Merge pull request #118 from modelstudioai/feat/config-ui-enhancements

Feat/config UI enhancements （本地配置管理面板能力增强）

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -39,7 +39,7 @@ body:
     attributes:
       label: Node version
       description: "Output of node --version"
-      placeholder: "v22.12.0"
+      placeholder: "v18.17.0"
     validations:
       required: true
 

.node-version

@@ -1 +0,0 @@
-24

.vite-hooks/pre-commit

@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 set -eu
 
-# Regenerate skill reference + SKILL metadata (needs bailian-cli-core dist).
+# Regenerate skill reference + SKILL metadata from source (no package build).
 pnpm run sync:skill-assets
 
 # Stage generator output so it is included in this commit.

AGENTS.md

@@ -1,82 +1,94 @@
 # bailian-cli — AI 维护指南
 
-本文件是 AI agent 维护本仓库时的契约。每次进入项目首先读这里,从下方"业务场景索引"挑一条,跳到对应的详细文档,按它的清单完成改动。
+本文件是 AI agent 维护本仓库时的契约。每次进入项目先读这里,从"业务场景索引"挑一条,再进入对应 `docs/agents/*.md` 清单。
 
 ## 项目地图
 
-monorepo 双包结构:
+monorepo 现在按"纯逻辑 → 运行时框架 → 命令库 → 产品入口"分层:
 
-- `packages/cli` — `bailian-cli` 包,CLI 命令、UI、入口
-- `packages/core` — `bailian-cli-core` 包,鉴权 / HTTP / 类型,纯逻辑层
+- `packages/core` — `bailian-cli-core`,纯逻辑层:鉴权、配置、HTTP client、错误、类型、文件工具
+- `packages/runtime` — `bailian-cli-runtime`,通用 CLI 运行时:`createCli`、参数解析、registry/help、middleware、error handler、输出、pipeline、Command Pack host
+- `packages/commands` — `bailian-cli-commands`,可复用命令实现库,只导出 command,不决定产品路径
+- `packages/cli` — `bailian-cli`,完整 `bl` 产品入口;`src/commands.ts` 组装 `bl` 暴露的命令路径
+- `packages/kscli` — `knowledge-studio-cli`,Knowledge Studio 专用入口;`src/main.ts` 复用 commands 并重映射为 `kscli` 路径
 
-### `packages/cli` 目录要点
+### 关键文件
 
 ```
-packages/cli/
-├── src/
-│   ├── main.ts              # 入口、鉴权分支、调用 registry
-│   ├── registry.ts          # 命令树解析、动态 help(读 catalog)
-│   ├── commands/
-│   │   ├── catalog.ts       # 命令总表(登记处,构建脚本也读它)
-│   │   ├── index.ts         # re-export commands
-│   │   └── <group>/...ts    # 各命令 defineCommand 实现
-│   ├── output/              # CLI 输出、prompt、progress
-│   └── urls.ts              # 控制台/文档 URL(仅 cli)
-└── tests/e2e/
+packages/cli/src/main.ts          # bl 入口,注入 binName/version/clientName/npmPackage
+packages/cli/src/commands.ts      # bl 产品命令 map,tools/generate-reference.ts 也读它
+packages/cli/src/command-pack-policy.ts # bl 的 Command Pack policy
+packages/kscli/src/main.ts        # kscli 入口和命令 map
+
+packages/commands/src/index.ts    # re-export 单个命令实现
+packages/commands/src/commands/   # defineCommand({ auth, flags, usageArgs, exampleArgs, run })
+
+packages/runtime/src/create-cli.ts # createCli(commands, options)
+packages/runtime/src/registry.ts   # 命令树解析 + 动态 help
+packages/runtime/src/middleware.ts # auth / telemetry / update / run command
+packages/runtime/src/command-packs/ # 通用 Command Pack 加载、校验、隔离安装目录和管理命令
+packages/runtime/src/urls.ts       # 用户面控制台 URL
+
+packages/core/src/types/command.ts # Command / flags / auth 类型
+packages/core/src/config/          # ConfigFile / Settings / source 解析
+packages/core/src/auth/            # apiKey / console credential 解析与落盘
+packages/core/src/client/          # HTTP client / endpoints / console gateway
 ```
 
-Skill / 命令手册随 `skills/bailian-cli/` 经 `npx skills add modelstudioai/cli` 安装。`tools/generate-reference.ts` 从 `catalog.ts` 生成命令手册到 `skills/bailian-cli/reference/`(纳入 git);与 `tools/sync-skill-metadata.ts` 一起在 **pre-commit**（`.vite-hooks/pre-commit`）及根脚本 `pnpm run sync:skill-assets` 中执行。
-
-非代码资产:
-
-- `tools/release/` — 发版自动化（CI 驱动，见 `.github/workflows/publish.yml`）
-- `tools/generate-reference.ts` — 从 `catalog.ts` 生成命令手册到 `skills/bailian-cli/reference/`
-- `tools/sync-skill-metadata.ts` — 从 `packages/cli/package.json` 同步 `skills/bailian-cli/SKILL.md` 的 `metadata.version`（与 `generate:reference` 一并由根目录 `pnpm run sync:skill-assets` 及 pre-commit 执行）
-- `README.md` / `README.zh.md` — npm 和 GitHub 主页
+Skill / 命令手册随 `skills/bailian-cli/` 经 `npx skills add modelstudioai/cli` 安装。`tools/generate-reference.ts` 从 **`packages/cli/src/commands.ts`** 生成 `skills/bailian-cli/reference/`(纳入 git);`tools/sync-skill-metadata.ts` 从 `packages/cli/package.json` 同步 `skills/bailian-cli/SKILL.md` 的 `metadata.version`。两者由根脚本 `pnpm run sync:skill-assets` 和 `.vite-hooks/pre-commit` 执行。
 
 约定:
 
-- core 是纯库,不依赖 cli(详见下方通用约定)
-- 文件路径与命令路径一一对应:`commands/text/chat.ts` ↔ `bl text chat`
-- 单级命令:`commands/<name>.ts`(如 `update.ts`);两级:`commands/<group>/<action>.ts`
-- 命令登记在 **`catalog.ts`**;`bl --help` 与 `tools/generate-reference.ts` 生成的命令手册同源,见 [command-add-remove.md](docs/agents/command-add-remove.md)
+- 命令实现文件路径仍按能力放置:`packages/commands/src/commands/text/chat.ts`
+- 产品命令路径由入口 map 决定:同一个实现可暴露为 `bl knowledge retrieve` 或 `kscli retrieve`
+- `defineCommand` 只写命令元数据与逻辑: `auth`、`flags`、`usageArgs`、`exampleArgs`、`validate`、`run`
+- `usageArgs` / `exampleArgs` 不写 `bl` 或 `kscli` 前缀;runtime / reference 生成器按产品路径补前缀
+- 不再使用 `catalog.ts` 作为登记处;新增/重命名命令必须同时看命令库导出和产品入口 map
+
+非代码资产:
+
+- `tools/release/` — 发版自动化（CI 驱动,见 `.github/workflows/publish.yml`）
+- `tools/generate-reference.ts` — 从 `packages/cli/src/commands.ts` 生成 `skills/bailian-cli/reference/`
+- `tools/sync-skill-metadata.ts` — 同步 `skills/bailian-cli/SKILL.md` 的 `metadata.version`
+- `README.md` / `README.zh.md` — npm 和 GitHub 主页
 
 ## 业务场景索引
 
 按当前任务从下表挑一条进入对应文档:
 
-| 场景           | 何时进入                                     | 详见                                                                     |
-| -------------- | -------------------------------------------- | ------------------------------------------------------------------------ |
-| 命令增删改     | 增加 / 删除 / 重命名 `bl xxx`                | [docs/agents/command-add-remove.md](docs/agents/command-add-remove.md)   |
-| E2E 测试维护   | 新增/改命令或 e2e 用例、补 help/缺参/dry-run | [docs/agents/cli-e2e-tests.md](docs/agents/cli-e2e-tests.md)             |
-| 批量压测       | 改/跑多能力并发压测、`test:stress`、fixtures | [docs/agents/stress-batch-tests.md](docs/agents/stress-batch-tests.md)   |
-| 选项变更       | 给已有命令加 `--flag` 或改默认值             | [docs/agents/command-flag-change.md](docs/agents/command-flag-change.md) |
-| 模型上下架     | 增加新模型 / 改默认模型 / 废弃旧模型         | [docs/agents/model-add-remove.md](docs/agents/model-add-remove.md)       |
-| 错误文案变更   | 改 `BailianError` 的 message 或 hint         | [docs/agents/error-hint-change.md](docs/agents/error-hint-change.md)     |
-| URL / 渠道变更 | 控制台域名 / 文档站 / 追踪参数               | [docs/agents/url-change.md](docs/agents/url-change.md)                   |
-| 鉴权扩展       | 加 OAuth / SSO / 换 token 来源               | [docs/agents/auth-change.md](docs/agents/auth-change.md)                 |
-| 配置项扩展     | 新 env var 或 `~/.bailian/config.json` 字段  | [docs/agents/config-add.md](docs/agents/config-add.md)                   |
-| 发布           | channel / stable 发布到 npm（CI 驱动）       | [docs/agents/publish.md](docs/agents/publish.md)                         |
-| 工具链调整     | lint 规则 / 构建配置 / 依赖升级              | [docs/agents/lint-toolchain.md](docs/agents/lint-toolchain.md)           |
+| 场景           | 何时进入                                     | 详见                                                                         |
+| -------------- | -------------------------------------------- | ---------------------------------------------------------------------------- |
+| 命令增删改     | 增加 / 删除 / 重命名 `bl xxx` 或入口命令路径 | [docs/agents/command-add-remove.md](docs/agents/command-add-remove.md)       |
+| E2E 测试维护   | 新增/改命令或 e2e 用例、补 help/缺参/dry-run | [docs/agents/cli-e2e-tests.md](docs/agents/cli-e2e-tests.md)                 |
+| 批量压测       | 改/跑多能力并发压测、`test:stress`、fixtures | [docs/agents/stress-batch-tests.md](docs/agents/stress-batch-tests.md)       |
+| 选项变更       | 给已有命令加 `--flag` 或改默认值             | [docs/agents/command-flag-change.md](docs/agents/command-flag-change.md)     |
+| 模型上下架     | 增加新模型 / 改默认模型 / 废弃旧模型         | [docs/agents/model-add-remove.md](docs/agents/model-add-remove.md)           |
+| 错误文案变更   | 改 `BailianError` 的 message 或 hint         | [docs/agents/error-hint-change.md](docs/agents/error-hint-change.md)         |
+| URL / 渠道变更 | 控制台域名 / 文档站 / 追踪参数               | [docs/agents/url-change.md](docs/agents/url-change.md)                       |
+| 鉴权扩展       | 加 OAuth / SSO / 换 token 来源               | [docs/agents/auth-change.md](docs/agents/auth-change.md)                     |
+| 配置项扩展     | 新 env var 或 `~/.bailian/config.json` 字段  | [docs/agents/config-add.md](docs/agents/config-add.md)                       |
+| Profile / 激活 | 改命名 Profile、预设或 `active_config`       | [docs/agents/config-profile-change.md](docs/agents/config-profile-change.md) |
+| 安装文档       | 改安装、鉴权、验证流程或线上 install 页面    | [docs/agents/install-doc-change.md](docs/agents/install-doc-change.md)       |
+| 发布           | channel / stable 发布到 npm（CI 驱动）       | [docs/agents/publish.md](docs/agents/publish.md)                             |
+| Change Log     | 发版说明 / 历史版本说明                      | [docs/agents/changelog-write.md](docs/agents/changelog-write.md)             |
+| 工具链调整     | lint 规则 / 构建配置 / 依赖升级              | [docs/agents/lint-toolchain.md](docs/agents/lint-toolchain.md)               |
+| Command Pack   | 扩展包 / 白名单 / plugin 管理命令            | [docs/agents/command-pack.md](docs/agents/command-pack.md)                   |
 
-如果当前任务无法对应任何场景,先按经验完成,然后**回来评估这是不是一类新场景** —— 是就新增一份 `docs/agents/<scenario>.md`,把清单沉淀下来。
+如果当前任务无法对应任何场景,先按经验完成,然后**回来评估这是不是一类新场景** —— 是就新增 `docs/agents/<scenario>.md`,把清单沉淀下来。
 
 ## 通用约定
 
-下面两条与场景无关,任何改动都适用。每次完成改动后自查。
+### 1. 发布包版本号同步
 
-### 1. cli 和 core 版本号同步
+源码包的 `version` 当前保持一致: `packages/core`、`packages/runtime`、`packages/commands`、`packages/cli`、`packages/kscli`。做版本 bump 时一动多动。release 工具当前强校验 / 发布范围以 `tools/release/lib/packages.mjs` 为准;把新包纳入发布前必须同步该清单和 [publish.md](docs/agents/publish.md)。
 
-`packages/cli/package.json` 和 `packages/core/package.json` 的 `version` 字段必须始终相等。一动两动。
+### 2. 分层边界
 
-### 2. core 是纯库,cli 是 core 的 UI 层
-
-core 不应该知道 cli 的存在。具体表现:
-
-- core 不写 stderr,不调 `process.exit`(用 `console.*` 或 `throw`)
-- core 抛的 `BailianError`,hint 字符串不出现 `bl xxx` 命令名
-- core 不写死域名 / region / 追踪参数(URL 集中在 `packages/cli/src/urls.ts`)
-- core 接收 cli 通过 `Config` 注入的 metadata(`clientName` / `clientVersion`)
+- `core` 是纯库:不依赖 `runtime` / `commands` / 产品入口;不调 `process.exit`;新增/改动时不硬编码 `bl` / `kscli` 命令名、控制台 URL 或渠道追踪参数。当前遗留项见 [error-hint-change.md](docs/agents/error-hint-change.md) 与 [url-change.md](docs/agents/url-change.md),触碰相关代码时顺手收敛
+- `runtime` 是通用 CLI 框架:可以处理 TTY、help、错误输出、middleware,但不写具体业务命令逻辑
+- `commands` 是命令实现库:不决定产品路径;不在 `usageArgs` / `exampleArgs` / hint 里硬编码产品 bin 前缀
+- `cli` / `kscli` 是产品层:负责命令路径 map、产品 identity、README、技能 reference、发版入口
+- URL 集中在 `packages/runtime/src/urls.ts`(用户面控制台)和 `packages/core/src/config/schema.ts` / client 层(API)
 
 ### 3. 错误处理边界:CLI 不翻译服务端错误
 
@@ -86,30 +98,33 @@ CLI 只为「自己能权威解释的错误」发出语义化信号,服务端的
 | ---------------------------------------------------- | -------- | ----------------------------------------------------------- |
 | 命令解析、缺 flag、参数校验                          | **内部** | `BailianError(USAGE)`                                       |
 | 文件 I/O(ENOENT/EACCES/...)                          | **内部** | `BailianError(GENERAL)` + errno-specific hint               |
-| 本地 credentials 缺失(resolver/ensure-key/AK-SK 等)  | **内部** | `BailianError(AUTH)`                                        |
+| 本地 credentials 缺失(resolver / auth stage 等)      | **内部** | `BailianError(AUTH)`                                        |
 | `fetch` 自身失败(DNS/TCP/TLS/proxy)                  | **内部** | `BailianError(NETWORK)` + 读 `err.cause.code` 给 errno-hint |
 | polling 客户端超时                                   | **内部** | `BailianError(TIMEOUT)`                                     |
 | HTTP 4xx/5xx、HTTP 200 + 业务错码、async task FAILED | **服务** | `BailianError(GENERAL)`,**message 原样透传**,不分类、不替换 |
 
-不要扮演服务端错误的翻译官——我们没有最新的错误码体系认知,二次包装只会撒谎(详见 `docs/agents/error-hint-change.md` 中的反面 case)。
+不要扮演服务端错误的翻译官——我们没有最新的错误码体系认知,二次包装只会撒谎。
 
-### 4. Console Gateway 命令必须声明 console 全局 flags
+### 4. Console Gateway 命令必须声明鉴权域
 
-如果新命令使用了 `callConsoleGateway`，必须在 `options` 中添加以下三个全局 flag 的说明，以便 `--help` 中展示：
+如果命令调用 Console Gateway,`defineCommand` 必须设置 `auth: "console"`。runtime 会基于 `CONSOLE_AUTH_FLAGS` 自动在 help 中展示 `--console-region`、`--console-site`、`--console-switch-agent`、`--workspace-id`,并由 `authStage` 解析/注入 console credential。命令不要重复声明这些凭证域 flag,也不要手动从 env/config 解析 token。
 
-```ts
-{ flag: "--console-region <region>", description: "Console region" },
-{ flag: "--console-site <site>", description: "Console site: domestic, international" },
-{ flag: "--console-switch-agent <uid>", description: "Switch agent UID", type: "number" },
-```
+### 5. 禁止单字母变量命名
 
-这些 flag 已在 `GLOBAL_OPTIONS`（`packages/core/src/types/command.ts`）中注册，由 `loadConfig` 写入 `config.consoleRegion` / `config.consoleSite` / `config.consoleSwitchAgent`，`callConsoleGateway` 自动读取——命令无需手动提取或传递。
+所有变量、参数、回调形参必须使用有语义的命名,不允许单字母(如 `i`、`m`、`p`、`t`、`e`、`s`)。具体表现:
+
+- 回调参数: `.map((m) => ...)` → `.map((model) => ...)`, `.find((t) => ...)` → `.find((template) => ...)`
+- catch 变量: `catch (e)` → `catch (error)`
+- for-of 循环: `for (const i of items)` → `for (const item of items)`
+- 临时变量: `const s = ...` → `const strategy = ...`
+
+例外: 仅当作用域极小(≤3 行)且语义从上下文完全明确时,可使用 `k`/`v`(Object.entries 的 key/value)。
 
 ## 完成改动后的快速验证
 
 ```sh
 vp check    # format + lint + type check
-vp test     # unit + e2e (e2e 需 API key)
+vp test     # unit + e2e (真实集成需 API key / console token)
 ```
 
 ## 这份指南本身怎么演化

CHANGELOG.md

@@ -1,11 +1,229 @@
 # Changelog
 
-All notable changes to `bailian-cli` and `bailian-cli-core` are documented here.
+All notable changes to the `bailian-cli` packages are documented here.
 
-The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). The `bailian-cli`, `bailian-cli-core`, `bailian-cli-runtime`, and `bailian-cli-commands` packages share a single version number — they are always released together.
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). The `bailian-cli`, `bailian-cli-core`, `bailian-cli-runtime`, `bailian-cli-commands`, and `knowledge-studio-cli` packages share a single version number.
 
 [中文版](CHANGELOG.zh.md) · [README](README.md) · [Contributing](CONTRIBUTING.md)
 
+## [1.13.0] - 2026-07-30
+
+### Added
+
+- **`bl config ui` Skills / MCP / Agents / Assets inventory** — browse installed skills, MCP servers, coding agents, and generated assets in the local Web UI with click-to-open detail drawers:
+  - Skills: render `SKILL.md` as Markdown (GFM tables supported), show local vs remote origin badges, and install a skill by uploading a `.zip` archive into any supported agent's skills root.
+  - MCP: view and edit JSON configuration with secret masking and mask-preserving writes; create, update, and delete MCP entries across Claude Code, Qwen Code, OpenCode, Cursor, Windsurf, Gemini, Qoder Work, OpenClaw, and Claude Desktop.
+  - Agents: quick-launch coding agents directly from the UI (gated on the CLI binary being on PATH).
+  - Assets: categorized, time-sorted browser with preview, open-locally, and delete.
+- **Model catalog suggestion chips** — per-category model names surfaced as click-to-fill chips under each `default_*_model` field in the config UI.
+- **Profiles tile grid** — profiles displayed as a tile grid with an add-tile and a design-consistent new-profile modal.
+
+### Changed
+
+- Config UI layout: collapsible grouped sidebar with icons and persistent state, responsive breakpoint, wider main area, sticky view headers, and right-side drawers for editing.
+
+### Fixed
+
+- Symlinked skill directories are now correctly identified as an installed source.
+- Config file detection now supports environment-variable-based paths and legacy configuration schemes.
+
+## [1.12.0] - 2026-07-28
+
+### Added
+
+- **`bl config agent --key` / `--region`** — run commands generated by the Model Studio web console as-is: `--key` accepts the console's encoded API key and decodes it locally (use instead of `--api-key`), and `--region` derives the Token Plan endpoint from a region name (use instead of `--base-url`).
+- **`bl config agent --context-window`** — set the context window written to the OpenClaw configuration (default 256000).
+- **`bl config agent --wire-api`** — choose the wire protocol written to the Codex configuration; `chat` is kept for legacy Codex 0.80.0 and earlier (a warning is shown).
+
+### Changed
+
+- `bl config agent` for Codex now writes `wire_api = "responses"` by default, matching current Codex releases that no longer accept `chat`.
+- `bl config agent` for Qwen Code now writes the `DASHSCOPE_API_KEY` environment variable instead of `BAILIAN_CLI_API_KEY`.
+
+### Fixed
+
+- `bl config agent` configurations now match each agent's official format: Claude Code honors `CLAUDE_CONFIG_DIR` and removes a stale `ANTHROPIC_API_KEY`; Qwen Code uses the v3 settings schema and writes credentials so a system-level `OPENAI_API_KEY` no longer takes precedence; OpenCode accepts JSONC config files (comments and trailing commas); OpenClaw registers the primary model in the model allowlist with complete cost metadata; Hermes uses the official flat `model.*` layout; Codex writes the official `env_key` with an `auth.json` fallback.
+- `bl config agent` now preserves existing user configuration when writing: it merges instead of overwriting, avoids duplicate provider entries, and keeps custom display names.
+
+## [1.11.2] - 2026-07-28
+
+### Changed
+
+- MCP tools and WebSearch now provide activation guidance and direct marketplace links when Bailian reports that the corresponding service is not activated. WebSearch also guides users with legacy SSE connections to reactivate the service using Streamable HTTP.
+
+### Fixed
+
+- Fixed text chat and API Key validation compatibility failures caused by sending unsupported `enable_thinking` values. Text chat now sends the parameter only when thinking is explicitly enabled, while validation uses a compatible model without sending it.
+
+## [1.11.1] - 2026-07-28
+
+### Added
+
+- `bl image edit` now supports `--function` for specifying edit operations with Wanx image-edit models such as `wanx2.1-imageedit`.
+
+### Fixed
+
+- Fixed image generation and editing failures and incorrect size parameters for some image models, improving compatibility with Qwen-Image, Wan/Wanx, Z-Image, and dated `wanx-v1` variants.
+
+## [1.11.0] - 2026-07-28
+
+### Added
+
+- **`bl managed-agent`** — declaratively manage Managed Agent infrastructure through a unified CLI. The Bailian provider connects to AgentStudio, with Claude, Qoder, and Ark providers also supported:
+  - `init` / `validate` / `plan` / `apply` / `destroy` — initialize and validate `agents.yaml`, preview and apply resource changes, and destroy managed resources.
+  - `state list` / `state show` / `state rm` / `state import` — inspect and manage local resource state, including adopting an existing remote resource or removing it from local state without destroying it remotely.
+  - `session create` / `session list` / `session get` / `session delete` / `session run` / `session send` / `session events` — manage the full session lifecycle with streaming responses and structured `--output json` output.
+  - `skill-list` — browse custom and official skills; use `--source all` to return both catalogs in one call.
+
+### Changed
+
+- Model Base URLs are now normalized to the URL origin; paths, query parameters, and fragments supplied in the Base URL are no longer included when constructing API request paths.
+
+### Fixed
+
+- The installation guide no longer recommends the removed `--non-interactive` flag and now documents explicit required arguments, `--output json`, and `NO_COLOR=1` for non-interactive environments.
+
+## [1.10.1] - 2026-07-22
+
+### Changed
+
+- Token Plan defaults now use the current text, image, and dedicated text-to-video, image-to-video, and reference-to-video models.
+- The Bailian CLI Skill now distinguishes Bailian-specific tasks from ordinary host-agent work more accurately and avoids repeated consent prompts within an approved workflow.
+- Published CLI packages now support Node.js 18.17 and later, lowering the previous minimum requirement from Node.js 22.12.
+
+### Fixed
+
+- Token Plan now handles local images correctly for image editing, image-to-video, reference-to-video, and vision understanding without requiring a separately hosted URL.
+
+## [1.10.0] - 2026-07-19
+
+### Added
+
+- **`bl config agent`** — configure Claude Code, Qwen Code, OpenCode, OpenClaw, Hermes Agent, or Codex to use DashScope in one command.
+
+### Changed
+
+- The Bailian CLI Skill now routes only matching Bailian and multimodal tasks to `bl`, and asks for consent before provider-neutral remote or billable calls.
+
+### Fixed
+
+- Full `bl auth logout` now clears the model Base URL so later logins cannot inherit a stale custom or Token Plan endpoint.
+
+## [1.9.0] - 2026-07-17
+
+### Added
+
+- **Token Plan support** — log in and call supported models directly without manually configuring the endpoint.
+- **Named Config Profiles** — create, switch, and manage isolated configurations; logging in to a named Profile activates it automatically.
+- **Console Access Token automation** — generate and automatically refresh Console Access Tokens.
+- **`bl workspace init`** — initialize a Bailian workspace and activate the required services in one workflow.
+
+### Fixed
+
+- Improved configuration safety and consistency, including secret masking and preservation of custom configuration fields.
+
+## [1.8.3] - 2026-07-16
+
+### Fixed
+
+- Fixed `bl text chat --messages-file -` failing on Windows by treating standard input as a `/dev/stdin` file path; piped JSON messages are now read from standard input correctly. (#103)
+
+## [1.8.2] - 2026-07-15
+
+### Changed
+
+- `bl model list` now defaults to JSON output; pass `--output text` for the table view.
+
+### Fixed
+
+- `bl model list --enrich` now returns each model's input parameter schema (predictConfig); it was previously always empty because the console gateway response envelope was not unwrapped.
+
+## [1.8.1] - 2026-07-14
+
+### Changed
+
+- Expanded the Command Pack allowlist to accept an additional internal command extension.
+
+## [1.8.0] - 2026-07-13
+
+### Added
+
+- **`bl model list`** — browse the Bailian model marketplace: list model families or show full details for a single family (`--model`), with filters for provider, capability, feature, and context-window, pagination (`--page` / `--page-size`), pricing, and `--enrich` for richer metadata.
+- **`bl usage summary`** — a unified usage view combining free-tier quota and a recent usage overview; `--days` sets the overview window (default 7).
+- **Command Pack host support** — added support for allowlisted internal command extensions.
+- **Audio & image fine-tuning** — `bl finetune audio create` (CosyVoice TTS) and `bl finetune image create` (Wan image generation) join the existing text flow. `bl finetune image create` supports `--generation-type t2i|i2i` to select text-to-image or image-to-image training.
+- **Audio & image deployment** — `bl deploy audio create` and `bl deploy image create` deploy fine-tuned TTS and image models as endpoints.
+- **Multimodal dataset validation** — `bl dataset upload` and `bl dataset validate` now accept `.zip` archives with `tts` and `image` schemas, validate referenced media files, and allow image archives up to 1 GB.
+
+### Changed
+
+- **Fine-tune and deploy commands are now split by modality (BREAKING)**: `bl finetune create` → `bl finetune text create`, and `bl deploy create` → `bl deploy text create`. Update any scripts that use the old paths.
+- **Deployment option renamed (BREAKING)**: `--template-id` → `--deploy-spec` on deployment creation commands.
+- **Fine-tune status exit behavior changed (BREAKING)**: `bl finetune watch` no longer reserves exit code 3 for running jobs. Running and succeeded jobs return 0; failed and canceled jobs use normal CLI errors.
+- `bl deploy audio create` now defaults to `--plan mu` (model-unit billing, per the CosyVoice deployment contract); text and image continue to default to `lora`.
+- `bl finetune audio create` now validates CosyVoice training data: audio files must be `.wav`, each `wav_fn` must start with `train/`, and exactly one training file is accepted.
+- `bl quota list` and `bl quota check` now report real RPM/TPM usage against limits, adding `RPM Left` / `TPM Left` columns with remaining-quota progress bars sourced from monitoring data.
+- `bl usage free` output now shares its rendering with `bl usage summary` for consistent free-tier tables.
+- `bl advisor recommend` no longer depends on a dedicated intent-detection model to analyze your request.
+
+### Removed
+
+- **Removed the `tongyi-intent-detect-v3` integration (BREAKING)** used by `bl advisor recommend`, along with the `intent_detect_base_url` config field and the `DASHSCOPE_INTENT_DETECT_BASE_URL` environment variable.
+
+### Fixed
+
+- Skill command-reference generation now reads product command maps directly from source and produces stable formatting during release checks.
+
+## [1.7.0] - 2026-07-09
+
+### Added
+
+- `bl auth login --open-api` now stores Alibaba Cloud OpenAPI AK/SK credentials for Token Plan commands; `bl auth status` reports API key, console, and OpenAPI credential state separately, and `bl auth logout --open-api` clears only OpenAPI credentials.
+- `kscli` help and examples now render as Knowledge Studio paths such as `kscli search`, `kscli chat`, and `kscli retrieve`, matching the standalone CLI.
+
+### Changed
+
+- Token Plan commands now use the shared OpenAPI AK/SK credential flow, including persisted credentials and `ALIBABA_CLOUD_ACCESS_KEY_ID` / `ALIBABA_CLOUD_ACCESS_KEY_SECRET` environment variables.
+- Auth flags are now scoped to the commands that can use them. Passing model, console, or OpenAPI credential flags to the wrong command now reports an unknown flag instead of being accepted and ignored.
+- Help and command reference output now show only the flags that apply to each command's auth mode, making model, console, and OpenAPI credentials easier to distinguish.
+- Missing required flags now return usage errors with exit code 2 instead of opening interactive prompts or printing help with exit code 0.
+- Image, video, and speech task commands now use `--async` consistently for returning task IDs without waiting; `--concurrent` is shown only on commands that support parallel requests.
+- Default command output is text unless `--output json`, `DASHSCOPE_OUTPUT=json`, or config explicitly requests JSON.
+- Update checks are throttled to once per day and can surface in non-TTY/agent runs.
+- Proxy setup now reads uppercase `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY` only; lowercase proxy environment variables are ignored.
+- `bl auth login` no longer prints the onboarding quick start block after a successful login.
+
+### Removed
+
+- Deprecated AK/SK authentication for `bl knowledge retrieve`; use DashScope API key auth for knowledge commands.
+- Removed `--no-color`, `--non-interactive`, and `--no-wait`. Use `NO_COLOR=1` for plain output and `--async` for task submission without waiting.
+- Removed `--yes` and interactive confirmation prompts from delete/logout commands; use `--dry-run` to preview before running destructive operations.
+
+### Fixed
+
+- Credential-gated `--dry-run` paths now skip auth preflight so commands such as Token Plan can print request details without configured credentials.
+- `--verbose` model requests again print request method, URL, auth source, and response status details.
+
+## [1.6.1] - 2026-07-03
+
+### Changed
+
+- `bl vision describe` examples and skill reference now use `qwen3-vl-plus` instead of the legacy `qwen-vl-plus` model id, matching the command's default model.
+
+## [1.6.0] - 2026-07-02
+
+### Added
+
+- `bl knowledge search` — semantic search across knowledge bases using the new workspace-based RAG API. Supports `--query`, `--agent-id`, `--workspace-id`, `--image` (multimodal retrieval, repeatable), and `--query-history` (JSON conversation context for multi-turn query rewriting).
+- `bl knowledge chat` — knowledge-base Q&A with SSE streaming. Supports `--message` (repeatable, with `role:content` prefix for multi-turn history), `--agent-id`, `--workspace-id`, and `--image` (multimodal). Displays real-time progress with step-change labels (retrieval, planning, generation) in interactive mode.
+- `bailian-cli-core` gains new types and endpoints for the workspace-based knowledge API: `KnowledgeSearchRequest` / `KnowledgeSearchResponse`, `KnowledgeChatRequest` / `KnowledgeChatStreamChunk` / `KnowledgeChatMessage` / `KnowledgeChatContentPart`, and `knowledgeSearchEndpoint` / `knowledgeChatEndpoint`.
+- `kscli` now ships `search` and `chat` commands alongside the existing `retrieve`.
+
+### Changed
+
+- `bl knowledge retrieve` is now marked as deprecated in its description; use `bl knowledge search` instead.
+- `kscli` README (EN + ZH) updated to feature `search` and `chat` as the primary commands, with `retrieve` marked deprecated.
+
 ## [1.5.0] - 2026-07-01
 
 ### Added

CHANGELOG.zh.md

@@ -1,11 +1,229 @@
 # 更新日志
 
-`bailian-cli` 和 `bailian-cli-core` 的所有重要变更都记录在此。
+`bailian-cli` 系列包的所有重要变更都记录在此。
 
-格式遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/),版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/spec/v2.0.0.html)。`bailian-cli`、`bailian-cli-core`、`bailian-cli-runtime`、`bailian-cli-commands` 共享一个版本号,总是一起发布。
+格式遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/),版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/spec/v2.0.0.html)。`bailian-cli`、`bailian-cli-core`、`bailian-cli-runtime`、`bailian-cli-commands`、`knowledge-studio-cli` 共享一个版本号。
 
 [English](CHANGELOG.md) · [README](README.zh.md) · [参与贡献](CONTRIBUTING.zh.md)
 
