Install
openclaw skills install alibabacloud-ecs-code-deployInstall Alibaba Cloud CLI (aliyun) and deploy projects to Alibaba Cloud ECS using aliyun appmanager commands. Use when the user wants to deploy applications or AI agents to ECS, set up aliyun CLI, or use appmanager init/deploy/status/delete commands.
openclaw skills install alibabacloud-ecs-code-deployaliyun appmanager is an Agent-friendly CLI tool for one-click deployment of applications (App) and AI Agents to Alibaba Cloud ECS. It supports non-interactive mode (--non-interactive), structured JSON output (--output json), and streaming NDJSON responses.
Default behavior: When user invokes /alibabacloud-ecs-code-deploy without specifying a project path or URL, deploy the current working directory project to Alibaba Cloud ECS. If user provides a git URL, clone it to the current directory first, then cd into the cloned directory and proceed with deployment.
EXECUTION ORDER: The Agent MUST follow the "Complete Deployment Workflow" section at the bottom of this document for the correct execution sequence. The Task sections below are organized by topic for reference — their numbering does NOT imply execution order.
Before executing any step, the Agent MUST create a todo list with ALL of the following items. Do NOT omit any item. Do NOT start deployment until the todo list is created.
待办列表(部署到阿里云 ECS):
[ ] 0. 解析 $SKILL_DIR(跨平台路径,必须最先执行 — 见下方 "Step 0" 章节)
[ ] 1. 环境预检(⚠️ 必须运行 deploy_toolkit.py check,禁止手动执行命令替代)
[ ] 2. 获取项目(如需克隆 git URL 则在此步执行;本地项目跳过)
── 🔀 检查 .appmanager/config.yaml 是否已存在(重复部署快捷路径)──
│ 存在 + 新建ECS(无 instanceId)→ 跳过 3~5,从 5.5 询价开始
│ 存在 + 已有ECS(有 instanceId)→ 跳过 3~5.5,从 6 部署开
│ 不存在 → 正常从 3 开始
─────────────────────────────────────────────────────────
[ ] 3. 读取项目(README.md → 快速部署方案)+ 识别类型(agent / app)
[ ] 4. 询问用户部署配置(地域 + 新建ECS/已有ECS)
[ ] 5. 初始化 + 生成脚本(appmanager init → 生成 start/stop 脚本写入 config.yaml)
[ ] 5.5. 部署前询价(⚠️ 必须运行 deploy_toolkit.py price,用户确认价格后再部署)
[ ] 6. 部署(⚠️ 必须运行 deploy_toolkit.py deploy,禁止手动执行 deploy 命令替代)
[ ] 7. 验证(⚠️ 必须运行 deploy_toolkit.py verify,禁止手动执行 status 命令替代)
[ ] 8. 输出最终结果(控制台链接 + 费用提醒 + 管理命令)
⛔ SCRIPT-FIRST RULE: Steps 1, 5, 6, 7 have a dedicated toolkit script at
$SKILL_DIR/scripts/deploy_toolkit.py(where$SKILL_DIRis resolved in Step 0 below — works on Qoder, Claude Code, and any other platform). The Agent MUST run the corresponding subcommand DIRECTLY as the FIRST and ONLY action for that step — NEVER run manual CLI commands (likealiyun version, version checks, credential checks) BEFORE or INSTEAD of the script. The script already handles ALL checks internally. Manual commands are ONLY allowed as fallback if the script file itself does not exist.❌ WRONG (Step 1): Run
aliyun version→ check version → run~/.aliyun/appmanager-venv/bin/python ...→ check version → THEN rundeploy_toolkit.py check✅ CORRECT (Step 1): Runpython3 "$SKILL_DIR/scripts/deploy_toolkit.py" check→ if exit 1, fix the issue it reports → if script file missing, THEN fall back to manual checks
Item 6 is NON-NEGOTIABLE. An Agent that skips log verification and directly outputs "deployment succeeded" has NOT completed this skill correctly. If
deploy_toolkit.py verifyexits 1 (failed), the Agent MUST fix the issue and re-deploy before proceeding to item 7.
