/alibabacloud-cms-manage

name: alibabacloud-cms-manage
description: |
  Entry skill for the aliyun CLI distribution of CloudMonitor (CMS).
  Use when the user mentions aliyun cms2, CloudMonitor, CMS commands,
  or any CMS module operation such as Integration Policy/Center, APM, RUM,
  Prometheus Service, Recording rule, alert rule, alert template, alert history,
  event hub, SLS event, PromQL, cloud resource, service observability,
  monitoring onboarding, metric query, etc.
license: Apache-2.0
compatibility: aliyun-cli>=3.3.15
metadata:
  domain: aiops
  owner: cms
  contact: cms@alibaba-inc.com

CMS CLI — `aliyun cms2`

Prerequisite Check

> **Once per session**: perform this prerequisite check only on the **first** invocation of this skill in a conversation. If all checks already passed earlier in the same session, skip directly to the relevant module.

1. **Check `aliyun` exists** — `which aliyun` (macOS/Linux) or `where aliyun` (Windows).

• Not found → ask the user to install the aliyun CLI first: <https://help.aliyun.com/document_detail/121541.html>. Stop and wait.

2. **Check CLI version** — run `aliyun version`. Minimum required: **3.3.15** (see `compatibility` in frontmatter).

> ⚠️ Compare version segments as **integers** (semver): 3.3.4 < 3.3.15 because 4 < 15. > Shell verification: `printf '%s\n' "3.3.15" "$(aliyun version)" | sort -V | head -1` > If the output equals the current version, the requirement is NOT met.

• Version OK → go to step 3.
• Version too old or unrecognized →

1. Run `aliyun upgrade --help` to test whether the `upgrade` subcommand exists.

• Available → run `aliyun upgrade -y` to update to the latest version automatically, then re-check `aliyun version`.

2. If `upgrade` not available → ask the user to upgrade manually following the official guide: <https://help.aliyun.com/zh/cli/update-cli>. Wait for the user to confirm the upgrade is complete, then re-check `aliyun version`. 3. If upgrade succeeded → go to step 3. 4. If upgrade failed → ask the user to upgrade manually: <https://help.aliyun.com/zh/cli/update-cli>. Stop and exit.

3. **Check `cms2` plugin** — run `aliyun cms2 --help`.

• Help output OK → continue to **Credentials**.
• `unknown command` / missing → **stop immediately**, output the error report below (append CLI version, OS, and error message), and make **no further CLI calls**.

---

Credentials

`aliyun cms2` reuses the aliyun CLI credential system (`aliyun configure`). Use `--profile <name>` to switch profiles.

Observability

Upon loading this skill, generate a random session ID (32-char lowercase hex string) once per session...

For every aliyun cms2 command, append: --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-cms-manage/{session-id}"

Local utility commands (e.g. `version`, `configure`, `plugin`, `--help`) do not support this flag and are excluded.

Global Conventions

**Hard constraint**: fallback to `aliyun cms`, other API versions, or any workaround is strictly prohibited.

> **Run `aliyun cms2 <command> [subcommand] --help` before first use of a subcommand in a session** to get the full flag list and examples. Once the help for the same subcommand has been read in the current session and the command shape has not changed, reuse that knowledge instead of repeating the help call. A named subcommand's `--help` / `--show-schema` / `--show-example-body` is the authority for that command's flags, body envelope, response fields, and environment behaviour — do not search other skill files for a copy of those fields.

• **Prefer `-o text`** (default) to reduce token consumption for list/get; use `-o json` only when the output is parsed field by field rather than read.
• **Addon-release `values`**: expand each field's `fieldPath` into nested JSON as specified in [Addon Values Defaults](references/integration-common.md#addon-values-defaults-hard-requirement). Do not write a dotted `fieldPath` as one literal key. How to pick `--env-type`, where child fields sit on create vs update, and when a subset is (or is not) a valid body, are in that section.
• **Region parameter required for mutating and detail commands**: unless otherwise specified by a module-specific rule, all `create`, `update`, `delete`, and single-resource `get`/detail commands MUST include the `--region` parameter so the request is routed to the correct backend OpenAPI endpoint. Omitting `--region` on these commands may cause routing failures or operate against an unintended region, and the error can name something else entirely — `integration policy create` returns `status 400: The workspace can not be created` even when the workspace exists and the body is valid. This does not apply to `list`/query commands that intentionally span multiple regions (e.g. `entity query --source CloudResource` all-region queries). Requiring the flag is not permission to choose its value — resolve it per [Region Confirmation Gate](#region-confirmation-gate-hard-requirement).
• **One choice, one question**: every enumerated choice (region, workspace, policy, addon, scope mode, tag match mode, and any other mutually exclusive parameter) is asked as one question carrying **all** of its options. Never split them across questions or into a `（续）...` continuation, and never drop the ones that do not fit — a split turns one choice into two answers that can conflict or be left incomplete, and a truncated list hides valid choices entirely. When the structured input form cannot render every option, ask as plain text and spell out every option with its explanation in the question body. A mutually exclusive choice stays single-select; only a genuinely multi-valued one (several regions) is multi-select. A prompt may carry several distinct choices, each its own question. Put any recommended value directly in the option label (for example `(Recommended)`); recommendations are advisory only and do not permit cloud-side writes unless anoth