+## [1.13.0] - 2026-07-30
+
+### 新增
+
+- **`bl config ui` 技能 / MCP / 代理 / 资产清单** — 在本地 Web UI 中浏览已安装的技能、MCP 服务器、编码代理和生成的资产，点击打开右侧详情抽屉：
+  - 技能：将 `SKILL.md` 渲染为 Markdown（支持 GFM 表格），展示本地/远程来源徽章，支持上传 `.zip` 压缩包将技能安装到任意受支持代理的技能目录。
+  - MCP：查看和编辑 JSON 配置，支持密钥掩码与掩码保真写回；支持在 Claude Code、Qwen Code、OpenCode、Cursor、Windsurf、Gemini、Qoder Work、OpenClaw 和 Claude Desktop 中创建、更新、删除 MCP 条目。
+  - 代理：从 UI 一键启动编码代理（需对应 CLI 二进制在 PATH 中）。
+  - 资产：按类别分组、按时间排序的浏览器，支持预览、本地打开和删除。
+- **模型目录建议芯片** — 在配置 UI 的每个 `default_*_model` 字段下方展示按类别分组的模型名称，点击即可填入。
+- **Profile 磁贴网格** — 配置文件以磁贴网格展示，新增添加磁贴和设计一致的新建 Profile 弹窗。
+
+### 变更
+
+- 配置 UI 布局：可折叠分组侧边栏（带图标和持久化状态）、响应式断点、更宽的主区域、吸顶视图标题、右侧抽屉式编辑。
+
+### 修复
+
+- 修复软链接技能目录未被正确识别为已安装来源的问题。
+- 配置文件检测现支持基于环境变量的路径和旧版配置方案。
+
+## [1.12.0] - 2026-07-28
+
+### 新增
+
+- **`bl config agent --key` / `--region`** —— 百炼控制台生成的命令可直接运行：`--key` 接收控制台编码后的 API Key 并在本地解码（与 `--api-key` 二选一）；`--region` 根据地域名自动派生 Token Plan 接入地址（与 `--base-url` 二选一）。
+- **`bl config agent --context-window`** —— 设置写入 OpenClaw 配置的上下文窗口大小（默认 256000）。
+- **`bl config agent --wire-api`** —— 选择写入 Codex 配置的通信协议；`chat` 仅保留给 Codex 0.80.0 及更早版本（会显示警告）。
+
+### 变更
+
+- `bl config agent` 配置 Codex 时默认写入 `wire_api = "responses"`，以适配已不再支持 `chat` 的新版 Codex。
+- `bl config agent` 配置 Qwen Code 时改用 `DASHSCOPE_API_KEY` 环境变量，不再使用 `BAILIAN_CLI_API_KEY`。
+
+### 修复
+
+- `bl config agent` 写入的配置现已与各 Agent 官方格式对齐：Claude Code 尊重 `CLAUDE_CONFIG_DIR` 并清理残留的 `ANTHROPIC_API_KEY`；Qwen Code 采用 v3 配置 schema 并正确写入凭证，避免被系统级 `OPENAI_API_KEY` 干扰；OpenCode 支持带注释和尾部逗号的 JSONC 配置文件；OpenClaw 会将主模型注册进模型白名单并补齐计费元数据；Hermes 改用官方扁平 `model.*` 结构；Codex 写入官方 `env_key` 并支持 `auth.json` 兜底。
+- `bl config agent` 写入配置时现会保留用户已有配置：合并而非覆盖，避免重复添加 provider 条目，并保留用户自定义的显示名。
+
+## [1.11.2] - 2026-07-28
+
+### 变更
+
+- MCP 工具或 WebSearch 因对应服务未开通而不可用时，CLI 现在会提供开通指引和市场直达链接；对于使用旧版 SSE 连接的 WebSearch，还会提示重新开通以切换至 Streamable HTTP。
+
+### 修复
+
+- 修复文本对话与 API Key 登录校验因传递不受支持的 `enable_thinking` 参数值而产生的兼容性错误。文本对话仅在用户明确开启思考模式时传递该参数，登录校验则改用兼容模型且不再传递该参数。
+
+## [1.11.1] - 2026-07-28
+
+### 新增
+
+- `bl image edit` 新增 `--function` 参数，支持为万相图片编辑模型（如 `wanx2.1-imageedit`）指定编辑功能。
+
+### 修复
+
+- 修复部分图片模型在图片生成与编辑时的调用失败和尺寸参数错误，并完善 Qwen-Image、Wan/Wanx、Z-Image 系列及 `wanx-v1` 日期版本的兼容性。
+
+## [1.11.0] - 2026-07-28
+
+### 新增
+
+- **`bl managed-agent`** —— 通过统一 CLI 声明式管理 Managed Agent 基础设施；百炼 Provider 对接 AgentStudio，并支持 Claude、Qoder 和 Ark：
+  - `init` / `validate` / `plan` / `apply` / `destroy` —— 基于 `agents.yaml` 初始化、校验、预览和执行资源变更，以及销毁已托管资源。
+  - `state list` / `state show` / `state rm` / `state import` —— 查看和管理本地资源状态，包括纳管已有远端资源或仅解除本地跟踪。
+  - `session create` / `session list` / `session get` / `session delete` / `session run` / `session send` / `session events` —— 完整的会话生命周期操作，支持流式响应和结构化的 `--output json` 输出。
+  - `skill-list` —— 浏览自定义与官方 Skill；使用 `--source all` 可一次返回两个来源。
+
+### 变更
+
+- 模型 Base URL 现在统一仅保留 URL Origin；传入的路径、查询参数和 Fragment 不再参与后续 API 请求路径拼接。
+
+### 修复
+
+- 安装指南不再推荐已移除的 `--non-interactive`，改为说明显式传入必填参数，并使用 `--output json` 或 `NO_COLOR=1` 适配非交互环境。
+
+## [1.10.1] - 2026-07-22
+
+### 变更
+
+- Token Plan 默认模型已更新为当前文本、图片，以及文生视频、图生视频和参考生视频的专用模型。
+- 百炼 CLI Skill 现在能更准确地区分百炼专属任务与普通宿主 Agent 任务，并避免在已授权的工作流中重复征求同意。
+- 已发布的 CLI 包现在支持 Node.js 18.17 及以上版本，最低版本要求由 Node.js 22.12 下调至 18.17。
+
+### 修复
+
+- Token Plan 现在能在图片编辑、图生视频、参考生视频和视觉理解中正确处理本地图片，无需另行托管为 URL。
+
+## [1.10.0] - 2026-07-19
+
+### 新增
+
+- **`bl config agent`** —— 一键配置 Claude Code、Qwen Code、OpenCode、OpenClaw、Hermes Agent 和 Codex 接入百炼模型服务。
+
+### 变更
+
+- 百炼 CLI Skill 现在只将匹配的百炼任务与多模态任务路由到 `bl`，并会在调用与平台无关的远程或计费能力前征求同意。
+
+### 修复
+
+- 完整执行 `bl auth logout` 时会同时清除模型 Base URL，避免后续登录继承失效的自定义或 Token Plan 接入地址。
+
+## [1.9.0] - 2026-07-17
+
+### 新增
+
+- **支持 Token Plan** —— 登录后即可直接调用支持的模型，无需手动配置接入地址。
+- **命名 Config Profile** —— 支持创建、切换和管理相互隔离的配置，登录后会自动激活当前 Profile。
+- **Console Access Token 自动化** —— 支持生成并自动刷新 Console Access Token。
+- **`bl workspace init`** —— 一站式完成百炼工作空间初始化和所需服务开通。
+
+### 修复
+
+- 提升配置安全性与一致性，包括密钥脱敏和自定义配置字段保留。
+
+## [1.8.3] - 2026-07-16
+
+### 修复
+
+- 修复 Windows 上 `bl text chat --messages-file -` 将标准输入当作 `/dev/stdin` 文件路径读取的问题；通过管道传入的 JSON 消息现在可以从标准输入正常读取。（#103）
+
+## [1.8.2] - 2026-07-15
+
+### 变更
+
+- `bl model list` 现在默认以 JSON 输出；需要表格视图请传 `--output text`。
+
+### 修复
+
+- `bl model list --enrich` 现在能正确返回每个模型的输入参数 schema（predictConfig）；此前因未解包控制台网关响应信封而始终为空。
+
+## [1.8.1] - 2026-07-14
+
+### 变更
+
+- 扩展 Command Pack 白名单，允许加载额外的内部命令扩展。
+
+## [1.8.0] - 2026-07-13
+
+### 新增
+
+- **`bl model list`** —— 浏览百炼模型市场：列出模型家族，或用 `--model` 查看单个家族的完整详情；支持按 provider、能力、特性、上下文窗口过滤，分页（`--page` / `--page-size`）、价格展示，以及 `--enrich` 获取更丰富的元数据。
+- **`bl usage summary`** —— 统一用量视图，一屏合并免费额度与近期用量概览；`--days` 设置概览时间窗口（默认 7 天）。
+- **Command Pack 宿主支持** —— 新增面向白名单内部命令扩展包的加载能力。
+- **音频与图像精调** —— 在原有文本流程之外新增 `bl finetune audio create`（CosyVoice 语音合成）与 `bl finetune image create`（万相图像生成）。`bl finetune image create` 支持 `--generation-type t2i|i2i` 显式选择文生图或图生图训练。
+- **音频与图像部署** —— `bl deploy audio create` 与 `bl deploy image create` 可将精调后的语音合成与图像模型部署为推理接入点。
+- **多模态数据集校验** —— `bl dataset upload` 与 `bl dataset validate` 现在支持使用 `tts`、`image` schema 的 `.zip` 压缩包，可校验包内引用的媒体文件，图像数据压缩包上限提升至 1 GB。
+
+### 变更
+
+- **精调与部署命令按模态拆分（BREAKING）**：`bl finetune create` → `bl finetune text create`，`bl deploy create` → `bl deploy text create`。请更新使用旧路径的脚本。
+- **部署参数重命名（BREAKING）**：部署创建命令的 `--template-id` 更名为 `--deploy-spec`。
+- **精调状态退出行为变更（BREAKING）**：`bl finetune watch` 不再使用退出码 3 表示任务运行中；运行中与成功均返回 0，失败与取消使用 CLI 的常规错误流程。
+- `bl deploy audio create` 默认使用 `--plan mu`（按模型单元计费，符合 CosyVoice 部署契约）；文本与图像仍默认 `lora`。
+- `bl finetune audio create` 现在会校验 CosyVoice 训练数据：音频必须为 `.wav`，每条 `wav_fn` 必须以 `train/` 开头，且只接受一个训练文件。
+- `bl quota list` 与 `bl quota check` 现在会基于监控数据展示真实的 RPM/TPM 用量与限额，新增 `RPM Left` / `TPM Left` 列及剩余额度进度条。
+- `bl usage free` 的输出现在与 `bl usage summary` 共用渲染逻辑，免费额度表格更一致。
+- `bl advisor recommend` 不再依赖独立的意图识别模型来分析你的需求。
+
+### 已移除
+
+- **移除 `bl advisor recommend` 使用的 `tongyi-intent-detect-v3` 集成（BREAKING）**，同时移除 `intent_detect_base_url` 配置字段与 `DASHSCOPE_INTENT_DETECT_BASE_URL` 环境变量。
+
+### 修复
+
+- Skill 命令参考文档生成现在直接读取产品命令源码，并在发布检查中保持稳定格式。
+
+## [1.7.0] - 2026-07-09
+
+### 新增
+
+- `bl auth login --open-api` 现在可以保存阿里云 OpenAPI AK/SK 凭据，供 Token Plan 命令使用；`bl auth status` 会分别展示 API Key、控制台和 OpenAPI 凭据状态，`bl auth logout --open-api` 可只清除 OpenAPI 凭据。
+- `kscli` 的 help 与示例现在展示为 `kscli search`、`kscli chat`、`kscli retrieve` 等 Knowledge Studio 独立入口路径。
+
+### 变更
+
+- Token Plan 命令统一使用 OpenAPI AK/SK 凭据流程，支持登录持久化凭据和 `ALIBABA_CLOUD_ACCESS_KEY_ID` / `ALIBABA_CLOUD_ACCESS_KEY_SECRET` 环境变量。
+- 鉴权 flag 现在只对可使用它们的命令生效。把模型、控制台或 OpenAPI 凭据 flag 传给错误的命令时，现在会报 unknown flag，而不是接受后忽略。
+- help 与命令参考现在只展示当前命令鉴权域适用的 flag，更容易区分模型、控制台和 OpenAPI 凭据。
+- 缺少必填 flag 时现在返回用法错误并以退出码 2 退出，不再进入交互式补全或打印 help 后以退出码 0 退出。
+- 图片、视频、语音任务类命令现在统一用 `--async` 表示提交任务后不等待；`--concurrent` 只在支持并发请求的命令上展示。
+- 命令默认输出为文本；仅在显式设置 `--output json`、`DASHSCOPE_OUTPUT=json` 或配置文件要求 JSON 时输出 JSON。
+- 更新检查节流调整为每天一次，并可在非 TTY / agent 场景展示更新提示。
+- 代理配置现在只读取大写 `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`，忽略小写代理环境变量。
+- `bl auth login` 成功后不再额外打印 onboarding quick start 内容。
+
+### 已移除
+
+- 移除 `bl knowledge retrieve` 已废弃的 AK/SK 鉴权；知识库命令请使用 DashScope API Key。
+- 移除 `--no-color`、`--non-interactive` 和 `--no-wait`。纯文本输出使用 `NO_COLOR=1`，提交任务后不等待使用 `--async`。
+- 移除删除 / 登出类命令的 `--yes` 与交互式确认提示；执行破坏性操作前请用 `--dry-run` 预览。
+
+### 修复
+
+- 需要凭据的 `--dry-run` 路径现在会跳过鉴权前置检查，例如 Token Plan 可在未配置凭据时先打印请求信息。
+- `--verbose` 的模型请求日志恢复输出请求方法、URL、鉴权来源与响应状态等信息。
+
+## [1.6.1] - 2026-07-03
+
+### 变更
+
+- `bl vision describe` 的示例与 skill 参考文档中的模型 id 由旧版 `qwen-vl-plus` 更新为 `qwen3-vl-plus`，与命令默认模型保持一致。
+
+## [1.6.0] - 2026-07-02
+
+### 新增
+
+- `bl knowledge search` — 基于新版 workspace RAG API 的知识库语义检索。支持 `--query`、`--agent-id`、`--workspace-id`、`--image`（多模态检索，可重复）和 `--query-history`（多轮对话上下文 JSON，用于查询重写）。
+- `bl knowledge chat` — 知识库 SSE 流式问答。支持 `--message`（可重复，支持 `角色:内容` 前缀传入多轮历史）、`--agent-id`、`--workspace-id` 和 `--image`（多模态）。交互模式下实时展示检索、规划、生成等步骤进度。
+- `bailian-cli-core` 新增 workspace 级知识 API 类型与端点：`KnowledgeSearchRequest` / `KnowledgeSearchResponse`、`KnowledgeChatRequest` / `KnowledgeChatStreamChunk` / `KnowledgeChatMessage` / `KnowledgeChatContentPart`，以及 `knowledgeSearchEndpoint` / `knowledgeChatEndpoint`。
+- `kscli` 现已包含 `search` 和 `chat` 命令。
+
+### 变更
+
+- `bl knowledge retrieve` 描述中已标记为废弃，请改用 `bl knowledge search`。
+- `kscli` README（中英文）更新，以 `search` 和 `chat` 为主推命令，`retrieve` 标记为废弃。
+
 ## [1.5.0] - 2026-07-01
 
 ### 新增

CONTRIBUTING.md

@@ -6,7 +6,8 @@ Developer guide for `bailian-cli` — the official CLI for Aliyun Model Studio (
 
 ## Prerequisites
 
-- Node.js ≥ 22.12
+- Node.js ≥ 22.12 (required for developing this repo)
+- End users installing the published CLI only need Node.js >= 18.17
 - pnpm 10.33.2 (`npm i -g pnpm@10.33.2`)
 - A DashScope API key for running e2e tests
 
@@ -33,13 +34,7 @@ pnpm install
 
 ### Running the CLI from source
 
-Open two terminals:
-
 ```bash
-# Terminal 1 — watch-build core
-pnpm dev
-
-# Terminal 2 — run any bl command
 pnpm bl auth login --api-key sk-xxxxx
 pnpm bl text chat --message "hello"
 pnpm bl video generate --prompt "a cat walking"

CONTRIBUTING.zh.md

@@ -6,8 +6,9 @@
 
 ## 环境要求
 
-- Node.js ≥ 22.12
-- pnpm 10.33.2(`npm i -g pnpm@10.33.2`)
+- 参与本仓库开发：Node.js ≥ 22.12
+- 仅安装/使用已发布的 CLI：Node.js >= 18.17
+- pnpm 10.33.2（`npm i -g pnpm@10.33.2`）
 - 跑 e2e 需要一个百炼 API Key
 
 ## 仓库结构
@@ -33,13 +34,7 @@ pnpm install
 
 ### 从源码运行 CLI
 
-开两个终端:
-
 ```bash
-# 终端 1 —— core watch 重建
-pnpm dev
-
-# 终端 2 —— 跑任意 bl 命令
 pnpm bl auth login --api-key sk-xxxxx
 pnpm bl text chat --message "你好"
 pnpm bl video generate --prompt "一只走路的猫"

INSTALL.md

@@ -7,7 +7,7 @@
 **原则**：先执行检查；若 **Node / 包管理器 / 网络** 任一不满足下文要求，Agent 应 **在本机终端内主动完成安装或配置**（例如升级 Node、切换镜像、配置 `npm` 代理等），再继续 `bailian-cli` 安装。仅在无权限或环境无法自动化时，再向用户说明原因并请其配合。
 
 1. **Node.js**
-   - 要求 **≥ 22.12.0**，执行 `node -v` 确认。
+   - 要求 **≥ 18.17.0**，执行 `node -v` 确认。
    - 未安装或版本不足：由 Agent 自行安装或升级 Node。
 
 2. **npm**（**唯一**允许的包管理器）
@@ -69,7 +69,7 @@ npx skills add modelstudioai/cli --all -g
 
 > 此方式同时打通 `app list`、`usage free` 等控制台能力，并自动配置 API Key 调用所需的鉴权信息。
 
-### 备选：由 Agent 引导用户输入 API Key 后登录
+### 备选一：由 Agent 引导用户输入普通 API Key 后登录
 
 适用于无法拉起浏览器的对话式安装（远程 SSH、CI 调试、纯终端环境等）：
 
@@ -80,6 +80,15 @@ npx skills add modelstudioai/cli --all -g
 3. 用户提供了 Key 之后，在**用户本机终端**执行（Agent 用终端工具跑，勿把 Key 写进回复正文）：`bl auth login --api-key <用户提供的_Key>`
 4. 登录成功后执行 `bl auth status --output json` 确认；汇报时只使用 masked 字段，**禁止**回显完整 Key。
 
+### 备选二：使用 Token Plan API Key
+
+- 获取入口：[Token Plan 订阅详情](https://bailian.console.aliyun.com/cn-beijing?tab=plan#/efm/subscription/overview)
+
+1. 请用户从订阅详情页获取或复制 Token Plan API Key，勿要求用户发到公开渠道。
+2. 在用户本机终端执行：`bl auth login --config token-plan --api-key <用户提供的_Key>`。
+3. `token-plan` Profile 已内置默认 Base URL；登录命令会先测试 Key，通过后才保存并激活该 Profile，无需另行配置或重复测试。
+4. 执行 `bl auth status --config token-plan --output json` 确认；汇报时只使用 masked 字段。
+
 ### 其他方式
 
 - **环境变量**（不落盘到配置文件）：在 shell 中配置 API Key 环境变量；变量名见 `bl auth status --help`，勿在对话中向用户解释底层命名。
@@ -89,20 +98,19 @@ npx skills add modelstudioai/cli --all -g
 ### Agent 安全约束
 
 - **禁止**把真实 API Key 写入仓库、日志、Skill、聊天记录的可公开部分。
-- CI / 非交互环境：使用 `bl ... --non-interactive`；通过密钥管理或环境变量注入，勿在脚本中硬编码 Key。
+- CI / 非交互环境：显式传入必填参数并使用 `--output json` 获取机器可读结果；如需纯文本输出，设置 `NO_COLOR=1`。通过密钥管理或环境变量注入，勿在脚本中硬编码 Key。
 
 ---
 
-## 4. 最小功能验证
+## 4. 配置验证
 
-在鉴权配置完成后执行：
+API Key 登录命令本身已经完成可用性测试，通过后只需确认配置状态：
 
 ```bash
 bl auth status --output json
-bl text chat --message "ping" --non-interactive --output json
 ```
 
-若失败：根据 stderr / JSON 中的 `hint` 或 `message` 排查（网络、Key 无效、`base_url` 等）。DashScope 端点：使用 `--base-url` / `bl config set --key base_url` / `DASHSCOPE_BASE_URL`，默认中国大陆 `https://dashscope.aliyuncs.com`。
+无需再执行重复的模型调用测试。若登录失败，根据 stderr / JSON 中的 `hint` 或 `message` 排查（网络、Key 无效、`base_url` 等）。DashScope 端点：使用 `--base-url` / `bl config set --key base_url` / `DASHSCOPE_BASE_URL`，默认中国大陆 `https://dashscope.aliyuncs.com`。
 
 ---
 
@@ -111,7 +119,7 @@ bl text chat --message "ping" --non-interactive --output json
 | 现象                    | 可能原因             | 建议动作                                                        |
 | ----------------------- | -------------------- | --------------------------------------------------------------- |
 | `bl: command not found` | 全局 bin 不在 PATH   | 检查 `npm prefix -g` 与 PATH                                    |
-| 安装报错 engines        | Node 版本过低        | 升级到 ≥ 22.12                                                  |
-| 401 / 鉴权失败          | 未 login 或 Key 无效 | 引导用户更新 Key 并 `bl auth login --api-key`                   |
+| 安装报错 engines        | Node 版本过低        | 升级到 ≥ 18.17                                                  |
+| 401 / 鉴权失败          | 未 login 或 Key 无效 | 按 Key 类型重新执行普通或 Token Plan 登录命令                   |
 | 企业网络无法访问 npm    | 代理 / 镜像          | 配置 registry 或代理后再装                                      |
 | 本机只有 pnpm、没有 npm | Agent 误用 pnpm 安装 | 先装/修好 **npm**，再用 `npm install -g bailian-cli`；勿用 pnpm |

README.md

@@ -5,7 +5,7 @@
 **The official command-line interface for Aliyun Model Studio (DashScope) AI Platform**
 
 [![npm version](https://img.shields.io/npm/v/bailian-cli?color=0969da&label=npm)](https://www.npmjs.com/package/bailian-cli)
-[![Node.js](https://img.shields.io/badge/node-%3E%3D22.12-brightgreen)](https://nodejs.org)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D18.17-brightgreen)](https://nodejs.org)
 [![TypeScript](https://img.shields.io/badge/TypeScript-strict-3178c6)](https://www.typescriptlang.org)
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue)](LICENSE)
 
@@ -30,6 +30,7 @@ Equip your AI Agent out-of-the-box with these capabilities, composable across co
 - **Video generation & editing** — happyhorse-1.1 series: text-/image-/reference-to-video and natural-language video editing (up to 9-image reference)
 - **Speech synthesis & recognition** — CosyVoice streaming TTS, voice cloning from 5–20s samples; FunAudio-ASR covers 30 languages including 7 Chinese dialects and 20+ Mandarin accents
 - **Image & video understanding** — Qwen-VL: long-form video analysis, chart/document parsing, visual reasoning, multilingual OCR
+- **Coding agent setup** — Configure Claude Code, Qwen Code, OpenCode, OpenClaw, Hermes Agent, or Codex to use DashScope with `bl config agent`
 
 > **Note:** The features below are currently available only to China site (aliyun.com) account holders and are not yet supported for international / global site accounts.
 
@@ -38,8 +39,8 @@ Equip your AI Agent out-of-the-box with these capabilities, composable across co
 - **MCP integration** — Orchestrate Bailian MCP servers: list services, inspect tools, and invoke any tool directly from the terminal
 - **Web search** — Real-time internet retrieval for up-to-date, accurate answers
 - **Model recommendation** — Describe your scenario and get best-fit model suggestions; supports scoped search, model comparison, and alternative discovery
-- **Fine-tuning & deployment** — Upload datasets, create SFT/LoRA/DPO/CPT jobs (`finetune create`), probe job status non-blockingly (`finetune watch`), query per-model training capability (`finetune capability`), and deploy trained models as endpoints (`deploy create`)
-- **Console capabilities** — Browse Bailian apps (`app list`), check free-tier quota (`usage free`), view model usage statistics (`usage stats`), manage workspaces (`workspace list`), and manage rate limits (`quota list/request/check/history`)
+- **Fine-tuning & deployment** — Upload datasets, create text/audio/image fine-tune jobs (`finetune text|audio|image create`; text covers SFT/LoRA/DPO/CPT), probe job status non-blockingly (`finetune watch`), query per-model training capability (`finetune capability`), and deploy trained models as endpoints (`deploy text|audio|image create`)
+- **Console capabilities** — Browse the model marketplace (`model list`) and Bailian apps (`app list`), review a unified usage view (`usage summary`), check free-tier quota (`usage free`), view model usage statistics (`usage stats`), manage workspaces (`workspace list`), and manage rate limits (`quota list/request/check/history`)
 - **Local file auto-upload** — Every URL parameter accepts a local path; uploaded to free temp storage with 48-hour validity
 
 ## Showcase: One-Sentence Cinematic Video
@@ -80,7 +81,7 @@ npm install -g bailian-cli
 npx skills add modelstudioai/cli --all -g
 ```
 
-> Requires Node.js >= 22.12.
+> Requires Node.js >= 18.17.
 
 ## Quick Start
 
@@ -91,6 +92,12 @@ bl auth login --console
 # Or authenticate with an API key
 bl auth login --api-key sk-xxxxx
 
+# Or use Token Plan (Base URL built in; the key is tested during login)
+bl auth login --config token-plan --api-key sk-sp-xxxxx
+
+# Configure a coding agent to use DashScope
+bl config agent --agent codex --base-url https://dashscope.aliyuncs.com/compatible-mode/v1 --api-key sk-xxxxx --model qwen3-coder-plus
+
 # Chat with Qwen
 bl text chat --message "What is DashScope?"
 
@@ -114,13 +121,15 @@ bl auth login --console
 
 # Fine-tune & deploy — a one-shot train-to-serve workflow
 bl dataset upload --file ./train.jsonl                 # Upload a .jsonl dataset (validated first)
-bl finetune create --model qwen3-8b --datasets ./train.jsonl --training-type sft-lora  # Local paths auto-upload
-bl finetune watch --job-id ft-xxx --output json       # Non-blocking status probe (exit 0/1/3 = done/failed/running)
+bl finetune text create --model qwen3-8b --datasets ./train.jsonl --training-type sft-lora  # Local paths auto-upload
+bl finetune watch --job-id ft-xxx --output json       # Non-blocking probe (running/succeeded return 0; failed/canceled report an error)
 bl finetune capability --model qwen3-8b               # Which training types a model supports
-bl deploy create --model qwen3-8b --name my-svc --plan mu  # Deploy the trained model as an endpoint
+bl deploy text create --model qwen3-8b --name my-svc --plan mu  # Deploy the trained model as an endpoint
 
-# Browse apps / free-tier quota / usage statistics / workspaces
+# Browse models / apps / free-tier quota / usage statistics / workspaces
+bl model list                                        # Browse model families and pricing
 bl app list
+bl usage summary                                     # Unified view: free-tier quota + recent usage overview
 bl usage free                                         # Free-tier quota across models (add --model/--expiring/--sort)
 bl usage stats --workspace-id <id>                    # Model usage statistics (add --model for per-model)
 bl workspace list                                     # List all workspaces
@@ -157,21 +166,34 @@ bl auth login --api-key sk-xxxxx
 bl text chat --api-key sk-xxxxx --message "Hello"
 ```
 
+### Token Plan API Key
+
+Get or copy the API key from the [Token Plan subscription overview](https://bailian.console.aliyun.com/cn-beijing?tab=plan#/efm/subscription/overview).
+The CLI has the default Token Plan Base URL built in. Login tests the key first, then saves and activates the `token-plan` config only when validation succeeds.
+
+```bash
+bl auth login --config token-plan --api-key sk-sp-xxxxx
+```
+
 ### Console Login (OAuth)
 
-Required for console capability commands (`app list`, `usage free`, `usage stats`, `workspace list`, `quota list/request/check/history`). Opens the Bailian console in your browser to sign in.
+Required for console capability commands (`model list`, `app list`, `usage summary/free/stats`, `workspace list`, `quota list/request/check/history`). Opens the Bailian console in your browser to sign in.
 
 ```bash
 bl auth login --console
 ```
 
-### Alibaba Cloud AK/SK (Knowledge Base & Token Plan)
+### Alibaba Cloud OpenAPI AK/SK (Token Plan only)
 
-Required for `knowledge retrieve` and the `token-plan` command group. Get your AccessKey from [RAM Console](https://ram.console.aliyun.com/manage/ak).
+Required for the `token-plan` command group. Get your AccessKey from [RAM Console](https://ram.console.aliyun.com/manage/ak).
 
