Alibabacloud Solution Deploy

# -*- coding: utf-8 -*-
"""Diagnose an Alibaba Cloud CLI command error.

Usage:
    python3 scripts/diagnose_cli_command.py <command> <error>

Example:
    python3 scripts/diagnose_cli_command.py 'aliyun ecs DescribeInstances' 'InvalidAccessKeyId.NotFound'
"""
import sys
import json

from alibabacloud_tea_openapi.client import Client as OpenApiClient
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_tea_util import models as util_models


def validate_input(value, name, max_length=2000):
    """Validate input value for length and non-empty."""
    if not value or len(value) > max_length:
        print(f"Error: {name} exceeds {max_length} chars or is empty", file=sys.stderr)
        sys.exit(1)


def sanitize_response(obj):
    """Recursively sanitize sensitive fields in response object."""
    sensitive_keys = {'accesskeyid', 'accesskeysecret', 'securitytoken', 'password', 'secret', 'accountid', 'credential'}
    
    if isinstance(obj, dict):
        sanitized = {}
        for key, value in obj.items():
            if key.lower() in sensitive_keys:
                sanitized[key] = "***REDACTED***"
            else:
                sanitized[key] = sanitize_response(value)
        return sanitized
    elif isinstance(obj, list):
        return [sanitize_response(item) for item in obj]
    else:
        return obj


def create_client() -> OpenApiClient:
    credential = CredentialClient()
    config = open_api_models.Config(credential=credential)
    config.endpoint = 'openapi-mcp.cn-hangzhou.aliyuncs.com'
    config.user_agent = 'AlibabaCloud-Agent-Skills'
    return OpenApiClient(config)


def diagnose_cli(command: str, error: str) -> dict:
    client = create_client()
    params = open_api_models.Params(
        action='DiagnoseCLI',
        version='2024-11-30',
        protocol='HTTPS',
        method='POST',
        auth_type='AK',
        style='ROA',
        pathname='/diagnoseCLI',
        req_body_type='json',
        body_type='json'
    )
    body = {'command': command, 'error': error}
    runtime = util_models.RuntimeOptions(read_timeout=60000)
    request = open_api_models.OpenApiRequest(body=body)
    return client.call_api(params, request, runtime)


if __name__ == '__main__':
    if len(sys.argv) < 3:
        print("Usage: python3 scripts/diagnose_cli_command.py <command> <error>", file=sys.stderr)
        sys.exit(1)
    command = sys.argv[1]
    error = sys.argv[2]
    
    validate_input(command, 'command', max_length=2000)
    validate_input(error, 'error', max_length=4000)
    
    result = diagnose_cli(command, error)
    sanitized = sanitize_response(result)
    print(json.dumps(sanitized, ensure_ascii=False, indent=2))

# -*- coding: utf-8 -*-
"""List API overviews for a given Alibaba Cloud product.

Usage:
    python3 scripts/lsit_api_overview.py <product> <version> [filter]

Example:
    python3 scripts/lsit_api_overview.py Ecs 2014-05-26
    python3 scripts/lsit_api_overview.py Ecs 2014-05-26 '云助手'
"""
import sys
import json
import re

from alibabacloud_tea_openapi.client import Client as OpenApiClient
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_tea_util import models as util_models
from alibabacloud_openapi_util.client import Client as OpenApiUtilClient


def validate_product(product):
    """Validate product matches ^[a-zA-Z][a-zA-Z0-9-]{0,49}$."""
    if not re.match(r'^[a-zA-Z][a-zA-Z0-9-]{0,49}$', product):
        print(f"Error: product must start with letter and contain only alphanumeric or hyphen, max 50 chars", file=sys.stderr)
        sys.exit(1)


def validate_version(version):
    r"""Validate version matches ^\d{4}-\d{2}-\d{2}$."""
    if not re.match(r'^\d{4}-\d{2}-\d{2}$', version):
        print(f"Error: version must be in YYYY-MM-DD format", file=sys.stderr)
        sys.exit(1)


def validate_input(value, name, max_length=2000):
    """Validate input value for length and non-empty."""
    if not value or len(value) > max_length:
        print(f"Error: {name} exceeds {max_length} chars or is empty", file=sys.stderr)
        sys.exit(1)


def sanitize_response(obj):
    """Recursively sanitize sensitive fields in response object."""
    sensitive_keys = {'accesskeyid', 'accesskeysecret', 'securitytoken', 'password', 'secret', 'accountid', 'credential'}
    
    if isinstance(obj, dict):
        sanitized = {}
        for key, value in obj.items():
            if key.lower() in sensitive_keys:
                sanitized[key] = "***REDACTED***"
            else:
                sanitized[key] = sanitize_response(value)
        return sanitized
    elif isinstance(obj, list):
        return [sanitize_response(item) for item in obj]
    else:
        return obj


def create_client() -> OpenApiClient:
    credential = CredentialClient()
    config = open_api_models.Config(credential=credential)
    config.endpoint = 'openapi-mcp.cn-hangzhou.aliyuncs.com'
    config.user_agent = 'AlibabaCloud-Agent-Skills'
    return OpenApiClient(config)


