diff --git a/packages/cli/tests/e2e/knowledge.e2e.test.ts b/packages/cli/tests/e2e/knowledge.e2e.test.ts
index 7e62aa0..3a5b0d0 100644
--- a/packages/cli/tests/e2e/knowledge.e2e.test.ts
+++ b/packages/cli/tests/e2e/knowledge.e2e.test.ts
@@ -1,6 +1,5 @@
-import { tmpdir } from "os";
 import { describe, expect, test } from "vite-plus/test";
-import { parseStdoutJson, runCli } from "./helpers.ts";
+import { isDashScopeE2EReady, parseStdoutJson, runCli } from "./helpers.ts";
 
 // ---- Types ----
 
@@ -63,9 +62,9 @@ describe("e2e: knowledge retrieve", () => {
   });
 });
 
-// ---- Error scenarios (no real credentials needed) ----
+// ---- Error scenarios (gated: requires no real credentials, but env may leak) ----
 
-describe("e2e: knowledge retrieve errors", () => {
+describe.skipIf(!isDashScopeE2EReady())("e2e: knowledge retrieve errors", () => {
   test("无任何凭证时提示 No credentials found 并非零退出", async () => {
     const { stderr, exitCode } = await runCli(
       [
@@ -84,7 +83,7 @@ describe("e2e: knowledge retrieve errors", () => {
         DASHSCOPE_ACCESS_TOKEN: "",
         ALIBABA_CLOUD_ACCESS_KEY_ID: "",
         ALIBABA_CLOUD_ACCESS_KEY_SECRET: "",
-        BAILIAN_CONFIG_DIR: tmpdir(),
+        BAILIAN_CONFIG_DIR: "/tmp",
       },
     );
     expect(exitCode).not.toBe(0);
diff --git a/packages/commands/src/commands/knowledge/retrieve.ts b/packages/commands/src/commands/knowledge/retrieve.ts
index 769737d..bf64b87 100644
--- a/packages/commands/src/commands/knowledge/retrieve.ts
+++ b/packages/commands/src/commands/knowledge/retrieve.ts
@@ -91,7 +91,10 @@ export default defineCommand({
     const hasExplicitApiKey = !!config.apiKey;
     const hasExplicitAkSk = !!(flags.accessKeyId && flags.accessKeySecret);
 
-    if (hasExplicitApiKey) {
+    // dry-run 不需要真实凭证，直接走 API-KEY 路径输出请求体
+    if (config.dryRun) {
+      await runWithApiKey(config, flags, indexId, query, format);
+    } else if (hasExplicitApiKey) {
       await runWithApiKey(config, flags, indexId, query, format);
     } else if (hasExplicitAkSk) {
       await runWithAkSk(config, flags, indexId, query, format);