 > Recommended: create a RAM sub-account with minimum privileges instead of using the root account's AK/SK.
 
 ```bash
+# Option 1: Login command (persisted to ~/.bailian/config.json)
+bl auth login --open-api --access-key-id LTAI5t... --access-key-secret ...
+
+# Option 2: Environment variables
 export ALIBABA_CLOUD_ACCESS_KEY_ID=LTAI5t...
 export ALIBABA_CLOUD_ACCESS_KEY_SECRET=...
 export BAILIAN_WORKSPACE_ID=ws-...
@@ -203,6 +225,7 @@ Config file location: `~/.bailian/config.json`
 | Qwen Model List              | https://help.aliyun.com/zh/model-studio/getting-started/models                            |
 | Aliyun Model Studio Console  | https://bailian.console.aliyun.com/?source_channel=cli_github                             |
 | Get API Key                  | https://bailian.console.aliyun.com/cn-beijing/?source_channel=key_github&tab=app#/api-key |
+| Get Token Plan API Key       | https://bailian.console.aliyun.com/cn-beijing?tab=plan#/efm/subscription/overview         |
 | Get AccessKey                | https://ram.console.aliyun.com/manage/ak                                                  |
 
 ## Changelog

README.zh.md

@@ -5,7 +5,7 @@
 **阿里云百炼 (DashScope) AI 平台命令行工具**
 
 [![npm version](https://img.shields.io/npm/v/bailian-cli?color=0969da&label=npm)](https://www.npmjs.com/package/bailian-cli)
-[![Node.js](https://img.shields.io/badge/node-%3E%3D22.12-brightgreen)](https://nodejs.org)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D18.17-brightgreen)](https://nodejs.org)
 [![TypeScript](https://img.shields.io/badge/TypeScript-strict-3178c6)](https://www.typescriptlang.org)
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue)](LICENSE)
 
@@ -30,6 +30,7 @@ _专为 AI Agent 打造，每个命令均可作为结构化工具调用。_
 - **视频生成与编辑** — happyhorse-1.1 系列，支持文生 / 图生 / 参考生（最多 9 张图参考）/ 自然语言视频编辑
 - **语音合成与识别** — CosyVoice 实时流式合成，5-20s 样本即可克隆；FunAudio-ASR 覆盖 30 种语种，含汉语七大方言与 20+ 口音官话
 - **图像与视频理解** — Qwen-VL：长视频解析、复杂图表与文档识别、视觉推理、多语种 OCR
+- **Coding Agent 配置** — 使用 `bl config agent` 将 Claude Code、Qwen Code、OpenCode、OpenClaw、Hermes Agent 或 Codex 配置为使用 DashScope
 
 > **注意：** 以下功能目前仅对中国站（aliyun.com）账号开放，国际站 / 全球站账号暂不支持。
 
@@ -38,8 +39,8 @@ _专为 AI Agent 打造，每个命令均可作为结构化工具调用。_
 - **MCP 集成** — 统一调度百炼 MCP 服务：列出服务、查看工具、直接在终端调用任意工具
 - **联网搜索** — 实时互联网信息检索，提升回答准确性及时效性
 - **模型推荐** — 描述你的场景，智能推荐最适合的模型；支持限定范围搜索、模型对比和替代发现
-- **微调与部署** — 上传数据集、创建 SFT/LoRA/DPO/CPT 调优任务（`finetune create`）、非阻塞探测任务状态（`finetune watch`）、按模型查训练能力（`finetune capability`），并把训练好的模型部署为推理服务（`deploy create`）
-- **控制台能力** — 浏览百炼应用（`app list`），查询模型免费额度（`usage free`），查看模型用量统计（`usage stats`），管理业务空间（`workspace list`），管理限流与提额（`quota list/request/check/history`）
+- **微调与部署** — 上传数据集、创建文本/音频/图像调优任务（`finetune text|audio|image create`；文本涵盖 SFT/LoRA/DPO/CPT）、非阻塞探测任务状态（`finetune watch`）、按模型查训练能力（`finetune capability`），并把训练好的模型部署为推理服务（`deploy text|audio|image create`）
+- **控制台能力** — 浏览模型市场（`model list`）和百炼应用（`app list`），查看统一用量视图（`usage summary`），查询模型免费额度（`usage free`），查看模型用量统计（`usage stats`），管理业务空间（`workspace list`），管理限流与提额（`quota list/request/check/history`）
 - **本地文件自动上传** — 所有 URL 参数同时支持本地路径，免费临时存储 48 小时
 
 ## 示例:一句话生成一部电影短片
@@ -78,7 +79,7 @@ npm install -g bailian-cli
 npx skills add modelstudioai/cli --all -g
 ```
 
-> 需要预先安装 Node.js >= 22.12。
+> 需要预先安装 Node.js >= 18.17。
 
 ## 快速开始
 
@@ -89,6 +90,12 @@ bl auth login --console
 # 或使用 API key 认证
 bl auth login --api-key sk-xxxxx
 
+# 或使用 Token Plan（已内置 Base URL，登录时自动测试 Key）
+bl auth login --config token-plan --api-key sk-sp-xxxxx
+
+# 配置 Coding Agent 使用 DashScope
+bl config agent --agent codex --base-url https://dashscope.aliyuncs.com/compatible-mode/v1 --api-key sk-xxxxx --model qwen3-coder-plus
+
 # 和通义千问对话
 bl text chat --message "你好，介绍一下阿里云百炼平台"
 
@@ -112,13 +119,15 @@ bl auth login --console
 
 # 微调与部署 — 从训练到服务的一站式流程
 bl dataset upload --file ./train.jsonl                 # 上传 .jsonl 数据集（先校验）
-bl finetune create --model qwen3-8b --datasets ./train.jsonl --training-type sft-lora  # 本地路径自动上传
-bl finetune watch --job-id ft-xxx --output json       # 非阻塞状态探测（退出码 0/1/3 = 成功/失败/进行中）
+bl finetune text create --model qwen3-8b --datasets ./train.jsonl --training-type sft-lora  # 本地路径自动上传
+bl finetune watch --job-id ft-xxx --output json       # 非阻塞探测（运行中/成功返回 0；失败/取消报错）
 bl finetune capability --model qwen3-8b               # 查询模型支持哪些训练方式
-bl deploy create --model qwen3-8b --name my-svc --plan mu  # 把训练好的模型部署为推理服务
+bl deploy text create --model qwen3-8b --name my-svc --plan mu  # 把训练好的模型部署为推理服务
 
-# 浏览应用 / 免费额度 / 用量统计 / 业务空间
+# 浏览模型 / 应用 / 免费额度 / 用量统计 / 业务空间
+bl model list                                        # 浏览模型系列与价格信息
 bl app list
+bl usage summary                                     # 统一视图：免费额度 + 近期用量概览
 bl usage free                                         # 各模型免费额度（可加 --model/--expiring/--sort）
 bl usage stats --workspace-id <id>                    # 模型用量统计（加 --model 查单模型）
 bl workspace list                                     # 列出所有业务空间
@@ -155,21 +164,34 @@ bl auth login --api-key sk-xxxxx
 bl text chat --api-key sk-xxxxx --message "你好"
 ```
 
+### Token Plan API Key
+
+前往 [Token Plan 订阅详情](https://bailian.console.aliyun.com/cn-beijing?tab=plan#/efm/subscription/overview) 获取或复制 API Key。
+CLI 已内置 Token Plan 的默认 Base URL；登录命令会先测试 Key，通过后才保存并激活 `token-plan` 配置。
+
+```bash
+bl auth login --config token-plan --api-key sk-sp-xxxxx
+```
+
 ### 控制台登录（OAuth）
 
-控制台能力命令（`app list`、`usage free`、`usage stats`、`workspace list`、`quota list/request/check/history`）需要使用此登录方式。打开浏览器跳转百炼控制台完成登录。
+控制台能力命令（`model list`、`app list`、`usage summary/free/stats`、`workspace list`、`quota list/request/check/history`）需要使用此登录方式。打开浏览器跳转百炼控制台完成登录。
 
 ```bash
 bl auth login --console
 ```
 
-### 阿里云 AK/SK（知识库检索与 Token Plan）
+### 阿里云 OpenAPI AK/SK（仅 Token Plan）
 
-`knowledge retrieve` 与 `token-plan` 命令组需要阿里云 AccessKey。前往 [RAM 控制台](https://ram.console.aliyun.com/manage/ak) 获取。
+`token-plan` 命令组需要阿里云 AccessKey。前往 [RAM 控制台](https://ram.console.aliyun.com/manage/ak) 获取。
 
 > 建议：创建 RAM 子账号并授予最小权限，避免使用主账号 AK/SK。
 
 ```bash
+# 方式一：登录命令（持久化到 ~/.bailian/config.json）
+bl auth login --open-api --access-key-id LTAI5t... --access-key-secret ...
+
+# 方式二：环境变量
 export ALIBABA_CLOUD_ACCESS_KEY_ID=LTAI5t...
 export ALIBABA_CLOUD_ACCESS_KEY_SECRET=...
 export BAILIAN_WORKSPACE_ID=ws-...
@@ -201,6 +223,7 @@ bl update
 | 通义千问模型列表        | https://help.aliyun.com/zh/model-studio/getting-started/models                            |
 | 阿里云百炼控制台        | https://bailian.console.aliyun.com/?source_channel=cli_github                             |
 | 获取 API Key            | https://bailian.console.aliyun.com/cn-beijing/?source_channel=key_github&tab=app#/api-key |
+| 获取 Token Plan API Key | https://bailian.console.aliyun.com/cn-beijing?tab=plan#/efm/subscription/overview         |
 | 获取 AccessKey          | https://ram.console.aliyun.com/manage/ak                                                  |
 
 ## 更新日志

docs/agents/auth-change.md

@@ -2,115 +2,162 @@
 
 ## 触发条件
 
-- 增加新的鉴权方式(OAuth、SSO、控制台回调登录)
-- 增加新的 token 来源(env / config / flag / 文件)
-- 调整凭证解析优先级
-- 改 `bl auth login` 流程
+- 增加新的鉴权域或 token 来源(env / config / flag / 文件)
+- 调整 API Key / Console token 解析优先级
+- 改 `bl auth login` / `auth status` / `auth logout` 流程
+- 改 runtime 对 command `auth` 的 gating 或 credential 注入
 
 ## 鉴权链路
 
 ```
-flag 优先 ─→ config 文件 ─→ env var
-   │             │            │
-   └──── resolveCredential() (core) ───┐
-                                         │
-                                         ▼
-                       cli/utils/ensure-key.ts (启动时拦)
-                       命令注入 Authorization 头
+argv flags ─┐
+env var   ──┼─ buildSources(flags) ─┐
+config    ──┘                       │
+                                    ├─ buildSettings(sources) → ctx.settings
+                                    │
+                                    ├─ resolveApiKey(sources)     → model-domain Client
+                                    ├─ resolveConsole(sources)    → console-domain Client
+                                    └─ resolveOpenApi(sources)    → OpenAPI Client
+
+defineCommand({ auth }) → runtime/authStage → ctx.client → command.run(ctx)
 ```
 
-凭证类型(`AuthMethod`):
+当前 command 鉴权域(`AuthRequirement`):
 
-- `api-key` — DashScope SK(`sk-...`),走 Bearer 头
-- `access-token` — 控制台 OAuth 回调拿到的临时 token,走 Bearer + 不同 endpoint
-- `ak/sk` — Alibaba Cloud 标准 AK/SK,走 ROA 签名(只用于知识库)
+- `apiKey` — DashScope / OpenAI-compatible 模型域,用 API key 与 model base URL
+- `console` — Bailian Console Gateway,用 console access token + region/site/switchAgent/workspace
+- `openapi` — 阿里云 OpenAPI 签名域,用 AccessKey ID/Secret 调用 Token Plan 等 OpenAPI
+- `none` — 本地命令、登录/配置类命令、无需 credential 的命令
 
-### 双凭证并存（API Key + Console）
+### 多凭证并存
 
-`~/.bailian/config.json` 可同时保存 `api_key` 与 `access_token`。**登录任一种方式不得删除另一种**（`bl auth login --api-key` / `--console` 只更新对应字段）。
+`~/.bailian/config.json` 可同时保存 `api_key`、`access_token` 与 `access_key_*`。登录任一种方式不得删除另一种:
+
+- `bl auth login --api-key ...` 只更新 `api_key` / `base_url`
+- `bl auth login --console` 只更新 `access_token` 以及回调携带的 console 作用域字段
+- `bl auth login --open-api ...` 只更新 `access_key_id` / `access_key_secret`
+- `bl auth logout --console` 只清 `access_token`
+- `bl auth logout --open-api` 只清 `access_key_id` / `access_key_secret` / `security_token`
+- `bl auth logout` 清 `api_key` + `base_url` + `access_token` + `access_key_*`
 
 解析分工:
 
-- `resolveCredential()` — DashScope API 命令（`text chat`、`file upload` 等）；config 里两者都有时 **优先 `api_key`**
-- `resolveConsoleGatewayCredential()` — 控制台网关（`app list`、`usage free`、`console call`）；**只用** env/file 的 `access_token`，忽略 `api_key`
+- `resolveApiKey()` — `auth: "apiKey"` 命令;优先级 `--api-key` > `DASHSCOPE_API_KEY` > config `api_key`
+- `resolveModelBaseUrl()` — model base URL;优先级 `--base-url` > `DASHSCOPE_BASE_URL` > config `base_url` > `REGIONS.cn`，返回前统一归一化为 URL origin（仅保留协议、host 和显式端口，去除 path、query、fragment）
+- `--config` 只选择 config 文件 block，不提升该 block 的字段优先级；内置套餐 Profile（当前为 `token-plan`）的预设仅在登录时物化写入，运行时继续走统一的 flag > env > selected config file > 默认值
+- 显式 `auth login --config <name>` 在凭证验证并落盘成功后自动激活目标 Profile；未传
+  `--config` 时继续写当前激活项，失败和 dry-run 不切换
+- `resolveConsole()` — `auth: "console"` 命令;当前 token 来自 config `access_token`,region/site/switchAgent 来自 flag > config > 默认
+- `resolveOpenApi()` — `auth: "openapi"` 命令;优先级 `--access-key-id/--access-key-secret` > `ALIBABA_CLOUD_ACCESS_KEY_ID/ALIBABA_CLOUD_ACCESS_KEY_SECRET` > config `access_key_*`。兼容读取旧字段 `openapi_access_key_*`,新写入只写短字段
+- `describeAuthState()` — `auth status` / banner / telemetry 使用的只读快照
 
-必改调用点: 凡 `callConsoleGateway` 必须用 `resolveConsoleGatewayCredential`，不能误用 `resolveCredential`（否则 config 仅有 api_key 时会拿 sk- 打网关）。
+命令不要直接解析 token、env 或 config。业务请求统一走 `ctx.client`;登录/配置命令通过 `ctx.authStore` / `ctx.configStore` 的窄接口操作落盘。
 
-`bl auth logout --console` 只清 `access_token`；全量 `bl auth logout` 清两者。
+### 例外:agent 命令的分层鉴权与 SDK 凭证内存注入
+
+`bl managed-agent *` 按调用链分两层:
+
+- **离线命令** — `init`、`validate`、`state list/show/rm`:`auth: "none"`，只读写本地文件，无需登录;引擎侧传 `credentials: "none"` 跳过凭证断言
+- **联网命令** — `plan`、`apply`、`destroy`、`state import`、`skill-list`、全部 `session *`:统一声明 `auth: "apiKey"` 硬门禁 —— 无论目标 provider 是谁，authStage 都经 `resolveApiKey(sources)` 解析 bailian 凭证(flag > env > active profile config)，缺失报统一 AUTH;引擎层 `assertProviderCredentials` 再对 agents.yaml 里**全部已声明 provider** 的空 key 拦截并给 provider 专属 hint。例外:`plan --no-refresh` / `plan --dry-run` 传 `credentials: "none"` 并强制 `refresh: false`（不联网、不回写 state，不查 provider key），其中 `--dry-run` 连登录也不要求（authStage 的 dry-run 豁免），`--no-refresh` 仍需登录。
+
+凭证不以真实值写入 `process.env`，而是经 `packages/commands/src/commands/managed-agent/_engine/` 的**内存注入管道**(`resolveAgentProjectConfig`)注入 SDK，管道五步:
+
+1. `prepareProviderEnv()` — 先 `bootstrapRuntimeCredentialsSync()`(SDK 把 `.env` / `~/.agents/config.json` 灌进 env，服务 claude/ark/qoder 等非 bailian provider)，再把全部凭证类 env(`CREDENTIAL_ENV_KEYS`，含别名)中仍为 undefined 的占位为 `""`，使 agents.yaml 插值不因缺变量抛错
+2. `resolveProjectConfig` — 插值发生:bailian 插值拿到占位空串，claude/ark 拿到真实 env 值;随后 `normalizeInterpolatedProviderBlocks()` 把插值为空导致的 YAML `null` 归一为 `""`(避免离线命令下空 key 在 SDK zod 层报 "received null")
+3. `injectProviderCredentials()` — 用 `ctx.client.exportApiCredential()`(lint 限定 `managed-agent/_engine/**` 可用)覆写内存 config 对象的 bailian 块:有凭证时 `api_key` 无条件覆写;`base_url`(拼 `/api/v1/agentstudio` 后缀，无凭证时用 client 默认域名补齐以满足 schema)/`workspace_id`(取 `settings.workspaceId`)仅在引用且为空时填充
+4. `scrubCredentialEnv()` — 从 `process.env` 删除全部凭证变量(真实凭证此后只存于 config 对象 → provider adapter 实例内存，不驻留 env / 不被子进程继承)
+5. `assertProviderCredentials(providers)` — 任一已声明 provider 的 `api_key` 为空 → CLI 权威 `AUTH` 错误 + provider 专属 hint(取代 SDK 原始插值/zod 报错);离线命令传 `credentials: "none"` 整体跳过
+
+`bl auth login` 仅管理 bailian(DashScope)凭证;claude/ark/qoder 的 key 从 env(shell / `.env` / `~/.agents/config.json`)经插值进入 config 对象，同样被清扫。禁止命令层直接 `readConfigFile` 裸读凭证;bailian 字段以 CLI 鉴权链为唯一信源。
 
 ## 必查清单
 
 ### A. core 层(类型 + 解析)
 
+- [ ] `packages/core/src/types/command.ts`:
+  - 如新增鉴权域,扩展 `AuthRequirement`
+  - 更新 `credentialFlagDefs()` 暴露该域可见的 flag
+  - 必要时新增 `*_AUTH_FLAGS`
 - [ ] `packages/core/src/auth/types.ts`:
-  - 新增 `AuthMethod` 字面量
-  - 新增 `ResolvedCredential` 字段(如 token 类型 / 过期时间)
+  - 新增 credential 类型 / source / scope 字段
 - [ ] `packages/core/src/auth/resolver.ts`:
-  - `resolveCredential()` 增加新分支
-  - 控制台网关命令用 `resolveConsoleGatewayCredential()`（与 DashScope 解析分离）
-  - 优先级注释保持清晰(数字标号)
-- [ ] `packages/core/src/auth/credentials.ts`:
-  - 如果新方式需要持久化,加 `save*` / `load*` / `clear*`
+  - 新增或调整 resolver,保持优先级注释清晰
+  - 新增/调整 resolver hint 时保持产品无关,不要新增 `bl` / `kscli` 硬编码;当前遗留的 `bl auth login` hint 如被触碰,迁到 runtime `enhanceHint`
+- [ ] `packages/core/src/auth/store.ts`:
+  - 如果新方式需要持久化,扩展 `AuthStore` / `AuthPersistPatch`
 - [ ] `packages/core/src/config/schema.ts`:
-  - `Config` 接口加新字段(如 `fileAccessToken`、`accessTokenEnv`)
-  - `ConfigFile` 接口加对应 disk 字段(snake_case)
+  - `ConfigFile` 加 disk 字段(snake_case)
+  - `Settings` 加运行时字段(如果命令需要读取)
 - [ ] `packages/core/src/config/loader.ts`:
-  - `loadConfig()` 把 env / 文件读到 Config 上
+  - `buildSources()` / `buildSettings()` 把 flag/env/file 读到正确层
 
-### B. core 客户端
+### B. runtime 层
 
-- [ ] `packages/core/src/client/http.ts`:
-  - 不同 `credential.method` 走不同分支(参考已有 `access-token` 分支走 console gateway)
-  - Authorization 头注入正确
+- [ ] `packages/runtime/src/create-cli.ts`:
+  - parse flags 时纳入新的全局/凭证域 flag
+  - `globalFlags` 与 `ownFlags` 分流正确
+- [ ] `packages/runtime/src/middleware.ts:authStage`:
+  - 根据 `command.auth` 解析 credential 并注入 `ctx.client`
+  - `settings.dryRun` 下是否允许缺 credential 的策略明确
+- [ ] `packages/runtime/src/error-handler.ts`:
+  - AUTH hint 增强使用 `binName`,不要硬编码 `bl`
+  - URL 从 `packages/runtime/src/urls.ts` import
 
-### C. cli 层
+### C. command 层
 
-- [ ] `packages/cli/src/utils/ensure-key.ts`:
-  - 启动时检查新凭证方式是否已配置,缺的话提示
-  - 如果是交互式 setup(类似 `bl auth login --console`),增加新分支
-- [ ] `packages/cli/src/commands/auth/login.ts`:
-  - 新增 `--xxx` flag 触发新登录流程
-  - 持久化到 config(调用 core 的 save 函数)
-- [ ] `packages/cli/src/commands/auth/status.ts`:
-  - 分别显示 `api_key` / `access_token` 是否已配置，以及 DashScope vs 控制台网关各自生效的 credential
-- [ ] `packages/cli/src/output/status-bar.ts`:
-  - 顶部状态条显示新凭证 method
+- [ ] `packages/commands/src/commands/auth/login.ts`:
+  - 新增/调整登录 flag 与流程
+  - 持久化只走 `ctx.authStore.login(...)`
+- [ ] `packages/commands/src/commands/auth/status.ts`:
+  - 分别显示 model / console / openapi 鉴权状态,并 mask token
+- [ ] `packages/commands/src/commands/auth/logout.ts`:
+  - 清理范围与双凭证并存规则一致
+- [ ] 新的业务命令设置正确 `auth`:
+  - 模型域请求 → `auth: "apiKey"`
+  - Console Gateway → `auth: "console"`
+  - 阿里云 OpenAPI 请求 → `auth: "openapi"`
+  - 本地/登录/配置 → `auth: "none"`
 
-### D. main 启动逻辑
-
-- [ ] 若新增命令**自行处理鉴权**或**不应在入口触发默认 API key 引导**,在对应 `defineCommand` 上设 `skipDefaultApiKeySetup: true`(见 `packages/core/src/types/command.ts`;`packages/cli/src/main.ts` 在 `registry.resolve` 后读取 `command.skipDefaultApiKeySetup`)
-
-### E. 错误文案
-
-- [ ] core 的 `BailianError` 鉴权失败 hint **保持通用**(不写 cli 命令名,见 [error-hint-change.md](error-hint-change.md))
-- [ ] cli 的 `enhanceHint` (error-handler.ts) 按 `ExitCode.AUTH` 注入新方式的 cli 命令引导
-
-### F. 用户面文档
+### D. 用户面文档
 
 - [ ] `README.md` / `README.zh.md` "Authentication" 段落
+- [ ] `skills/bailian-cli/reference/` 通过 `pnpm run sync:skill-assets` 重建
 
-### G. 测试
+### E. 测试
 
 - [ ] `packages/cli/tests/e2e/auth.e2e.test.ts` 增加新方式的 happy / failure 路径
 - [ ] mask token 的输出格式不变(避免泄漏)
+- [ ] 如调整 resolver 优先级,补 core/runtime 单测覆盖 flag > env > file
 
 ## 完成后自查
 
 ```sh
 # 各种凭证组合
-unset DASHSCOPE_API_KEY DASHSCOPE_ACCESS_TOKEN
-HOME=/tmp/empty node packages/cli/src/main.ts auth status
+unset DASHSCOPE_API_KEY ALIBABA_CLOUD_ACCESS_KEY_ID ALIBABA_CLOUD_ACCESS_KEY_SECRET
+HOME=/tmp/empty pnpm -F bailian-cli exec tsx src/main.ts auth status
 
-# flag 注入
-node packages/cli/src/main.ts auth status --api-key sk-xxx
+# flag 注入(凭证域 flag 只在对应业务命令可见,auth status 不接收)
+pnpm -F bailian-cli exec tsx src/main.ts text chat --message hi --api-key sk-xxx --dry-run
+pnpm -F bailian-cli exec tsx src/main.ts token-plan list-seats --access-key-id ak-xxx --access-key-secret sec-xxx --dry-run
+pnpm -F bailian-cli exec tsx src/main.ts auth login --open-api --access-key-id ak-xxx --access-key-secret sec-xxx --dry-run
 
 # env 注入
-DASHSCOPE_ACCESS_TOKEN=xxx node packages/cli/src/main.ts auth status
+DASHSCOPE_API_KEY=sk-xxx pnpm -F bailian-cli exec tsx src/main.ts auth status
+ALIBABA_CLOUD_ACCESS_KEY_ID=ak-xxx ALIBABA_CLOUD_ACCESS_KEY_SECRET=sec-xxx pnpm -F bailian-cli exec tsx src/main.ts auth status
+```
+
+Console 登录/网关相关改动:
+
+```sh
+pnpm -F bailian-cli exec tsx src/main.ts auth login --console
+pnpm -F bailian-cli exec tsx src/main.ts usage stats --dry-run --output json
 ```
 
 ## 常见漏点
 
-- ✗ 加了新 token 来源但忘了改 `resolveCredential` 优先级,实际不生效
-- ✗ `Config` 加字段但 `loadConfig` 没读 → 字段永远 undefined
-- ✗ `bl auth login` 写成功但 `bl auth status` 不识别(两边走的 storage path 不一致)
+- ✗ 加了新 token 来源但忘了改 resolver 优先级,实际不生效
+- ✗ `ConfigFile` / `Settings` 加字段但 `parseConfigFile` 或 `buildSettings` 没读
+- ✗ `auth login` 写成功但 `auth status` 不识别(两边走的 storage path 不一致)
 - ✗ token mask 显示完整 token,日志泄漏
+- ✗ `auth: "console"` 命令误用 `apiKey` 域,config 只有 API key 时会把 `sk-...` 发到网关
+- ✗ 新增 core resolver hint 时写死产品命令,导致 `kscli` 等入口提示错误

docs/agents/branch-merge-review.md

@@ -50,13 +50,13 @@ git diff --name-only <base>...<head>
 - [ ] **`package.json` 没破坏发布元数据**:`bin` / `exports` / `files` / `inlinedDependencies` 字段任何删除或改名都要单独评估
 - [ ] **公共依赖没被悄悄升级**:catalog / 根 lockfile 改动要列出来
 - [ ] **`package.json` version 没倒退**:目标分支已经更高时(如 main 1.0.3 vs head 1.0.0-beta.1),手动对齐版本号,不要被 head 覆盖
-- [ ] **全局表没冲突**:`registry.ts`、`defineCommand` 的 `skipDefaultApiKeySetup`(见 `packages/core/src/types/command.ts`)、`ExitCode` 三处新增项不和现有项冲突
+- [ ] **全局表没冲突**:`packages/cli/src/commands.ts` / `packages/kscli/src/main.ts` command map、`defineCommand({ auth })`、`GLOBAL_FLAGS` / `MODEL_AUTH_FLAGS` / `CONSOLE_AUTH_FLAGS` / `OPENAPI_AUTH_FLAGS`、`ExitCode` 新增项不和现有项冲突
 
 ## 清单 B:用户透出(用户可见的新东西必看)
 
 - [ ] **新命令 / 新 flag** 已同步到用户面文档:
   - [README.md](README.md) + [README.zh.md](README.zh.md)(中英文都要,常漏 `_CN`)
-  - (SKILL.md 已迁出本仓库,由 `npx add skills` 机制独立维护,不在本仓库 review 范围)
+  - `skills/bailian-cli/reference/` + `skills/bailian-cli/SKILL.md` 通过 `pnpm run sync:skill-assets` 更新并提交
 - [ ] **`bl <cmd> --help`** 文案完整:`description` / `examples` 都填了
 - [ ] **demo / quickstart**:用户可调用的新命令至少有一个示例
 - [ ] **行为变化的老命令**:在 commit message / CHANGELOG 注明用户感知的差异
@@ -80,7 +80,7 @@ git diff --name-only <base>...<head>
 解冲突要点(merge 时不要漏):
   - <冲突文件> + <字段/段落> + <怎么取舍>
   ↑ 放"合并那一刻才会出现"的细节,例如 package.json 的 files/scripts/devDependencies 各取并集、
-    `skipDefaultApiKeySetup` 这类命令元数据两边都加项时不要丢一侧、pnpm-lock.yaml 直接 rm 后 pnpm install 重生等。
+    command map / `auth` / 全局 flags 这类元数据两边都加项时不要丢一侧、pnpm-lock.yaml 直接 rm 后 pnpm install 重生等。
 建议修(可后置):
   - ...
 仅信息(无需动作,告知即可):
@@ -94,11 +94,11 @@ git diff --name-only <base>...<head>
 
 ## 常见漏点(基于历史踩坑)
 
-| 漏点                                                                            | 后果                                                                          |
-| ------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
-| `pnpm-workspace.yaml` 把 `packages/*` 收窄成显式列表                            | 合并后目标分支的新子包不再被 workspace 识别,`pnpm install` 看似正常但子包失联 |
-| 源分支 version 比目标分支低,直接 merge 覆盖                                     | npm 上版本号回退,latest tag 错乱                                              |
-| `registry.ts` 注册新命令但忘了 [README](README.md) / [README.zh](README.zh.md)  | 用户完全感知不到新功能                                                        |
-| 共享 util 重构(抽公共函数)只改了一处调用方                                      | 其它调用方静默走旧分支,行为分裂                                               |
-| 不该跳过默认 API key 引导的命令误设 `skipDefaultApiKeySetup: true`              | 安全风险,用户没配置 key 也能调付费 API                                        |
-| `catalog.ts` / `skipDefaultApiKeySetup` 这类元数据两边都加项,解冲突时被合掉一侧 | 某个命令突然要求登录 / 某个新命令注册丢失,编译能过、回归不易察觉              |
+| 漏点                                                                                                 | 后果                                                                          |
+| ---------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
+| `pnpm-workspace.yaml` 把 `packages/*` 收窄成显式列表                                                 | 合并后目标分支的新子包不再被 workspace 识别,`pnpm install` 看似正常但子包失联 |
+| 源分支 version 比目标分支低,直接 merge 覆盖                                                          | npm 上版本号回退,latest tag 错乱                                              |
+| `packages/cli/src/commands.ts` 注册新命令但忘了 [README](README.md) / [README.zh](README.zh.md)      | 用户完全感知不到新功能                                                        |
+| 共享 util 重构(抽公共函数)只改了一处调用方                                                           | 其它调用方静默走旧分支,行为分裂                                               |
+| 命令 `auth` 域设错（如 Console Gateway 用了 `apiKey`）                                               | 凭证域 flag/help/credential 注入都错,运行期才暴露                             |
+| `packages/cli/src/commands.ts` / `packages/kscli/src/main.ts` 这类 map 两边都加项,解冲突时被合掉一侧 | 某个新命令注册丢失,编译能过、回归不易察觉                                     |

docs/agents/changelog-write.md

@@ -81,11 +81,12 @@ git merge-base --is-ancestor 12f2b1b 3fc54ae && echo "IN" || echo "NOT IN"
 光看 commit 还不够,要确认目标功能的代码 / 文件在 release commit 上真的存在:
 
 ```sh
-# 列出 release commit 下某目录的文件
-git ls-tree -r <releaseCommit> --name-only -- packages/cli/src/commands/
+# 列出 release commit 下命令实现与产品入口
+git ls-tree -r <releaseCommit> --name-only -- packages/commands/src/commands/
+git show <releaseCommit>:packages/cli/src/commands.ts | head
 
 # 看 release commit 下某文件的内容
-git show <releaseCommit>:packages/cli/src/commands/console/call.ts | head
+git show <releaseCommit>:packages/commands/src/commands/console/call.ts | head
 ```
 
 特别注意被一行带过的"杂项" commit。本仓库历史踩过坑:`feat(cli): enhance output options and add new commands` 这种标题里藏了**新命令** + **新输出格式** + **logout 增强**三件事,粗看会全部漏掉。

docs/agents/cli-e2e-tests.md

@@ -1,30 +1,58 @@
 # CLI E2E 测试规范
 
+## 架构分层
+
+| 层级            | 路径                                                  | 测什么                                                                                   |
+| --------------- | ----------------------------------------------------- | ---------------------------------------------------------------------------------------- |
+| **共享基建**    | `packages/e2e`                                        | gating、子进程 runner、output、globalSetup（`private`，不发布）                          |
+| **命令 E2E**    | `packages/commands/tests/e2e`                         | help、缺参、dry-run、live（gated）；每用例最小路由                                       |
+| **bl smoke**    | `packages/cli/tests/e2e/registry.smoke.e2e.test.ts`   | 产品 map 全部 path `--help`、分组 help、根 help                                          |
+| **kscli smoke** | `packages/kscli/tests/e2e/registry.smoke.e2e.test.ts` | 从 `kscli/src/commands.ts` 推导 path/分组；identity（`--version`、`search --help` path） |
+| **runtime**     | `packages/runtime/tests`                              | `proxy.e2e`、console 跨域 flag 拒绝                                                      |
+
+**依赖边界**：`e2e` → `core`；`commands/tests` → `e2e` + `commands/src`；产品 tests → `e2e` + 各自 `src`。**禁止**产品 import `commands/tests/**`（子进程 spawn harness 路径除外）。
+
 ## 触发条件
 
-- 新增/修改 `packages/cli/src` 下的 command（`commands/catalog.ts` 登记、`defineCommand` 实现、options/usage）
-- 新建或扩展 `packages/cli/tests/e2e/*.e2e.test.ts` 用例
-- 为命令补 help / 缺参 / dry-run / 真实集成测试
+- 新增/修改 `packages/commands/src/commands` 下的 command 实现
+- 新增/修改 `packages/cli/src/commands.ts` 的 `bl` 命令路径 map
+- 新建或扩展 `packages/commands/tests/e2e/<topic>.e2e.test.ts`
+- 新增 bl 产品 path → `registry.smoke` 自动覆盖 leaf path；commands topic 测试在 `topic-routes.ts` 补最小路由
 
-以上情况必须同步维护 `packages/cli/tests/e2e/<topic>.e2e.test.ts`。跑测与环境变量见 `.cursor/skills/bailian-cli-e2e/SKILL.md`。
+跑测与环境变量见 `.cursor/skills/bailian-cli-e2e/SKILL.md`。
+
+> **规则**：共享 command 行为在 `commands/tests/e2e`；产品 map、identity、CLI-only 命令留在对应产品 `tests/e2e`。
 
 ## 文件与工具
 
-- 路径：`packages/cli/tests/e2e/<kebab-topic>.e2e.test.ts`
-- 框架：`vite-plus/test`；子进程跑 CLI：`runCli` from `./helpers.ts`
+### commands E2E
+
+- 路径：`packages/commands/tests/e2e/<kebab-topic>.e2e.test.ts`
+- 子进程：`runCommandE2e(routes, args)` from `./helpers.ts`（spawn `harness/main.ts`，`routes` 为本 topic 最小 path → export 映射）
+- fixtures：`packages/commands/tests/e2e/fixtures/`
+- 路由常量：`topic-routes.ts`（按 topic 维护，**非**全量产品 map）
+
+### 产品 smoke
+
+- bl：`runCli` from `packages/cli/tests/e2e/helpers.ts`
+- kscli：`runKscli` from `packages/kscli/tests/e2e/helpers.ts`
+
+### 共享
+
+- gating / output / runner：`e2e/gating`、`e2e/output`、`e2e/runner`
+- globalSetup：根 `vite.config.ts` → `packages/e2e/src/global-setup.ts`
 - 解析 JSON stdout：`parseStdoutJson`；输出目录：`makeE2eOutputDir(e2eLabelFromMetaUrl(import.meta.url))`
 - 长任务：`cliTimeoutPrefix()`；视频用例加 `test(..., 3_600_000)` 等显式超时
 
 ## 双层 describe（固定结构）
 
 ```ts
-// 1) 不 skip：分组 + --help，无密钥、无真实 API
+// 1) 不 skip：--help，无密钥、无真实 API（分组 help 由 bl registry.smoke 覆盖）
 describe("e2e: <topic>", () => {
-  test("<group> 分组展示子命令帮助且成功退出", ...);
   test("<subcommand> --help 正常退出", ...);
 });
 
-// 2) skipIf：缺参 / dry-run / 真实集成；原有集成用例放最后、勿改逻辑
+// 2) skipIf：缺参 / dry-run / 真实集成
 describe.skipIf(<ready>)("e2e: <topic>（DashScope …）", () => {
   test("缺少 --<flag> 时退出为用法错误 (2)", ...);
   test("<cmd> --dry-run ...", ...); // 若适用
@@ -32,57 +60,74 @@ describe.skipIf(<ready>)("e2e: <topic>（DashScope …）", () => {
 });
 ```
 
-## skip 条件（helpers.ts）
+## skip 条件（`e2e/gating`，commands helpers re-export）
 
-| 场景                | 条件                                                  |
-| ------------------- | ----------------------------------------------------- |
-| 文本/搜索/记忆/配置 | `isDashScopeE2EReady()`                               |
-| 图像/语音           | `isBailianE2EMediaEnabled() && isDashScopeE2EReady()` |
-| 视频                | `isBailianE2EVideoEnabled() && isDashScopeE2EReady()` |
-| 知识库              | `isKnowledgeE2EReady()`                               |
-| 视频 download/task  | 另需 `BAILIAN_E2E_VIDEO_TASK_ID`                      |
+| 场景                    | 条件                                                                                                       |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------- |
+| 文本/搜索/记忆/配置     | `isDashScopeE2EReady()`                                                                                    |
+| 图像/语音               | `isBailianE2EMediaEnabled() && isDashScopeE2EReady()`                                                      |
+| 视频                    | `isBailianE2EVideoEnabled() && isDashScopeE2EReady()`                                                      |
+| OpenAPI AK/SK           | `isOpenApiE2EReady()`（`.env` 中必须同时提供完整 AK/SK）                                                   |
+| 视频 download/task      | 另需 `BAILIAN_E2E_VIDEO_TASK_ID`                                                                           |
+| 知识库 chat/search live | `isChatE2EReady()` / `isSearchE2EReady()`（`knowledge chat/search`，需 `BAILIAN_WORKSPACE_ID` + agent ID） |
 
