alibabacloud-pai-workspace-manage

What this skill does

# PAI Workspace Management

Create, query, and list workspaces on Alibaba Cloud Platform for AI (PAI). Workspaces serve as isolated management units for AI model training, data processing, and related tasks.

**Architecture**: PAI AIWorkSpace (Workspace)

**Workspace Modes**:
- **Simple Mode**: Production environment only (`prod`)
- **Standard Mode**: Development (`dev`) + Production (`prod`) environments

---

## Installation

> **Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.
> Then [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> Then [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

**[MUST] CLI User-Agent** — Every `aliyun` CLI command invocation must include:
`--user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-workspace-manage`

```bash
aliyun version
aliyun configure set --auto-plugin-install true
aliyun plugin update
```

---

## Credential Verification

> **Pre-check: Alibaba Cloud Credentials Required**
>
> **Security Rules:**
> - **NEVER** read, echo, or print AK/SK values (e.g., `echo $ALIBABA_CLOUD_ACCESS_KEY_ID` is FORBIDDEN)
> - **NEVER** ask the user to input AK/SK directly in the conversation or command line
> - **NEVER** use `aliyun configure set` with literal credential values
> - **ONLY** use `aliyun configure list` to check credential status
>
> **Sensitive Data Masking:**
> - The following fields in API responses contain personally identifiable information and **MUST be masked** before displaying to the user:
>   - `Owner.UserId` / `Creator` — Show only last 4 digits, e.g., `****1234`
>   - `Owner.UserKp` — Never display, omit entirely
>   - `Owner.UserName` / `Owner.DisplayName` — Show only first character + `***`, e.g., `z***`
>   - Accounts in `AdminNames` — Mask as `u***@example.com` format
> - **[MUST] Raw sensitive data MUST NOT appear in stdout, execution logs, on disk, or in the conversation**: The execution framework logs ALL command stdout to execution logs/transcripts (e.g., `ran-scripts/executed-actions.log`). Therefore, **EVERY** execution of `get-workspace` or `list-workspaces` (including basic queries without `--verbose`) must include `| jq -r` pipe filtering — because `Creator` is **always** returned and is sensitive. There must be **NO execution step** where the raw API JSON appears in command output, even as an intermediate step. The `| jq -r` pipe must be part of a **single pipeline command**:
>
>   **Basic query** (without `--verbose`):
>   ```bash
>   aliyun aiworkspace get-workspace --workspace-id <ID> --region <RegionId> \
>     --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-workspace-manage \
>     | jq -r '"Workspace: \(.WorkspaceName) (ID: \(.WorkspaceId))
>   Status: \(.Status)
>   Environment: \(.EnvTypes | join(", "))
>   Created: \(.GmtCreateTime)
>   Creator ID: \(.Creator // "" | if length > 0 then "****" + .[-4:] else "N/A" end)"'
>   ```
>
>   **Verbose query** (with `--verbose true`):
>   ```bash
>   aliyun aiworkspace get-workspace --workspace-id <ID> --verbose true --region <RegionId> \
>     --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-workspace-manage \
>     | jq -r '"Workspace: \(.WorkspaceName) (ID: \(.WorkspaceId))
>   Status: \(.Status)
>   Owner: \(.Owner.UserName // "" | if length > 0 then .[0:1] + "***" else "N/A" end) (ID: \(.Owner.UserId // "" | if length > 0 then "****" + .[-4:] else "N/A" end))
>   Creator ID: \(.Creator // "" | if length > 0 then "****" + .[-4:] else "N/A" end)
>   Administrators: \(.AdminNames // [] | map(.[0:1] + "***") | join(", "))"'
>   ```
>
>   The raw API response flows through the pipe internally and never reaches shell stdout. Only `jq`'s output (with masked values and natural language keys) is captured by the execution framework. The following are **all prohibited**:
>   - Running the CLI command **without** `| jq` pipe filtering — even for basic queries (the `Creator` field is always returned and sensitive)
>   - **Two-step processing** — running the CLI command first to get raw output, then separately masking it. The raw JSON would appear in the execution transcript before masking is applied. The `| jq -r` MUST be part of the same single pipeline command
>   - **Capturing raw output to shell variables** — e.g., `response=$(aliyun ...)` then `echo "$response" | jq ...`. The variable assignment captures raw data into the execution log
>   - Output redirection (`> file.json`, `>> file.log`, `| tee file`)
>   - Executing commands via shell scripts saved to disk (e.g., `ran-scripts/*.sh`)
>   - **Embedding raw API response data in any script or code file** — e.g., writing a Python/shell script that contains raw JSON values as string literals, variables, or data structures (such as `ran_scripts/process_workspace_data.py`). All data processing must be done entirely within the `| jq -r` pipe; do NOT create intermediate processing scripts that contain raw data
>   - Displaying raw JSON snippets in the conversation
> - **[MUST] Original API field names MUST NOT be used as output keys**: Even when values are masked, using original API field names (such as `UserId`, `UserName`, `UserKp`, `AdminNames`) as JSON keys or structured output key names in any output (conversation or files) is **prohibited**. Use natural language key names instead:
>   - `UserId` / `Creator` → `Owner ID` or `Creator ID`
>   - `UserName` → `Username`
>   - `DisplayName` → `Display Name`
>   - `AdminNames` → `Administrators`
>
>   **Correct approach**: **EVERY** execution of `get-workspace` or `list-workspaces` must be a **single pipeline command** with `| jq -r` appended. The Agent must NEVER run the CLI command first and then process the output in a separate step — the raw JSON would appear in the execution transcript before masking is applied. All data extraction, masking, and formatting must happen inside the `jq` filter. If saving to a file, redirect the **jq output** (not the CLI output) using `> file.md` at the end of the pipeline. This rule applies to ALL queries — basic, verbose, and list.
>
> ```bash
> aliyun configure list
> ```
> Check the output for a valid profile (AK, STS, or OAuth identity).
>
> **If no valid profile exists, STOP here.**
> 1. Obtain credentials from [Alibaba Cloud Console](https://ram.console.aliyun.com/manage/ak)
> 2. Configure credentials **outside of this session** (via `aliyun configure` in terminal or environment variables in shell profile)
> 3. Return and re-run after `aliyun configure list` shows a valid profile

---

## RAM Permissions

See `references/ram-policies.md` for required permissions (including Policy JSON and instructions).

> **[MUST] Permission Failure Handling:** When any command or API call fails due to permission errors at any point during execution, follow this process:
> 1. Read `references/ram-policies.md` to get the full list of permissions required by this SKILL
> 2. Use `ram-permission-diagnose` skill to guide the user through requesting the necessary permissions
> 3. Pause and wait until the user confirms that the required permissions have been granted

---

## Parameter Confirmation

> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call,
> ALL user-customizable parameters (e.g., RegionId, WorkspaceName, Description, EnvTypes, etc.)
> MUST be confirmed with the user. Do NOT assume or use default values without explicit user approval.

| Parameter | Required/Optional | Description | Example |
|-----------|-------------------|-------------|---------|
| `--region` | Required | Region ID (global parameter), **must be specified by the user**, do not use default values | `cn-hangzhou` |
| `--workspace-name` | Required | Wor