def list_api_overviews(product: str, version: str, filter_keyword: str = '') -> dict:
    client = create_client()
    params = open_api_models.Params(
        action='ListApiOverviews',
        version='2024-11-30',
        protocol='HTTPS',
        method='GET',
        auth_type='AK',
        style='ROA',
        pathname='/listApiOverviews',
        req_body_type='json',
        body_type='json'
    )
    queries = {'product': product, 'version': version}
    if filter_keyword:
        queries['filter'] = filter_keyword
    runtime = util_models.RuntimeOptions(read_timeout=30000)
    request = open_api_models.OpenApiRequest(
        query=OpenApiUtilClient.query(queries)
    )
    return client.call_api(params, request, runtime)


if __name__ == '__main__':
    if len(sys.argv) < 3:
        print("Usage: python3 scripts/lsit_api_overview.py <product> <version> [filter]", file=sys.stderr)
        sys.exit(1)
    product = sys.argv[1]
    version = sys.argv[2]
    filter_kw = sys.argv[3] if len(sys.argv) > 3 else ''
    
    validate_product(product)
    validate_version(version)
    if filter_kw:
        validate_input(filter_kw, 'filter', max_length=200)
    
    result = list_api_overviews(product, version, filter_kw)
    sanitized = sanitize_response(result)
    print(json.dumps(sanitized, ensure_ascii=False, indent=2))

# -*- coding: utf-8 -*-
"""List Alibaba Cloud products by keyword filter.

Usage:
    python3 scripts/lsit_products.py <filter_keyword>

Example:
    python3 scripts/lsit_products.py '云网络'
    python3 scripts/lsit_products.py 'ECS'
"""
import sys
import json

from alibabacloud_tea_openapi.client import Client as OpenApiClient
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_tea_util import models as util_models
from alibabacloud_openapi_util.client import Client as OpenApiUtilClient


def validate_input(value, name, max_length=2000):
    """Validate input value for length and non-empty."""
    if not value or len(value) > max_length:
        print(f"Error: {name} exceeds {max_length} chars or is empty", file=sys.stderr)
        sys.exit(1)


def sanitize_response(obj):
    """Recursively sanitize sensitive fields in response object."""
    sensitive_keys = {'accesskeyid', 'accesskeysecret', 'securitytoken', 'password', 'secret', 'accountid', 'credential'}
    
    if isinstance(obj, dict):
        sanitized = {}
        for key, value in obj.items():
            if key.lower() in sensitive_keys:
                sanitized[key] = "***REDACTED***"
            else:
                sanitized[key] = sanitize_response(value)
        return sanitized
    elif isinstance(obj, list):
        return [sanitize_response(item) for item in obj]
    else:
        return obj


def create_client() -> OpenApiClient:
    credential = CredentialClient()
    config = open_api_models.Config(credential=credential)
    config.endpoint = 'openapi-mcp.cn-hangzhou.aliyuncs.com'
    config.user_agent = 'AlibabaCloud-Agent-Skills'
    return OpenApiClient(config)


def list_products(filter_keyword: str) -> dict:
    client = create_client()
    params = open_api_models.Params(
        action='ListProducts',
        version='2024-11-30',
        protocol='HTTPS',
        method='GET',
        auth_type='AK',
        style='ROA',
        pathname='/listProducts',
        req_body_type='json',
        body_type='json'
    )
    queries = {}
    if filter_keyword:
        queries['filter'] = filter_keyword
    runtime = util_models.RuntimeOptions(read_timeout=30000)
    request = open_api_models.OpenApiRequest(
        query=OpenApiUtilClient.query(queries)
    )
    return client.call_api(params, request, runtime)


if __name__ == '__main__':
    if len(sys.argv) < 2:
        print("Usage: python3 scripts/lsit_products.py <filter_keyword>", file=sys.stderr)
        sys.exit(1)
    filter_keyword = sys.argv[1]
    
    validate_input(filter_keyword, 'filter_keyword', max_length=200)
    
    result = list_products(filter_keyword)
    sanitized = sanitize_response(result)
    print(json.dumps(sanitized, ensure_ascii=False, indent=2))

# -*- coding: utf-8 -*-
"""Search Alibaba Cloud APIs by natural language prompt.

Usage:
    python3 scripts/search_apis.py <prompt> [limit]

Example:
    python3 scripts/search_apis.py '创建ECS实例'
    python3 scripts/search_apis.py '创建ECS实例' 5
"""
import sys
import json

from alibabacloud_tea_openapi.client import Client as OpenApiClient
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_tea_util import models as util_models


def validate_input(value, name, max_length=2000):
    """Validate input value for length and non-empty."""
    if not value or len(value) > max_length:
        print(f"Error: {name} exceeds {max_length} chars or is empty", file=sys.stderr)
        sys.exit(1)


def validate_int_range(value, name, min_val, max_val):
    """Validate integer is within range."""
    if value < min_val or value > max_val:
        print(f"Error: {name} must be between {min_val} and {max_val}", file=sys.stderr)
        sys.exit(1)


def sanitize_response(obj):
    """Recursively sanitize sensitive fields in response object."""
    sensitive_keys = {'accesskeyid', 'accesskeysecret', 'securitytoken', 'password', 'secret', 'accountid', 'credential'}
    
    if isinstance(obj, dict):
        sanitized = {}
        for key, value in obj.items():
            if key.lower() in sensitive_keys:
                sanitized[key] = "***REDACTED***"
            else:
                sanitized[key] = sanitize_response(value)
        return sanitized
    elif isinstance(obj, list):
        return [sanitize_response(item) for item in obj]
    else:
        return obj