 ## 用例类型
 
-1. **分组 help**：`runCli(["image"])` → `exitCode === 0`，stdout+stderr 含子命令名
-2. **--help**：`runCli([..., "--help"])` → stderr 含主要 flags
-3. **缺参**：`--non-interactive` 且不传 required flag → `exitCode === 2`，stderr 匹配 `--flag|Missing required argument`
-4. **--dry-run**：仅当实现在联网/上传/写盘**之前**返回；断言 stdout JSON/文本，不入网
-5. **真实集成**：保留既有用例名称与断言；放在 skip 块**末尾**
+1. **--help**：`runCommandE2e(ROUTES, [..., "--help"])` → stderr 含主要 flags
+2. **缺参**：带无害全局 flag（如 `--quiet`）且不传 required flag → `exitCode === 2`
+3. **--dry-run**：实现在联网/上传/写盘**之前**返回；断言 stdout JSON/文本
+4. **真实集成**：放在 skip 块**末尾**
+
+## 增删命令同步
+
+- **commands export** + **topic 路由**（`topic-routes.ts` 或测试文件内 `ROUTES`）+ **产品 map**（`cli/commands.ts` / `kscli/commands.ts`）
+- 分组 help 由产品 `registry.smoke` 负责，无需在 commands 重复
 
 ## 安全与例外
 
-- **禁止真实破坏性操作**：`auth logout` 只用 `--dry-run`；`config set` 只用 `--dry-run`
+- **禁止破坏真实用户配置**：`auth logout` 默认只用 `--dry-run`；需要验证实际落盘时，必须通过
+  `BAILIAN_CONFIG_DIR` 指向隔离 fixture；`config set` 只用 `--dry-run`
 - **不加 dry-run**：`dryRun` 在 `resolveFileUrl` / `resolveCredential` / 上传**之后**的命令（如 `image edit`、`speech recognize` 带 `--url`）
 - **`--list-voices` 等旁路**：先于 `--text` 校验的 flag，缺参用例勿带该 flag
 - 新增 required option → 至少一条缺参用例；改 dry-run 输出 → 更新对应断言
 
 ## 新增 command 检查清单
 
-- [ ] `commands/catalog.ts` 登记 + `tests/e2e/<topic>.e2e.test.ts`（新建或扩展）
-- [ ] 若改了 `usage` / `options` / `examples`,跑 `pnpm --filter bailian-cli run generate:reference` 更新 `skills/bailian-cli/reference/` 并提交
-- [ ] 顶层：分组 help + 子命令 `--help`（多子命令则各一条 help）
+- [ ] `packages/commands/src/index.ts` 导出 + `packages/cli/src/commands.ts` 暴露路径 + `topic-routes.ts` 补最小路由
+- [ ] `packages/commands/tests/e2e/<topic>.e2e.test.ts`（新建或扩展）
+- [ ] 若改了 `usageArgs` / `flags` / `exampleArgs`,跑 `pnpm --filter bailian-cli run generate:reference` 更新 `skills/bailian-cli/reference/` 并提交
+- [ ] 子命令 `--help`（分组 help 由 bl `registry.smoke` 覆盖）
 - [ ] skip 块：每个 required flag 缺参；可 dry-run 则加一条
 - [ ] 至少一条真实集成（或说明为何仅 smoke）；不破坏已有集成用例顺序
-- [ ] `pnpm test packages/cli/tests/e2e/<file>` 通过
+- [ ] `vp test packages/commands/tests/e2e/<file>` 通过
+
+## 调试命令
+
+```sh
+pnpm --filter bailian-cli-commands exec vp test packages/commands/tests/e2e/text-chat.e2e.test.ts
+pnpm --filter bailian-cli exec vp test packages/cli/tests/e2e/registry.smoke.e2e.test.ts
+pnpm --filter knowledge-studio-cli exec vp test packages/kscli/tests/e2e/registry.smoke.e2e.test.ts
+pnpm --filter bailian-cli-runtime exec vp test packages/runtime/tests/proxy.e2e.test.ts
+```
 
 ## 示例片段
 
 ```ts
+import { FOO_ROUTES } from "./topic-routes.ts";
+
 test("foo bar 缺少 --prompt 时退出为用法错误 (2)", async () => {
-  const { stderr, exitCode } = await runCli(["foo", "bar", "--non-interactive"]);
+  const { stderr, exitCode } = await runCommandE2e(FOO_ROUTES, ["foo", "bar", "--quiet"]);
   expect(exitCode).toBe(2);
   expect(stderr).toMatch(/--prompt|Missing required argument/i);
 });
 
 test("foo bar --dry-run 仅输出计划", async () => {
-  const { stdout, stderr, exitCode } = await runCli([
+  const { stdout, stderr, exitCode } = await runCommandE2e(FOO_ROUTES, [
     "foo",
     "bar",
     "--dry-run",
     "--prompt",
     "x",
-    "--non-interactive",
     "--output",
     "json",
   ]);
@@ -97,4 +142,4 @@ test("foo bar --dry-run 仅输出计划", async () => {
 - **E2E**：单条/少量调用、断言固定、可进 `vp test`（见上文 skip 条件）
 - **批量压测**：`packages/cli/tests/stress/run.mjs` + `targets/*.mjs`，并发 + 报告，**仅手动** `pnpm run test:stress -- <target>`
 
-勿把压测并入 E2E 或默认 CI。详见 [stress-batch-tests.md](stress-batch-tests.md)。
+勿把压测并入 E2E 或默认 CI。详见 [stress-batch-tests.md](stress-batch-tests.md).

docs/agents/command-add-remove.md

@@ -5,89 +5,129 @@
 - 增加新的 `bl xxx` 命令
 - 删除已有命令
 - 重命名命令(包括从单级 `bl x` 改成 `bl x y` 或反向)
+- 调整某个 shared command 在 `bl` / `kscli` 等产品入口里的暴露路径
 
-## 命令路径与文件路径的对应规则
+## 命令实现与产品路径的关系
+
+命令实现住在 `packages/commands`,产品路径由入口包决定。实现文件路径按能力组织,但不再等同于最终命令路径。
 
 ```
-单级命令(无 group):  commands/<name>.ts          ↔  bl <name>
-                     例: commands/update.ts      ↔  bl update
-
-两级命令(有 group):  commands/<group>/<action>.ts ↔  bl <group> <action>
-                     例: commands/text/chat.ts   ↔  bl text chat
-
-三级命令(子组,慎用): commands/<group>/<sub>/<action>.ts ↔ bl <group> <sub> <action>
-                     例: commands/memory/profile/create.ts ↔ bl memory profile create
-                     仅当子组下有 ≥2 个 action 时合理(否则拍平到两级)
+实现文件:
+  packages/commands/src/commands/knowledge/retrieve.ts
+    ↓ packages/commands/src/index.ts export { default as knowledgeRetrieve }
+产品入口:
+  packages/cli/src/commands.ts  "knowledge retrieve": knowledgeRetrieve  ↔ bl knowledge retrieve
+  packages/kscli/src/main.ts    "retrieve": knowledgeRetrieve             ↔ kscli retrieve
 ```
 
-文件路径与命令路径必须 1:1 对齐。
+常见路径形态:
+
+```
+单级命令:  packages/commands/src/commands/update.ts              ↔ bl update
+两级命令:  packages/commands/src/commands/text/chat.ts           ↔ bl text chat
+子组命令:  packages/commands/src/commands/memory/profile-get.ts  ↔ bl memory profile get
+```
+
+子组要慎用:只有子组下有 ≥2 个 action 时才合理,否则优先拍平到两级。
 
 ## CLI 命令注册架构(必读)
 
-命令元数据以 **`catalog.ts` 为单一登记处**;`registry.ts` 只负责解析与打印 help,不再内嵌命令表或手写 Resources 列表。
+`packages/commands` 是命令库,只导出单个 command;不内置 path presets,不关心 `bl` / `kscli`。每个产品入口传入自己的 command map,`runtime` 负责解析、help、鉴权、遥测、执行。
 
 ```
-commands/<...>.ts   defineCommand({ name, description, usage, options, examples, run })
+packages/commands/src/commands/<...>.ts
+  defineCommand({ auth, flags, usageArgs, exampleArgs, validate, run })
         ↓
-commands/catalog.ts   export const commands: Record<string, Command>
+packages/commands/src/index.ts
+  export { default as xxxCommand } from "./commands/...ts"
         ↓
-   ┌────┴────┬──────────────────────┬─────────────────────┐
-   ↓         ↓                      ↓                     ↓
-registry.ts  main.ts      tools/generate-reference.ts   export-schema.ts
-(解析/help)  (入口)       → skills/bailian-cli/reference/index.md + <group>.md
+┌──────────────────────────────┬──────────────────────────────┐
+│ packages/cli/src/commands.ts │ packages/kscli/src/main.ts   │
+│ { "text chat": textChat }    │ { "retrieve": knowledge... } │
+└──────────────┬───────────────┴──────────────┬───────────────┘
+               ↓                              ↓
+        createCli(commands, identity)  →  runtime registry/help/middleware
+               ↓
+        tools/generate-reference.ts reads packages/cli/src/commands.ts
 ```
 
-- **`packages/cli/src/commands/catalog.ts`**: `import` 命令模块 + `"<path>": handler` 映射;**不** `import registry.ts`(避免构建时循环依赖)
-- **`packages/cli/src/commands/index.ts`**: `export { commands } from "./catalog.ts"`(给包内 re-export 用)
-- **`packages/cli/src/registry.ts`**: `import { commands } from "./commands/catalog.ts"`,建树、`resolve`、`printHelp`;Commands / Global Flags 从 `Command` 元数据与 `GLOBAL_OPTIONS` **动态生成**
-- **`tools/generate-reference.ts`**: pre-commit / `pnpm run sync:skill-assets` 时读 `catalog.ts`,写 `skills/bailian-cli/reference/index.md`(索引) + `skills/bailian-cli/reference/<一级命令>.md`(详情,勿手改)。该目录**纳入 git**,随 `npx skills add modelstudioai/cli` 分发
+- **`packages/commands/src/commands/<...>.ts`**:命令实现;`usageArgs` / `exampleArgs` 只写参数片段,不写 `bl` / `kscli` 前缀
+- **`packages/commands/src/index.ts`**:导出命令实现;新增命令必须在这里 re-export
+- **`packages/cli/src/commands.ts`**:`bl` 产品命令 map;新增/删除/重命名 `bl` 命令必须改这里
+- **`packages/kscli/src/main.ts`**:`kscli` 产品命令 map;只有该入口需要暴露/变更时才改
+- **`packages/runtime/src/registry.ts`**:通用 registry,从传入 map 建树;不要在这里登记业务命令
+- **`tools/generate-reference.ts`**:pre-commit / `pnpm run sync:skill-assets` 时读 `packages/cli/src/commands.ts`,写 `skills/bailian-cli/reference/index.md` + `<一级命令>.md`。该目录**纳入 git**,勿手改
 
-已删除、勿再引用:`commands/help.ts`、`registry.ts` 内联 `new CommandRegistry({...})`、`printRootHelp` 手写命令行。
+已删除/勿再引用:旧的 `packages/cli/src/commands/catalog.ts`、旧的 `packages/cli/src/commands/index.ts` catalog re-export、`packages/cli/src/registry.ts`、`skipDefaultApiKeySetup`、`ensureApiKey` 启动拦截、`config/export-schema.ts`。
 
 ## 必查清单
 
-### A. 代码层
+### A. 命令库
 
-- [ ] **新建/删除/移动**对应的 `packages/cli/src/commands/<...>.ts` 文件
-- [ ] **`packages/cli/src/commands/catalog.ts`**:
-  - 增删 `import xxx from "./.../xxx.ts"`
-  - 在 `export const commands` 里增删 `"<group> <action>": xxx`(key 与 `defineCommand({ name })` 一致)
-- [ ] **不要**在 `registry.ts` 里重复登记命令(已从 catalog 读取)
-- [ ] 如果命令需要跳过入口的默认 DashScope API key 引导(`ensureApiKey`),在对应 `defineCommand` 上设 `skipDefaultApiKeySetup: true`(字段定义见 `packages/core/src/types/command.ts`;`main.ts` 根据已解析的 `command` 读取)
-- [ ] **`config/export-schema.ts`**: 若新命令不适合作为 agent tool,评估是否加入 `SKIP_PREFIXES`;该文件在 `run()` 内 `import("../catalog.ts")`,勿顶层 import catalog 以免循环依赖
+- [ ] 新建/删除/移动对应的 `packages/commands/src/commands/<...>.ts`
+- [ ] `defineCommand` 字段使用当前 schema:
+  - `auth: "apiKey" | "console" | "openapi" | "none"`
+  - `flags`(camelCase key,由 runtime 渲染为 kebab-case)
+  - `usageArgs`(不含 bin/path 前缀)
+  - `exampleArgs`(不含 bin/path 前缀)
+  - `validate`(跨 flag 校验)
+  - 普通业务命令的 `run(ctx)` 只读 `ctx.flags` / `ctx.settings` / `ctx.client`
+  - `commands/auth/**` 可用 `ctx.authStore`,`commands/config/**` 可用 `ctx.configStore`;不要把这些持久化能力扩散到普通业务命令
+  - `commands/plugin/**` 可用 `ctx.commandPacks`;产品 policy 由 runtime 绑定,命令不要自行 import 产品入口
+- [ ] `packages/commands/src/index.ts`:新增或移除对应 export
+- [ ] 如果命令调用 Console Gateway,设置 `auth: "console"`;不要重复声明 console 凭证域 flags
+- [ ] 如果命令不需要网络或自己管理配置/登录,设置 `auth: "none"`;不要绕过 runtime auth stage
 
-### B. 文档层
+### B. 产品入口
+
+- [ ] `packages/cli/src/commands.ts`:按需增删 `import` 与 `commands` map key
+- [ ] 新 map key 就是 `bl` 下的命令路径;重命名时全仓 grep 旧路径字符串
+- [ ] 如果 `kscli` 入口也要暴露/移除该能力,同步 `packages/kscli/src/main.ts`
+- [ ] 不要在 `packages/runtime/src/registry.ts` 或 `create-cli.ts` 里写业务命令表
+
+### C. 文档层
 
 - [ ] 运行 `pnpm run sync:skill-assets`(或正常 `git commit` 走 pre-commit),刷新 `skills/bailian-cli/reference/` 与 `SKILL.md` 的 `metadata.version` 并提交
-- [ ] `README.md` / `README.zh.md`: Quick Start、命令一览(用户向,与 help 对齐即可)
-- [ ] `skills/bailian-cli/SKILL.md`: 若安装说明或能力边界有变,同步更新
+- [ ] `README.md` / `README.zh.md`:Quick Start、命令一览、认证说明(用户向,与 help 对齐)
+- [ ] `skills/bailian-cli/SKILL.md`:若安装说明或能力边界有变,同步更新
 
-### C. 测试层
+### D. 测试层
 
-- [ ] 按 [cli-e2e-tests.md](cli-e2e-tests.md) 新建或更新 `packages/cli/tests/e2e/<topic>.e2e.test.ts`
-- [ ] 删除命令时一并删对应 e2e
+- [ ] 按 [cli-e2e-tests.md](cli-e2e-tests.md) 新建或更新 `packages/commands/tests/e2e/<topic>.e2e.test.ts`
+- [ ] 同步 `packages/commands/tests/e2e/topic-routes.ts`（该 topic 的最小 path → export 映射）
+- [ ] bl 产品 path 变更由 `registry.smoke` 自动覆盖；kscli 变更同步 `kscli/src/commands.ts` 与 `registry.smoke`
+- [ ] 删除命令时一并删对应 commands e2e / README 示例 / reference / topic 路由条目
+- [ ] 如果 shared command 在不同入口路径下复用,至少确保 commands e2e 覆盖 `bl` path；`kscli` 入口改动需补对应 smoke 或说明不测 flat path live
 
-### D. 重命名特殊处理
+### E. 重命名特殊处理
 
 - [ ] 全仓 grep **旧命令名字符串**,确保以下位置全部更新:
-  - `catalog.ts` 的 key
-  - error hints(cli 层)
+  - `packages/cli/src/commands.ts` map key
+  - `packages/kscli/src/commands.ts` map key(如适用)
+  - 用户可见 hint / README / tests
   - `skills/bailian-cli/reference/`(重建后检查并提交)
-  - README 示例
-  - 测试断言
+- [ ] 检查 `usageArgs` / `exampleArgs` 没有硬编码旧的 `bl <path>` 前缀
 
 ## 完成后自查
 
 ```sh
-pnpm run sync:skill-assets   # reference/ + SKILL metadata.version 与 catalog / package.json 一致
-node packages/cli/src/main.ts <new-command> --help
-node packages/cli/src/main.ts                        # 根 help 列表含新命令
-vp test packages/cli/tests/e2e/<topic>.e2e.test.ts   # 相关 e2e
+pnpm run sync:skill-assets
+pnpm -F bailian-cli exec tsx src/main.ts <new-command> --help
+pnpm -F bailian-cli exec tsx src/main.ts
+vp test packages/commands/tests/e2e/<topic>.e2e.test.ts
+```
+
+如改了 `kscli` 入口:
+
+```sh
+pnpm -F knowledge-studio-cli exec tsx src/main.ts <command> --help
 ```
 
 ## 常见漏点
 
-- ✗ 只改了命令文件,忘了 **`catalog.ts`** → 命令不存在或 help 里没有
-- ✗ 手改 **`skills/bailian-cli/reference/*.md`** → 下次 generate 被覆盖;应改 `defineCommand` 后重新 generate 并提交
-- ✗ 在 `export-schema.ts` 顶层 `import catalog` → 可能与 registry 循环依赖
+- ✗ 只新增 `packages/commands/src/commands/...` 文件,忘了在 `packages/commands/src/index.ts` 导出
+- ✗ 只导出了命令实现,忘了在 `packages/cli/src/commands.ts` 暴露路径 → `bl --help` 看不到
+- ✗ 手改 `skills/bailian-cli/reference/*.md` → 下次 generate 被覆盖;应改 command metadata 后重新 generate 并提交
+- ✗ 在 `usageArgs` / `exampleArgs` 写死 `bl text chat` → `kscli` 等入口复用时 help 错
+- ✗ Console Gateway 命令忘设 `auth: "console"` → console flags / credential 注入都不生效
 - ✗ 单 action 的子组是反模式,新增时优先拍平为两级

docs/agents/command-flag-change.md

@@ -11,20 +11,21 @@
 
 ### A. 命令文件本身
 
-- [ ] `packages/cli/src/commands/<group>/<action>.ts`:
-  - `defineCommand({ options: [...] })` 数组里增删/改 `{ flag, description, type, required }`
-  - `usage` 字段(如 `"bl text chat --message <text> [flags]"`)反映新签名
-  - `examples` 数组覆盖新 flag 至少一个示例
-  - `run()` 里读取 flag 的代码:
-    - 类型转换正确(`type: "number"` 时 `flags.x as number`,`"array"` 时 `as string[]`)
-    - 必填校验:`if (!flags.x) failIfMissing("x", ...)` 或交互式 prompt
-    - 默认值 fallback
+- [ ] `packages/commands/src/commands/<group>/<action>.ts`:
+  - `defineCommand({ flags: { ... } })` 里增删/改 camelCase flag key 与 `{ type, valueHint, description, required }`
+  - `usageArgs` 字段只写参数片段(如 `"--message <text> [flags]"`),不写 `bl <path>`
+  - `exampleArgs` 数组覆盖新 flag 至少一个示例,同样不写 bin/path 前缀
+  - `run()` 里只从 `ctx.flags` 读取本命令 flag,从 `ctx.settings` 读取全局/config 解析结果
+  - 类型由 `ParsedFlags<typeof FLAGS>` 推导;避免手写 `flags.x as number` 这类断言
+  - 单 flag 必填用 `required: true`;跨 flag / 值相关校验放 `validate`
+  - 默认值 fallback 写在命令实现或 `Settings` 解析层,不要重复解析 env/config
 
 ### B. 鉴权 / 全局选项
 
-- [ ] 如果是**全局 flag**(所有命令通用),改 `packages/core/src/types/command.ts` 的 `GLOBAL_OPTIONS`
-- [ ] 如果新 flag 影响 `Config`,改 `packages/core/src/config/schema.ts` 的 `Config` 接口
-- [ ] 如果对应 env var,改 `packages/core/src/config/loader.ts` 的 `loadConfig`
+- [ ] 如果是**全局 flag**(所有命令通用),改 `packages/core/src/types/command.ts` 的 `GLOBAL_FLAGS`
+- [ ] 如果是凭证域 flag,优先确认是否属于 `MODEL_AUTH_FLAGS` 或 `CONSOLE_AUTH_FLAGS`;不要在单个命令里重复声明
+- [ ] 如果新 flag 影响有效配置面,改 `packages/core/src/config/schema.ts` 的 `Settings` 接口
+- [ ] 如果对应 env var 或 config 文件字段,改 `packages/core/src/config/loader.ts` 的 `buildSettings`
 
 ### C. 文档层
 
@@ -44,13 +45,13 @@
 ## 完成后自查
 
 ```sh
-node packages/cli/src/main.ts <command> --help          # 看新 flag 出现在 Options
-node packages/cli/src/main.ts <command> --new-flag x   # 实测一遍
+pnpm -F bailian-cli exec tsx src/main.ts <command> --help          # 看新 flag 出现在 Flags
+pnpm -F bailian-cli exec tsx src/main.ts <command> --new-flag x   # 实测一遍
 ```
 
 ## 常见漏点
 
-- ✗ 加 `type: "number"` 但 `String(flags.x)` 触发 lint 警告(参考已修过的 memory/list.ts)
 - ✗ 加了 array 型 flag 但没考虑用户可能传多次
 - ✗ 改默认值忘记更新 description 里的 "(default: xxx)" 文案
-- ✗ Required flag 缺失时直接抛硬错而不是 prompt(交互友好性问题,参考已实现 prompt 的命令文件作为示例)
+- ✗ 在 `usageArgs` / `exampleArgs` 里写死 `bl <path>`,导致其它产品入口复用时 help 错
+- ✗ required flag 缺失又在 `run()` 里重复手写校验,与 parser/`validate` 的错误文案不一致

docs/agents/command-pack.md

@@ -0,0 +1,56 @@
+# Command Pack 维护
+
+## 触发条件
+
+- 新增或移除 Command Pack 包
+- 调整包白名单、允许的命令前缀或协议字段
+- 修改 `plugin install/link/list/remove`
+- 修改 Command Pack 加载、隔离、兼容性或独立安装目录
+
+## 分层边界
+
+- `packages/core/src/types/command-pack.ts`：稳定的协议元数据和导出类型，不知道具体产品或白名单。
+- `packages/runtime/src/command-packs/`：所有 CLI 共用的加载、校验、API 适配、产品隔离安装目录和 manager 实现。
+- `packages/runtime/src/create-cli.ts`：始终接收静态 command map，按 `CliOptions.commandPacks` 统一合并 pack，并把已绑定产品 identity/policy 的 manager 注入 `ctx.commandPacks`。
+- `packages/commands/src/commands/plugin/`：普通共享管理命令，只依赖 `ctx.commandPacks`，不 import 任何产品 policy。
+- `packages/cli/src/command-pack-policy.ts`：`bl` 支持的包、命令前缀和凭据授权。
+- `kscli` 当前不传 `commandPacks`，使用 runtime 的默认空 policy。
+- 当前只有 `bl` 从 `bailian-cli-commands` 导入并登记 `plugin *`；使用默认空 policy 的产品不提前暴露管理命令。
+
+不要把产品白名单写进 core/runtime，也不要通过扫描全局 `node_modules` 自动发现包。通用机制放 runtime，产品差异只由 policy 表达。
+
+## 安全与兼容性清单
+
+- [ ] 包名必须精确命中当前产品 policy 的 `supported`，命令路径必须位于该包允许的前缀。
+- [ ] 正式安装只接受包名加 version/tag；本地目录只走 `plugin link`。
+- [ ] npm 使用独立安装目录和 `--ignore-scripts`，不污染 CLI 自身依赖树。
+- [ ] npm 子进程只继承明确允许的 registry/config/cache/proxy/TLS 配置，不通配透传 pnpm 注入的 `npm_config_*`。
+- [ ] 安装目录按 `identity.npmPackage` 隔离，不能让一个产品安装/删除另一个产品的 pack。
+- [ ] 安装目录只隔离依赖位置，不隔离执行权限；Command Pack 必须视为 CLI 进程内的完全可信代码。
+- [ ] 入口 realpath 不能逃逸包根目录。
+- [ ] 加载前检查 `type`、`apiVersion`、`minCliVersion`；报告状态只使用 `loaded/failed`，具体原因写入 `error`。
+- [ ] Command Pack 不能覆盖内置命令、其他 pack 命令或重声明保留 flag。
+- [ ] 普通网络请求走 `ctx.client`；基础 Context 提供 `identity/settings/flags/client/output/errors`，不提供原始凭据。
+- [ ] `ctx.credentials.apiKey()` 仅限 policy 显式声明 `credentialAccess: ["apiKey"]`，且命令自身为 `auth: "apiKey"`。
+- [ ] 不向 Command Pack 暴露原始 Console Token、OpenAPI AK/SK、`authStore` 或 `configStore`。
+- [ ] 不向 Command Pack 暴露宿主的 `commandPacks` manager，避免 pack 安装或删除其他 pack。
+- [ ] 单包失败必须 fail-open：保留内置命令和其他合法 pack。
+- [ ] 破坏协议前优先在适配层兼容；确实无法兼容时才提升 `apiVersion`。
+
+## 测试与文档
+
+- [ ] `packages/runtime/tests/command-packs.test.ts` 覆盖产品 policy、安装目录隔离、协议版本、前缀和导出契约。
+- [ ] `packages/cli/tests/e2e/command-packs.e2e.test.ts` 覆盖 help、link、执行、output/errors、凭据授权、list、remove。
+- [ ] `packages/kscli/tests/e2e/command-packs.e2e.test.ts` 覆盖统一 host 和 runtime 默认空 policy 下不暴露管理命令。
+- [ ] fixture 的包名必须在测试白名单内，且构建入口不依赖工作区运行时解析。
+- [ ] 更新生成的 `skills/bailian-cli/reference/plugin.md`；公开 `README.md` / `README.zh.md` 等正式对外发布时再补。
+
+验证：
+
+```sh
+vp test packages/runtime/tests/command-packs.test.ts
+vp test packages/cli/tests/e2e/command-packs.e2e.test.ts
+vp test packages/kscli/tests/e2e/command-packs.e2e.test.ts
+pnpm run sync:skill-assets
+vp check
+```

docs/agents/config-add.md

@@ -11,46 +11,46 @@
 
 ```
 flag (--xxx)   ─┐
-                ├─ loadConfig() 合并 ─→ Config(运行时单一对象)
+                ├─ buildSources() + buildSettings() ─→ Settings(命令读取面)
 env (XXX=yyy)  ─┤
                 │
 config 文件     ─┘
 ~/.bailian/config.json
 ```
 
-优先级一般是 **flag > env > config 文件 > 默认值**,具体见 `core/config/loader.ts`。
+优先级一般是 **flag > env > config 文件 > 默认值**,具体见 `packages/core/src/config/loader.ts`。
 
 ## 必查清单
 
 ### A. 类型定义
 
 - [ ] `packages/core/src/config/schema.ts`:
-  - `Config`(运行时形状)加新字段
+  - `Settings`(运行时有效配置面)加新字段
   - `ConfigFile`(disk 形状,snake_case)加新字段(如果允许写文件)
   - `parseConfigFile()` 解析新字段
   - 如果是 enum 字段,加校验
 
 ### B. 加载逻辑
 
-- [ ] `packages/core/src/config/loader.ts:loadConfig()`:
-  - 加新字段的合并逻辑(`flags.x ?? process.env.XXX ?? file.x ?? default`)
+- [ ] `packages/core/src/config/loader.ts`:
+  - `buildSources()` 如需新增来源,把 flag/file/env 纳入 sources
+  - `buildSettings()` 加新字段的合并逻辑(`flags.x ?? process.env.XXX ?? file.x ?? default`)
   - 校验(数值范围、枚举合法性等)
   - 校验失败抛 `BailianError(USAGE)`
 
 ### C. 全局 flag(如果加的是 flag)
 
-- [ ] `packages/core/src/types/command.ts:GLOBAL_OPTIONS` 数组
-- [ ] `registry.ts` 的 `buildGlobalFlagLines` 会**自动**从 `GLOBAL_OPTIONS` 生成 `bl --help` 与 `reference/index.md` 的全局 flag 段,无需手写
-- [ ] flag 的 type 标注(`boolean` / `number` / `array`),让 args.ts 正确解析
+- [ ] `packages/core/src/types/command.ts:GLOBAL_FLAGS`
+- [ ] `packages/runtime/src/registry.ts` 会**自动**从 `GLOBAL_FLAGS` 生成 root help;`tools/generate-reference.ts` 会生成 `reference/index.md` 的全局 flag 段
+- [ ] flag 的 type 标注(`switch` / `boolean` / `number` / `array` / `string`),让 `packages/runtime/src/args.ts` 正确解析
 - [ ] 改完全局 flag 后跑 `pnpm --filter bailian-cli run generate:reference`
 
 ### D. 命令使用方
 
-- [ ] 用到新字段的命令文件直接读 `config.xxx`,不要重复解析
+- [ ] 用到新字段的命令文件直接读 `ctx.settings.xxx`,不要重复解析 env/config
 - [ ] 配置展示 / 修改命令同步:
-  - `packages/cli/src/commands/config/show.ts` 显示新字段
-  - `packages/cli/src/commands/config/set.ts` 允许 set
-  - `packages/cli/src/commands/config/export-schema.ts` 在 schema 输出里
+  - `packages/commands/src/commands/config/show.ts` 显示新字段
+  - `packages/commands/src/commands/config/set.ts` 的 `VALID_KEYS` / `KEY_ALIASES` / description 允许 set
 
 ### E. 文档
 
@@ -66,19 +66,19 @@ config 文件     ─┘
 
 ```sh
 # 三个来源都试一遍
-node packages/cli/src/main.ts config show --output json | grep <new-field>
-XXX=value node packages/cli/src/main.ts config show --output json | grep <new-field>
-node packages/cli/src/main.ts config show --xxx value --output json | grep <new-field>
+pnpm -F bailian-cli exec tsx src/main.ts config show --output json | grep <new-field>
+XXX=value pnpm -F bailian-cli exec tsx src/main.ts config show --output json | grep <new-field>
+pnpm -F bailian-cli exec tsx src/main.ts config show --xxx value --output json | grep <new-field>
 