$SKILL_DIR — Cross-Platform PathThe toolkit script lives at
<skill-root>/scripts/deploy_toolkit.py. Different platforms install skills to different locations (Qoder/Claude Code/Qwen/...). The Agent MUST resolve the absolute skill root once at session start and reuse it everywhere$SKILL_DIRappears below. Hardcoding any platform-specific path is FORBIDDEN.
See references/skill-dir-resolution.md for the full 10-candidate detection algorithm, the export + test -f verify snippet, and Pattern A / Pattern B / ⛔ Anti-pattern usage rules.
Quick recap (read the reference for details):
export SKILL_DIR="/abs/path" then later python3 "$SKILL_DIR/scripts/deploy_toolkit.py" <sub>python3 "/abs/path/scripts/deploy_toolkit.py" <sub>SKILL_DIR=/path python3 "$SKILL_DIR/..." — outer shell expands $SKILL_DIR BEFORE the prefix assignment, producing /scripts/deploy_toolkit.py and ENOENT. If you see python3: can't open file '/scripts/deploy_toolkit.py', switch to Pattern A or B.Primary action: Run python3 "$SKILL_DIR/scripts/deploy_toolkit.py" check — it checks CLI version + appmanager-cli version + credentials in one run. Only if the script file is missing, use the fallback in references/init-and-credentials.md.
⚠️ 环境前提不满足时的处置规则(MUST): When
checkexits 1 because the aliyun CLI is missing or older than 3.3.14 (or appmanager-cli is missing/outdated), the Agent MUST NOT stop the workflow silently. The required flow is:
- ASK the user first — show the detected version + the required version + the install/upgrade command, and ask for explicit consent (e.g. "当前 aliyun CLI 版本 3.3.4 低于 appmanager 所需 ≥3.3.14,是否同意升级(覆盖安装到 /usr/local/bin,需要 sudo)?"). Never assume yes; never paste credentials.
- On approval — execute the install/upgrade command (see snippet below or references/init-and-credentials.md for the right arch), then re-run
deploy_toolkit.py checkto confirm.- On refusal — stop with the refusal as the reason. Do NOT continue with the older version (deployment will fail anyway).
The toolkit's
checkoutput already includes an→ AGENT: DO NOT stop. ASK user ...line for each fixable issue — follow it verbatim.
⛔ MUST configure AI-Mode: Agent MUST ensure AI-Mode is properly configured before running any
aliyun appmanagercommands. All subsequentaliyunCLI calls automatically carry the configured User-Agent header — no per-command--user-agentflag needed.
# 1. Enable AI-Mode (MUST — enables User-Agent tracking in all API calls)
aliyun configure ai-mode enable
# 2. Set User-Agent for skill traceability (MUST — identifies this skill in API logs)
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ecs-code-deploy"
# 3. Update plugins to latest (ensures appmanager subcommand is available)
aliyun plugin update
# 4. Verify AI-Mode status
aliyun configure ai-mode show
# Expected: enabled=true, user-agent=AlibabaCloud-Agent-Skills/alibabacloud-ecs-code-deploy
Disable AI-Mode (when troubleshooting or if explicitly required):
# Disable AI-Mode (stops sending User-Agent header; re-enable with 'enable' above)
aliyun configure ai-mode disable
deploy_toolkit.py checkalready handles AI-Mode enable + set-user-agent internally. The above is only needed for manual fallback scenarios.
deploy_toolkit.py check already validates credentials. Only if credentials are missing/invalid, see references/init-and-credentials.md for the default-credential-chain remediation flow.
⛔ SA-2.12 — DO NOT explicitly handle AK/SK: This skill MUST rely on the aliyun CLI/SDK default credential chain (ECS RAM Role / env vars / pre-existing
~/.aliyun/config.json). The Agent NEVER asks the user to paste AccessKey/Secret/STS-Token values into the chat, NEVER puts raw AK/SK in tool-call arguments or scripts, and NEVER echoes credential values. When credentials are missing, instruct the user to configure them out-of-band (their own terminal/shell profile/RAM role) and only re-verify viaaliyun sts get-caller-identity. Full remediation flow → references/init-and-credentials.md.CRITICAL PROHIBITION: NEVER run standalone
appmanageroraliyun appmanager login.