def create_client() -> OpenApiClient:
    credential = CredentialClient()
    config = open_api_models.Config(credential=credential)
    config.endpoint = 'openapi-mcp.cn-hangzhou.aliyuncs.com'
    config.user_agent = 'AlibabaCloud-Agent-Skills'
    return OpenApiClient(config)


def search_apis(prompt: str, limit: int = 5) -> dict:
    client = create_client()
    params = open_api_models.Params(
        action='SearchApis',
        version='2024-11-30',
        protocol='HTTPS',
        method='POST',
        auth_type='AK',
        style='ROA',
        pathname='/searchApis',
        req_body_type='json',
        body_type='json'
    )
    body = {'prompt': prompt, 'limit': limit}
    runtime = util_models.RuntimeOptions(read_timeout=60000)
    request = open_api_models.OpenApiRequest(body=body)
    return client.call_api(params, request, runtime)


if __name__ == '__main__':
    if len(sys.argv) < 2:
        print("Usage: python3 scripts/search_apis.py <prompt> [limit]", file=sys.stderr)
        sys.exit(1)
    prompt = sys.argv[1]
    limit = int(sys.argv[2]) if len(sys.argv) > 2 else 5
    
    validate_input(prompt, 'prompt', max_length=2000)
    validate_int_range(limit, 'limit', 1, 100)
    
    result = search_apis(prompt, limit)
    sanitized = sanitize_response(result)
    print(json.dumps(sanitized, ensure_ascii=False, indent=2))

# -*- coding: utf-8 -*-
"""Search Alibaba Cloud documents by keyword.

Usage:
    python3 scripts/search_documents.py <query> [limit]

Example:
    python3 scripts/search_documents.py 'ECS实例规格'
    python3 scripts/search_documents.py 'VPC网络配置' 5
"""
import sys
import json

from alibabacloud_tea_openapi.client import Client as OpenApiClient
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_tea_util import models as util_models


def validate_input(value, name, max_length=2000):
    """Validate input value for length and non-empty."""
    if not value or len(value) > max_length:
        print(f"Error: {name} exceeds {max_length} chars or is empty", file=sys.stderr)
        sys.exit(1)


def validate_int_range(value, name, min_val, max_val):
    """Validate integer is within range."""
    if value < min_val or value > max_val:
        print(f"Error: {name} must be between {min_val} and {max_val}", file=sys.stderr)
        sys.exit(1)


def sanitize_response(obj):
    """Recursively sanitize sensitive fields in response object."""
    sensitive_keys = {'accesskeyid', 'accesskeysecret', 'securitytoken', 'password', 'secret', 'accountid', 'credential'}
    
    if isinstance(obj, dict):
        sanitized = {}
        for key, value in obj.items():
            if key.lower() in sensitive_keys:
                sanitized[key] = "***REDACTED***"
            else:
                sanitized[key] = sanitize_response(value)
        return sanitized
    elif isinstance(obj, list):
        return [sanitize_response(item) for item in obj]
    else:
        return obj


def create_client() -> OpenApiClient:
    credential = CredentialClient()
    config = open_api_models.Config(credential=credential)
    config.endpoint = 'openapi-mcp.cn-hangzhou.aliyuncs.com'
    config.user_agent = 'AlibabaCloud-Agent-Skills'
    return OpenApiClient(config)


def search_documents(query: str, limit: int = 5) -> dict:
    client = create_client()
    params = open_api_models.Params(
        action='SearchDocuments',
        version='2024-11-30',
        protocol='HTTPS',
        method='POST',
        auth_type='AK',
        style='ROA',
        pathname='/searchDocuments',
        req_body_type='json',
        body_type='json'
    )
    body = {'query': query, 'limit': limit}
    runtime = util_models.RuntimeOptions(read_timeout=60000)
    request = open_api_models.OpenApiRequest(body=body)
    return client.call_api(params, request, runtime)


if __name__ == '__main__':
    if len(sys.argv) < 2:
        print("Usage: python3 scripts/search_documents.py <query> [limit]", file=sys.stderr)
        sys.exit(1)
    query = sys.argv[1]
    limit = int(sys.argv[2]) if len(sys.argv) > 2 else 5
    
    validate_input(query, 'query', max_length=2000)
    validate_int_range(limit, 'limit', 1, 100)
    
    result = search_documents(query, limit)
    sanitized = sanitize_response(result)
    print(json.dumps(sanitized, ensure_ascii=False, indent=2))

#!/usr/bin/env bash
set -euo pipefail

# terraform_runtime_online.sh - Execute Terraform via Alibaba Cloud IaCService
#
# Usage:
#   terraform_runtime_online.sh validate <hcl_file_or_code>
#   terraform_runtime_online.sh plan     <hcl_file_or_code> [existing_state_id]
#   terraform_runtime_online.sh apply    <hcl_file_or_code>                  # fresh apply (first time)
#   terraform_runtime_online.sh apply    <hcl_file_or_code> --state-id <id>  # retry failed apply / update existing state
#   terraform_runtime_online.sh apply    --state-id <id>                     # apply a previously planned state
#   terraform_runtime_online.sh destroy  <state_id> [--force]
#   terraform_runtime_online.sh poll     <state_id> [max_attempts] [interval_seconds]
#
# ⚠️  STATE_ID REUSE RULE:
#   - plan  → apply: do NOT pass the plan stateId to apply (IaCService locks plan states)
#   - Once a STATE_ID exists (from a previous apply), ALL subsequent changes to the same
#     deployment MUST reuse it via --state-id, including:
#       • Retrying after a failed/partial apply
#       • Adding new resources to main.tf
#       • Modifying existing resource configuration
#     Only the very first apply of a brand-new deployment runs without --state-id.
#     A fresh apply without --state-id creates a NEW state and causes duplicate resources.