-# 写到文件
-node packages/cli/src/main.ts config set --key <key> --value <value>
+# 写到文件(会改用户 HOME,必要时先用临时 HOME)
+pnpm -F bailian-cli exec tsx src/main.ts config set --key <key> --value <value>
 cat ~/.bailian/config.json
 ```
 
 ## 常见漏点
 
-- ✗ `Config` 接口加字段但 `loadConfig` 没填,运行时永远 undefined
+- ✗ `Settings` 接口加字段但 `buildSettings` 没填,运行时永远 undefined
 - ✗ `ConfigFile` 用 camelCase 字段名(disk schema 应该是 snake_case)
-- ✗ 全局 flag 没标 `type: "boolean"`,被当成需要值的 `--xxx <value>`
+- ✗ 全局 switch 没标 `type: "switch"`,被当成需要值的 `--xxx <value>`
 - ✗ 加了 env var 但 README 表格没更新,用户不知道有这条
 - ✗ `config show` 不显示新字段,用户改了无法回查

docs/agents/config-profile-change.md

@@ -0,0 +1,78 @@
+# Config Profile 与激活状态变更清单
+
+适用于新增 Profile 预设、修改命名 Profile 选择规则、调整 `active_config`，或新增/修改 `bl config list/use/show/ui` 等 Profile 管理能力。
+
+## 1. 保持存储边界
+
+- Profile 业务字段继续由 `ConfigFile` / `CONFIG_FILE_KEYS` 管理。
+- `active_config` 是 `config.json` 顶层元数据，不得进入命名 Profile block，也不得被 `config set` 当作普通字段写入。
+- 识别命名 Profile 时必须排除业务字段和顶层元数据。
+- 旧配置缺少 `active_config` 时继续等价于激活 `default`。
+
+## 2. 保持选择语义
+
+```text
+显式 --config <name> > active_config > default
+```
+
+- 解析阶段用局部变量保留“是否显式传入 `--config`”的信息；完成 Config 选择后不进入 `Settings`。
+- `--config default` 必须显式选择顶层配置并绕过命名激活项。
+- 普通命令的显式 `--config` 只覆盖本次选择，不修改持久化激活状态；例外是
+  `auth login --config ...`，凭证验证并落盘成功后自动激活该 Profile。
+- 激活状态只选择配置 block，不改变字段优先级；字段仍为 flag > env > selected config > 默认值。
+- Pipeline 等进程内调用链也要复用统一的 `buildSources()`，避免绕过激活状态。
+- Console access token 自动刷新等后台读写必须携带 `settings.configName`，不得直接读写顶层 default。
+
+## 3. 保持读写命令交互一致
+
+- `auth login`、`config set` 等写命令未传 `--config` 时修改当前激活项。
+- `auth login --config <name>` 显式指定不存在的 Profile 时，仅在凭证验证成功并实际落盘时
+  创建和激活；`config set --config <name>` 可创建但不自动激活。
+- `config show`、`auth status` 和业务消费等读命令不得因为显式指定不存在的名称而创建 Profile。
+- `auth logout` 默认只清理当前激活项；显式 `--config` 只清理指定项。
+- 按凭证域退出时必须清理该域的完整字段集合，例如 OpenAPI 同时清理 AK、SK 和 STS `security_token`。
+- 所有生产代码读取“当前配置”时优先经过 `buildSources()` 或携带解析后的 `configName`；直接调用无名称的 `readConfigFile()` / `writeConfigFile()` 只适用于明确操作顶层 default 的底层能力。
+
+## 4. 保持状态一致性
+
+- `config use` 只能激活已经存在的命名 Profile；`default` 始终有效。
+- 配置文件中的 `active_config` 指向不存在的 Profile 时返回 usage error，不静默回退。
+- 删除当前激活的命名 Profile 时，同一次落盘切回 `default`，不得留下悬空引用。
+- 配置写入继续使用临时文件 + rename，避免中断后留下半写文件。
+
+## 5. 命令与展示联动
+
+- 新增/重命名命令时同步 `packages/commands/src/index.ts` 和产品入口 `packages/cli/src/commands.ts`。
+- `config list` 标识所有 Profile 与当前激活项。
+- `config show`、`auth status` 只输出本次最终选择的 `config` 和 `config_file`，不重复携带激活状态。
+- `config ui` 从持久化元数据读取激活项，提供显式激活操作，并在删除激活项后刷新为 `default`。
+- `config ui` 展示并可编辑完整 `ConfigFile`（含 `console_*`、`telemetry`），保存时按类型（数字/布尔/枚举）归一化写回；`config set` 仍只暴露较窄的 `VALID_KEYS`。UI 未管理的顶层元数据（如 `active_config`）不进入 Profile block，仍由写盘逻辑单独保留。
+- `config ui` 只读展示本地 agent 生态：Skills 跨全部 agent skill 目录（`~/.agents/skills` 及各 agent 的 `skills/`，含软链接）按 id 聚合并标注安装来源；MCP、Agents 从各 agent 本地配置读取。
+- `config ui` 提供 Assets 资产管理：扫描 `output_dir`（默认 `~/bailian-output`）下的 `images/videos/speech/omni` 分类及根目录散落文件，按分类与生成时间（mtime）标记，支持按分类筛选、内联预览（图/视频/音频）与删除单个文件；文件读取与删除均通过限定在输出目录内的路径校验（防目录穿越）。
+- 同步 E2E topic routes、Skill setup 和自动生成 reference。
+
+## 6. 最小测试矩阵
+
+- 旧配置无 `active_config` -> `default`。
+- 激活命名 Profile 后，无 `--config` 的命令选择该 Profile。
+- 显式命名 `--config` 和 `--config default` 均覆盖激活项且不修改磁盘状态。
+- 激活不存在的 Profile 失败且不写盘。
+- 悬空 `active_config` 明确失败。
+- 删除激活 Profile 后切回 `default`。
+- 登录、退出、`config set` 分别覆盖“当前激活项”和“显式不存在名称成功后创建”。
+- 显式 `auth login --config <name>` 成功后激活该 Profile，失败或 dry-run 不创建、不切换；
+  `--config default` 成功后切回 `default`。
+- Console token 自动刷新不从其他 Profile 借用 AK/SK，也不把新 token 写入其他 Profile。
+- `config list/show/use/ui`、`auth status` 和依赖默认模型的消费命令覆盖对应 E2E。
+- `config ui` 覆盖保存时保留顶层元数据（如 `active_config`），继续允许空值清除字段，并覆盖 `console_*`/`telemetry` 的类型归一化与枚举校验。
+- Assets:`listAssets` 覆盖分类归类、时间倒序、目录缺失返回空；`resolveAssetPath` 覆盖目录穿越拦截;`contentType` 覆盖常见扩展名映射。
+
+## 7. 完成检查
+
+```sh
+pnpm run sync:skill-assets
+vp check
+vp test
+```
+
+命令 E2E 会启动本地子进程，Config UI 测试还会监听 `127.0.0.1` 临时端口；受限沙箱内出现 `EPERM` 时，需要在允许本地进程和端口的环境中复跑。

docs/agents/error-hint-change.md

@@ -3,8 +3,8 @@
 ## 触发条件
 
 - 修改 `BailianError` 的 message 或 hint
-- 调整 cli 的 hint 增强逻辑(`enhanceHint`)
-- 改 ensure-key 的 setup 流程文案
+- 调整 runtime 的 hint 增强逻辑(`enhanceHint`)
+- 改 auth stage / resolver 的鉴权失败文案
 - 改任何抛错位置的分类(exitCode)
 
 > 注意:`mapApiError` **不再做错误分类**(参见下方"边界原则")。如果你想给某种 HTTP 错误码加白名单分类,请先回到本文档读完"边界原则"再说。
@@ -17,7 +17,7 @@
 | ---------------------------------------------------- | -------- | ----------------------------------------------------------- |
 | 命令解析、缺 flag、参数校验                          | **内部** | `BailianError(USAGE)`                                       |
 | 文件 I/O(ENOENT/EACCES/...)                          | **内部** | `BailianError(GENERAL)` + errno-specific hint               |
-| 本地 credentials 缺失(resolver/ensure-key/AK-SK 等)  | **内部** | `BailianError(AUTH)`                                        |
+| 本地 credentials 缺失(resolver / authStage 等)       | **内部** | `BailianError(AUTH)`                                        |
 | `fetch` 自身失败(DNS/TCP/TLS/proxy)                  | **内部** | `BailianError(NETWORK)` + 读 `err.cause.code` 给 errno-hint |
 | polling 客户端超时                                   | **内部** | `BailianError(TIMEOUT)`                                     |
 | HTTP 4xx/5xx、HTTP 200 + 业务错码、async task FAILED | **服务** | `BailianError(GENERAL)`,**message 原样透传**,不分类、不替换 |
@@ -39,9 +39,9 @@
 ```
 core 抛出 BailianError(message, exitCode, hint, cause?)
   ↓ 沿调用栈冒泡
-cli/main.ts: main().catch(handleError)
+runtime/create-cli.ts: dispatch().catch(handleError)
   ↓
-cli/error-handler.ts:
+runtime/error-handler.ts:
   - 服务端错误(BailianError(GENERAL)) → text 直接打 message
   - 内部 AUTH/USAGE/NETWORK/TIMEOUT → 走 enhanceHint(只 AUTH 还有增强)
   - TypeError("fetch failed") → 读 err.cause.code 翻成 NETWORK
@@ -62,36 +62,42 @@ process.exit(err.exitCode)
 
 - ❌ 不要回退到"401 → AUTH、429 → QUOTA"那套白名单
 - ✅ message 把 status / apiCode / request_id 拼进去就够,exit 统一 GENERAL
-- 例外:CLI **自己**因为本地状态产生的 BailianError(resolver、ensure-key 等)可以用语义化 exitCode
+- 例外:CLI/runtime **自己**因为本地状态产生的 BailianError(resolver、authStage 等)可以用语义化 exitCode
 
 ### 3. core 的 hint 必须不含 cli 关切
 
-- ❌ 不写 `bl xxx` 命令名
-- ❌ 不写控制台 URL 或 region
-- ❌ 不写渠道追踪参数(`source_channel=xxx`)
+- ❌ 新增/改动时不写 `bl xxx` 命令名
+- ❌ 新增/改动时不写 `kscli xxx` 等产品入口命令名
+- ❌ 新增/改动时不写控制台 URL 或 region
+- ❌ 新增/改动时不写渠道追踪参数(`source_channel=xxx`)
 - ✅ 只描述抽象做法(如 `"Set DASHSCOPE_API_KEY environment variable, or pass --api-key."`)
+- 当前遗留:`packages/core/src/auth/resolver.ts` 仍含 `bl auth login` hint;触碰鉴权错误时迁到 runtime `enhanceHint`
 
-### 4. cli 端可以自由使用 cli 命令名 + URL
+### 4. runtime / 产品层可以使用入口名 + URL
 
-- 命令文件、`error-handler.ts`、`utils/ensure-key.ts` 是 cli 层,内部可以写 `bl xxx`
-- URL 必须从 `packages/cli/src/urls.ts` import,不能硬编码
+- `packages/runtime/src/error-handler.ts` 通过 `binName` 渲染 `bl` / `kscli` 等入口名,不要硬编码
+- 产品入口 / README / E2E 可以写具体入口命令
+- shared command 实现不写 `bl` / `kscli` 前缀;`usageArgs` / `exampleArgs` 只写参数片段
+- URL 必须从 `packages/runtime/src/urls.ts` import,不能硬编码
 
 ## 必查清单
 
 ### A. core 改动(message / hint)
 
 - [ ] `packages/core/src/errors/api.ts` 的 `mapApiError`:**保持透传形态**,不要加白名单分支
-- [ ] `packages/core/src/auth/resolver.ts` 改 throw 语句:hint 不含 cli 关切
-- [ ] 任何 core 文件 throw 的 BailianError:同上
+- [ ] `packages/core/src/auth/resolver.ts` 新增/改 throw 语句时:hint 不含 cli 关切;已有 `bl auth login` 遗留点被触碰时要收敛
+- [ ] 任何 core 文件新增/改 BailianError:同上
 
-### B. cli 增强(`enhanceHint`)
+### B. runtime 增强(`enhanceHint`)
 
-- [ ] `packages/cli/src/error-handler.ts:enhanceHint`:**当前只为 internal AUTH 增强**(因为只有 resolver/ensure-key 等内部位置会发 AUTH)
+- [ ] `packages/runtime/src/error-handler.ts:enhanceHint`:**当前只为 internal AUTH 增强**(因为 resolver / authStage 等内部位置会发 AUTH)
+- [ ] 命令名使用 `binName`,不要硬编码 `bl`
 - [ ] URL 必须是 `import { API_KEY_PAGE } from "./urls.ts"`
 
-### C. cli 直接抛错(`ensure-key`、命令文件)
+### C. command / runtime 直接抛错
 
-- [ ] cli 层抛 BailianError 时,hint 里可以放 cli 命令名,但 **URL 一律走 `urls.ts` import**
+- [ ] runtime 层抛 BailianError 时,hint 里可以放 `binName` 渲染的入口命令,但 **URL 一律走 `urls.ts` import**
+- [ ] `packages/commands` 作为 shared command 库,默认不硬编码产品 bin;如果确需用户操作提示,优先依赖 runtime error handler 或 `ctx.identity.binName`
 - [ ] 抛错位置如果**已经在调用服务端**,catch 时不要替换 message——重新评估是否需要 catch
 
 ### D. 文案一致性
@@ -104,14 +110,14 @@ process.exit(err.exitCode)
 
 ```sh
 # 触发对应错误,看 text 输出
-HOME=/tmp/empty node packages/cli/src/main.ts text chat --message "x" --non-interactive
+HOME=/tmp/empty pnpm -F bailian-cli exec tsx src/main.ts text chat --message "x"
 
 # 看 JSON 输出(应包含 cause 字段当 cause 存在时)
-HOME=/tmp/empty node packages/cli/src/main.ts text chat --message "x" --non-interactive --output json
+HOME=/tmp/empty pnpm -F bailian-cli exec tsx src/main.ts text chat --message "x" --output json
 
 # 模拟网络层错误,验证 errno 透传
 DASHSCOPE_BASE_URL=https://nonexistent-host.invalid \
-  node packages/cli/src/main.ts text chat --message hi
+  pnpm -F bailian-cli exec tsx src/main.ts text chat --message hi
 # 预期:"Network request failed: ENOTFOUND ..." + Caused by 链
 ```
 

docs/agents/install-doc-change.md

@@ -0,0 +1,42 @@
+# 安装文档变更
+
+## 触发条件
+
+- 修改根目录 `INSTALL.md` 的安装、鉴权或验证流程
+- 修改发布包 Node.js 要求、全局 flag 或安装文档引用的命令
+- 同步或发布 `https://bailian.aliyun.com/cli/install.md`
+
+## 必查清单
+
+### A. CLI 契约
+
+- [ ] `INSTALL.md` 中的 `bl` 命令路径存在于 `packages/cli/src/commands.ts`
+- [ ] 示例 flag 属于 `GLOBAL_FLAGS`、命令鉴权域 flag 或命令自身 `flags`
+- [ ] Node.js 用户安装要求与 `packages/cli/package.json` 的 `engines.node` 一致，不使用根 `package.json` 的开发环境要求
+- [ ] 鉴权流程与 `packages/commands/src/commands/auth/` 的实际校验、保存和 Profile 激活行为一致
+
+### B. 静态副本
+
+- [ ] 将 `INSTALL.md` 同步到 `bailian-cli-static-resources/public/install.txt`
+- [ ] 使用 `cmp -s` 确认两份文档逐字节一致
+- [ ] 静态资源仓库单独创建分支、提交和发布，不把跨仓库改动遗漏在 CLI PR 之外
+
+### C. 线上验证
+
+- [ ] 发布后读取 `https://bailian.aliyun.com/cli/install.md`，确认内容来自最新静态副本
+- [ ] 带随机 query 参数复查，区分 CDN 缓存与源站未更新
+- [ ] 验证线上文档中的安装命令、Node.js 要求和配置验证段落，不只检查页面可访问
+
+## 完成后自查
+
+```sh
+pnpm -F bailian-cli test -- tests/install-doc.test.ts
+cmp -s INSTALL.md ../bailian-cli-static-resources/public/install.txt
+curl -L -s "https://bailian.aliyun.com/cli/install.md?verify=$(date +%s)"
+```
+
+## 常见漏点
+
+- `--non-interactive` 已从 CLI 移除，但旧安装文档和静态副本仍把它当作全局 flag
+- 根 `package.json` 是开发工具链 Node.js 要求；用户安装要求以 `packages/cli/package.json` 为准
+- 静态仓库文件名是 `public/install.txt`，线上稳定地址是 `/cli/install.md`；只更新其中一侧不会自动证明发布成功

docs/agents/lint-toolchain.md

@@ -12,9 +12,9 @@
 
 ### A. 版本一致性
 
-- [ ] `package.json` 的 `engines.node` 与 README 的 Node.js 徽章一致
+- [ ] 发布包（`cli` 等）的 `engines.node` 与 README 的 Node.js 徽章一致；根/e2e 开发要求（`>=22.12`）与 CONTRIBUTING 一致
 - [ ] `pnpm-lock.yaml` 同步生成(运行 `pnpm install`)
-- [ ] 三处 `tsconfig.json`(根 + cli + core)的 target / module 设置一致
+- [ ] 各源码包 `tsconfig.json`(根 + core + runtime + commands + cli + kscli)的 target / module 设置一致
 
 ### B. lint / format 规则改动
 
@@ -26,13 +26,15 @@
 
 ### C. 构建配置
 
-- [ ] `packages/cli/vite.config.ts` 和 `packages/core/vite.config.ts` 的 entry / external / dts 设置
-- [ ] cli 的 bundle 必须把 `bailian-cli-core` 当 **external**(不内联),确认 `dist/bailian.mjs` 第一行有 `from "bailian-cli-core"`
-- [ ] cli 的 bundle 第一行必须有 `#!/usr/bin/env node` shebang(`tools/release.mjs check` 会断言)
+- [ ] `packages/*/vite.config.ts` 的 entry / dts / exports 设置符合包类型:
+  - library 包(core/runtime/commands):本地 `exports` 默认指向 `src/index.ts`;`publishConfig.exports` 覆盖发布入口为 `dist/index.mjs`;dts 产物正常生成
+  - binary 包(cli/kscli):entry 指向 `src/main.ts`,有 shebang,`exports: true`
+- [ ] cli / kscli 的 bundle 必须把 workspace 包(`bailian-cli-core` / `bailian-cli-runtime` / `bailian-cli-commands`)当 **external**(不内联),确认 dist 中仍是 package import
+- [ ] cli / kscli 的 binary bundle 第一行必须有 `#!/usr/bin/env node` shebang
 
 ### D. 依赖升级
 
-- [ ] 检查 `bailian-cli-core` 在 cli 的 `dependencies` 里仍是 `"workspace:*"`(不要变成实际版本号 — `tools/release.mjs` 会拦)
+- [ ] 检查 workspace 内部依赖在 `dependencies` 里仍是 `"workspace:*"`(不要手改成实际版本号;发布时由 pack/publish 流程解析)
 - [ ] 升级后跑 `vp check && vp test`
 - [ ] 升级 `@types/node` 时注意 Node API 变化(如 fs.existsSync 行为)
 
@@ -40,11 +42,11 @@
 
 - [ ] `.vite-hooks/pre-commit` 改动后,`pnpm install` 重新软链(走 `prepare: vp config`)
 - [ ] 增加 hook 时,确认在干净 clone 后能自动激活
-- [ ] pre-commit 会跑 `pnpm run sync:skill-assets`(先 build core,再 `generate:reference` + `sync:skill-version`)并 `git add` skill 资产,最后 `vp staged`
+- [ ] pre-commit 会跑 `pnpm run sync:skill-assets`(`generate:reference` 含格式化 + `sync:skill-version`,直接读源码、无需先 build)并 `git add` skill 资产,最后 `vp staged`
 
 ### F. CI / 发版工具
 
-- [ ] `tools/release.mjs` 中如有版本/规则相关的硬编码,同步更新
+- [ ] `tools/release/` 中如有版本/规则相关的硬编码,同步更新
 - [ ] 比如 `secretPatterns` 添加新的敏感值识别
 
 ## 完成后自查
@@ -54,13 +56,13 @@
 pnpm install --frozen-lockfile
 vp check
 vp test
-node tools/release.mjs check
+node tools/release/check.mjs
 ```
 
 ## 常见漏点
 
 - ✗ 升级 Node engines 但忘了 README 徽章
 - ✗ 改 lint 规则后没全仓 `--fix`,新人 PR 报红一片
-- ✗ 改 cli 的 vite config 把 core 不小心打成 inline,bundle 体积暴涨
+- ✗ 改 cli/kscli 的 vite config 把 core/runtime/commands 不小心打成 inline,bundle 体积暴涨
 - ✗ Oxlint 配置改了但 IDE 缓存还是旧的(IDE 可能要重启 ts server)
 - ✗ 升级依赖一并升 lockfile,改动量大但没拆 commit

docs/agents/maintaining-agent-docs.md

@@ -109,7 +109,7 @@
 ### Do
 
 - 写清晰的 **must / must-not / 必查**,不写"建议"性语气
-- 用 file path + 具体 action 的句式(`packages/cli/src/commands/catalog.ts:增加 import 与 commands 条目`)
+- 用 file path + 具体 action 的句式(`packages/cli/src/commands.ts:增加产品命令 map 条目`)
 - 在每份场景末尾留**常见漏点**段,持续累积真实经验
 - 在跨场景的不变量上互相引用,不复制
 

docs/agents/model-add-remove.md

@@ -12,12 +12,13 @@
 
 ### A. 命令实现
 
-- [ ] `packages/cli/src/commands/<group>/<action>.ts`:
+- [ ] `packages/commands/src/commands/<group>/<action>.ts`:
   - `--model` flag 的 description 里"default:"反映新默认值
-  - 命令内部 `const model = (flags.model as string) || "<default>"` 的 fallback 字符串
+  - 命令内部 `const model = flags.model || settings.defaultXxxModel || "<default>"` 的 fallback 字符串
   - 如果命令维护一个 supported-models 列表(如 `speech/synthesize.ts:MODEL_VOICES`),增删条目
   - 如果不同模型有不同 endpoint / 请求体形状,确保 `if (model.startsWith("xxx"))` 分支覆盖
 - [ ] 模型如有特殊 endpoint,看 `packages/core/src/client/endpoints.ts`
+- [ ] 如果新增的是某产品入口专属能力,确认 `packages/cli/src/commands.ts` 或其它入口 map 是否需要暴露/隐藏
 
 ### B. 类型层
 
@@ -41,9 +42,9 @@
 
 ```sh
 # 默认模型走通
-node packages/cli/src/main.ts <command> --message "test"
+pnpm -F bailian-cli exec tsx src/main.ts <command> --message "test"
 # 显式指定新模型
-node packages/cli/src/main.ts <command> --model <new-model> --message "test"
+pnpm -F bailian-cli exec tsx src/main.ts <command> --model <new-model> --message "test"
 ```
 
 ## 常见漏点

docs/agents/publish.md

@@ -20,37 +20,40 @@
 
 ### channel 发布
 
-1. 在 GitHub 触发 Publish workflow，mode 选 `channel`，channel 填 dist-tag 名（如 `mcp`）
-2. CI 自动：生成 `0.0.0-beta-<sha7>-<date>` 版本号 → 自检 → 构建 → 发布到指定 dist-tag
+1. 在 GitHub 触发 Publish workflow，package 选 `bailian-cli` 或 `knowledge-studio-cli`，mode 选 `channel`，channel 填 dist-tag 名（如 `mcp`）
+2. CI 自动：生成 `0.0.0-beta-<sha7>-<date>` 版本号 → 临时 bump 对应包集合 → 自检 → 构建 → 发布到指定 dist-tag
 3. 对应脚本：`tools/release/publish-channel.mjs`
 
 ### stable 发布
 
-1. 确保 `packages/cli/package.json` 和 `packages/core/package.json` 已升到目标版本且一致
-2. 在 GitHub 触发 Publish workflow，mode 选 `stable`
+1. 确保当前 release tooling 覆盖的包(`tools/release/lib/packages.mjs`)已升到目标版本且一致;当前基础集合为 `packages/core` / `packages/runtime` / `packages/commands` / `packages/cli`，`knowledge-studio-cli` 发布会额外包含 `packages/kscli`
+2. 在 GitHub 触发 Publish workflow，package 选目标包集合，mode 选 `stable`
 3. 需要 production environment 审批人批准
-4. CI 自动：自检 → 构建 → 发布到 latest → 打 git tag
-5. 对应脚本：`tools/release/publish-stable.mjs`
+4. CI 自动：自检 → 构建 → 检查 npm 已发布版本 → 发布到 latest → 打 git tag
+5. 如果所选发布集合的当前版本已全部存在于 npm，stable 发布会失败并提示先升级版本号；如果只有部分包已发布，CI 会继续补发缺失包
+6. 对应脚本：`tools/release/publish-stable.mjs`
 
 ## 自检（`tools/release/check.mjs`）
 
 两种模式都会先跑 `check.mjs`，覆盖以下检查：
 
-| 检查项                           | 说明                                      |
-| -------------------------------- | ----------------------------------------- |
-| `pnpm install --frozen-lockfile` | lockfile 一致性                           |
-| README 同步                      | `packages/cli/README.md` 与根 README 一致 |
-| 版本号一致                       | cli 与 core 的 version 字段相同           |
-| `workspace:*` 替换               | cli 对 core 的依赖解析为真实版本号        |
-| 构建 core + cli                  | `pnpm build`                              |
-| pnpm pack                        | 打 tarball                                |
-| publint                          | 包元数据校验                              |
-| gitleaks                         | 敏感信息扫描                              |
+| 检查项                           | 说明                                                                                             |
+| -------------------------------- | ------------------------------------------------------------------------------------------------ |
+| `pnpm install --frozen-lockfile` | lockfile 一致性                                                                                  |
+| README 同步                      | `packages/cli/README.md` 与根 README 一致                                                        |
+| 版本号一致                       | `tools/release/lib/packages.mjs` 中待发布包集合 version 相同                                     |
+| `workspace:*` 替换               | 发布包间 workspace 依赖解析为真实版本号                                                          |
+| 构建                             | 基础发布构建 core/runtime/commands 依赖和 cli;`--knowledge` 额外构建 `knowledge-studio-cli`      |
+| 生成资产                         | 重建 `skills/bailian-cli/reference/`;非 channel 模式还同步 `skills/bailian-cli/SKILL.md` version |
+| pnpm pack                        | 打 tarball                                                                                       |
+| publint                          | 包元数据校验                                                                                     |
+| gitleaks                         | 敏感信息扫描                                                                                     |
 
 本地可以 dry-run 验证：
 
 ```sh
 node tools/release/publish-channel.mjs --channel test --dry-run
+node tools/release/publish-channel.mjs --channel test --knowledge --dry-run
 ```
 
 ## CI 基础设施
@@ -58,13 +61,15 @@ node tools/release/publish-channel.mjs --channel test --dry-run
 - **认证**：npm OIDC Trusted Publishing（无 token），需要 `id-token: write` 权限
 - **Node 版本**：24（npm 11.5+ 才支持 OIDC token 交换）
 - **Actions 版本**：checkout/setup-node/pnpm-action 均为 v6（Node 24 兼容）
-- **npm 配置**：两个包的 Trusted Publisher 都指向 `modelstudioai/cli` 的 `publish.yml`，environment 留空
+- **npm 配置**：当前 release tooling 发布的包(`bailian-cli-core` / `bailian-cli-runtime` / `bailian-cli-commands` / `bailian-cli` / `knowledge-studio-cli`)的 Trusted Publisher 指向 `modelstudioai/cli` 的 `publish.yml`;新增发布包时同步 npm Trusted Publisher
 
 ## `check.mjs` 不覆盖的（手动确认）
 
 ### 版本号目标（仅 stable）
 
-- [ ] `packages/cli/package.json` 和 `packages/core/package.json` 已升到目标版本
+- [ ] `tools/release/lib/packages.mjs` 覆盖的目标包集合已升到目标版本且一致
+- [ ] 源码包 `packages/core/package.json`、`packages/runtime/package.json`、`packages/commands/package.json`、`packages/cli/package.json`、`packages/kscli/package.json` 是否需要同步升版已人工确认;当前仓库通常保持五包版本一致
+- [ ] `tools/release/lib/packages.mjs` 的 `PACKAGES` 覆盖基础发布包;`KSCLI_PACKAGE` / `ALL_PACKAGES` 覆盖 `knowledge-studio-cli` 发布路径;如果新增发布包,同步 `publish-stable.mjs` / `publish-channel.mjs` 的 bump、publish、idempotency 逻辑和 `.github/workflows/publish.yml` 的 package 选项
 - [ ] pre-release 格式正确（`1.0.0-beta.0` / `1.0.0-rc.1`，**不要直接用 `1.0.0` 当 beta**）
 
 ### CHANGELOG（仅 stable）
@@ -78,21 +83,25 @@ node tools/release/publish-channel.mjs --channel test --dry-run
 - [ ] `README.md` / `README.zh.md` 的 Quick Start 命令仍能跑通
 - [ ] README 的 Node.js 徽章版本与 `cli/package.json.engines.node` 一致
 - [ ] README 宣传的 bin 名称在 `cli/package.json.bin` 都真的注册
-- [ ] `LICENSE` 文件存在（根 + cli + core 各一份）
+- [ ] `packages/kscli/README.md` / `README.zh.md` 与 `knowledge-studio-cli` 的 bin、控制台 URL、认证方式一致
+- [ ] `LICENSE` 文件存在（根 + 当前实际发布包;新增发布包时补该包 LICENSE）
 
 ## 完成后
 
-- [ ] 验证 npm 上能装：`npm view bailian-cli@<tag> version`
-- [ ] 试装一次：`npm i -g bailian-cli@<tag> && bl --version`
+- [ ] 验证 npm 上能装：`npm view bailian-cli@<tag> version`;如发布 `knowledge-studio-cli`，同时 `npm view knowledge-studio-cli@<tag> version`
+- [ ] 试装一次：`npm i -g bailian-cli@<tag> && bl --version`;如发布 `knowledge-studio-cli`，同时 `npm i -g knowledge-studio-cli@<tag> && kscli --version`
 
 ## 常见漏点（基于历史踩坑）
 
-| 漏点                                                     | 后果                                               |
-| -------------------------------------------------------- | -------------------------------------------------- |
-| cli 升版号但 core 没升                                   | check.mjs 会拦下                                   |
-| 发版漏更 CHANGELOG，或分类写成规范外的 `优化`/`Improved` | 用户看不到本次变更，分类与历史不一致               |
-| `1.0.0` 当 beta 直接发                                   | 占了 `latest` tag，所有用户被强升，撤回成本极高    |
-| README 写的 bin 名实际 `package.json.bin` 没注册         | 用户复制命令报 `command not found`                 |
-| Node 徽章 `>=18`、engines `>=22.12` 不一致               | 用户在 Node 18 上 `npm i` 被 engine 警告或直接失败 |
-| npm Trusted Publisher 的 workflow filename 改了没同步    | OIDC 匹配不上，publish 报 404                      |
-| CI 用 Node 22（npm 10）跑 publish                        | npm 10 不支持 OIDC token 交换，publish 报 404      |
+| 漏点                                                                | 后果                                                                               |
+| ------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
+| 只升部分包,漏升 runtime/commands/kscli                              | 当前 check.mjs 按所选发布集合校验,但未选择 `knowledge-studio-cli` 时不会覆盖 kscli |
+| 新增发布包但没加 `tools/release/lib/packages.mjs`                   | CI 不会 bump/publish/校验该包                                                      |
+| cli 升版号但 core 没升                                              | check.mjs 会拦下                                                                   |
+| 发版漏更 CHANGELOG，或分类写成规范外的 `优化`/`Improved`            | 用户看不到本次变更，分类与历史不一致                                               |
+| `1.0.0` 当 beta 直接发                                              | 占了 `latest` tag，所有用户被强升，撤回成本极高                                    |
+| README 写的 bin 名实际 `package.json.bin` 没注册                    | 用户复制命令报 `command not found`                                                 |
+| Node 徽章与 `cli/package.json.engines` 不一致（当前应为 `>=18.17`） | 用户在声明外的 Node 上 `npm i` 被 engine 警告或直接失败                            |
+| npm Trusted Publisher 的 workflow filename 改了没同步               | OIDC 匹配不上，publish 报 404                                                      |
+| CI 用 Node 22（npm 10）跑 publish                                   | npm 10 不支持 OIDC token 交换，publish 报 404                                      |
+| stable 发布前没有升级版本号                                         | 所选发布集合的版本已全部存在于 npm，CI 明确报错并要求先升级版本号                  |

docs/agents/stress-batch-tests.md

@@ -115,19 +115,18 @@ pnpm run test:stress -- video-edit --reuse-fixtures -- --count 3
 
 ### 子进程调用方式
 
-- **实际执行**：`node packages/cli/src/main.ts <args>`，`cwd` 为 `packages/cli`
+- **实际执行**：仓库本地 `tsx src/main.ts <args>`，`cwd` 为 `packages/cli`
 - **禁止**用 `pnpm run dev` 跑子任务：`pnpm` 会向 stdout 打生命周期日志，污染 JSON 解析
 - **报告中的「完整命令」**：用 `pnpm run dev ...` 展示（`buildDisplayCommand`）
 
 ### 必须带的 CLI 参数（通用）
 
-- `--non-interactive`
 - 除 `speech recognize` 外，压测子进程宜带 `--output json`（语音识别以 `--out` 文件为准 stdout 可能为纯文本）
 - 异步类命令带 `--timeout`、对应 `--poll-interval`
 
 **禁止**对子进程加 `--quiet`（与 `--output json` 并存时可能丢 `urls` / `video_url`）。
 
-**禁止**对视频相关子进程加 `--no-wait`；须阻塞到任务完成（及下载路径正确时落盘）。
+**禁止**对视频相关子进程加 `--async`；须阻塞到任务完成（及下载路径正确时落盘）。
 
 ### 成功 / 失败判定（概要）
 
@@ -192,8 +191,8 @@ pnpm run test:stress -- video-edit --reuse-fixtures -- --count 3
 ### 只改压测脚本时
 
 - [ ] `lib/paths.mjs` 解析的 `CLI_PACKAGE` / `MONOREPO_ROOT` 仍正确
-- [ ] 子进程仍为 `node` + `src/main.ts`，未改回裸 `pnpm run dev` 执行任务
-- [ ] 未对子进程加 `--quiet`，视频未加 `--no-wait`
+- [ ] 子进程仍为仓库本地 `tsx` + `src/main.ts`，未改回裸 `pnpm run dev` 执行任务
+- [ ] 未对子进程加 `--quiet`，视频未加 `--async`
 - [ ] `parsers.mjs` 与文档中的成功判定一致
 - [ ] 根 `package.json` 仅保留 `test:stress` 入口指向 `run.mjs`
 - [ ] `node --check` 对相关 `.mjs` 通过，`pnpm run test:stress -- list` 可运行

docs/agents/url-change.md

@@ -13,12 +13,15 @@
 core/config/schema.ts                   ← API endpoint / 文档站(region-aware)
   REGIONS{cn, us, intl}     dashscope.aliyuncs.com 等
   DOCS_HOSTS{cn, us, intl}  help.aliyun.com/zh/model-studio
-  BAILIAN_HOST              bailian.cn-beijing.aliyuncs.com (POP API)
+  BAILIAN_HOST              bailian.cn-beijing.aliyuncs.com (OpenAPI)
 
-cli/src/urls.ts                          ← 用户面控制台 URL(cn-only)
+runtime/src/urls.ts                      ← 用户面控制台 URL(cn-only)
   BAILIAN_CONSOLE_ROOT      bailian.console.aliyun.com
   BAILIAN_CONSOLE           BAILIAN_CONSOLE_ROOT/cn-beijing
   API_KEY_PAGE              BAILIAN_CONSOLE/?tab=app#/api-key
+  TOKEN_PLAN_PAGE           BAILIAN_CONSOLE_ROOT/cn-beijing?tab=plan#/efm/subscription/overview
+  MCP_WEBSEARCH_PAGE        mcpMarketplaceDetailPage("WebSearch")
+  mcpMarketplaceDetailPage    BAILIAN_CONSOLE?tab=mcp#/mcp-market/detail/<serverCode>
 
 core/files/upload.ts                     ← 文件上传 endpoint(cn-pinned)
   UPLOAD_API                ${REGIONS.cn}/api/v1/uploads
@@ -29,14 +32,16 @@ core/files/upload.ts                     ← 文件上传 endpoint(cn-pinned)
 ### A. TS 源码(必须 import,不准硬编码)
 
 - [ ] `packages/core/src/config/schema.ts` 是所有 API/docs 基址的源头
-- [ ] `packages/cli/src/urls.ts` 是所有用户面控制台 URL 的源头
+- [ ] `packages/runtime/src/urls.ts` 是所有用户面控制台 URL 的源头
 - [ ] 改完后 grep 验证:
 