CRITICAL ORDERING RULE: Before scanning any project files, the Agent MUST read
README.md(orREADME) in the project root. This is ALWAYS the first action in Task 3.
What to extract from README:
pip install -r requirements.txt && python main.py, npm install && npm start)Step A: List what README provides to the user.
Step B: Select method by priority:
| Priority | Method Type | Action |
|---|---|---|
| 1 (HIGHEST) | Native CLI / package manager install (npm install -g, pip install, go install) | Use directly |
| 2 | Native build + run (pip install && python main.py, npm install && npm start) | Use, install runtime |
| 3 | Script-based deploy (bash deploy.sh) | Must confirm non-interactive |
| 4 (LOWEST) | Docker / docker-compose | Only when no higher priority exists; check China accessibility |
Step C: Execute based on scenario:
Why README first? Most projects document the exact build/run commands. Auto-detecting from files alone is error-prone.
| Condition | Type |
|---|---|
Project depends on agentscope | agent |
| Everything else (langchain, mcp, autogen, web services, tools, etc.) | app |
--nameUse the project directory name (lowercased, hyphens). Inform user: "应用名称默认使用目录名 <name>"
--region and ECS target (MUST ask user)Agent MUST ask both questions together in ONE message:
1. 请问您希望部署到哪个地域?
- 上海(cn-shanghai)/ 杭州(cn-hangzhou)/ 北京(cn-beijing)/ 深圳(cn-shenzhen)/ 广州(cn-guangzhou)/ 成都(cn-chengdu)/ 南京(cn-nanjing)/ 香港(cn-hongkong)
2. 使用新建 ECS 还是已有 ECS?
- 新建 ECS(自动创建实例,按量付费)
- 已有 ECS(请提供实例 ID,如
i-bp1xxxxxxxx)
NEVER use "华东1区"/"华北2区". NEVER add descriptions. City names only.
--port (App type only, OPTIONAL)Only specify when the project actually listens on HTTP. Skip for background services (bots, workers, CLI tools). If needed but unknown, default to 8080. Agent type does NOT use --port.
See references/init-and-credentials.md for all init flag combinations.
Creates .appmanager/config.yaml. Does NOT support --overwrite — delete .appmanager/ first if exists.
For ALL project types, the Agent MUST generate deployment scripts and write them into .appmanager/config.yaml.
common.scripts.start and common.scripts.stop (NEVER top-level scripts)| Indicator Files | Language |
|---|---|
package.json / *.js / *.ts | Node.js |
requirements.txt / pyproject.toml / *.py | Python |
pom.xml / build.gradle / *.java | Java |
go.mod / *.go | Go |
composer.json / *.php | PHP |
docker-compose.yml / Dockerfile | Docker |
| Language | Must Read | Why |
|---|---|---|
| Python | pyproject.toml, requirements.txt | Entry point, deps |
| Node.js | package.json | scripts.start, main field |
| Java | pom.xml or build.gradle | JAR name |
| Go | go.mod | Module → binary name |
| PHP | composer.json | Framework detection |
| Docker | docker-compose.yml / Dockerfile | Services, ports |
[project.scripts] in pyproject.toml → main.py → app.py → manage.pyscripts.start → main field → index.js → server.jsfind ... -name "*.jar" | head -1 → java -jarfind ... -type f -perm /111composer install --no-dev → php artisan serve or php -Sdocker compose up -d / docker compose down| Rule | Requirement |
|---|---|
| ⛔ MANDATORY zip extract | Start script MUST: find zip → mkdir -p → unzip -o → cd. Without this, project dir DOES NOT EXIST on ECS |
| Runtime install | MUST install language runtime FIRST (ECS is bare) |
| Install unzip | command -v unzip &>/dev/null || $PKG_MGR install -y unzip |
| Idempotent | Safe to run multiple times |
| ⛔ Log file FIXED path | MUST be /root/app.log and /root/app.pid. verify script hardcodes these paths |
| Log append | Always >> (never >) |
| PID file | echo $! > /root/app.pid after nohup ... & |
| Background run | nohup ... >> /root/app.log 2>&1 & |
| Stop old process | [ -f /root/app.pid ] && kill "$(cat /root/app.pid)" 2>/dev/null || true |
| App dir | /root/{app_name} |
| No heredoc | NEVER use << 'EOF' inside scripts — breaks YAML. Use printf or python3 -c |
| MANDATORY tail log | End with sleep 3 && cat /root/app.log for verification capture |
| ⛔ Stop script: NO exit | MUST NOT contain exit. Deploy system concatenates stop+start — exit kills the entire process |
ECS instances are bare Linux (typically Alibaba Cloud Linux, RHEL-based, uses
yum/dnf).
