- render auth flag sections only for auth domains used by registered commands
- make quick-start prompts opt-in through createCli options
- keep the existing quick-start prompts wired only for bl
- add openapi auth requirement with command-scoped access key flags and paired credential resolution
- persist OpenAPI credentials through auth login/status/logout using access_key_* config fields
- route token-plan commands through the centralized ACS signing client
- keep legacy openapi_access_key_* config readable while rejecting it as a new config set key
- refresh docs, generated references, telemetry authMethod, and e2e coverage
- flags split into GLOBAL_FLAGS (all commands) plus MODEL_AUTH_FLAGS /
CONSOLE_AUTH_FLAGS, parsed only for commands of the matching auth
domain; cross-domain flags now fail with "Unknown flag" instead of
being silently ignored
- all shadow redeclarations removed; the registry guard now rejects any
own flag named after a reserved (global or visible-domain) flag
- --workspace-id joins the console domain (chain: flag > env > file);
usage stats drops its private declaration and in-command priority
- auth login declares its credential args as own command parameters
(--api-key / --base-url / --console-site, original behavior intact);
auth status no longer accepts credential-domain overrides (use env or
config set instead)
- command help and the generated reference both show Flags (own + auth
domain) plus a full Global Flags section, replacing the footer hint
- breaking: pipeline run --timeout renamed to --step-timeout (collided
with the global request timeout)
- commands consume a narrowed context (identity/settings/own flags/client);
config/auth commands additionally use configStore()/authStore() accessors
- resolution happens once at dispatch: buildSources/buildSettings plus
per-domain credential resolvers; dry-run tolerates missing credentials
- transport takes structured deps; credentials are injected only by Client;
console gateway takes a resolved target with optional token (anonymous
catalog calls); pipeline steps and advisor run against client/settings
- telemetry receives authMethod as a value; global/command flags are split
at dispatch with a same-type shadowing guard at registry build
- behavior change: base URL resolution now prefers DASHSCOPE_BASE_URL env
over config file base_url (unified flag > env > file > default chain)
- priority chains, store semantics and command capability boundaries are
locked by unit tests
Move all credential handling out of commands into one place. authStage
resolves the credential for the command's declared `auth` and bakes it into
`ctx.client`, gating (throw) when missing; commands reach the network only
through `ctx.client` and never touch tokens or baseUrl.
- add Client (request/requestJson/uploadFile/mcp/console/url) wrapping the
token + baseUrl; commands call it instead of self-resolving
- run(config, flags) → run(ctx) + CommandContext; migrate all 45 commands
- split domains: model = pure api-key (drop access-token fallback), console =
config.json only (drop DASHSCOPE_ACCESS_TOKEN env)
- consolidate env reads in loadConfig; CredentialSource = flag | env | config;
priority flag > env > config
- endpoints return paths (xxxPath) instead of full URLs; baseUrl owned by Client
- auth status now uses describeAuth
- video/download: auth "none" → "apiKey" (it needs the model API)
- dedupe fetchModelList behind an injected console-call function
- remove ensureApiKey/ensure-key.ts, prompt.ts + isInteractive, and the old
resolveCredential/resolveConsoleGatewayCredential resolvers
- tests: adapt auth.e2e to the new auth status shape; drop the
DASHSCOPE_ACCESS_TOKEN branch from console-readiness gates
Replace the positional `OptionDef[]` array (key/type regex-parsed from
"--x <v>" strings) with a keyed `FlagsDef` record whose `type` drives both
runtime parsing and compile-time flag-type inference (`Flags<typeof DEF>`).
GLOBAL_FLAGS becomes the single source; the hand-kept GlobalFlags interface
(types/flags.ts) is deleted.
- core: SwitchFlag|ValueFlag union, ParsedFlags/Flags inference, defineCommand
infers F from spec.flags
- runtime: parseFlags dispatches on def.type (switch/string/number/boolean/
array/choices) with declarative required-flag enforcement
- commands: migrate every flag declaration to the keyed form
- naming: option→flag throughout (OptionDef→FlagDef, OptionsDef→FlagsDef,
GLOBAL_OPTIONS→GLOBAL_FLAGS, command field options→flags), plus user-facing
"Options:"→"Flags:" in help and the regenerated skill reference docs
Behavior-preserving aside from the intentional Options→Flags wording:
vp check clean across all packages, 29 parser tests pass, reference regen
byte-identical before the terminology swap.
- drop IncompleteCommandError: missing-required, failed validate, and bad/unknown
flags are all UsageError now
- error boundary keys on bareness — bare command that fails → help (exit 0);
non-bare invalid → error + message (exit 2)
- login: drop config.apiKey fallback, --api-key required-unless-console via validate
- speech: drop empty --text-file guard (empty content is the API's concern)
Commands now declare their credential requirement explicitly via a
required `auth: "apiKey" | "console" | "none"` field instead of the
boolean `skipDefaultApiKeySetup`. The runtime prepares credentials
based on this declaration and skips API-key setup under --dry-run.
- core: add AuthRequirement type and required `auth` field to
Command/CommandSpec; drop skipDefaultApiKeySetup
- runtime: gate API-key setup on `auth === "apiKey" && !dryRun`
- commands: annotate all 45 commands (apiKey 25 / console 11 / none 9)
Decompose the monolithic `cli` package into three layers so multiple
products can be assembled from a shared base:
- bailian-cli-runtime: framework infra (createCli, registry, args,
output, pipeline, utils) — product-agnostic
- bailian-cli-commands: command library, grouped (base/knowledge/text/
media/memory/misc) so each product picks the sets it needs
- packages/cli (bl): full command set; packages/rag (rag): base +
knowledge only
Product identity (binName / clientName / npmPackage) is injected at the
createCli boundary and required there, with no per-consumer defaults.
chenanran555