 ```sh
 # 控制台 URL — 应只在 urls.ts 出现
 grep -rnE "https://bailian\.console\.aliyun\.com" packages/ --include="*.ts" \
   | grep -v "node_modules" | grep -v "/dist/"
-# 期望:只匹配 packages/cli/src/urls.ts
+# 期望:匹配 packages/runtime/src/urls.ts;
+# 当前遗留例外:packages/commands/src/commands/auth/login-console.ts(登录站点映射)、
+# packages/core/src/advisor/recommend.ts(模型文档 deep link)。触碰时优先收敛到统一 URL 模块。
 
 # API endpoint — 应只在 schema.ts 和 upload.ts 出现
 grep -rnE "https://dashscope[a-z-]*\.aliyuncs\.com" packages/ --include="*.ts" \
@@ -51,24 +56,24 @@ grep -rnE "https://dashscope[a-z-]*\.aliyuncs\.com" packages/ --include="*.ts" \
 
 ### C. 渠道追踪参数
 
-- [ ] **当前现状**:全仓不带 `source_channel=aliway` 等追踪参数
-- [ ] 如未来要恢复以收集分析数据,**统一评估再加回**(不要单点恢复造成不一致)
-- [ ] 全仓 grep `source_channel=`,确认无残留
+- [ ] **当前现状**:TS 源码不带 `source_channel=...`;README / package README 中保留 `cli_github` / `key_github` 等用户入口追踪参数
+- [ ] 如未来调整追踪参数,统一评估 README、`packages/cli/README*`、`packages/core/README*` 与 package homepage,不要单点改造成不一致
+- [ ] grep `source_channel=`,确认每个残留都属于预期用户面文档或已批准的追踪入口
 
 ## 完成后自查
 
 ```sh
 # 验证错误 hint 不再泄漏旧 URL
-HOME=/tmp/empty node packages/cli/src/main.ts text chat --message x --non-interactive
+HOME=/tmp/empty pnpm -F bailian-cli exec tsx src/main.ts text chat --message x
 # 看输出的 Get API Key URL 是否走新值
 
 # 验证 banner / help
-node packages/cli/src/main.ts                     # banner
-node packages/cli/src/main.ts help                # help 命令
+pnpm -F bailian-cli exec tsx src/main.ts                     # banner
+pnpm -F bailian-cli exec tsx src/main.ts help                # help 命令
 ```
 
 ## 常见漏点
 
-- ✗ 改了 `urls.ts` 但忘记同步 README(用户最先看到)
-- ✗ 在 cli 命令文件里 inline `https://bailian.console.aliyun.com/...` 而不是 `${API_KEY_PAGE}`
+- ✗ 改了 `urls.ts` / 登录站点 / 文档 deep link 但忘记同步 README(用户最先看到)
+- ✗ 在 runtime / command 文件里 inline `https://bailian.console.aliyun.com/...` 而不是从 `urls.ts` import
 - ✗ 在 core 的 hint 里写 URL(违反 [error-hint-change.md](error-hint-change.md) 不变量 1)

docs/plans/finetune-deploy-mvp.md

@@ -1,438 +0,0 @@
-# 模型训练 + 数据集 + 部署：最小闭环 CLI 设计
-
-> 目标：一个 Qwen 文本模型 SFT 训练、数据集上传、模型部署的端到端最小链路。
-
----
-
-## 一、命令概览
-
-| 优先级 | 命令                                | 映射 API                                      | 用途                            |
-| ------ | ----------------------------------- | --------------------------------------------- | ------------------------------- |
-| P0     | `bl dataset upload <path>`          | `POST /api/v1/files`                          | 上传训练数据(含本地格式校验)    |
-| P0     | `bl finetune create`                | `POST /api/v1/fine-tunes`                     | 创建 SFT 训练任务(预填默认超参) |
-| P0     | `bl finetune status <job_id>`       | `GET /api/v1/fine-tunes/{job_id}`             | 查询训练状态                    |
-| P0     | `bl deploy create`                  | `POST /api/v1/deployments`                    | 部署训练好的模型                |
-| P1     | `bl finetune logs <job_id>`         | `GET /api/v1/fine-tunes/{job_id}/logs`        | 拉取训练日志                    |
-| P1     | `bl finetune checkpoints <job_id>`  | `GET /api/v1/fine-tunes/{job_id}/checkpoints` | 查看/挑选 Checkpoint            |
-| P1     | `bl deploy status <deployed_model>` | `GET /api/v1/deployments/{deployed_model}`    | 查询部署状态                    |
-| P1     | `bl deploy delete <deployed_model>` | `DELETE /api/v1/deployments/{deployed_model}` | 下线部署                        |
-| P1     | `bl infer --model <deployed_model>` | 复用 `text chat` 通路                         | 调用已部署模型                  |
-
----
-
-## 二、P0 命令详细设计
-
-### 2.1 `bl dataset upload`
-
-**定位：** 上传训练数据文件到百炼平台，获取 `file_id` 供训练任务引用。
-
-#### CLI 签名
-
-```
-bl dataset upload <path> [--purpose fine-tune] [--validate] [--no-validate]
-```
-
-| Flag            | 必填 | 默认值      | 说明                           |
-| --------------- | ---- | ----------- | ------------------------------ |
-| `<path>`        | 是   | —           | 本地文件路径（.jsonl 或 .zip） |
-| `--purpose`     | 否   | `fine-tune` | 文件用途标签                   |
-| `--validate`    | 否   | `true`      | 上传前执行本地格式校验         |
-| `--no-validate` | 否   | —           | 跳过本地校验                   |
-
-#### 本地格式校验规则（提交前拦截）
-
-校验逻辑在 `packages/core` 实现（纯函数），CLI 调用后展示错误：
-
-1. **文件格式检查**：仅允许 `.jsonl` 和 `.zip`（zip 内根目录必须有 `data.jsonl`）
-2. **JSONL 逐行校验**：
-   - 每行可被 `JSON.parse`
-   - 顶层必须包含 `messages` 数组
-   - `messages` 中每项必须包含 `role`（枚举：`system` | `user` | `assistant`）和 `content`（非空字符串）
-   - 至少包含一条 `user` + 一条 `assistant` 消息
-3. **数量校验**：SFT 训练至少需要上千条数据（给出 warning 而非 hard fail，阈值建议 ≥ 10 条 hard fail）
-4. **文件体积**：≤ 300MB
-
-#### 校验失败输出示例
-
-```
-✗ Validation failed:
-
-  Line 3: missing "messages" field
-  Line 7: role "bot" is not valid (expected: system | user | assistant)
-  Line 12: "content" is empty string
-
-Fix 3 errors above and retry.
-```
-
-#### API 调用
-
-```
-POST https://dashscope.aliyuncs.com/api/v1/files
-Content-Type: multipart/form-data
-Authorization: Bearer <api-key>
-
-Body:
-  files: <binary>
-  purpose: "fine-tune"
-
-Response 200:
-{
-  "id": "file-xxxx",
-  "bytes": 12345,
-  "filename": "train.jsonl",
-  "purpose": "fine-tune",
-  "created_at": 1700000000
-}
-```
-
-#### 输出
-
-- 默认 text：`✓ Uploaded file-xxxx (12.3 KB) — use this ID in bl finetune create`
-- `--output json`：完整 response body
-- `--quiet`：仅输出 `file-xxxx`
-
----
-
-### 2.2 `bl finetune create`
-
-**定位：** 创建一个 SFT 训练任务。核心设计原则——**预填合理默认超参 + 提交前二次确认**，降低 OOM/超参不合理导致的训练失败率。
-
-#### CLI 签名
-
-```
-bl finetune create --model <model> --data <file_id> [hyperparams...]
-```
-
-| Flag                | 必填 | 默认值       | 说明                                         |
-| ------------------- | ---- | ------------ | -------------------------------------------- |
-| `--model`           | 是   | —            | 基座模型（如 `qwen3-8b`, `qwen3-14b`）       |
-| `--data`            | 是   | —            | 训练数据 file_id（bl dataset upload 返回值） |
-| `--validation-data` | 否   | —            | 验证数据 file_id                             |
-| `--epochs`          | 否   | 3            | 训练轮次 (n_epochs)                          |
-| `--batch-size`      | 否   | 按模型自动选 | 批大小                                       |
-| `--lr`              | 否   | 按模型自动选 | 学习率 (learning_rate_multiplier)            |
-| `--warmup-ratio`    | 否   | 0.1          | warmup 比例                                  |
-| `--suffix`          | 否   | —            | 输出模型后缀名                               |
-| `--yes` / `-y`      | 否   | —            | 跳过确认直接提交                             |
-
-#### 预填默认超参策略
-
-| 基座模型   | batch_size | lr_multiplier | n_epochs | 备注             |
-| ---------- | ---------- | ------------- | -------- | ---------------- |
-| qwen3-8b   | 4          | 1e-5          | 3        | 小模型可大 batch |
-| qwen3-14b  | 2          | 5e-6          | 3        | 中模型防 OOM     |
-| qwen3-32b+ | 1          | 2e-6          | 2        | 大模型保守设置   |
-
-> 以上为建议默认值，用户显式传参时覆盖。具体映射表在 `packages/core/src/finetune/defaults.ts` 维护。
-
-#### 提交前交互确认
-
-非 `--yes` 模式下，显示任务摘要等待确认：
-
-```
-┌─ Fine-tune Job Summary ──────────────────────┐
-│ Model:        qwen3-8b                        │
-│ Training:     file-abc123 (2,048 samples)     │
-│ Validation:   (none)                          │
-│ Epochs:       3                               │
-│ Batch size:   4                               │
-│ LR:           1e-5                            │
-│ Warmup:       0.1                             │
-│ Suffix:       my-assistant                    │
-│                                               │
-│ Estimated cost: ~¥XX (based on token count)   │
-└───────────────────────────────────────────────┘
-Proceed? [Y/n]
-```
-
-#### API 调用
-
-```
-POST https://dashscope.aliyuncs.com/api/v1/fine-tunes
-Authorization: Bearer <api-key>
-Content-Type: application/json
-
-{
-  "model": "qwen3-8b",
-  "training_file_ids": ["file-abc123"],
-  "validation_file_ids": [],
-  "hyper_parameters": {
-    "n_epochs": 3,
-    "batch_size": 4,
-    "learning_rate": "1e-5",
-    "warmup_ratio": 0.1
-  },
-  "suffix": "my-assistant"
-}
-
-Response 200:
-{
-  "job_id": "ft-xxxx",
-  "status": "PENDING",
-  "model": "qwen3-8b",
-  "created_at": "2025-01-01T00:00:00Z",
-  "training_file_ids": ["file-abc123"],
-  "hyper_parameters": {...},
-  "trained_model": null
-}
-```
-
-#### 输出
-
-- text：`✓ Fine-tune job ft-xxxx created (PENDING). Track with: bl finetune status ft-xxxx`
-- json：完整 response body
-- quiet：`ft-xxxx`
-
----
-
-### 2.3 `bl finetune status`
-
-**定位：** 查询训练任务状态，支持 `--wait` 轮询模式。
-
-#### CLI 签名
-
-```
-bl finetune status <job_id> [--wait] [--interval <seconds>]
-```
-
-| Flag         | 必填 | 默认值 | 说明             |
-| ------------ | ---- | ------ | ---------------- |
-| `<job_id>`   | 是   | —      | 任务 ID          |
-| `--wait`     | 否   | —      | 持续轮询直到终态 |
-| `--interval` | 否   | 30     | 轮询间隔(秒)     |
-
-#### 状态机
-
-```
-PENDING → RUNNING → SUCCEEDED
-                  ↘ FAILED
-```
-
-#### 输出（text 模式）
-
-单次查询：
-
-```
-Job:     ft-xxxx
-Status:  RUNNING (elapsed 12m)
-Model:   qwen3-8b
-Output:  (pending)
-```
-
-`--wait` 模式（spinner + 实时刷新）：
-
-```
-⠋ ft-xxxx RUNNING [14:32 elapsed]
-✓ ft-xxxx SUCCEEDED — trained model: qwen3-8b:ft-xxxx-20250101
-  Deploy with: bl deploy create --model qwen3-8b:ft-xxxx-20250101
-```
-
-失败时：
-
-```
-✗ ft-xxxx FAILED
-  Error: OutOfMemory — try reducing --batch-size or using a smaller model
-```
-
----
-
-### 2.4 `bl deploy create`
-
-**定位：** 将训练好的模型（或 checkpoint）部署为可调用的推理服务。
-
-#### CLI 签名
-
-```
-bl deploy create --model <model_name> [--plan <plan>] [--capacity <n>]
-```
-
-| Flag         | 必填 | 默认值     | 说明                                            |
-| ------------ | ---- | ---------- | ----------------------------------------------- |
-| `--model`    | 是   | —          | 待部署模型名称（finetune 产出的 trained_model） |
-| `--plan`     | 否   | `standard` | 部署方案                                        |
-| `--capacity` | 否   | 依 plan    | 并发容量                                        |
-| `--wait`     | 否   | —          | 等待部署就绪                                    |
-
-#### API 调用
-
-```
-POST https://dashscope.aliyuncs.com/api/v1/deployments
-Authorization: Bearer <api-key>
-Content-Type: application/json
-
-{
-  "model_name": "qwen3-8b:ft-xxxx-20250101",
-  "plan": "standard",
-  "capacity": 2
-}
-
-Response 200:
-{
-  "deployed_model": "qwen3-8b-ft-xxxx",
-  "model_name": "qwen3-8b:ft-xxxx-20250101",
-  "status": "PENDING",
-  "created_at": "..."
-}
-```
-
-#### 输出
-
-```
-✓ Deployment created: qwen3-8b-ft-xxxx (PENDING)
-  Once RUNNING, call with: bl text chat --model qwen3-8b-ft-xxxx
-  Check status: bl deploy status qwen3-8b-ft-xxxx
-```
-
----
-
-## 三、P1 命令简要设计
-
-### 3.1 `bl finetune logs <job_id>`
-
-流式输出训练日志，支持 `--follow`（类似 `tail -f`）。输出 loss/step/epoch 信息。
-
-### 3.2 `bl finetune checkpoints <job_id>`
-
-列出可选 checkpoint（step, loss, eval metrics），支持 `--output json` 供脚本使用。可配合 `bl deploy create --model <checkpoint_model>` 部署指定 checkpoint。
-
-### 3.3 `bl deploy status <deployed_model>`
-
-查询部署状态及资源信息（PENDING → RUNNING → STOPPED/FAILED）。
-
-### 3.4 `bl deploy delete <deployed_model>`
-
-下线部署。需部署处于 RUNNING/STOPPED/FAILED 状态。交互确认或 `--yes` 跳过。
-
-### 3.5 `bl infer --model <deployed_model>`
-
-实际可复用已有 `bl text chat --model <deployed_model>` 通路，作为别名/快捷方式。P1 考虑是否有独立存在必要。
-
----
-
-## 四、代码架构方案
-
-按照 monorepo 分层约定（core 纯逻辑 / cli 是 UI）：
-
-### packages/core 新增模块
-
-```
-packages/core/src/
-├── finetune/
-│   ├── index.ts          # re-export
-│   ├── api.ts            # createFineTune, getFineTune, getFineTuneLogs, getCheckpoints
-│   ├── defaults.ts       # 模型 → 默认超参映射表
-│   └── types.ts          # FineTuneJob, HyperParameters, CheckpointInfo 类型
-├── dataset/
-│   ├── index.ts
-│   ├── upload.ts         # uploadDataset (multipart)
-│   ├── validate.ts       # validateJsonl (纯函数,逐行校验)
-│   └── types.ts          # DatasetFile, ValidationError 类型
-└── deploy/
-    ├── index.ts
-    ├── api.ts            # createDeployment, getDeployment, deleteDeployment
-    └── types.ts          # Deployment, DeploymentStatus 类型
-```
-
-### packages/cli 新增命令
-
-```
-packages/cli/src/commands/
-├── dataset/
-│   └── upload.ts         # bl dataset upload
-├── finetune/
-│   ├── create.ts         # bl finetune create
-│   ├── status.ts         # bl finetune status
-│   ├── logs.ts           # bl finetune logs
-│   └── checkpoints.ts    # bl finetune checkpoints
-└── deploy/
-    ├── create.ts         # bl deploy create
-    ├── status.ts         # bl deploy status
-    └── delete.ts         # bl deploy delete
-```
-
----
-
-## 五、关键设计决策
-
-### 5.1 数据格式校验放在 CLI 侧（提交前拦截）
-
-训练失败 TOP 原因中"数据格式错误"占比高。与其等服务端 10 分钟后返回 FAILED，不如 CLI 本地秒级校验：
-
-- **validate.ts** 是纯函数，接收 ReadableStream/Buffer，返回 `ValidationError[]`
-- CLI 在 `dataset upload` 默认执行校验，`--no-validate` 允许跳过
-- 未来可扩展为独立命令 `bl dataset validate <path>`
-
-### 5.2 超参预填 + 确认而非强制
-
-- core 维护 `defaults.ts` 映射：`model → { batch_size, lr, epochs }`
-- CLI `finetune create` 未指定超参时自动填入
-- 提交前展示完整参数面板（非 --yes 模式），避免"我以为用了默认但其实没传"
-
-### 5.3 费用感知（P1+）
-
-- 图像/语音/视频训练费用远高于文本。MVP 阶段（Qwen 文本 SFT）费用可控
-- 后续扩展多模态时，在 confirm panel 中强化费用估算提示
-- `bl quota check` 已存在，可在 `finetune create` 内部集成余额预检
-
-### 5.4 `bl infer` 是否独立存在
-
-建议 P1 阶段**不新增** `bl infer`，而是让 `bl text chat --model <deployed_model>` 直接工作。部署完成后的引导文案中指明这个用法即可。减少命令膨胀。
-
----
-
-## 六、最小闭环用户操作流
-
-```bash
-# 1. 准备数据 → 上传（含校验）
-bl dataset upload ./train.jsonl
-# ✓ Uploaded file-abc123 (5.2 MB)
-
-# 2. 创建训练任务（自动预填超参）
-bl finetune create --model qwen3-8b --data file-abc123
-# Shows summary panel → confirm → ✓ Job ft-xxxx created
-
-# 3. 等待训练完成
-bl finetune status ft-xxxx --wait
-# ⠋ RUNNING [23:15] → ✓ SUCCEEDED: qwen3-8b:ft-xxxx-20250601
-
-# 4. 部署模型
-bl deploy create --model qwen3-8b:ft-xxxx-20250601 --wait
-# ✓ Deployed: qwen3-8b-ft-xxxx (RUNNING)
-
-# 5. 调用模型
-bl text chat --model qwen3-8b-ft-xxxx "你好，介绍一下你自己"
-# (正常推理输出)
-```
-
----
-
-## 七、实现顺序建议
-
-```
-Phase 1 (P0 — 最小闭环):
-  core: dataset/validate.ts → dataset/upload.ts → finetune/api.ts → deploy/api.ts
-  cli:  dataset upload → finetune create → finetune status → deploy create
-  测试: 单元测试 validate.ts + e2e dry-run + 真实 API 端到端一次
-
-Phase 2 (P1 — 可观测性):
-  finetune logs → finetune checkpoints → deploy status → deploy delete
-  费用估算集成
-
-Phase 3 (后续):
-  bl dataset validate (独立命令)
-  bl dataset list (查看已上传)
-  bl finetune list (查看历史任务)
-  多模态 SFT 支持（图像/视频数据格式校验扩展）
-```
-
----
-
-## 八、风险与 TODO
-
-| 风险点            | 影响              | 缓解措施                                      |
-| ----------------- | ----------------- | --------------------------------------------- |
-| OOM 训练失败      | 用户浪费时间/金钱 | 保守默认超参 + batch_size 自适应模型大小      |
-| 数据格式错误      | 训练启动后才失败  | 本地校验拦截，启动秒级反馈                    |
-| 部署等待时间长    | 用户困惑          | `--wait` + 预估时间提示                       |
-| 费用超预期        | 账号欠费          | confirm panel 预估费用（P1 集成 quota check） |
-| API endpoint 变动 | 调用失败          | 端点集中管理在 core/client/endpoints.ts       |

package.json

@@ -16,7 +16,7 @@
     "ready": "vp check && vp run -r test && vp run -r build",
     "prepare": "vp config",
     "check": "vp check",
-    "sync:skill-assets": "pnpm --filter \"bailian-cli^...\" run build && pnpm --filter bailian-cli run generate:reference && pnpm --filter bailian-cli run sync:skill-version",
+    "sync:skill-assets": "pnpm --filter bailian-cli run generate:reference && pnpm --filter bailian-cli run sync:skill-version",
     "dev": "pnpm -F bailian-cli-core dev",
     "bl": "pnpm -F bailian-cli dev",
     "kscli": "pnpm -F knowledge-studio-cli dev",
@@ -26,6 +26,7 @@
     "test:stress": "node packages/cli/tests/stress/run.mjs"
   },
   "devDependencies": {
+    "tsx": "catalog:",
     "vite-plus": "catalog:"
   },
   "engines": {

packages/cli/.gitignore

@@ -2,4 +2,7 @@ node_modules
 dist
 *.log
 .DS_Store
-outputs/
+outputs/
+# agents
+agents.state.json
+.env

packages/cli/README.md

@@ -5,7 +5,7 @@
 **The official command-line interface for Aliyun Model Studio (DashScope) AI Platform**
 
 [![npm version](https://img.shields.io/npm/v/bailian-cli?color=0969da&label=npm)](https://www.npmjs.com/package/bailian-cli)
-[![Node.js](https://img.shields.io/badge/node-%3E%3D22.12-brightgreen)](https://nodejs.org)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D18.17-brightgreen)](https://nodejs.org)
 [![TypeScript](https://img.shields.io/badge/TypeScript-strict-3178c6)](https://www.typescriptlang.org)
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue)](LICENSE)
 
@@ -30,6 +30,7 @@ Equip your AI Agent out-of-the-box with these capabilities, composable across co
 - **Video generation & editing** — happyhorse-1.1 series: text-/image-/reference-to-video and natural-language video editing (up to 9-image reference)
 - **Speech synthesis & recognition** — CosyVoice streaming TTS, voice cloning from 5–20s samples; FunAudio-ASR covers 30 languages including 7 Chinese dialects and 20+ Mandarin accents
 - **Image & video understanding** — Qwen-VL: long-form video analysis, chart/document parsing, visual reasoning, multilingual OCR
+- **Coding agent setup** — Configure Claude Code, Qwen Code, OpenCode, OpenClaw, Hermes Agent, or Codex to use DashScope with `bl config agent`
 
 > **Note:** The features below are currently available only to China site (aliyun.com) account holders and are not yet supported for international / global site accounts.
 
@@ -38,8 +39,8 @@ Equip your AI Agent out-of-the-box with these capabilities, composable across co
 - **MCP integration** — Orchestrate Bailian MCP servers: list services, inspect tools, and invoke any tool directly from the terminal
 - **Web search** — Real-time internet retrieval for up-to-date, accurate answers
 - **Model recommendation** — Describe your scenario and get best-fit model suggestions; supports scoped search, model comparison, and alternative discovery
-- **Fine-tuning & deployment** — Upload datasets, create SFT/LoRA/DPO/CPT jobs (`finetune create`), probe job status non-blockingly (`finetune watch`), query per-model training capability (`finetune capability`), and deploy trained models as endpoints (`deploy create`)
-- **Console capabilities** — Browse Bailian apps (`app list`), check free-tier quota (`usage free`), view model usage statistics (`usage stats`), manage workspaces (`workspace list`), and manage rate limits (`quota list/request/check/history`)
+- **Fine-tuning & deployment** — Upload datasets, create text/audio/image fine-tune jobs (`finetune text|audio|image create`; text covers SFT/LoRA/DPO/CPT), probe job status non-blockingly (`finetune watch`), query per-model training capability (`finetune capability`), and deploy trained models as endpoints (`deploy text|audio|image create`)
+- **Console capabilities** — Browse the model marketplace (`model list`) and Bailian apps (`app list`), review a unified usage view (`usage summary`), check free-tier quota (`usage free`), view model usage statistics (`usage stats`), manage workspaces (`workspace list`), and manage rate limits (`quota list/request/check/history`)
 - **Local file auto-upload** — Every URL parameter accepts a local path; uploaded to free temp storage with 48-hour validity
 
 ## Showcase: One-Sentence Cinematic Video
@@ -80,7 +81,7 @@ npm install -g bailian-cli
 npx skills add modelstudioai/cli --all -g
 ```
 
-> Requires Node.js >= 22.12.
+> Requires Node.js >= 18.17.
 
 ## Quick Start
 
@@ -91,6 +92,12 @@ bl auth login --console
 # Or authenticate with an API key
 bl auth login --api-key sk-xxxxx
 
+# Or use Token Plan (Base URL built in; the key is tested during login)
+bl auth login --config token-plan --api-key sk-sp-xxxxx
+
+# Configure a coding agent to use DashScope
+bl config agent --agent codex --base-url https://dashscope.aliyuncs.com/compatible-mode/v1 --api-key sk-xxxxx --model qwen3-coder-plus
+
 # Chat with Qwen
 bl text chat --message "What is DashScope?"
 
@@ -114,13 +121,15 @@ bl auth login --console
 
 # Fine-tune & deploy — a one-shot train-to-serve workflow
 bl dataset upload --file ./train.jsonl                 # Upload a .jsonl dataset (validated first)
-bl finetune create --model qwen3-8b --datasets ./train.jsonl --training-type sft-lora  # Local paths auto-upload
-bl finetune watch --job-id ft-xxx --output json       # Non-blocking status probe (exit 0/1/3 = done/failed/running)
+bl finetune text create --model qwen3-8b --datasets ./train.jsonl --training-type sft-lora  # Local paths auto-upload
+bl finetune watch --job-id ft-xxx --output json       # Non-blocking probe (running/succeeded return 0; failed/canceled report an error)
 bl finetune capability --model qwen3-8b               # Which training types a model supports
-bl deploy create --model qwen3-8b --name my-svc --plan mu  # Deploy the trained model as an endpoint
+bl deploy text create --model qwen3-8b --name my-svc --plan mu  # Deploy the trained model as an endpoint
 
-# Browse apps / free-tier quota / usage statistics / workspaces
+# Browse models / apps / free-tier quota / usage statistics / workspaces
+bl model list                                        # Browse model families and pricing
 bl app list
+bl usage summary                                     # Unified view: free-tier quota + recent usage overview
 bl usage free                                         # Free-tier quota across models (add --model/--expiring/--sort)
 bl usage stats --workspace-id <id>                    # Model usage statistics (add --model for per-model)
 bl workspace list                                     # List all workspaces
@@ -157,21 +166,34 @@ bl auth login --api-key sk-xxxxx
 bl text chat --api-key sk-xxxxx --message "Hello"
 ```
 
+### Token Plan API Key
+
+Get or copy the API key from the [Token Plan subscription overview](https://bailian.console.aliyun.com/cn-beijing?tab=plan#/efm/subscription/overview).
+The CLI has the default Token Plan Base URL built in. Login tests the key first, then saves and activates the `token-plan` config only when validation succeeds.
+
+```bash
+bl auth login --config token-plan --api-key sk-sp-xxxxx
+```
+
 ### Console Login (OAuth)
 
-Required for console capability commands (`app list`, `usage free`, `usage stats`, `workspace list`, `quota list/request/check/history`). Opens the Bailian console in your browser to sign in.
+Required for console capability commands (`model list`, `app list`, `usage summary/free/stats`, `workspace list`, `quota list/request/check/history`). Opens the Bailian console in your browser to sign in.
 
 ```bash
 bl auth login --console
 ```
 
-### Alibaba Cloud AK/SK (Knowledge Base & Token Plan)
+### Alibaba Cloud OpenAPI AK/SK (Token Plan only)
 
-Required for `knowledge retrieve` and the `token-plan` command group. Get your AccessKey from [RAM Console](https://ram.console.aliyun.com/manage/ak).
+Required for the `token-plan` command group. Get your AccessKey from [RAM Console](https://ram.console.aliyun.com/manage/ak).
 