For script templates, language install commands, and config.yaml writing method, see references/script-templates.md.
MANDATORY: Before deploying, run price check and ask user for confirmation.
python3 "$SKILL_DIR/scripts/deploy_toolkit.py" price --config .appmanager/config.yaml
=== AGENT_CONFIRM_REQUIRED ===: Present COMPLETE cost breakdown to user (fixed hourly + traffic ¥/GB), ask confirmationAgent MUST present: "预估费用:¥X.XXX/小时(≈¥XXX.XX/月),公网流量按实际使用量另计 ¥0.80/GB。是否确认继续部署?"
aliyun appmanager <agent|app> deploy --overwrite --output json
STOP after deploy success —
status: successonly means orchestration completed. Agent MUST run Task 6 verification before outputting results.
⛔
ReleaseCancelled语义:意味着 start 脚本在 ECS 上执行失败或超时。不是"有人取消了部署"。唯一正确动作:运行deploy_toolkit.py verify→ 看日志 → 修脚本 → 重新部署。
失败处理流程:
deploy_toolkit.py verify 获取 /root/app.log(禁止跳过)
status: Deployed不代表应用在运行。Agent MUST 运行 verify 并语义分析日志。
deploy_toolkit.py verify(自动读取 config.yaml 参数)See references/deploy-output-and-management.md for:
Before outputting results, Agent MUST print ✅ 部署自检报告 with all items confirmed. Only proceed when all pass.
⛔ MANDATORY EXECUTION RULE: The Agent MUST follow this sequence exactly. For steps that specify a script (steps 1, 5, 6), the Agent MUST run the script — NEVER manually replicate the script's logic with individual commands. The Task sections above are REFERENCE ONLY (for understanding what the scripts do internally or as fallback if scripts are missing).
python3 "/abs/path/scripts/deploy_toolkit.py" ...SKILL_DIR=/path python3 "$SKILL_DIR/..." — outer shell expands $SKILL_DIR/scripts/deploy_toolkit.py and ENOENT.python3 "$SKILL_DIR/scripts/deploy_toolkit.py" check
aliyun version, ~/.aliyun/appmanager-venv/bin/python -c "...",→ AGENT: DO NOT stop. ASK user ...rm -rf ~/.aliyun/appmanager-venv (auto-recreates on next aliyunaliyun configure interactive) — NEVERagentscope; everything else is "app"rm -rf .appmanager deletes the existing deployment config.pwd shows expected path).appmanager (NEVER absolute, NEVER with variables)python3 "$SKILL_DIR/scripts/deploy_toolkit.py" price --config .appmanager/config.yaml
python3 "$SKILL_DIR/scripts/deploy_toolkit.py" deploy
--type <agent|app> --name <APP_NAME> --group <GROUP_NAME> --region <REGION_ID>
aliyun appmanager deploy directly without this scriptpython3 "$SKILL_DIR/scripts/deploy_toolkit.py" verify
--type <agent|app> --name <APP_NAME> --group <GROUP_NAME> --region <REGION_ID>
aliyun appmanager status + manual log analysis instead of this script