Use headless non-interactive mode

Prerequisites

• Install and configure IaC Code is complete.

• The model configuration is verified in an interactive environment. Headless mode does not start the authentication wizard.

• Read-only Alibaba Cloud permissions are configured for querying cloud resources. Configure precise permission rules for write operations.

Quick start

Run a one-time read-only cloud resource query with command parameters:

iac-code --prompt "Query the ROS stacks in cn-hangzhou, summarize the stacks in an abnormal state, and do not perform any write operations" \
  --permission-mode dont_ask

Expected result: standard output displays a summary of stack states, and the process exits after the task completes.

Pass the task from standard input:

printf '%s\n' 'Check the cloud resource solution in the current directory, list the security and cost risks, and do not modify files or cloud resources' \
| iac-code --prompt - \
    --permission-mode dont_ask

--prompt - suits scenarios where the prompt is generated by a file, a template system, or an upstream command.

Select an output format

Get the final JSON output:

iac-code \
  --prompt "Query the ROS stacks in cn-hangzhou and output a state summary, and do not perform any write operations" \
  --output-format json \
  --max-turns 20 \
  --permission-mode dont_ask

The caller must parse JSON only from standard output and handle standard error separately as a diagnostic log.

Handle exit codes

Automation systems must check both the structured result and the exit code, and set an external timeout for the IaC Code process.

Control tool permissions

Headless mode cannot display interactive approvals. Select the permission configuration that matches your scenario:

--permission-mode dont_ask will deny operations that would otherwise require confirmation, making it suitable for read-only queries and checks. When file writes or cloud resource management are needed, commands or cloud APIs should be precisely constrained via --allowed-tools and --disallowed-tools.

For example, for an automated task that only needs to allow specified ROS write APIs, use the corresponding fine-grained tool authorization mode. Do not use bypass_permissions merely to remove approval prompts; if you do use this mode, you should still rely on runtime isolation, RAM least privilege, auditing, and manual change control gates.

Script example

The following script writes the structured result to the build artifact directory and preserves the exit code of IaC Code:

#!/usr/bin/env bash

set -u
mkdir -p build

if printf '%s\n' 'Query the ROS stacks in cn-hangzhou, summarize the abnormal states, and do not perform any write operations' \
| iac-code --prompt - \
      --output-format json \
      --max-turns 20 \
      --permission-mode dont_ask \
      > build/iac-code-result.json; then
  echo "IaC Code query completed"
else
  status=$?
  echo "IaC Code query failed. Exit code: ${status}" >&2
  exit "${status}"
fi

FAQ

References

• Install and use IaC Code

• Integrate IaC Code by using Headless mode

• Complete reference for Headless non-interactive mode

• Command line options