ENDPOINT="iac.cn-zhangjiakou.aliyuncs.com"
SELF="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/$(basename "${BASH_SOURCE[0]}")"

# ---------------------------------------------------------------------------
# Color helpers (degrade gracefully if tput unavailable)
# ---------------------------------------------------------------------------
_green()  { command -v tput &>/dev/null && tput setaf 2; }
_red()    { command -v tput &>/dev/null && tput setaf 1; }
_yellow() { command -v tput &>/dev/null && tput setaf 3; }
_reset()  { command -v tput &>/dev/null && tput sgr0; }

# ---------------------------------------------------------------------------
# Shared helper: resolve file-or-inline input to CODE variable
# ---------------------------------------------------------------------------
_read_input() {
    local input="$1"
    if [[ -f "$input" ]]; then
        cat "$input"
    else
        printf '%s' "$input"
    fi
}

# ---------------------------------------------------------------------------
# cmd: validate
# ---------------------------------------------------------------------------
cmd_validate() {
    if [[ $# -lt 1 || "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
        echo "Usage: $0 validate <hcl_file_or_code>"
        echo "Exit 0 = Validated, 1 = Errored"
        exit 1
    fi

    local input="$1"
    local code
    code=$(_read_input "$input")
    echo "Validating: $input" >&2

    local token response status message
    token="$(uuidgen)"
    response=$(aliyun iacservice validate-module \
        --endpoint "$ENDPOINT" \
        --client-token "$token" \
        --source Upload \
        --code "$code" 2>&1) || { echo "$(_red)Error: validate-module failed$(_reset)" >&2; echo "$response" >&2; exit 1; }

    status=$(echo "$response" | python3 -c "
import sys,json
try: print(json.load(sys.stdin).get('status','Unknown'))
except: print('Unknown')
" 2>/dev/null) || status="Unknown"

    message=$(echo "$response" | python3 -c "
import sys,json
try: print(json.load(sys.stdin).get('message',''))
except: print('')
" 2>/dev/null) || message=""

    echo "" >&2
    if [[ "$status" == "Validated" ]]; then
        echo "$(_green)Validated$(_reset)" >&2
        [[ -n "$message" ]] && echo "$message" >&2
        exit 0
    else
        echo "$(_red)Validation failed: $status$(_reset)" >&2
        [[ -n "$message" ]] && echo "$message" >&2
        exit 1
    fi
}

# ---------------------------------------------------------------------------
# cmd: poll
# ---------------------------------------------------------------------------
cmd_poll() {
    if [[ $# -lt 1 || "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
        echo "Usage: $0 poll <state_id> [max_attempts] [interval_seconds]"
        echo "Exit 0 = terminal state reached, 1 = timeout or Errored"
        exit 1
    fi

    local state_id="$1"
    local max="${2:-60}"
    local interval="${3:-10}"
    local terminal_states=("Planned" "PlannedAndFinished" "Applied" "Errored" "Canceled" "Discarded")

    _is_terminal() {
        local s="$1"
        for t in "${terminal_states[@]}"; do [[ "$s" == "$t" ]] && return 0; done
        return 1
    }

    local attempt=0 response status
    while [[ $attempt -lt $max ]]; do
        attempt=$((attempt + 1))
        response=$(aliyun iacservice get-execute-state --endpoint "$ENDPOINT" --state-id "$state_id" 2>&1) || true
        status=$(echo "$response" | python3 -c "
import sys,json
try: print(json.load(sys.stdin).get('status','Unknown'))
except: print('Unknown')
" 2>/dev/null) || status="Unknown"

        if [[ "$status" == "Errored" ]]; then
            echo "[$attempt/$max] $(_red)Status: $status$(_reset)" >&2
        elif _is_terminal "$status"; then
            echo "[$attempt/$max] $(_green)Status: $status$(_reset)" >&2
        else
            echo "[$attempt/$max] $(_yellow)Status: $status$(_reset)" >&2
        fi

        if _is_terminal "$status"; then
            if [[ "$status" == "Errored" ]]; then
                local errmsg
                errmsg=$(echo "$response" | python3 -c "
import sys,json
try: print(json.load(sys.stdin).get('errorMessage','Unknown error'))
except: print('Unknown error')
" 2>/dev/null) || errmsg="Unknown error"
                echo "$(_red)Error: $errmsg$(_reset)" >&2
                exit 1
            fi
            exit 0
        fi

