_boxes"
    how_to_obtain: "Create a Hetzner Console API token for the project containing the Storage Box. Use read-only scope for inventory and read-write scope only for approved Storage Box management changes. Set `HETZNER_API_TOKEN` through browser admin at the active `/admin/secrets` route; if browser admin is unavailable, use `/secret set HETZNER_API_TOKEN \"<hetzner-console-api-token>\"` in browser `/chat` or TUI; local console fallback: `hybridclaw secret set HETZNER_API_TOKEN \"<hetzner-console-api-token>\"`."
  - id: hetzner-storage-box-basic-auth
    kind: header
    required: false
    secret_ref:
      source: store
      id: HETZNER_STORAGE_BOX_BASIC_AUTH
    scope: "*.your-storagebox.de WebDAV Authorization header"
    how_to_obtain: "Base64-encode '<storage-box-username>:<password>' and store only that encoded value. Set `HETZNER_STORAGE_BOX_BASIC_AUTH` through browser admin at the active `/admin/secrets` route; if browser admin is unavailable, use `/secret set HETZNER_STORAGE_BOX_BASIC_AUTH \"<base64-username-password>\"` in browser `/chat` or TUI; local console fallback: `hybridclaw secret set HETZNER_STORAGE_BOX_BASIC_AUTH \"<base64-username-password>\"`. The helper injects it as 'Authorization: Basic <secret>' for WebDAV file operations."
metadata:
  hybridclaw:
    category: infrastructure
    short_description: "Hetzner Storage Box inventory, snapshots, and guarded WebDAV file operations."
    tags:
      - hetzner
      - storage-box
      - webdav
      - archive
      - infrastructure
    stakes_tiers:
      green:
        - list-storage-boxes
        - get-storage-box
        - list-snapshots
        - list-files
        - download-file
        - public-url
      amber:
        - share-public-link
        - create-storage-box
        - update-storage-box
        - create-snapshot
        - upload-text
        - create-directory
        - archive-text
      red:
        - delete-storage-box
        - delete-snapshot
        - delete-path
    escalation:
      writes: confirm-each
      route: f14
    cost_measurement:
      system: UsageTotals
      sub_limit_key: hetzner-storage-box

Hetzner Storage Box

Use this skill for Storage Box inventory, lifecycle and snapshot management, plus WebDAV file reads and guarded uploads/archives.

Default Workflow

1. Use Hetzner API reads (`list-storage-boxes`, `get-storage-box`) for inventory and metadata. 2. Use WebDAV reads (`list-files`, `download-file`) for file inspection. 3. Use `plan` before any management, file write, or public-link request. 4. Treat `hetzner_storage_box.cjs` as the API/WebDAV wrapper. Do not handcraft Hetzner Storage Box API URLs, WebDAV URLs, JSON bodies, tiers, or secret refs from memory. 5. For prompt/user testing, stop after `plan` or after helper payload generation. Do not call the built-in `http_request` tool. 6. For real user requests that need live Storage Box API or WebDAV reads, pass the helper-emitted `httpRequest` object unchanged to `http_request`. The `bearerSecretName` or `secretHeaders` field is the secret reference; do not rewrite it, preflight it, inspect it, or ask the model for the secret. 7. If a live `http_request` call returns 401 or 403, stop after that first failure. Do not retry, do not fan out to more endpoints or paths, and ask the operator to set or verify the relevant secret. 8. Require explicit operator grant before creating boxes, changing settings, snapshots, uploads, archives, directory creation, public sharing, or deletes. 9. Never paste, print, or inspect `HETZNER_API_TOKEN` or Storage Box passwords. The gateway injects API bearer tokens and WebDAV Basic auth server-side.

Secret Setup

API management calls use `HETZNER_API_TOKEN`. Set or update it in this order:

1. Browser admin: open the active HybridClaw admin URL ending in `/admin/secrets`. 2. Browser `/chat` or TUI fallback: `/secret set HETZNER_API_TOKEN "<hetzner-console-api-token>"`. 3. Local console fallback:

hybridclaw secret set HETZNER_API_TOKEN "<hetzner-console-api-token>"

`HETZNER_API_TOKEN` is the Hetzner Console token for Cloud and Storage Box management APIs. DNS uses its own `HETZNER_DNS_API_TOKEN` because Hetzner DNS is served by a separate DNS API and `Auth-API-Token` header.

WebDAV file operations use a Basic-auth secret containing only the base64 encoded `username:password` payload. Set it in the same order:

1. Browser admin: open the active HybridClaw admin URL ending in `/admin/secrets`. 2. Browser `/chat` or TUI fallback: `/secret set HETZNER_STORAGE_BOX_BASIC_AUTH "<base64-username-password>"`. 3. Local console fallback:

printf '%s' 'u00000:storage-box-password' | base64
hybridclaw secret set HETZNER_STORAGE_BOX_BASIC_AUTH "<base64-username-password>"

See [references/operator-setup.md](references/operator-setup.md) for operator setup, scope, and autonomy defaults.

Command Contract

node skills/hetzner-storage-box/hetzner_storage_box.cjs --help

Build management API requests:

node skills/hetzner-storage-box/hetzner_storage_box.cjs --format json http-request list-storage-boxes
node skills/hetzner-storage-box/hetzner_storage_box.cjs --format json http-request get-storage-box --box-id 123456
node skills/hetzner-storage-box/hetzner_storage_box.cjs --format json http-request create-snapshot --box-id 123456 --description "pre-archive" --operator-grant

Build WebDAV file requests:

node skills/hetzner-storage-box/hetzner_storage_box.cjs --format json webdav-request list-files \