Alibaba Cloud Private Network Connectivity Diagnosis

Mandatory First Action

Before reasoning about the cause or running any diagnostic command, execute Step 0 with the skill scripts:

PYTHON=$(bash scripts/detect_python.sh) || exit 1
$PYTHON scripts/net_common.py check-env
$PYTHON scripts/net_common.py parse-input --input "<all user-provided information>"

If parse-input returns workflow_blocked: true or exits with code 2, stop and output its required_action to the user. Wait for source/destination instance IDs, IP addresses, or VPC IDs and their region. Do not continue diagnosis, infer a local target, or inspect the execution environment. In particular, do not run ss, netstat, lsof, curl, ping, nc, telnet, ip, iptables, firewall-cmd, nslookup, or inspect /proc, nginx, Kubernetes, container, proxy, certificate, host, listener, interface, or local route state. Those describe the AgentHub runner, not the user's Alibaba Cloud network.

Once blocked, do not rerun parse-input with fabricated, guessed, example, or default endpoints. A normal second call cannot clear the guard. Only after a new user response supplies endpoint information, parse that response with --resume-after-user-response. Using this flag before a real user follow-up is a critical violation.

This gate applies even when the prompt only says that a protocol or port, such as TCP 443, is unreachable. The only permitted next action without a cloud endpoint is to ask for the missing endpoint information.

Blocked-workflow completion rule: The first turn is complete as soon as required_action is returned. Do not keep a command running while waiting for the user and do not poll, sleep, or retry. Resume only in a later user turn.