        [[ $attempt -lt $max ]] && sleep "$interval"
    done

    echo "$(_red)Timeout: $max attempts reached$(_reset)" >&2
    exit 1
}

# ---------------------------------------------------------------------------
# cmd: plan
# ---------------------------------------------------------------------------
cmd_plan() {
    if [[ $# -lt 1 || "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
        echo "Usage: $0 plan <hcl_file_or_code> [existing_state_id]"
        echo "Output: STATE_ID=<id>  PLAN_OUTPUT_FILE=<path>"
        echo "Exit 0 = Planned/PlannedAndFinished, 1 = Errored"
        exit 1
    fi

    local input="$1"
    local state_id="${2:-}"
    local code token aliyun_cmd response new_state_id
    code=$(_read_input "$input")
    echo "Planning: $input" >&2
    [[ -n "$state_id" ]] && echo "Using existing state: $state_id" >&2

    token="$(uuidgen)"
    aliyun_cmd="aliyun iacservice execute-terraform-plan --endpoint $ENDPOINT --client-token $token --code \"\$code\""
    [[ -n "$state_id" ]] && aliyun_cmd="$aliyun_cmd --state-id $state_id"

    response=$(eval "$aliyun_cmd" 2>&1) || { echo "$(_red)Error: execute-terraform-plan failed$(_reset)" >&2; echo "$response" >&2; exit 1; }

    new_state_id=$(echo "$response" | python3 -c "
import sys,json
try: print(json.load(sys.stdin).get('stateId',''))
except: print('')
" 2>/dev/null) || new_state_id=""
    [[ -z "$new_state_id" ]] && { echo "$(_red)Error: no stateId in response$(_reset)" >&2; echo "$response" >&2; exit 1; }

    echo "STATE_ID=$new_state_id"
    echo "" >&2; echo "Plan started. stateId: $new_state_id" >&2; echo "Polling..." >&2; echo "" >&2

    "$SELF" poll "$new_state_id" || { echo "$(_red)Plan failed$(_reset)" >&2; exit 1; }

    local final_response final_status error_message
    final_response=$(aliyun iacservice get-execute-state --endpoint "$ENDPOINT" --state-id "$new_state_id" 2>&1) || true
    final_status=$(echo "$final_response" | python3 -c "
import sys,json
try: print(json.load(sys.stdin).get('status','Unknown'))
except: print('Unknown')
" 2>/dev/null) || final_status="Unknown"

    echo "" >&2
    if [[ "$final_status" == "Planned" || "$final_status" == "PlannedAndFinished" ]]; then
        echo "$(_green)Plan completed: $final_status$(_reset)" >&2

        local plan_file="/tmp/tf_plan_${new_state_id}.txt"
        local plan_summary
        plan_summary=$(echo "$final_response" | python3 -c "
import sys,json,re
plan_file=sys.argv[1]
try:
    data=json.loads(sys.stdin.read(),strict=False)
    lf=data.get('logFile',{})
    log=lf.get('tf-plan.run.log','') if isinstance(lf,dict) else (lf if isinstance(lf,str) else '')
    if not log: print('  No plan details available'); sys.exit(0)
    clean=re.sub(r'\x1b\[[0-9;]*[a-zA-Z]','',log)
    open(plan_file,'w').write(clean)
    lines=clean.split('\n')
    summary=[l for l in lines if ('# ' in l and ('will be' in l or 'must be' in l)) or l.strip().startswith('Plan:') or 'No changes' in l]
    for s in (summary or ['  (see full output for details)']): print('  '+s.strip())
except Exception as e: print(f'  Could not parse: {e}')
" "$plan_file" 2>/dev/null) || plan_summary="  Could not parse plan details"

        echo "" >&2
        echo "=== Plan Summary ===" >&2
        echo "$plan_summary" >&2
        [[ -f "$plan_file" ]] && { echo "" >&2; echo "Full output: cat $plan_file" >&2; }
        echo "====================" >&2
        echo "PLAN_OUTPUT_FILE=$plan_file"
        exit 0
    elif [[ "$final_status" == "Errored" ]]; then
        error_message=$(echo "$final_response" | python3 -c "
import sys,json
try: m=json.load(sys.stdin).get('errorMessage',''); m and print(m)
except: pass
" 2>/dev/null) || error_message=""
        echo "$(_red)Plan failed: $final_status$(_reset)" >&2
        [[ -n "$error_message" ]] && echo "$(_red)Error: $error_message$(_reset)" >&2
        exit 1
    else
        echo "$(_yellow)Plan status: $final_status$(_reset)" >&2
        exit 0
    fi
}

# ---------------------------------------------------------------------------
# cmd: apply
# ---------------------------------------------------------------------------
cmd_apply() {
    if [[ $# -lt 1 || "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
        echo "Usage:"
        echo "  $0 apply <hcl_file_or_code>                     # first apply of a brand-new deployment"
        echo "  $0 apply <hcl_file_or_code> --state-id <id>     # any subsequent change to an existing deployment"
        echo "  $0 apply --state-id <id>                        # apply a previously planned state"
        echo ""
        echo "  STATE_ID REUSE RULE:"
        echo "  Once a STATE_ID exists, ALL subsequent operations on the same deployment MUST"
        echo "  pass --state-id, including: retry after failure, add resources, modify config."
        echo "  Starting a fresh apply (without --state-id) creates a NEW state and causes"
        echo "  duplicate resource creation."
        echo ""
        echo "Output: STATE_ID=<id>"
        echo "Exit 0 = Applied, 1 = Errored"
        exit 1
    fi

    local input="" state_id="" code=""
    while [[ $# -gt 0 ]]; do
        case "$1" in
            --state-id) state_id="${2:-}"; shift 2 ;;
            --help|-h)  cmd_apply --help ;;
            *)          input="$1"; shift ;;
        esac
    done

    [[ -z "$input" && -z "$state_id" ]] && { echo "$(_red)Error: provide HCL code/file or --state-id$(_reset)" >&2; exit 1; }
    [[ -n "$input" ]] && { code=$(_read_input "$input"); echo "Applying: $input" >&2; }
    [[ -n "$state_id" ]] && echo "Using existing state: $state_id" >&2

    local token aliyun_cmd response new_state_id
    local max_retries=6 retry_delay=10 retry=0
    token="$(uuidgen)"

