diff --git a/packages/cli/src/commands/dataset/validate.ts b/packages/cli/src/commands/dataset/validate.ts
index 36b66d2..e64a81a 100644
--- a/packages/cli/src/commands/dataset/validate.ts
+++ b/packages/cli/src/commands/dataset/validate.ts
@@ -26,6 +26,8 @@ function formatStats(result: ValidationResult): string[] {
 export default defineCommand({
   name: "dataset validate",
   description: "Locally validate a dataset file (.jsonl) without uploading",
+  // 纯本地校验，不触网、不需 API key（与 `pipeline validate` 一致）。
+  skipDefaultApiKeySetup: true,
   usage: "bl dataset validate --file <path> [--full-validate] [--schema <chatml|dpo>]",
   options: [
     { flag: "--file <path>", description: "Local .jsonl dataset file", required: true },
diff --git a/packages/cli/tests/e2e/dataset.e2e.test.ts b/packages/cli/tests/e2e/dataset.e2e.test.ts
index 38c497e..89c0067 100644
--- a/packages/cli/tests/e2e/dataset.e2e.test.ts
+++ b/packages/cli/tests/e2e/dataset.e2e.test.ts
@@ -8,12 +8,17 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Dataset (fine-tune file) E2E.
  *
- * The local validation tests have no network dependency and run in the
- * default suite. The remote upload/list/delete tests require DashScope
- * credentials and are gated by isDashScopeE2EReady().
+ * The suite exercises command discovery, help text, local dataset validation,
+ * and the `--dry-run` upload preview with no network dependency. Because
+ * `ensureApiKey` runs before every command (see main.ts), these cases are
+ * gated by isDashScopeE2EReady() — they are skipped when no DashScope
+ * credential is present (e.g. on CI) and run offline when one is. (`dataset
+ * validate` itself is keyless via skipDefaultApiKeySetup, but the rest of the
+ * suite needs a key, so the whole offline block is gated together.) The
+ * remote list test is also gated.
  */
 
-describe("e2e: dataset (offline)", () => {
+describe.skipIf(!isDashScopeE2EReady())("e2e: dataset (offline)", () => {
   test("dataset --help 列出子命令", async () => {
     const { stdout, stderr, exitCode } = await runCli(["dataset"]);
     expect(exitCode, stderr).toBe(0);
diff --git a/packages/cli/tests/e2e/deploy.e2e.test.ts b/packages/cli/tests/e2e/deploy.e2e.test.ts
index 8403c5e..5fdcd63 100644
--- a/packages/cli/tests/e2e/deploy.e2e.test.ts
+++ b/packages/cli/tests/e2e/deploy.e2e.test.ts
@@ -4,16 +4,16 @@ import { isDashScopeE2EReady, parseStdoutJson, runCli } from "./helpers.ts";
 /**
  * Deploy E2E.
  *
- * The offline suite exercises command discovery, help text, and the
- * `--dry-run` structured-output path (arg parsing + body construction) with no
- * network dependency, so it passes whether or not an API key is configured.
- * The remote list test is gated by isDashScopeE2EReady() — it is skipped when
- * no DashScope credential is present, and when it does run it tolerates both
- * empty accounts and auth/permission failures (see the test comment). The
- * suite is therefore green with no key, a valid key, or an invalid key.
+ * The suite exercises command discovery, help text, and the `--dry-run`
+ * structured-output path (arg parsing + body construction) with no network
+ * dependency. Because `ensureApiKey` runs before every command (see main.ts),
+ * these cases are gated by isDashScopeE2EReady() — they are skipped when no
+ * DashScope credential is present (e.g. on CI) and run offline when one is.
+ * The remote list test is also gated and tolerates both empty accounts and
+ * auth/permission failures (see the test comment).
  */
 
-describe("e2e: deploy (offline)", () => {
+describe.skipIf(!isDashScopeE2EReady())("e2e: deploy (offline)", () => {
   test("deploy 列出子命令", async () => {
     const { stdout, stderr, exitCode } = await runCli(["deploy"]);
     expect(exitCode, stderr).toBe(0);
diff --git a/packages/cli/tests/e2e/finetune.e2e.test.ts b/packages/cli/tests/e2e/finetune.e2e.test.ts
index 1dd21ab..450fd6f 100644
--- a/packages/cli/tests/e2e/finetune.e2e.test.ts
+++ b/packages/cli/tests/e2e/finetune.e2e.test.ts
@@ -5,16 +5,16 @@ import { isDashScopeE2EReady, parseStdoutJson, runCli, cliPackageRoot } from "./
 /**
  * Fine-tune E2E.
  *
- * The offline suite exercises command discovery, help text, and the
- * `--dry-run` structured-output path (arg parsing + body construction) with no
- * network dependency, so it passes whether or not an API key is configured.
- * The remote list test is gated by isDashScopeE2EReady() — it is skipped when
- * no DashScope credential is present, and when it does run it tolerates both
- * empty accounts and auth/permission failures (see the test comment). The
- * suite is therefore green with no key, a valid key, or an invalid key.
+ * The suite exercises command discovery, help text, and the `--dry-run`
+ * structured-output path (arg parsing + body construction) with no network
+ * dependency. Because `ensureApiKey` runs before every command (see main.ts),
+ * these cases are gated by isDashScopeE2EReady() — they are skipped when no
+ * DashScope credential is present (e.g. on CI) and run offline when one is.
+ * The remote list test is also gated and tolerates both empty accounts and
+ * auth/permission failures (see the test comment).
  */
 
-describe("e2e: finetune (offline)", () => {
+describe.skipIf(!isDashScopeE2EReady())("e2e: finetune (offline)", () => {
   test("finetune 列出子命令", async () => {
     const { stdout, stderr, exitCode } = await runCli(["finetune"]);
     expect(exitCode, stderr).toBe(0);