 > Recommended: create a RAM sub-account with minimum privileges instead of using the root account's AK/SK.
 
 ```bash
+# Option 1: Login command (persisted to ~/.bailian/config.json)
+bl auth login --open-api --access-key-id LTAI5t... --access-key-secret ...
+
+# Option 2: Environment variables
 export ALIBABA_CLOUD_ACCESS_KEY_ID=LTAI5t...
 export ALIBABA_CLOUD_ACCESS_KEY_SECRET=...
 export BAILIAN_WORKSPACE_ID=ws-...
@@ -203,6 +225,7 @@ Config file location: `~/.bailian/config.json`
 | Qwen Model List              | https://help.aliyun.com/zh/model-studio/getting-started/models                            |
 | Aliyun Model Studio Console  | https://bailian.console.aliyun.com/?source_channel=cli_github                             |
 | Get API Key                  | https://bailian.console.aliyun.com/cn-beijing/?source_channel=key_github&tab=app#/api-key |
+| Get Token Plan API Key       | https://bailian.console.aliyun.com/cn-beijing?tab=plan#/efm/subscription/overview         |
 | Get AccessKey                | https://ram.console.aliyun.com/manage/ak                                                  |
 
 ## Changelog

packages/cli/README.zh.md

@@ -5,7 +5,7 @@
 **阿里云百炼 (DashScope) AI 平台命令行工具**
 
 [![npm version](https://img.shields.io/npm/v/bailian-cli?color=0969da&label=npm)](https://www.npmjs.com/package/bailian-cli)
-[![Node.js](https://img.shields.io/badge/node-%3E%3D22.12-brightgreen)](https://nodejs.org)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D18.17-brightgreen)](https://nodejs.org)
 [![TypeScript](https://img.shields.io/badge/TypeScript-strict-3178c6)](https://www.typescriptlang.org)
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue)](LICENSE)
 
@@ -30,6 +30,7 @@ _专为 AI Agent 打造，每个命令均可作为结构化工具调用。_
 - **视频生成与编辑** — happyhorse-1.1 系列，支持文生 / 图生 / 参考生（最多 9 张图参考）/ 自然语言视频编辑
 - **语音合成与识别** — CosyVoice 实时流式合成，5-20s 样本即可克隆；FunAudio-ASR 覆盖 30 种语种，含汉语七大方言与 20+ 口音官话
 - **图像与视频理解** — Qwen-VL：长视频解析、复杂图表与文档识别、视觉推理、多语种 OCR
+- **Coding Agent 配置** — 使用 `bl config agent` 将 Claude Code、Qwen Code、OpenCode、OpenClaw、Hermes Agent 或 Codex 配置为使用 DashScope
 
 > **注意：** 以下功能目前仅对中国站（aliyun.com）账号开放，国际站 / 全球站账号暂不支持。
 
@@ -38,8 +39,8 @@ _专为 AI Agent 打造，每个命令均可作为结构化工具调用。_
 - **MCP 集成** — 统一调度百炼 MCP 服务：列出服务、查看工具、直接在终端调用任意工具
 - **联网搜索** — 实时互联网信息检索，提升回答准确性及时效性
 - **模型推荐** — 描述你的场景，智能推荐最适合的模型；支持限定范围搜索、模型对比和替代发现
-- **微调与部署** — 上传数据集、创建 SFT/LoRA/DPO/CPT 调优任务（`finetune create`）、非阻塞探测任务状态（`finetune watch`）、按模型查训练能力（`finetune capability`），并把训练好的模型部署为推理服务（`deploy create`）
-- **控制台能力** — 浏览百炼应用（`app list`），查询模型免费额度（`usage free`），查看模型用量统计（`usage stats`），管理业务空间（`workspace list`），管理限流与提额（`quota list/request/check/history`）
+- **微调与部署** — 上传数据集、创建文本/音频/图像调优任务（`finetune text|audio|image create`；文本涵盖 SFT/LoRA/DPO/CPT）、非阻塞探测任务状态（`finetune watch`）、按模型查训练能力（`finetune capability`），并把训练好的模型部署为推理服务（`deploy text|audio|image create`）
+- **控制台能力** — 浏览模型市场（`model list`）和百炼应用（`app list`），查看统一用量视图（`usage summary`），查询模型免费额度（`usage free`），查看模型用量统计（`usage stats`），管理业务空间（`workspace list`），管理限流与提额（`quota list/request/check/history`）
 - **本地文件自动上传** — 所有 URL 参数同时支持本地路径，免费临时存储 48 小时
 
 ## 示例:一句话生成一部电影短片
@@ -78,7 +79,7 @@ npm install -g bailian-cli
 npx skills add modelstudioai/cli --all -g
 ```
 
-> 需要预先安装 Node.js >= 22.12。
+> 需要预先安装 Node.js >= 18.17。
 
 ## 快速开始
 
@@ -89,6 +90,12 @@ bl auth login --console
 # 或使用 API key 认证
 bl auth login --api-key sk-xxxxx
 
+# 或使用 Token Plan（已内置 Base URL，登录时自动测试 Key）
+bl auth login --config token-plan --api-key sk-sp-xxxxx
+
+# 配置 Coding Agent 使用 DashScope
+bl config agent --agent codex --base-url https://dashscope.aliyuncs.com/compatible-mode/v1 --api-key sk-xxxxx --model qwen3-coder-plus
+
 # 和通义千问对话
 bl text chat --message "你好，介绍一下阿里云百炼平台"
 
@@ -112,13 +119,15 @@ bl auth login --console
 
 # 微调与部署 — 从训练到服务的一站式流程
 bl dataset upload --file ./train.jsonl                 # 上传 .jsonl 数据集（先校验）
-bl finetune create --model qwen3-8b --datasets ./train.jsonl --training-type sft-lora  # 本地路径自动上传
-bl finetune watch --job-id ft-xxx --output json       # 非阻塞状态探测（退出码 0/1/3 = 成功/失败/进行中）
+bl finetune text create --model qwen3-8b --datasets ./train.jsonl --training-type sft-lora  # 本地路径自动上传
+bl finetune watch --job-id ft-xxx --output json       # 非阻塞探测（运行中/成功返回 0；失败/取消报错）
 bl finetune capability --model qwen3-8b               # 查询模型支持哪些训练方式
-bl deploy create --model qwen3-8b --name my-svc --plan mu  # 把训练好的模型部署为推理服务
+bl deploy text create --model qwen3-8b --name my-svc --plan mu  # 把训练好的模型部署为推理服务
 
-# 浏览应用 / 免费额度 / 用量统计 / 业务空间
+# 浏览模型 / 应用 / 免费额度 / 用量统计 / 业务空间
+bl model list                                        # 浏览模型系列与价格信息
 bl app list
+bl usage summary                                     # 统一视图：免费额度 + 近期用量概览
 bl usage free                                         # 各模型免费额度（可加 --model/--expiring/--sort）
 bl usage stats --workspace-id <id>                    # 模型用量统计（加 --model 查单模型）
 bl workspace list                                     # 列出所有业务空间
@@ -155,21 +164,34 @@ bl auth login --api-key sk-xxxxx
 bl text chat --api-key sk-xxxxx --message "你好"
 ```
 
+### Token Plan API Key
+
+前往 [Token Plan 订阅详情](https://bailian.console.aliyun.com/cn-beijing?tab=plan#/efm/subscription/overview) 获取或复制 API Key。
+CLI 已内置 Token Plan 的默认 Base URL；登录命令会先测试 Key，通过后才保存并激活 `token-plan` 配置。
+
+```bash
+bl auth login --config token-plan --api-key sk-sp-xxxxx
+```
+
 ### 控制台登录（OAuth）
 
-控制台能力命令（`app list`、`usage free`、`usage stats`、`workspace list`、`quota list/request/check/history`）需要使用此登录方式。打开浏览器跳转百炼控制台完成登录。
+控制台能力命令（`model list`、`app list`、`usage summary/free/stats`、`workspace list`、`quota list/request/check/history`）需要使用此登录方式。打开浏览器跳转百炼控制台完成登录。
 
 ```bash
 bl auth login --console
 ```
 
-### 阿里云 AK/SK（知识库检索与 Token Plan）
+### 阿里云 OpenAPI AK/SK（仅 Token Plan）
 
-`knowledge retrieve` 与 `token-plan` 命令组需要阿里云 AccessKey。前往 [RAM 控制台](https://ram.console.aliyun.com/manage/ak) 获取。
+`token-plan` 命令组需要阿里云 AccessKey。前往 [RAM 控制台](https://ram.console.aliyun.com/manage/ak) 获取。
 
 > 建议：创建 RAM 子账号并授予最小权限，避免使用主账号 AK/SK。
 
 ```bash
+# 方式一：登录命令（持久化到 ~/.bailian/config.json）
+bl auth login --open-api --access-key-id LTAI5t... --access-key-secret ...
+
+# 方式二：环境变量
 export ALIBABA_CLOUD_ACCESS_KEY_ID=LTAI5t...
 export ALIBABA_CLOUD_ACCESS_KEY_SECRET=...
 export BAILIAN_WORKSPACE_ID=ws-...
@@ -201,6 +223,7 @@ bl update
 | 通义千问模型列表        | https://help.aliyun.com/zh/model-studio/getting-started/models                            |
 | 阿里云百炼控制台        | https://bailian.console.aliyun.com/?source_channel=cli_github                             |
 | 获取 API Key            | https://bailian.console.aliyun.com/cn-beijing/?source_channel=key_github&tab=app#/api-key |
+| 获取 Token Plan API Key | https://bailian.console.aliyun.com/cn-beijing?tab=plan#/efm/subscription/overview         |
 | 获取 AccessKey          | https://ram.console.aliyun.com/manage/ak                                                  |
 
 ## 更新日志

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bailian-cli",
-  "version": "1.5.0",
+  "version": "1.13.0",
   "description": "CLI for Aliyun Model Studio (DashScope) AI Platform.",
   "keywords": [
     "agent",
@@ -40,10 +40,10 @@
     "registry": "https://registry.npmjs.org/"
   },
   "scripts": {
-    "generate:reference": "node --experimental-strip-types ../../tools/generate-reference.ts && sh -c 'cd ../.. && vp check --fix skills/bailian-cli/reference'",
-    "sync:skill-version": "node --experimental-strip-types ../../tools/sync-skill-metadata.ts",
+    "generate:reference": "tsx ../../tools/generate-reference.ts && sh -c 'cd ../.. && vp check --fix skills/bailian-cli/reference'",
+    "sync:skill-version": "tsx ../../tools/sync-skill-metadata.ts",
     "build": "vp pack",
-    "dev": "node src/main.ts",
+    "dev": "tsx src/main.ts",
     "test": "vp test",
     "check": "vp check"
   },
@@ -59,12 +59,13 @@
     "ajv": "catalog:",
     "boxen": "catalog:",
     "chalk": "catalog:",
+    "e2e": "workspace:*",
     "typescript": "^6.0.2",
     "undici": "catalog:",
     "vite-plus": "0.1.22",
     "yaml": "catalog:"
   },
   "engines": {
-    "node": ">=22.12.0"
+    "node": ">=18.17.0"
   }
 }

packages/cli/src/command-pack-policy.ts

@@ -0,0 +1,14 @@
+import type { CommandPackPolicy } from "bailian-cli-runtime";
+
+/** Command Packs accepted by the bl product. */
+export const commandPackPolicy = {
+  supported: {
+    "@ali/bailian-plugin-agent": {
+      commandPrefixes: ["agent"],
+      credentialAccess: ["apiKey"],
+    },
+    "@ali/bailian-plugin-inner-console-call": {
+      commandPrefixes: ["inner-console"],
+    },
+  },
+} as const satisfies CommandPackPolicy;

packages/cli/src/commands.ts

@@ -1,8 +1,9 @@
-import type { Command } from "bailian-cli-core";
+import type { AnyCommand } from "bailian-cli-core";
 import {
   authLogin,
   authStatus,
   authLogout,
+  authGenerateAccessToken,
   textChat,
   textOmni,
   imageGenerate,
@@ -15,6 +16,10 @@ import {
   visionDescribe,
   configShow,
   configSet,
+  configList,
+  configUse,
+  configUi,
+  configAgent,
   update,
   appCall,
   appList,
@@ -26,6 +31,8 @@ import {
   memoryProfileCreate,
   memoryProfileGet,
   knowledgeRetrieve,
+  knowledgeSearch,
+  knowledgeChat,
   mcpCall,
   mcpList,
   mcpTools,
@@ -37,9 +44,11 @@ import {
   usageFree,
   usageFreetier,
   usageStats,
+  usageSummary,
   pipelineRun,
   pipelineValidate,
   advisorRecommend,
+  modelList,
   workspaceList,
   quotaList,
   quotaRequest,
@@ -50,7 +59,9 @@ import {
   datasetGet,
   datasetDelete,
   datasetValidate,
-  finetuneCreate,
+  finetuneTextCreate,
+  finetuneAudioCreate,
+  finetuneImageCreate,
   finetuneList,
   finetuneGet,
   finetuneCancel,
@@ -60,7 +71,9 @@ import {
   finetuneExport,
   finetuneWatch,
   finetuneCapability,
-  deployCreate,
+  deployTextCreate,
+  deployAudioCreate,
+  deployImageCreate,
   deployList,
   deployGet,
   deployModels,
@@ -71,6 +84,28 @@ import {
   tokenPlanCreateKey,
   tokenPlanAssignSeats,
   tokenPlanAddMember,
+  workspaceInit,
+  pluginInstall,
+  pluginLink,
+  pluginList,
+  pluginRemove,
+  managedAgentInit,
+  managedAgentValidate,
+  managedAgentPlan,
+  managedAgentApply,
+  managedAgentDestroy,
+  managedAgentStateList,
+  managedAgentStateShow,
+  managedAgentStateRm,
+  managedAgentStateImport,
+  managedAgentSessionCreate,
+  managedAgentSessionList,
+  managedAgentSessionGet,
+  managedAgentSessionDelete,
+  managedAgentSessionRun,
+  managedAgentSessionSend,
+  managedAgentSessionEvents,
+  managedAgentSkillList,
 } from "bailian-cli-commands";
 
 // Full bailian-cli product: every command, exposed under the `bl` binary.
@@ -78,10 +113,11 @@ import {
 // ships no presets, so the map is spelled out here. Kept in its own module
 // (no side effects) so tools like generate-reference.ts can import it without
 // starting the CLI.
-export const commands: Record<string, Command> = {
+export const commands: Record<string, AnyCommand> = {
   "auth login": authLogin,
   "auth status": authStatus,
   "auth logout": authLogout,
+  "auth generate-access-token": authGenerateAccessToken,
   "text chat": textChat,
   omni: textOmni,
   "image generate": imageGenerate,
@@ -94,6 +130,10 @@ export const commands: Record<string, Command> = {
   "vision describe": visionDescribe,
   "config show": configShow,
   "config set": configSet,
+  "config list": configList,
+  "config use": configUse,
+  "config ui": configUi,
+  "config agent": configAgent,
   update,
   "app call": appCall,
   "app list": appList,
@@ -105,6 +145,8 @@ export const commands: Record<string, Command> = {
   "memory profile create": memoryProfileCreate,
   "memory profile get": memoryProfileGet,
   "knowledge retrieve": knowledgeRetrieve,
+  "knowledge search": knowledgeSearch,
+  "knowledge chat": knowledgeChat,
   "mcp call": mcpCall,
   "mcp list": mcpList,
   "mcp tools": mcpTools,
@@ -116,9 +158,11 @@ export const commands: Record<string, Command> = {
   "usage free": usageFree,
   "usage freetier": usageFreetier,
   "usage stats": usageStats,
+  "usage summary": usageSummary,
   "pipeline run": pipelineRun,
   "pipeline validate": pipelineValidate,
   "advisor recommend": advisorRecommend,
+  "model list": modelList,
   "workspace list": workspaceList,
   "quota list": quotaList,
   "quota request": quotaRequest,
@@ -129,7 +173,9 @@ export const commands: Record<string, Command> = {
   "dataset get": datasetGet,
   "dataset delete": datasetDelete,
   "dataset validate": datasetValidate,
-  "finetune create": finetuneCreate,
+  "finetune text create": finetuneTextCreate,
+  "finetune audio create": finetuneAudioCreate,
+  "finetune image create": finetuneImageCreate,
   "finetune list": finetuneList,
   "finetune get": finetuneGet,
   "finetune cancel": finetuneCancel,
@@ -139,7 +185,9 @@ export const commands: Record<string, Command> = {
   "finetune export": finetuneExport,
   "finetune watch": finetuneWatch,
   "finetune capability": finetuneCapability,
-  "deploy create": deployCreate,
+  "deploy text create": deployTextCreate,
+  "deploy audio create": deployAudioCreate,
+  "deploy image create": deployImageCreate,
   "deploy list": deployList,
   "deploy get": deployGet,
   "deploy models": deployModels,
@@ -150,4 +198,26 @@ export const commands: Record<string, Command> = {
   "token-plan create-key": tokenPlanCreateKey,
   "token-plan assign-seats": tokenPlanAssignSeats,
   "token-plan add-member": tokenPlanAddMember,
+  "workspace init": workspaceInit,
+  "plugin install": pluginInstall,
+  "plugin link": pluginLink,
+  "plugin list": pluginList,
+  "plugin remove": pluginRemove,
+  "managed-agent init": managedAgentInit,
+  "managed-agent validate": managedAgentValidate,
+  "managed-agent plan": managedAgentPlan,
+  "managed-agent apply": managedAgentApply,
+  "managed-agent destroy": managedAgentDestroy,
+  "managed-agent state list": managedAgentStateList,
+  "managed-agent state show": managedAgentStateShow,
+  "managed-agent state rm": managedAgentStateRm,
+  "managed-agent state import": managedAgentStateImport,
+  "managed-agent session create": managedAgentSessionCreate,
+  "managed-agent session list": managedAgentSessionList,
+  "managed-agent session get": managedAgentSessionGet,
+  "managed-agent session delete": managedAgentSessionDelete,
+  "managed-agent session run": managedAgentSessionRun,
+  "managed-agent session send": managedAgentSessionSend,
+  "managed-agent session events": managedAgentSessionEvents,
+  "managed-agent skill-list": managedAgentSkillList,
 };

packages/cli/src/main.ts

@@ -1,10 +1,20 @@
 import { createCli } from "bailian-cli-runtime";
 import { commands } from "./commands.ts";
+import { commandPackPolicy } from "./command-pack-policy.ts";
 import pkg from "../package.json" with { type: "json" };
 
+const quickStartTasks = [
+  "Help me generate a set of Amazon e-commerce main images for baseball caps (white background + lifestyle shots + model wear shots)",
+  "Help me generate a 3-minute humorous crosstalk audio clip",
+  "Help me generate a Little Red Riding Hood picture-book PDF (with illustrations)",
+  "Help me analyze this video and write a Xiaohongshu-style post",
+] as const;
+
 void createCli(commands, {
   binName: "bl",
   version: pkg.version,
   clientName: "bailian-cli",
   npmPackage: "bailian-cli",
+  quickStartTasks,
+  commandPacks: commandPackPolicy,
 }).run();

packages/cli/tests/e2e/advisor-recommend.e2e.test.ts

@@ -1,163 +0,0 @@
-import { describe, expect, test } from "vite-plus/test";
-import { isDashScopeE2EReady, parseStdoutJson, runCli } from "./helpers.ts";
-
-describe("e2e: advisor recommend", () => {
-  test("advisor shows subcommand groups and exits successfully", async () => {
-    const { stdout, stderr, exitCode } = await runCli(["advisor"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(`${stdout}\n${stderr}`).toMatch(/advisor|recommend/i);
-  });
-
-  test("advisor recommend --help exits successfully", async () => {
-    const { stderr, exitCode } = await runCli(["advisor", "recommend", "--help"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stderr).toMatch(/recommend|--message|dry-run/i);
-  });
-});
-
-describe.skipIf(!isDashScopeE2EReady())("e2e: advisor recommend (DashScope)", () => {
-  test("advisor recommend without --message prints help and exits", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "advisor",
-      "recommend",
-      "--non-interactive",
-    ]);
-    expect(exitCode).toBe(0);
-    expect(`${stdout}\n${stderr}`).toMatch(/--message|Usage:/i);
-  });
-
-  test("advisor recommend --dry-run outputs intent analysis and candidates", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "advisor",
-      "recommend",
-      "--dry-run",
-      "--message",
-      "I want to build a customer service bot that understands images",
-      "--non-interactive",
-      "--output",
-      "json",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    const data = parseStdoutJson<{
-      userInput?: string;
-      intent?: { requiredCapabilities?: string[]; inputModality?: string[] };
-      candidateCount?: number;
-      candidates?: Array<{ model?: string; score?: number }>;
-    }>(stdout);
-    expect(data.userInput).toBe("I want to build a customer service bot that understands images");
-    expect(data.intent?.requiredCapabilities).toContain("VU");
-    expect(data.intent?.inputModality).toContain("Image");
-    expect(data.candidateCount).toBeGreaterThan(0);
-    expect(data.candidates?.[0]?.model).toBeDefined();
-    expect(data.candidates?.[0]?.score).toBeGreaterThan(0);
-  }, 60_000);
-
-  test("advisor recommend full flow returns results", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "advisor",
-      "recommend",
-      "--message",
-      "low-cost high-concurrency online customer service",
-      "--non-interactive",
-      "--output",
-      "json",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    const data = parseStdoutJson<{
-      intent?: { taskSummary?: string };
-      result?: {
-        type?: string;
-        recommendations?: Array<{
-          model?: string;
-          name?: string;
-          reason?: string;
-        }>;
-      };
-      candidates?: number;
-    }>(stdout);
-    expect(data.result?.type).toBe("single");
-    expect(data.result?.recommendations?.length).toBeGreaterThan(0);
-    expect(data.result?.recommendations?.[0]?.model).toBeDefined();
-    expect(data.result?.recommendations?.[0]?.reason).toBeDefined();
-  }, 120_000);
-
-  // ---- Model preference: positive cases ----
-
-  test("scoped preference — intent contains modelPreference.mode=scoped when family is specified", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "advisor",
-      "recommend",
-      "--dry-run",
-      "--message",
-      "Which model in the deepseek family is best for fast reasoning?",
-      "--non-interactive",
-      "--output",
-      "json",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    const data = parseStdoutJson<{
-      intent?: { modelPreference?: { mode?: string; targets?: string[] } };
-    }>(stdout);
-    expect(data.intent?.modelPreference?.mode).toBe("scoped");
-    expect(data.intent?.modelPreference?.targets?.length).toBeGreaterThan(0);
-    expect(
-      data.intent?.modelPreference?.targets?.some((target) =>
-        target.toLowerCase().includes("deepseek"),
-      ),
-    ).toBe(true);
-  }, 60_000);
-
-  test("comparison preference — intent contains modelPreference.mode=comparison when comparing models", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "advisor",
-      "recommend",
-      "--dry-run",
-      "--message",
-      "Which is better for code generation, qwen-max or deepseek-v3?",
-      "--non-interactive",
-      "--output",
-      "json",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    const data = parseStdoutJson<{
-      intent?: { modelPreference?: { mode?: string; targets?: string[] } };
-    }>(stdout);
-    expect(data.intent?.modelPreference?.mode).toBe("comparison");
-    expect(data.intent?.modelPreference?.targets?.length).toBeGreaterThanOrEqual(2);
-  }, 60_000);
-
-  test("excludes preference — intent detects modelPreference when excluding models", async () => {
-    const { stderr, exitCode } = await runCli([
-      "advisor",
-      "recommend",
-      "--dry-run",
-      "--message",
-      "Not qwen, recommend a model suitable for text generation",
-      "--non-interactive",
-      "--output",
-      "json",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-  }, 60_000);
-
-  // ---- Model preference: negative cases ----
-
-  test("no preference — intent has no modelPreference or mode=unconstrained for generic queries", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "advisor",
-      "recommend",
-      "--dry-run",
-      "--message",
-      "I want to build a customer service bot that understands images",
-      "--non-interactive",
-      "--output",
-      "json",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    const data = parseStdoutJson<{
-      intent?: { modelPreference?: { mode?: string } };
-    }>(stdout);
-    const mode = data.intent?.modelPreference?.mode;
-    expect(mode === undefined || mode === "unconstrained").toBe(true);
-  }, 60_000);
-});

packages/cli/tests/e2e/auth.e2e.test.ts

@@ -1,184 +0,0 @@
-import { describe, expect, test } from "vite-plus/test";
-import { isDashScopeE2EReady, parseStdoutJson, runCli } from "./helpers.ts";
-
-/**
- * Auth 相关 E2E：只验证 CLI 进程能正常解析参数并退出。
- */
-
-describe("e2e: auth", () => {
-  test("auth 分组展示子命令帮助且退出码为 0", async () => {
-    const { stdout, stderr, exitCode } = await runCli(["auth"]);
-    expect(exitCode, stderr).toBe(0);
-    const out = `${stdout}\n${stderr}`;
-    expect(out).toMatch(/auth|Authentication|login|logout|status/i);
-  });
-
-  test("auth login --help 正常退出", async () => {
-    const { stderr, exitCode } = await runCli(["auth", "login", "--help"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stderr).toMatch(/login|api-key/i);
-    expect(stderr).toMatch(/--console-site/);
-  });
-
-  test("auth logout --help 正常退出", async () => {
-    const { stderr, exitCode } = await runCli(["auth", "logout", "--help"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stderr).toMatch(/logout|dry-run|yes/i);
-  });
-
-  test("auth status --help 正常退出", async () => {
-    const { stderr, exitCode } = await runCli(["auth", "status", "--help"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stderr).toMatch(/status|output/i);
-  });
-
-  test("auth login 缺少 --api-key 时打印子命令帮助并退出 (0)", async () => {
-    const { stderr, exitCode } = await runCli(["auth", "login", "--non-interactive"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stderr).toMatch(/--api-key|Usage:/i);
-  });
-
-  test("auth login --dry-run --api-key 不发起校验与落盘", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "auth",
-      "login",
-      "--dry-run",
-      "--api-key",
-      "sk-e2e-dry-run-placeholder",
-      "--non-interactive",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stdout).toContain("Would validate and save API key.");
-  });
-
-  test("auth login --dry-run 覆盖全局参数 --output json --timeout", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "auth",
-      "login",
-      "--dry-run",
-      "--api-key",
-      "sk-e2e-dry-run-placeholder",
-      "--non-interactive",
-      "--output",
-      "json",
-      "--timeout",
-      "120",
-      "--no-color",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stdout).toContain("Would validate and save API key.");
-  });
-
-  test("auth login 缺少密钥且 --output json 时仍打印子命令帮助 (0)", async () => {
-    const { stderr, exitCode } = await runCli([
-      "auth",
-      "login",
-      "--non-interactive",
-      "--output",
-      "json",
-    ]);
-    expect(exitCode).toBe(0);
-    expect(stderr).toMatch(/--api-key|Usage:/i);
-  });
-
-  test("auth logout --dry-run 不写入配置", async () => {
-    const { stdout, stderr, exitCode } = await runCli(["auth", "logout", "--dry-run"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stdout).toContain("No changes made.");
-    expect(stderr).not.toContain("Cleared api_key");
-  });
-
-  test("auth logout --dry-run --yes --non-interactive", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "auth",
-      "logout",
-      "--dry-run",
-      "--yes",
-      "--non-interactive",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stdout).toContain("No changes made.");
-    expect(stderr).not.toContain("Cleared api_key");
-  });
-
-  test("auth logout --dry-run --quiet --no-color", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "auth",
-      "logout",
-      "--dry-run",
-      "--quiet",
-      "--no-color",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stdout).toContain("No changes made.");
-  });
-
-  test("auth logout --dry-run --output json（不清除密钥）", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "auth",
-      "logout",
-      "--dry-run",
-      "--output",
-      "json",
-      "--non-interactive",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stdout).toContain("No changes made.");
-    expect(stderr).not.toContain("Cleared api_key");
-  });
-
-  test.skipIf(!isDashScopeE2EReady())("auth status 文本输出", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "auth",
-      "status",
-      "--non-interactive",
-      "--output",
-      "text",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stdout).toMatch(
-      /Authentication Status|API key:|Console token:|DashScope API:|Console gateway:/,
-    );
-  });
-
-  test.skipIf(!isDashScopeE2EReady())("auth status --output json", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "auth",
-      "status",
-      "--non-interactive",
-      "--output",
-      "json",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    const data = parseStdoutJson<{
-      authenticated?: boolean;
-      api_key?: { configured?: boolean };
-      dashscope_commands?: { method?: string };
-    }>(stdout);
-    expect(data.authenticated).toBe(true);
-    expect(data.api_key?.configured).toBe(true);
-    expect(data.dashscope_commands?.method).toBeDefined();
-  });
-
-  test.skipIf(!isDashScopeE2EReady())(
-    "auth status --output json --quiet --base-url 国内",
-    async () => {
-      const { stdout, stderr, exitCode } = await runCli([
-        "auth",
-        "status",
-        "--non-interactive",
-        "--output",
-        "json",
-        "--quiet",
-        "--base-url",
-        "https://dashscope.aliyuncs.com",
-      ]);
-      expect(exitCode, stderr).toBe(0);
-      const data = parseStdoutJson<{ authenticated?: boolean; dashscope_commands?: unknown }>(
-        stdout,
-      );
-      expect(data.authenticated).toBe(true);
-      expect(data.dashscope_commands).toBeDefined();
-    },
-  );
-});

packages/cli/tests/e2e/command-packs.e2e.test.ts

@@ -0,0 +1,134 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { afterAll, beforeAll, describe, expect, test } from "vite-plus/test";
+import { parseStdoutJson, runCli } from "./helpers.ts";
+
+const fixtureRoot = join(fileURLToPath(import.meta.url), "..", "..", "fixtures", "command-pack");
+let configDir: string;
+
+function env(): NodeJS.ProcessEnv {
+  return { BAILIAN_CONFIG_DIR: configDir, DO_NOT_TRACK: "1" };
+}
+
+describe("e2e: Command Pack", () => {
+  beforeAll(async () => {
+    configDir = await mkdtemp(join(tmpdir(), "bl-command-pack-e2e-"));
+  });
+
+  afterAll(async () => {
+    await rm(configDir, { recursive: true, force: true });
+  });
+
+  test("plugin 分组和管理命令 help 正常", async () => {
+    const group = await runCli(["plugin"], env());
+    expect(group.exitCode, group.stderr).toBe(0);
+    expect(group.stderr).toContain("plugin install");
+    expect(group.stderr).toContain("plugin link");
+    expect(group.stderr).toContain("plugin list");
+    expect(group.stderr).toContain("plugin remove");
+
+    const install = await runCli(["plugin", "install", "--help"], env());
+    expect(install.exitCode, install.stderr).toBe(0);
+    expect(install.stderr).toContain("--package");
+  });
+
+  test("未 link 时插件命令不存在", async () => {
+    const result = await runCli(["agent", "ping", "--message", "before"], env());
+    expect(result.exitCode).not.toBe(0);
+    expect(result.stderr).toMatch(/Unknown command/i);
+  });
+
+  test("link 后命令进入原生 registry/help/执行链路", async () => {
+    const linked = await runCli(
+      ["plugin", "link", "--path", fixtureRoot, "--output", "json"],
+      env(),
+    );
+    expect(linked.exitCode, linked.stderr).toBe(0);
+    const linkedJson = parseStdoutJson<{ linked: { name: string; commands: string[] } }>(
+      linked.stdout,
+    );
+    expect(linkedJson.linked.name).toBe("@ali/bailian-plugin-agent");
+    expect(linkedJson.linked.commands).toEqual([
+      "agent credential",
+      "agent credential-denied",
+      "agent fail",
+      "agent output",
+      "agent ping",
+    ]);
+
+    const rootHelp = await runCli(["--help"], env());
+    expect(rootHelp.exitCode, rootHelp.stderr).toBe(0);
+    expect(rootHelp.stderr).toContain("agent ping");
+
+    const commandHelp = await runCli(["agent", "ping", "--help"], env());
+    expect(commandHelp.exitCode, commandHelp.stderr).toBe(0);
+    expect(commandHelp.stderr).toContain("Ping the Command Pack fixture");
+    expect(commandHelp.stderr).toContain("--message");
+
+    const executed = await runCli(["agent", "ping", "--message", "hello"], env());
+    expect(executed.exitCode, executed.stderr).toBe(0);
+    expect(executed.stdout).toContain("command-pack:hello");
+
+    const credential = await runCli(["agent", "credential", "--api-key", "fixture-key"], env());
+    expect(credential.exitCode, credential.stderr).toBe(0);
+    expect(credential.stdout).toContain("credential-source:flag");
+
+    const denied = await runCli(["agent", "credential-denied"], {
+      ...env(),
+      DASHSCOPE_API_KEY: "fixture-key",
+    });
+    expect(denied.exitCode).toBe(1);
+    expect(denied.stderr).toContain('must declare auth="apiKey"');
+
+    const outputText = await runCli(["agent", "output"], env());
+    expect(outputText.exitCode, outputText.stderr).toBe(0);
+    expect(outputText.stdout).toBe("command-pack-output\n");
+
+    const outputJson = await runCli(["agent", "output", "--output", "json"], env());
+    expect(outputJson.exitCode, outputJson.stderr).toBe(0);
+    expect(parseStdoutJson(outputJson.stdout)).toEqual({ source: "command-pack", ok: true });
+
+    const failed = await runCli(["agent", "fail", "--output", "text"], env());
+    expect(failed.exitCode).toBe(2);
+    expect(failed.stderr).toContain("Command Pack fixture usage error.");
+    expect(failed.stderr).toContain("Use agent fail only in tests.");
+  });
+
+  test("plugin list 输出加载状态", async () => {
+    const result = await runCli(["plugin", "list", "--output", "json"], env());
+    expect(result.exitCode, result.stderr).toBe(0);
+    const json = parseStdoutJson<{
+      command_packs: Array<{ name: string; status: string; commands: string[] }>;
+    }>(result.stdout);
+    expect(json.command_packs).toEqual([
+      expect.objectContaining({
+        name: "@ali/bailian-plugin-agent",
+        status: "loaded",
+        commands: [
+          "agent credential",
+          "agent credential-denied",
+          "agent fail",
+          "agent output",
+          "agent ping",
+        ],
+      }),
+    ]);
+  });
+
+  test("remove 后命令从下一进程消失", async () => {
+    const removed = await runCli(
+      ["plugin", "remove", "--name", "@ali/bailian-plugin-agent", "--output", "json"],
+      env(),
+    );
+    expect(removed.exitCode, removed.stderr).toBe(0);
+    expect(parseStdoutJson<{ removed: string }>(removed.stdout).removed).toBe(
+      "@ali/bailian-plugin-agent",
+    );
+
+    const result = await runCli(["agent", "ping", "--message", "after"], env());
+    expect(result.exitCode).not.toBe(0);
+    expect(result.stderr).toMatch(/Unknown command/i);
+  });
+});

packages/cli/tests/e2e/config-profile.e2e.test.ts

@@ -0,0 +1,164 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { describe, expect, test } from "vite-plus/test";
+import { parseStdoutJson, runCli } from "./helpers.ts";
+
+function withTempConfigDir<T>(fn: (dir: string) => Promise<T>): Promise<T> {
+  const dir = mkdtempSync(join(tmpdir(), "bl-config-profile-"));
+  return fn(dir).finally(() => {
+    rmSync(dir, { recursive: true, force: true });
+  });
+}
+
+function writeConfig(dir: string, data: Record<string, unknown>): void {
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, "config.json"), JSON.stringify(data, null, 2) + "\n");
+}
+
+describe("e2e: named config", () => {
+  test("根帮助展示 --config 全局标志", async () => {
+    const { stderr, exitCode } = await runCli(["--help"]);
+    expect(exitCode, stderr).toBe(0);
+    expect(stderr).toMatch(/--config <name>/);
+  });
+
+  test("config set --config 写入命名 block 且不影响默认配置", async () => {
+    await withTempConfigDir(async (dir) => {
+      writeConfig(dir, { output: "text", api_key: "sk-default" });
+
+      const setResult = await runCli(
+        [
+          "config",
+          "set",
+          "--config",
+          "dev",
+          "--key",
+          "output",
+          "--value",
+          "json",
+          "--output",
+          "json",
+        ],
+        { BAILIAN_CONFIG_DIR: dir },
+      );
+      expect(setResult.exitCode, setResult.stderr).toBe(0);
+      const setData = parseStdoutJson<{
+        output?: string;
+        config?: string;
+        config_file?: string;
+      }>(setResult.stdout);
+      expect(setData.output).toBe("json");
+      expect(setData.config).toBe("dev");
+      expect(setData.config_file).toBe(join(dir, "config.json"));
+
+      const raw = JSON.parse(readFileSync(join(dir, "config.json"), "utf8")) as Record<
+        string,
+        unknown
+      >;
+      expect(raw.output).toBe("text");
+      expect((raw.dev as Record<string, unknown>).output).toBe("json");
+    });
+  });
+
+  test("config show --config 只展示命名 block", async () => {
+    await withTempConfigDir(async (dir) => {
+      writeConfig(dir, {
+        output: "text",
+        api_key: "sk-default",
+        dev: { output: "json", access_token: "tok-dev" },
+      });
+
+      const { stdout, stderr, exitCode } = await runCli(
+        ["config", "show", "--config", "dev", "--output", "json"],
+        { BAILIAN_CONFIG_DIR: dir },
+      );
+      expect(exitCode, stderr).toBe(0);
+      const data = parseStdoutJson<Record<string, unknown>>(stdout);
+      expect(data.config).toBe("dev");
+      expect(data.config_file).toBe(join(dir, "config.json"));
+      expect(data.output).toBe("json");
+      expect(data.access_token).toBeDefined();
+      expect(data.api_key).toBeUndefined();
+    });
+  });
+
+  test("auth status --config 不继承默认凭证", async () => {
+    await withTempConfigDir(async (dir) => {
+      writeConfig(dir, { api_key: "sk-default", dev: { output: "json" } });
+
+      const devStatus = await runCli(["auth", "status", "--config", "dev", "--output", "json"], {
+        BAILIAN_CONFIG_DIR: dir,
+        DASHSCOPE_API_KEY: "",
+        ALIBABA_CLOUD_ACCESS_KEY_ID: "",
+        ALIBABA_CLOUD_ACCESS_KEY_SECRET: "",
+      });
+      expect(devStatus.exitCode, devStatus.stderr).toBe(0);
+      const devData = parseStdoutJson<Record<string, unknown>>(devStatus.stdout);
+      expect(devData.authenticated).toBe(false);
+      expect(devData.config).toBe("dev");
+
+      const defaultStatus = await runCli(["auth", "status", "--output", "json"], {
+        BAILIAN_CONFIG_DIR: dir,
+        DASHSCOPE_API_KEY: "",
+        ALIBABA_CLOUD_ACCESS_KEY_ID: "",
+        ALIBABA_CLOUD_ACCESS_KEY_SECRET: "",
+      });
+      expect(defaultStatus.exitCode, defaultStatus.stderr).toBe(0);
+      const defaultData = parseStdoutJson<Record<string, unknown>>(defaultStatus.stdout);
+      expect(defaultData.authenticated).toBe(true);
+      expect(defaultData.config).toBe("default");
+    });
+  });
+
+  test("--config default 等价默认配置", async () => {
+    await withTempConfigDir(async (dir) => {
+      writeConfig(dir, {
+        active_config: "token-plan",
+        output: "json",
+        api_key: "sk-default",
+        "token-plan": { output: "text", api_key: "sk-token" },
+      });
+      const { stdout, stderr, exitCode } = await runCli(
+        ["config", "show", "--config", "default", "--output", "json"],
+        { BAILIAN_CONFIG_DIR: dir },
+      );
+      expect(exitCode, stderr).toBe(0);
+      const data = parseStdoutJson<Record<string, unknown>>(stdout);
+      expect(data.config).toBe("default");
+      expect(data.active).toBeUndefined();
+      expect(data.api_key).toBeDefined();
+      const raw = JSON.parse(readFileSync(join(dir, "config.json"), "utf8")) as Record<
+        string,
+        unknown
+      >;
+      expect(raw.active_config).toBe("token-plan");
+    });
+  });
+
+  test("非法 --config 名称报 usage error", async () => {
+    const { stderr, exitCode } = await runCli(["auth", "status", "--config", "../evil"]);
+    expect(exitCode).toBe(2);
+    expect(stderr).toMatch(/Invalid config name/);
+  });
+
+  test("auth status 文本输出分行展示选中 Config 和配置文件", async () => {
+    await withTempConfigDir(async (dir) => {
+      writeConfig(dir, {
+        active_config: "token-plan",
+        "token-plan": { api_key: "sk-token" },
+      });
+
+      const result = await runCli(["auth", "status", "--output", "text"], {
+        BAILIAN_CONFIG_DIR: dir,
+        DASHSCOPE_API_KEY: "",
+        ALIBABA_CLOUD_ACCESS_KEY_ID: "",
+        ALIBABA_CLOUD_ACCESS_KEY_SECRET: "",
+      });
+      expect(result.exitCode, result.stderr).toBe(0);
+      expect(result.stdout).toContain("Config: token-plan\n");
+      expect(result.stdout).toContain(`Config file: ${join(dir, "config.json")}\n`);
+      expect(result.stdout).not.toContain("Active config:");
+    });
+  });
+});