    _build_cmd() {
        local cmd="aliyun iacservice execute-terraform-apply --endpoint $ENDPOINT --client-token $token"
        [[ -n "$code" ]]     && cmd="$cmd --code \"\$code\""
        [[ -n "$state_id" ]] && cmd="$cmd --state-id $state_id"
        echo "$cmd"
    }

    aliyun_cmd=$(_build_cmd)
    while true; do
        response=$(eval "$aliyun_cmd" 2>&1) && break
        if echo "$response" | grep -q "InvalidOperation.TaskStatus"; then
            retry=$((retry + 1))
            if [[ $retry -ge $max_retries ]]; then
                echo "$(_red)Error: state lock not released after $max_retries retries$(_reset)" >&2
                echo "$response" >&2; exit 1
            fi
            echo "$(_yellow)[Retry $retry/$max_retries] State lock not released, waiting ${retry_delay}s...$(_reset)" >&2
            sleep "$retry_delay"
            token="$(uuidgen)"; aliyun_cmd=$(_build_cmd)
        else
            echo "$(_red)Error: execute-terraform-apply failed$(_reset)" >&2; echo "$response" >&2; exit 1
        fi
    done

    new_state_id=$(echo "$response" | python3 -c "
import sys,json
try: print(json.load(sys.stdin).get('stateId',''))
except: print('')
" 2>/dev/null) || new_state_id=""
    [[ -z "$new_state_id" ]] && { echo "$(_red)Error: no stateId in response$(_reset)" >&2; echo "$response" >&2; exit 1; }

    echo "STATE_ID=$new_state_id"
    echo "" >&2; echo "Apply started. stateId: $new_state_id" >&2; echo "Polling..." >&2; echo "" >&2

    "$SELF" poll "$new_state_id" || { echo "$(_red)Apply failed$(_reset)" >&2; exit 1; }

    local final_response final_status error_message
    final_response=$(aliyun iacservice get-execute-state --endpoint "$ENDPOINT" --state-id "$new_state_id" 2>&1) || true
    final_status=$(echo "$final_response" | python3 -c "
import sys,json
try: print(json.load(sys.stdin).get('status','Unknown'))
except: print('Unknown')
" 2>/dev/null) || final_status="Unknown"

    echo "" >&2
    if [[ "$final_status" == "Applied" ]]; then
        echo "$(_green)Apply completed: $final_status$(_reset)" >&2
        echo "" >&2; echo "Resources:" >&2
        echo "$final_response" | python3 -c "
import sys,json
try:
    data=json.load(sys.stdin)
    s=data.get('state','')
    state=json.loads(s) if isinstance(s,str) else s
    resources=state.get('resources',[]) if state else []
    if resources:
        for r in resources:
            for i in r.get('instances',[]):
                print(f'  {r[\"type\"]}.{r[\"name\"]}: {i.get(\"attributes\",{}).get(\"id\",\"N/A\")}')
    else: print('  No resources found')
except Exception as e: print(f'  Could not parse resources: {e}')
" 2>/dev/null || echo "  Could not parse resources" >&2
        exit 0
    elif [[ "$final_status" == "Errored" ]]; then
        error_message=$(echo "$final_response" | python3 -c "
import sys,json
try: m=json.load(sys.stdin).get('errorMessage',''); m and print(m)
except: pass
" 2>/dev/null) || error_message=""
        echo "$(_red)Apply failed: $final_status$(_reset)" >&2
        [[ -n "$error_message" ]] && echo "$(_red)Error: $error_message$(_reset)" >&2
        exit 1
    else
        echo "$(_yellow)Apply status: $final_status$(_reset)" >&2; exit 0
    fi
}

# ---------------------------------------------------------------------------
# cmd: destroy
# ---------------------------------------------------------------------------
cmd_destroy() {
    if [[ $# -lt 1 || "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
        echo "Usage: $0 destroy <state_id> [--force]"
        echo "Exit 0 = Destroyed, 1 = Failed or not confirmed"
        exit 1
    fi

    local state_id="" force=false
    while [[ $# -gt 0 ]]; do
        case "$1" in
            --force) force=true; shift ;;
            --help|-h) cmd_destroy --help ;;
            *) state_id="$1"; shift ;;
        esac
    done

    [[ -z "$state_id" ]] && { echo "$(_red)Error: state_id required$(_reset)" >&2; exit 1; }

    # Pre-check: get current state and list resources
    echo "Pre-check: querying state $state_id ..." >&2
    local pre_response pre_status
    pre_response=$(aliyun iacservice get-execute-state --endpoint "$ENDPOINT" --state-id "$state_id" 2>&1) || {
        echo "$(_red)Error: cannot query state $state_id$(_reset)" >&2
        echo "$pre_response" >&2; exit 1
    }

    pre_status=$(echo "$pre_response" | python3 -c "
import sys,json
try: print(json.load(sys.stdin).get('status','Unknown'))
except: print('Unknown')
" 2>/dev/null) || pre_status="Unknown"

