Move all credential handling out of commands into one place. authStage
resolves the credential for the command's declared `auth` and bakes it into
`ctx.client`, gating (throw) when missing; commands reach the network only
through `ctx.client` and never touch tokens or baseUrl.
- add Client (request/requestJson/uploadFile/mcp/console/url) wrapping the
token + baseUrl; commands call it instead of self-resolving
- run(config, flags) → run(ctx) + CommandContext; migrate all 45 commands
- split domains: model = pure api-key (drop access-token fallback), console =
config.json only (drop DASHSCOPE_ACCESS_TOKEN env)
- consolidate env reads in loadConfig; CredentialSource = flag | env | config;
priority flag > env > config
- endpoints return paths (xxxPath) instead of full URLs; baseUrl owned by Client
- auth status now uses describeAuth
- video/download: auth "none" → "apiKey" (it needs the model API)
- dedupe fetchModelList behind an injected console-call function
- remove ensureApiKey/ensure-key.ts, prompt.ts + isInteractive, and the old
resolveCredential/resolveConsoleGatewayCredential resolvers
- tests: adapt auth.e2e to the new auth status shape; drop the
DASHSCOPE_ACCESS_TOKEN branch from console-readiness gates
Decompose the monolithic `cli` package into three layers so multiple
products can be assembled from a shared base:
- bailian-cli-runtime: framework infra (createCli, registry, args,
output, pipeline, utils) — product-agnostic
- bailian-cli-commands: command library, grouped (base/knowledge/text/
media/memory/misc) so each product picks the sets it needs
- packages/cli (bl): full command set; packages/rag (rag): base +
knowledge only
Product identity (binName / clientName / npmPackage) is injected at the
createCli boundary and required there, with no per-consumer defaults.
若麒