/alibabacloud-pai-workspace-manage

name: alibabacloud-pai-workspace-manage
description: |
  Alibaba Cloud PAI Workspace Management Skill. Create, query, and list workspaces on the Platform for AI (PAI).
  Triggers: "create PAI workspace", "query PAI workspace", "list workspaces", "PAI workspace", "create workspace", "get workspace", "list workspaces", "AIWorkSpace CreateWorkspace", "AIWorkSpace GetWorkspace", "AIWorkSpace ListWorkspaces"

PAI Workspace Management

Create, query, and list workspaces on Alibaba Cloud Platform for AI (PAI). Workspaces serve as isolated management units for AI model training, data processing, and related tasks.

**Architecture**: PAI AIWorkSpace (Workspace)

**Workspace Modes**:

• **Simple Mode**: Production environment only (`prod`)
• **Standard Mode**: Development (`dev`) + Production (`prod`) environments

---

Installation

> **Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see `references/cli-installation-guide.md` for installation instructions. > Then [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > Then [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

**[MUST] CLI User-Agent** — Every `aliyun` CLI command invocation must include: `--user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-workspace-manage`

aliyun version
aliyun configure set --auto-plugin-install true
aliyun plugin update

---

Credential Verification

> **Pre-check: Alibaba Cloud Credentials Required** > > **Security Rules:** > - **NEVER** read, echo, or print AK/SK values (e.g., `echo $ALIBABA_CLOUD_ACCESS_KEY_ID` is FORBIDDEN) > - **NEVER** ask the user to input AK/SK directly in the conversation or command line > - **NEVER** use `aliyun configure set` with literal credential values > - **ONLY** use `aliyun configure list` to check credential status > > **Sensitive Data Masking:** > - The following fields in API responses contain personally identifiable information and **MUST be masked** before displaying to the user: > - `Owner.UserId` / `Creator` — Show only last 4 digits, e.g., `****1234` > - `Owner.UserKp` — Never display, omit entirely > - `Owner.UserName` / `Owner.DisplayName` — Show only first character + `***`, e.g., `z***` > - Accounts in `AdminNames` — Mask as `u***@example.com` format > - **[MUST] Raw sensitive data MUST NOT appear in stdout, execution logs, on disk, or in the conversation**: The execution framework logs ALL command stdout to execution logs/transcripts (e.g., `ran-scripts/executed-actions.log`). Therefore, **EVERY** execution of `get-workspace` or `list-workspaces` (including basic queries without `--verbose`) must include `| jq -r` pipe filtering — because `Creator` is **always** returned and is sensitive. There must be **NO execution step** where the raw API JSON appears in command output, even as an intermediate step. The `| jq -r` pipe must be part of a **single pipeline command**: > > **Basic query** (without `--verbose`): > ```bash > aliyun aiworkspace get-workspace --workspace-id <ID> --region <RegionId> \ > --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-workspace-manage \ > | jq -r '"Workspace: \(.WorkspaceName) (ID: \(.WorkspaceId)) > Status: \(.Status) > Environment: \(.EnvTypes | join(", ")) > Created: \(.GmtCreateTime) > Creator ID: \(.Creator // "" | if length > 0 then "****" + .[-4:] else "N/A" end)"' > ``` > > **Verbose query** (with `--verbose true`): > ```bash > aliyun aiworkspace get-workspace --workspace-id <ID> --verbose true --region <RegionId> \ > --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-workspace-manage \ > | jq -r '"Workspace: \(.WorkspaceName) (ID: \(.WorkspaceId)) > Status: \(.Status) > Owner: \(.Owner.UserName // "" | if length > 0 then .[0:1] + "***" else "N/A" end) (ID: \(.Owner.UserId // "" | if length > 0 then "****" + .[-4:] else "N/A" end)) > Creator ID: \(.Creator // "" | if length > 0 then "****" + .[-4:] else "N/A" end) > Administrators: \(.AdminNames // [] | map(.[0:1] + "***") | join(", "))"' > ``` > > The raw API response flows through the pipe internally and never reaches shell stdout. Only `jq`'s output (with masked values and natural language keys) is captured by the execution framework. The following are **all prohibited**: > - Running the CLI command **without** `| jq` pipe filtering — even for basic queries (the `Creator` field is always returned and sensitive) > - **Two-step processing** — running the CLI command first to get raw output, then separately masking it. The raw JSON would appear in the execution transcript before masking is applied. The `| jq -r` MUST be part of the same single pipeline command > - **Capturing raw output to shell variables** — e.g., `response=$(aliyun ...)` then `echo "$response" | jq ...`. The variable assignment captures raw data into the execution log > - Output redirection (`> file.json`, `>> file.log`, `| tee file`) > - Executing commands via shell scripts saved to disk (e.g., `ran-scripts/*.sh`) > - **Embedding raw API response data in any script or code file** — e.g., writing a Python/shell script that contains raw JSON values as string literals, variables, or data structures (such as `ran_scripts/process_workspace_data.py`). All data processing must be done entirely within the `| jq -r` pipe; do NOT create intermediate processing scripts that contain raw data > - Displaying raw JSON snippets in the conversation > - **[MUST] Original API field names MUST NOT be used as output keys**: Even when values are masked, using original API field names (such as `UserId`, `UserName`, `UserKp`, `AdminNames`) as JSON keys or structured output key names in any output (conversation or files) is **prohibited**. Use natural l