    echo "" >&2
    echo "$(_yellow)⚠️  The following resources will be DESTROYED:$(_reset)" >&2
    echo "$pre_response" | python3 -c "
import sys,json
try:
    data=json.load(sys.stdin)
    s=data.get('state','')
    state=json.loads(s) if isinstance(s,str) else s
    resources=state.get('resources',[]) if state else []
    if resources:
        for r in resources:
            for i in r.get('instances',[]):
                print(f'  {r[\"type\"]}.{r[\"name\"]}: {i.get(\"attributes\",{}).get(\"id\",\"N/A\")}')
    else: print('  (no resources found in state)')
except Exception as e: print(f'  Could not parse resources: {e}')
" 2>/dev/null || echo "  Could not parse resources" >&2
    echo "" >&2

    if [[ "$force" != true ]]; then
        echo "$(_red)Destruction not confirmed. Add --force to proceed.$(_reset)" >&2
        exit 1
    fi

    echo "Destroying resources for state: $state_id" >&2

    local token response destroy_state_id
    token="$(uuidgen)"
    response=$(aliyun iacservice execute-terraform-destroy \
        --endpoint "$ENDPOINT" \
        --client-token "$token" \
        --state-id "$state_id" 2>&1) || { echo "$(_red)Error: execute-terraform-destroy failed$(_reset)" >&2; echo "$response" >&2; exit 1; }

    destroy_state_id=$(echo "$response" | python3 -c "
import sys,json
try:
    sid=json.load(sys.stdin).get('stateId','')
    print(sid if sid else '$state_id')
except: print('$state_id')
" 2>/dev/null) || destroy_state_id="$state_id"

    echo "Polling..." >&2; echo "" >&2
    "$SELF" poll "$destroy_state_id" || { echo "$(_red)Destroy failed$(_reset)" >&2; exit 1; }

    local final_response final_status
    final_response=$(aliyun iacservice get-execute-state --endpoint "$ENDPOINT" --state-id "$destroy_state_id" 2>&1) || true
    final_status=$(echo "$final_response" | python3 -c "
import sys,json
try: print(json.load(sys.stdin).get('status','Unknown'))
except: print('Unknown')
" 2>/dev/null) || final_status="Unknown"

    echo "" >&2
    if [[ "$final_status" == "Applied" || "$final_status" == "Canceled" || "$final_status" == "Discarded" ]]; then
        echo "$(_green)Destroy completed: $final_status$(_reset)" >&2; exit 0
    elif [[ "$final_status" == "Errored" ]]; then
        local errmsg
        errmsg=$(echo "$final_response" | python3 -c "
import sys,json
try: m=json.load(sys.stdin).get('errorMessage',''); m and print(m)
except: pass
" 2>/dev/null) || errmsg=""
        echo "$(_red)Destroy failed: $final_status$(_reset)" >&2
        [[ -n "$errmsg" ]] && echo "$(_red)Error: $errmsg$(_reset)" >&2
        exit 1
    else
        echo "$(_yellow)Destroy status: $final_status$(_reset)" >&2; exit 0
    fi
}

# ---------------------------------------------------------------------------
# Dispatch
# ---------------------------------------------------------------------------
usage() {
    echo "Usage: $0 <command> [args]"
    echo ""
    echo "Commands:"
    echo "  validate <hcl_file_or_code>                  Validate HCL syntax"
    echo "  plan     <hcl_file_or_code> [state_id]       Preview changes"
    echo "  apply    <hcl_file_or_code> [--state-id id]  Create/update infrastructure"
    echo "  apply    --state-id <id>                     Apply planned state"
    echo "  destroy  <state_id> [--force]                Destroy resources"
    echo "  poll     <state_id> [max] [interval]         Poll execution status"
    echo ""
    echo "Run '$0 <command> --help' for per-command usage."
    exit 1
}

COMMAND="${1:-}"
shift || true

case "$COMMAND" in
    validate) cmd_validate "$@" ;;
    plan)     cmd_plan     "$@" ;;
    apply)    cmd_apply    "$@" ;;
    destroy)  cmd_destroy  "$@" ;;
    poll)     cmd_poll     "$@" ;;
    *)        usage ;;
esac

#!/bin/bash
# Alibaba Cloud CLI Environment Verification Script
# Usage: bash scripts/verify_env.sh

if [ -z "$BASH_VERSION" ]; then
    echo "Please run this script with bash: bash $0"
    exit 1
fi

TOTAL=0
PASSED=0
MISSING_ITEMS=()

check() {
    local name="$1"
    local result="$2"
    local fix_hint="$3"
    TOTAL=$((TOTAL + 1))
    if [ "$result" = "0" ]; then
        PASSED=$((PASSED + 1))
        echo "  ✅ PASS  $name"
    else
        echo "  ❌ FAIL  $name"
        if [ -n "$fix_hint" ]; then
            MISSING_ITEMS+=("$fix_hint")
        fi
    fi
}

echo "========================================="
echo "  Alibaba Cloud CLI Environment Check"
echo "========================================="
echo ""

# 1. Check aliyun CLI installed
echo "--- 1. Aliyun CLI ---"
if command -v aliyun &>/dev/null; then
    CLI_VERSION=$(aliyun version 2>&1 | head -1)
    echo "  Version: $CLI_VERSION"
    # Check version >= 3.3.0
    MAJOR=$(echo "$CLI_VERSION" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 | cut -d. -f1)
    MINOR=$(echo "$CLI_VERSION" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 | cut -d. -f2)
    PATCH=$(echo "$CLI_VERSION" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 | cut -d. -f3)
    if [ -n "$MAJOR" ] && [ "$MAJOR" -ge 3 ] && [ "$MINOR" -ge 3 ]; then
        check "Aliyun CLI >= 3.3.0" "0" ""
    elif [ -n "$MAJOR" ] && [ "$MAJOR" -gt 3 ]; then
        check "Aliyun CLI >= 3.3.0" "0" ""
    else
        check "Aliyun CLI >= 3.3.0" "1" "[CLI] Upgrade aliyun CLI to 3.3.0+: brew upgrade aliyun-cli (macOS) or download from https://aliyuncli.alicdn.com/"
    fi
else
    check "Aliyun CLI installed" "1" "[CLI] Install aliyun CLI: brew install aliyun-cli (macOS) or see https://help.aliyun.com/zh/cli/"
fi
echo ""

# 2. Check CLI credentials (via STS GetCallerIdentity)
echo "--- 2. CLI Credentials ---"
if command -v aliyun &>/dev/null; then
    STS_OUTPUT=$(aliyun sts GetCallerIdentity 2>&1)
    if echo "$STS_OUTPUT" | grep -q '"AccountId"'; then
        ACCOUNT_ID=$(echo "$STS_OUTPUT" | python3 -c "import sys,json;print(json.load(sys.stdin)['AccountId'])" 2>/dev/null)
        ARN=$(echo "$STS_OUTPUT" | python3 -c "import sys,json;print(json.load(sys.stdin)['Arn'])" 2>/dev/null)
        MASKED_ACCOUNT="${ACCOUNT_ID:0:4}****${ACCOUNT_ID: -4}"
        MASKED_ARN=$(echo "$ARN" | sed "s/$ACCOUNT_ID/${MASKED_ACCOUNT}/g")
        echo "  Account: $MASKED_ACCOUNT"
        echo "  Identity: $MASKED_ARN"
        check "CLI credentials valid" "0" ""
    else
        echo "  Error: $STS_OUTPUT"
        check "CLI credentials valid" "1" "[Config] Run: aliyun configure set --mode AK --access-key-id <your-ak> --access-key-secret <your-sk> --region cn-hangzhou"
    fi
else
    check "CLI credentials" "1" "[CLI] Install aliyun CLI first"
fi
echo ""

# 3. Check auto-plugin-install
echo "--- 3. Auto Plugin Install ---"
if command -v aliyun &>/dev/null; then
    CONFIG_JSON="$HOME/.aliyun/config.json"
    if [ -f "$CONFIG_JSON" ]; then
        AUTO_INSTALL=$(python3 -c "
import json
with open('$CONFIG_JSON') as f:
    cfg = json.load(f)
# Check current profile
profiles = cfg.get('profiles', [])
current = cfg.get('current', 'default')
for p in profiles:
    if p.get('name') == current:
        print(str(p.get('auto_plugin_install', False)).lower())
        break
else:
    print('false')
" 2>/dev/null || echo "false")
        if [ "$AUTO_INSTALL" = "true" ]; then
            check "Auto plugin install enabled" "0" ""
        else
            check "Auto plugin install enabled" "1" "[Config] Run: aliyun configure set --auto-plugin-install true"
        fi
    else
        check "Auto plugin install enabled" "1" "[Config] Run: aliyun configure set --auto-plugin-install true"
    fi
else
    check "Auto plugin install" "1" "[CLI] Install aliyun CLI first"
fi
echo ""

# 4. Check Python3 (needed for helper scripts)
echo "--- 4. Python3 (for helper scripts) ---"
if command -v python3 &>/dev/null; then
    PY_VERSION=$(python3 --version 2>&1 || echo "unknown")
    echo "  Version: $PY_VERSION"
    check "Python3 available" "0" ""
else
    check "Python3 available" "1" "[Python3] Install Python 3.8+: https://www.python.org/downloads/"
fi
echo ""

# 5. Check Python SDK (needed for helper scripts only)
echo "--- 5. Python SDK (for helper scripts) ---"
if command -v python3 &>/dev/null; then
    SDK_PACKAGES=(
        "alibabacloud_tea_openapi"
        "alibabacloud_credentials"
        "alibabacloud_tea_util"
        "alibabacloud_openapi_util"
    )
    MISSING_SDK=()
    for pkg in "${SDK_PACKAGES[@]}"; do
        if ! python3 -c "import $pkg" &>/dev/null; then
            MISSING_SDK+=("$pkg")
        fi
    done
    if [ ${#MISSING_SDK[@]} -eq 0 ]; then
        check "SDK packages for helper scripts" "0" ""
    else
        check "SDK packages for helper scripts (missing: ${MISSING_SDK[*]})" "1" "[SDK] Run: pip3 install alibabacloud-tea-openapi alibabacloud-credentials alibabacloud-tea-util alibabacloud-openapi-util"
    fi
else
    check "SDK packages check" "1" "[Python3] Install Python 3.8+ first"
fi

echo ""
echo "========================================="
echo "  Result: $PASSED/$TOTAL passed"
echo "========================================="

if [ "$PASSED" -eq "$TOTAL" ]; then
    echo "  ✅ All CLI environment checks passed!"
    exit 0
else
    echo ""
    IFS=$'\n' UNIQUE_MISSING=($(sort -u <<<"${MISSING_ITEMS[*]}")); unset IFS

    echo "  ❌ $((TOTAL - PASSED)) item(s) failed. How to fix:"
    echo ""
    for item in "${UNIQUE_MISSING[@]}"; do
        echo "  $item"
    done
    echo ""
    exit 1
fi