packages/cli/tests/e2e/config.e2e.test.ts

@@ -1,143 +0,0 @@
-import { describe, expect, test } from "vite-plus/test";
-import { parseStdoutJson, runCli } from "./helpers.ts";
-
-/**
- * Config 相关 E2E
- */
-
-describe("e2e: config", () => {
-  test("config 分组展示子命令帮助且成功退出", async () => {
-    const { stdout, stderr, exitCode } = await runCli(["config"]);
-    expect(exitCode, stderr).toBe(0);
-    const out = `${stdout}\n${stderr}`;
-    expect(out).toMatch(/config|show|set|export-schema/i);
-  });
-
-  test("config show --help 正常退出", async () => {
-    const { stderr, exitCode } = await runCli(["config", "show", "--help"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stderr).toMatch(/show|config/i);
-  });
-
-  test("config set --help 正常退出", async () => {
-    const { stderr, exitCode } = await runCli(["config", "set", "--help"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stderr).toMatch(/set|--key|--value/i);
-  });
-
-  test("config show --output json", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "config",
-      "show",
-      "--non-interactive",
-      "--output",
-      "json",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    const data = parseStdoutJson<{
-      config_file?: string;
-      base_url?: string;
-      timeout?: number;
-    }>(stdout);
-    expect(data.config_file).toBeDefined();
-    expect(data.base_url).toBeDefined();
-    expect(data.timeout).toBeDefined();
-  });
-
-  test("config show --output text --no-color", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "config",
-      "show",
-      "--non-interactive",
-      "--output",
-      "text",
-      "--no-color",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stdout).toMatch(/config_file|timeout|base_url/i);
-  });
-
-  test("config set 缺少 --key / --value 时退出为用法错误 (2)", async () => {
-    const { stderr, exitCode } = await runCli(["config", "set", "--non-interactive"]);
-    expect(exitCode).toBe(2);
-    expect(stderr).toMatch(/--key|--value|required/i);
-  });
-
-  test("config set 非法 key 时退出为用法错误", async () => {
-    const { stderr, exitCode } = await runCli([
-      "config",
-      "set",
-      "--non-interactive",
-      "--key",
-      "not-a-real-key",
-      "--value",
-      "x",
-    ]);
-    expect(exitCode).toBe(2);
-    expect(stderr).toMatch(/Invalid config key|not-a-real-key/i);
-  });
-
-  test("config set 非法 output", async () => {
-    const { stderr, exitCode } = await runCli([
-      "config",
-      "set",
-      "--non-interactive",
-      "--key",
-      "output",
-      "--value",
-      "yaml",
-    ]);
-    expect(exitCode).toBe(2);
-    expect(stderr).toMatch(/Invalid output|text, json/i);
-  });
-
-  test("config set 非法 timeout", async () => {
-    const { stderr, exitCode } = await runCli([
-      "config",
-      "set",
-      "--non-interactive",
-      "--key",
-      "timeout",
-      "--value",
-      "0",
-    ]);
-    expect(exitCode).toBe(2);
-    expect(stderr).toMatch(/Invalid timeout|positive/i);
-  });
-
-  test("config set --dry-run 不落盘（仅输出 would_set）", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "config",
-      "set",
-      "--dry-run",
-      "--non-interactive",
-      "--key",
-      "output",
-      "--value",
-      "json",
-      "--output",
-      "json",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    const data = parseStdoutJson<{ would_set?: { output?: string } }>(stdout);
-    expect(data.would_set?.output).toBe("json");
-  });
-
-  test("config set --dry-run 支持连字符别名 key", async () => {
-    const { stdout, stderr, exitCode } = await runCli([
-      "config",
-      "set",
-      "--dry-run",
-      "--non-interactive",
-      "--key",
-      "default-text-model",
-      "--value",
-      "qwen3.7-max",
-      "--output",
-      "json",
-    ]);
-    expect(exitCode, stderr).toBe(0);
-    const data = parseStdoutJson<{ would_set?: { default_text_model?: string } }>(stdout);
-    expect(data.would_set?.default_text_model).toBe("qwen3.7-max");
-  });
-});

packages/cli/tests/e2e/helpers.ts

@@ -1,216 +1,52 @@
-import { execFile } from "child_process";
-import { mkdirSync, readFileSync } from "fs";
-import { promisify } from "util";
-import { basename, dirname, join } from "path";
+import { dirname, join } from "path";
 import { fileURLToPath } from "url";
-import { readConfigFile } from "bailian-cli-core";
+import {
+  cliTimeoutPrefix,
+  cliTimeoutSeconds,
+  e2eLabelFromMetaUrl,
+  isConsoleAuthFailure,
+  makeE2eOutputDir,
+  parseStdoutJson,
+} from "e2e/output";
+import { runNodeMain, type RunCliResult } from "e2e/runner";
+import {
+  isBailianE2EEnabled,
+  isBailianE2EMediaEnabled,
+  isBailianE2EVideoEnabled,
+  isChatE2EReady,
+  isConsoleE2EReady,
+  isDashScopeE2EReady,
+  isSearchE2EReady,
+} from "e2e/gating";
+import { monorepoRoot } from "e2e/monorepo-root";
 
-const execFileAsync = promisify(execFile);
+export {
+  cliTimeoutPrefix,
+  cliTimeoutSeconds,
+  e2eLabelFromMetaUrl,
+  isBailianE2EEnabled,
+  isBailianE2EMediaEnabled,
+  isBailianE2EVideoEnabled,
+  isChatE2EReady,
+  isConsoleAuthFailure,
+  isConsoleE2EReady,
+  isDashScopeE2EReady,
+  isSearchE2EReady,
+  makeE2eOutputDir,
+  monorepoRoot,
+  parseStdoutJson,
+};
+export type { RunCliResult };
 
-/**
- * Vitest `global-setup.ts` 写入 `test/output/` 下本文件名，供各 worker 进程读取同一会话 id。
- * （仅模块内变量无法跨 Vitest 多进程 worker 共享。）
- */
-export const E2E_RUN_SESSION_FILENAME = ".e2e-run-session";
-
-/**
- * 单次 `vp test` / Vitest 运行共用的 E2E 输出会话目录名（惰性缓存于当前进程）。
- */
-let e2eOutputSessionId: string | undefined;
-
-/** `packages/cli` 根目录（含 `src/main.ts`） */
+/** `packages/cli` 根目录 */
 export const cliPackageRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
 
 const mainTs = join(cliPackageRoot, "src", "main.ts");
 
-/** Monorepo 根（含根 `package.json`） */
-export function monorepoRoot(): string {
-  return join(cliPackageRoot, "..", "..");
-}
-
-function readE2eRunSessionFromOutputDir(): string | undefined {
-  try {
-    const p = join(monorepoRoot(), "test", "output", E2E_RUN_SESSION_FILENAME);
-    const t = readFileSync(p, "utf8").trim();
-    return t.length > 0 ? t : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-function getE2eOutputSessionId(): string {
-  if (!e2eOutputSessionId) {
-    const fromEnv = process.env.BAILIAN_E2E_RUN_ID?.trim();
-    if (fromEnv) {
-      e2eOutputSessionId = fromEnv.replace(/[^a-zA-Z0-9._-]+/g, "-");
-    } else {
-      const fromFile = readE2eRunSessionFromOutputDir();
-      if (fromFile) {
-        e2eOutputSessionId = fromFile.replace(/[^a-zA-Z0-9._-]+/g, "-");
-      } else {
-        e2eOutputSessionId = `e2e-run-${Date.now()}-${process.pid}`;
-      }
-    }
-  }
-  return e2eOutputSessionId;
-}
-
-/**
- * 在 `test/output/<会话>/` 下创建用例子目录。
- * 会话 id 优先 `BAILIAN_E2E_RUN_ID`，否则读 Vitest globalSetup 写入的 `test/output/.e2e-run-session`，
- * 再否则回退为单进程 id（非 Vitest 直接跑用例时）。
- * 若已设 `BAILIAN_E2E_OUT` 则直接使用（不再套会话目录）。
- */
-export function makeE2eOutputDir(label: string): string {
-  const fromEnv = process.env.BAILIAN_E2E_OUT?.trim();
-  if (fromEnv) {
-    mkdirSync(fromEnv, { recursive: true });
-    return fromEnv;
-  }
-  const safe = label.replace(/[^a-zA-Z0-9._-]+/g, "-");
-  const sessionDir = join(monorepoRoot(), "test", "output", getE2eOutputSessionId());
-  mkdirSync(sessionDir, { recursive: true });
-  const dir = join(sessionDir, `e2e-vp-${safe}-${Date.now()}`);
-  mkdirSync(dir, { recursive: true });
-  return dir;
-}
-
-/** 全局 `--timeout` 秒数（视频等长任务） */
-export function cliTimeoutSeconds(): string {
-  return process.env.BAILIAN_E2E_TIMEOUT_SEC?.trim() || "3600";
-}
-
-export function cliTimeoutPrefix(): string[] {
-  return ["--timeout", cliTimeoutSeconds()];
-}
-
-/** 显式开启后才跑真实网络 E2E，避免默认 `vp test` 依赖密钥或打外网 */
-export function isBailianE2EEnabled(): boolean {
-  return process.env.BAILIAN_E2E === "1";
-}
-
-/** 可调 DashScope 的 API Key：环境变量优先，否则读 ~/.bailian/config.json */
-export function isDashScopeE2EReady(): boolean {
-  if (!isBailianE2EEnabled()) return false;
-  if (process.env.DASHSCOPE_API_KEY?.trim()) return true;
-  try {
-    const f = readConfigFile();
-    return typeof f.api_key === "string" && f.api_key.length > 0;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Console-gateway 命令（quota / usage free / usage stats）的 E2E 就绪检查：
- * 需 `BAILIAN_E2E=1` 且存在 console access_token（环境变量 `DASHSCOPE_ACCESS_TOKEN`
- * 或 `~/.bailian/config.json` 的 `access_token`）。
- *
- * 仅检查 token 是否存在——无法本地判断是否过期。token 过期时 gated 用例仍会执行，
- * 但用 `isConsoleAuthFailure` 把“session 未登录/已过期”的优雅报错视为通过，保持
- * 与 deploy/dataset “无 key / 有效 key / 失效 key 均绿”的一致策略。
- */
-export function isConsoleE2EReady(): boolean {
-  if (!isBailianE2EEnabled()) return false;
-  if (process.env.DASHSCOPE_ACCESS_TOKEN?.trim()) return true;
-  try {
-    const config = readConfigFile();
-    return typeof config.access_token === "string" && config.access_token.length > 0;
-  } catch {
-    return false;
-  }
-}
-
-/** 语音与图像（可设 `BAILIAN_E2E_MEDIA=0` 在仅跑文本/记忆/知识库时跳过） */
-export function isBailianE2EMediaEnabled(): boolean {
-  if (process.env.BAILIAN_E2E_MEDIA === "0") return false;
-  return isBailianE2EEnabled();
-}
-
-/** 文生视频 / 图生视频 / 参考视频 / 视频编辑（耗时长，默认关闭） */
-export function isBailianE2EVideoEnabled(): boolean {
-  return isBailianE2EEnabled() && process.env.BAILIAN_E2E_VIDEO === "1";
-}
-
-/** 从 `import.meta.url` 生成 OUT 子目录标签，避免并行用例目录冲突 */
-export function e2eLabelFromMetaUrl(metaUrl: string): string {
-  return basename(fileURLToPath(metaUrl), ".ts").replace(/\.e2e\.test$/, "");
-}
-
-/** 知识库用例：须显式索引 ID + API-KEY 或 AK/SK */
-export function isKnowledgeE2EReady(): boolean {
-  if (!isBailianE2EEnabled()) return false;
-  if (!process.env.BAILIAN_E2E_INDEX_ID) return false;
-  const hasApiKey = isDashScopeE2EReady();
-  const hasAkSk =
-    !!process.env.ALIBABA_CLOUD_ACCESS_KEY_ID && !!process.env.ALIBABA_CLOUD_ACCESS_KEY_SECRET;
-  return hasApiKey || hasAkSk;
-}
-
-export function isKnowledgeAkSkReady(): boolean {
-  return (
-    isBailianE2EEnabled() &&
-    !!process.env.ALIBABA_CLOUD_ACCESS_KEY_ID &&
-    !!process.env.ALIBABA_CLOUD_ACCESS_KEY_SECRET &&
-    !!process.env.BAILIAN_E2E_INDEX_ID
-  );
-}
-
-export interface RunCliResult {
-  stdout: string;
-  stderr: string;
-  exitCode: number;
-}
-
-/**
- * 子进程执行 CLI（等价于在 `packages/cli` 下 `node src/main.ts ...`）。
- * request_id 等诊断信息在 stderr；`--output json` 时 JSON 在 stdout。
- */
+/** 子进程执行 bl CLI */
 export async function runCli(
   args: string[],
   envOverrides: NodeJS.ProcessEnv = {},
 ): Promise<RunCliResult> {
-  try {
-    const { stdout, stderr } = await execFileAsync("node", [mainTs, ...args], {
-      cwd: cliPackageRoot,
-      encoding: "utf8",
-      maxBuffer: 32 * 1024 * 1024,
-      env: {
-        ...process.env,
-        NODE_NO_WARNINGS: "1",
-        DO_NOT_TRACK: "1",
-        ...envOverrides,
-      },
-    });
-    return { stdout: stdout ?? "", stderr: stderr ?? "", exitCode: 0 };
-  } catch (err: unknown) {
-    const e = err as {
-      stdout?: string;
-      stderr?: string;
-      code?: number;
-    };
-    return {
-      stdout: e.stdout ?? "",
-      stderr: e.stderr ?? "",
-      exitCode: typeof e.code === "number" ? e.code : 1,
-    };
-  }
-}
-
-export function parseStdoutJson<T = unknown>(stdout: string): T {
-  const t = stdout.trim();
-  return JSON.parse(t) as T;
-}
-
-/**
- * 判断一次 CLI 运行是否因 console session 未登录/已过期而失败。
- *
- * Console E2E 用例的 readiness 闸（`isConsoleE2EReady`）只能判断 token 是否存在，
- * 无法判断是否过期；token 失效时 gated 用例仍会执行并拿到鉴权错误。本函数让用例
- * 参考 deploy/dataset 的做法：只要 CLI 把鉴权错误优雅上抛（非零退出 + stderr 说明
- * session 失效），即视为通过，而不是强求 exit 0 的成功输出。
- */
-export function isConsoleAuthFailure(result: RunCliResult): boolean {
-  if (result.exitCode === 0) return false;
-  return /not logged in|has expired|NotLogined|Run `bl auth login/i.test(result.stderr);
+  return runNodeMain(mainTs, args, { cwd: cliPackageRoot, env: envOverrides });
 }

packages/cli/tests/e2e/image-edit.e2e.test.ts

@@ -1,104 +0,0 @@
-import { describe, expect, test } from "vite-plus/test";
-import { dirname, join } from "path";
-import { fileURLToPath } from "url";
-import {
-  e2eLabelFromMetaUrl,
-  isBailianE2EMediaEnabled,
-  isDashScopeE2EReady,
-  makeE2eOutputDir,
-  parseStdoutJson,
-  runCli,
-} from "./helpers.ts";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-/**
- * Image edit E2E
- */
-
-describe("e2e: image edit", () => {
-  test("image 分组展示子命令帮助且成功退出", async () => {
-    const { stdout, stderr, exitCode } = await runCli(["image"]);
-    expect(exitCode, stderr).toBe(0);
-    const out = `${stdout}\n${stderr}`;
-    expect(out).toMatch(/image|generate|edit/i);
-  });
-
-  test("image edit --help 正常退出", async () => {
-    const { stderr, exitCode } = await runCli(["image", "edit", "--help"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stderr).toMatch(/edit|--image|--prompt/i);
-  });
-});
-
-describe.skipIf(!isBailianE2EMediaEnabled() || !isDashScopeE2EReady())("e2e: image edit", () => {
-  test("image edit 缺少 --image 时打印子命令帮助并退出 (0)", async () => {
-    const { stderr, exitCode } = await runCli([
-      "image",
-      "edit",
-      "--prompt",
-      "仅提示词",
-      "--non-interactive",
-    ]);
-    expect(exitCode).toBe(0);
-    expect(stderr).toMatch(/--image|Usage:/i);
-  });
-
-  test("image edit 缺少 --prompt 时打印子命令帮助并退出 (0)", async () => {
-    const testPng = join(__dirname, ".smoke-32.png");
-    const { stderr, exitCode } = await runCli([
-      "image",
-      "edit",
-      "--image",
-      testPng,
-      "--non-interactive",
-    ]);
-    expect(exitCode).toBe(0);
-    expect(stderr).toMatch(/--prompt|Usage:/i);
-  });
-
-  test("【qwen-image-2.0】图片编辑", async () => {
-    const outDir = makeE2eOutputDir(e2eLabelFromMetaUrl(import.meta.url));
-    const gen = await runCli([
-      "image",
-      "generate",
-      "--model",
-      "qwen-image-2.0",
-      "--prompt",
-      "一只简笔画小猫，白底",
-      "--out-dir",
-      outDir,
-      "--out-prefix",
-      "e2e-gen",
-      "--non-interactive",
-      "--output",
-      "json",
-    ]);
-    expect(gen.exitCode, gen.stderr).toBe(0);
-    const genData = parseStdoutJson<{ urls?: string[] }>(gen.stdout);
-    const imagePath = genData.urls?.[0];
-
-    expect(imagePath).toBeTruthy();
-
-    const ed = await runCli([
-      "image",
-      "edit",
-      "--model",
-      "qwen-image-2.0",
-      "--image",
-      imagePath!,
-      "--prompt",
-      "把背景改成浅蓝色",
-      "--out-dir",
-      outDir,
-      "--out-prefix",
-      "e2e-edit",
-      "--non-interactive",
-      "--output",
-      "json",
-    ]);
-    expect(ed.exitCode, ed.stderr).toBe(0);
-    const edData = parseStdoutJson<{ saved?: string[] }>(ed.stdout);
-    expect(edData.saved?.length ?? 0).toBeGreaterThan(0);
-  }, 600_000);
-});

packages/cli/tests/e2e/image-generate.e2e.test.ts

@@ -1,70 +0,0 @@
-import { describe, expect, test } from "vite-plus/test";
-import {
-  e2eLabelFromMetaUrl,
-  isBailianE2EMediaEnabled,
-  isDashScopeE2EReady,
-  makeE2eOutputDir,
-  parseStdoutJson,
-  runCli,
-} from "./helpers.ts";
-
-/**
- * Image generate：先做 help / 分组等常规检测（不依赖密钥、不调生成接口）。
- * 需 DashScope + 媒体 E2E 的缺参、dry-run 与真实生成放在 skip 块内；
- * 真实生成用例保持原逻辑与顺序，放在块内最后。
- */
-
-describe("e2e: image generate", () => {
-  test("image 分组展示子命令帮助且成功退出", async () => {
-    const { stdout, stderr, exitCode } = await runCli(["image"]);
-    expect(exitCode, stderr).toBe(0);
-    const out = `${stdout}\n${stderr}`;
-    expect(out).toMatch(/image|generate|edit/i);
-  });
-
-  test("image generate --help 正常退出", async () => {
-    const { stderr, exitCode } = await runCli(["image", "generate", "--help"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stderr).toMatch(/generate|--prompt|--model/i);
-  });
-});
-
-describe.skipIf(!isBailianE2EMediaEnabled() || !isDashScopeE2EReady())(
-  "e2e: image generate",
-  () => {
-    test("image generate 缺少 --prompt 时打印子命令帮助并退出 (0)", async () => {
-      const { stderr, exitCode } = await runCli([
-        "image",
-        "generate",
-        "--model",
-        "qwen-image-2.0",
-        "--non-interactive",
-      ]);
-      expect(exitCode).toBe(0);
-      expect(stderr).toMatch(/--prompt|Usage:/i);
-    });
-
-    test("【qwen-image-2.0】图片生成", async () => {
-      const outDir = makeE2eOutputDir(e2eLabelFromMetaUrl(import.meta.url));
-      const { stdout, stderr, exitCode } = await runCli([
-        "image",
-        "generate",
-        "--model",
-        "qwen-image-2.0",
-        "--prompt",
-        "一只简笔画小猫，白底",
-        "--out-dir",
-        outDir,
-        "--out-prefix",
-        "e2e-gen",
-        "--non-interactive",
-        "--output",
-        "json",
-      ]);
-      expect(exitCode, stderr).toBe(0);
-      const data = parseStdoutJson<{ saved?: string[] }>(stdout);
-      expect(data.saved?.length ?? 0).toBeGreaterThan(0);
-      expect(data.saved?.[0]).toContain("e2e-gen");
-    }, 300_000);
-  },
-);

packages/cli/tests/e2e/registry.smoke.e2e.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, test } from "vite-plus/test";
+import { deriveGroupPaths } from "e2e/registry-smoke";
+import { commands } from "../../src/commands.ts";
+import { runCli } from "./helpers.ts";
+
+const commandPaths = Object.keys(commands).sort();
+const groupPaths = deriveGroupPaths(commandPaths);
+
+describe("e2e: bl registry smoke", () => {
+  test("根帮助展示 bl 与全局 flag", async () => {
+    const { stderr, exitCode } = await runCli(["--help"]);
+    expect(exitCode, stderr).toBe(0);
+    expect(stderr).toMatch(/\bbl\b/i);
+    expect(stderr).toMatch(/--base-url/);
+    expect(stderr).toMatch(/--console-region/);
+    expect(stderr).toMatch(/--console-site/);
+    expect(stderr).toMatch(/--console-switch-agent/);
+    expect(stderr).not.toMatch(/^\s*--region\s/m);
+  });
+
+  test("quota check --help:Flags 含 console 域鉴权 flag,Global Flags 全量列出", async () => {
+    const { stderr, exitCode } = await runCli(["quota", "check", "--help"]);
+    expect(exitCode, stderr).toBe(0);
+    expect(stderr).toMatch(/Global Flags:/);
+    expect(stderr).toMatch(/--console-region <region>/);
+    expect(stderr).toMatch(/--model <model>/);
+    expect(stderr).toMatch(/--period <minutes>/);
+    expect(stderr).toMatch(/--output <format>/);
+    expect(stderr).not.toMatch(/API region \(default: cn-beijing\)/);
+  });
+
+  test.each(commandPaths)("已注册命令 %s --help 成功", async (path) => {
+    const { stderr, exitCode } = await runCli([...path.split(" "), "--help"]);
+    expect(exitCode, stderr).toBe(0);
+  });
+
+  test.each(groupPaths)("命令分组 %s --help 成功", async (path) => {
+    const { stderr, exitCode } = await runCli([...path.split(" "), "--help"]);
+    expect(exitCode, stderr).toBe(0);
+  });
+});

packages/cli/tests/e2e/usage-summary.e2e.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from "vite-plus/test";
+import { isConsoleE2EReady, isConsoleAuthFailure, parseStdoutJson, runCli } from "./helpers.ts";
+
+describe("e2e: usage summary", () => {
+  test("usage summary --help 正常退出", async () => {
+    const { stderr, exitCode } = await runCli(["usage", "summary", "--help"]);
+    expect(exitCode, stderr).toBe(0);
+    expect(stderr).toMatch(/--days|summary|usage/i);
+  });
+
+  test("usage summary --help 包含所有示例", async () => {
+    const { stderr, exitCode } = await runCli(["usage", "summary", "--help"]);
+    expect(exitCode, stderr).toBe(0);
+    expect(stderr).toContain("bl usage summary");
+    expect(stderr).toContain("bl usage summary --days 30");
+  });
+});
+
+describe.skipIf(!isConsoleE2EReady())("e2e: usage summary（Console）", () => {
+  test("usage summary --dry-run 输出 free-tier 计划请求", async () => {
+    const { stdout, stderr, exitCode } = await runCli([
+      "usage",
+      "summary",
+      "--dry-run",
+      "--output",
+      "json",
+    ]);
+    expect(exitCode, stderr).toBe(0);
+    const data = parseStdoutJson<{ freeTier?: { api?: string }; usage?: unknown }>(stdout);
+    expect(data.freeTier?.api).toContain("queryFreeTierQuota");
+  });
+
+  test("usage summary --dry-run --workspace-id 附带用量概览计划请求", async () => {
+    const { stdout, stderr, exitCode } = await runCli([
+      "usage",
+      "summary",
+      "--dry-run",
+      "--workspace-id",
+      "ws-e2e-dry-run",
+      "--output",
+      "json",
+    ]);
+    expect(exitCode, stderr).toBe(0);
+    const data = parseStdoutJson<{
+      usage?: { api?: string; data?: { reqDTO?: { filterWorkspaceId?: string } } };
+    }>(stdout);
+    expect(data.usage?.api).toContain("getModelUsageStatistic");
+    expect(data.usage?.data?.reqDTO?.filterWorkspaceId).toBe("ws-e2e-dry-run");
+  });
+
+  test("usage summary 文本输出正常返回", async () => {
+    const result = await runCli(["usage", "summary", "--output", "text"]);
+    if (isConsoleAuthFailure(result)) return;
+    expect(result.exitCode, result.stderr).toBe(0);
+  });
+
+  test("usage summary JSON 输出包含 freeTier 字段", async () => {
+    const result = await runCli(["usage", "summary", "--output", "json"]);
+    if (isConsoleAuthFailure(result)) return;
+    expect(result.exitCode, result.stderr).toBe(0);
+    const data = parseStdoutJson<{ freeTier?: unknown; period?: unknown }>(result.stdout);
+    expect(data.period).toBeTypeOf("object");
+    expect(Array.isArray(data.freeTier)).toBe(true);
+  });
+});

packages/cli/tests/e2e/video-generate-i2v.e2e.test.ts

@@ -1,115 +0,0 @@
-import { join } from "node:path";
-import { describe, expect, test } from "vite-plus/test";
-import {
-  cliTimeoutPrefix,
-  e2eLabelFromMetaUrl,
-  isBailianE2EVideoEnabled,
-  isDashScopeE2EReady,
-  makeE2eOutputDir,
-  parseStdoutJson,
-  runCli,
-} from "./helpers.ts";
-
-/**
- * Video generate (i2v)：help / 分组不依赖密钥；长任务需视频 E2E + DashScope。
- */
-
-describe("e2e: video generate (i2v)", () => {
-  test("video 分组展示子命令帮助且成功退出", async () => {
-    const { stdout, stderr, exitCode } = await runCli(["video"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(`${stdout}\n${stderr}`).toMatch(/video|generate|edit|ref|task|download/i);
-  });
-
-  test("video generate --help 正常退出", async () => {
-    const { stderr, exitCode } = await runCli(["video", "generate", "--help"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stderr).toMatch(/generate|--prompt|--image|model/i);
-  });
-});
-
-describe.skipIf(!isBailianE2EVideoEnabled() || !isDashScopeE2EReady())(
-  "e2e: video generate (i2v)（DashScope 视频）",
-  () => {
-    test("video generate 缺少 --prompt 时打印子命令帮助并退出 (0)", async () => {
-      const { stderr, exitCode } = await runCli([
-        ...cliTimeoutPrefix(),
-        "video",
-        "generate",
-        "--model",
-        "happyhorse-1.1-i2v",
-        "--image",
-        "https://example.com/placeholder.png",
-        "--non-interactive",
-      ]);
-      expect(exitCode).toBe(0);
-      expect(stderr).toMatch(/--prompt|Usage:/i);
-    });
-
-    test("video generate --dry-run（无 --image）仅输出 request（t2v 路径不调上传）", async () => {
-      const { stdout, stderr, exitCode } = await runCli([
-        ...cliTimeoutPrefix(),
-        "video",
-        "generate",
-        "--dry-run",
-        "--model",
-        "happyhorse-1.1-t2v",
-        "--prompt",
-        "干跑无图",
-        "--non-interactive",
-        "--output",
-        "json",
-      ]);
-      expect(exitCode, stderr).toBe(0);
-      const data = parseStdoutJson<{ request?: { input?: { prompt?: string; media?: unknown } } }>(
-        stdout,
-      );
-      expect(data.request?.input?.prompt).toBe("干跑无图");
-      expect(data.request?.input?.media).toBeUndefined();
-    });
-
-    test("【happyhorse-1.1-i2v】图片生成视频", async () => {
-      const outDir = makeE2eOutputDir(e2eLabelFromMetaUrl(import.meta.url));
-      const png = join(outDir, "e2e-gen.png");
-      const gen = await runCli([
-        "image",
-        "generate",
-        "--model",
-        "qwen-image-2.0",
-        "--prompt",
-        "一只简笔画小猫，白底",
-        "--out-dir",
-        outDir,
-        "--out-prefix",
-        "e2e-gen",
-        "--non-interactive",
-        "--output",
-        "json",
-      ]);
-      expect(gen.exitCode, gen.stderr).toBe(0);
-      const genData = parseStdoutJson<{ saved?: string[] }>(gen.stdout);
-      const imagePath = genData.saved?.[0] ?? png;
-
-      const { stdout, stderr, exitCode } = await runCli([
-        ...cliTimeoutPrefix(),
-        "video",
-        "generate",
-        "--model",
-        "happyhorse-1.1-i2v",
-        "--image",
-        imagePath,
-        "--prompt",
-        "镜头缓慢推进，小猫微微动一下",
-        "--download",
-        join(outDir, "e2e-video-i2v.mp4"),
-        "--non-interactive",
-        "--output",
-        "json",
-      ]);
-      expect(exitCode, stderr).toBe(0);
-      const data = parseStdoutJson<{ status?: string; video_url?: string; saved?: string }>(stdout);
-      expect(data.status).toBe("SUCCEEDED");
-      expect(data.video_url?.startsWith("https://")).toBe(true);
-    }, 3_600_000);
-  },
-);

packages/cli/tests/e2e/video-ref-r2v.e2e.test.ts

@@ -1,108 +0,0 @@
-import { join } from "node:path";
-import { describe, expect, test } from "vite-plus/test";
-import {
-  cliTimeoutPrefix,
-  e2eLabelFromMetaUrl,
-  isBailianE2EVideoEnabled,
-  isDashScopeE2EReady,
-  makeE2eOutputDir,
-  parseStdoutJson,
-  runCli,
-} from "./helpers.ts";
-
-/**
- * Video ref (r2v)：help / 分组不依赖密钥；参考生成需视频 E2E + DashScope。
- */
-
-describe("e2e: video ref (r2v)", () => {
-  test("video 分组展示子命令帮助且成功退出", async () => {
-    const { stdout, stderr, exitCode } = await runCli(["video"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(`${stdout}\n${stderr}`).toMatch(/video|generate|edit|ref|task|download/i);
-  });
-
-  test("video ref --help 正常退出", async () => {
-    const { stderr, exitCode } = await runCli(["video", "ref", "--help"]);
-    expect(exitCode, stderr).toBe(0);
-    expect(stderr).toMatch(/ref|--prompt|--image|model/i);
-  });
-});
-
-describe.skipIf(!isBailianE2EVideoEnabled() || !isDashScopeE2EReady())(
-  "e2e: video ref (r2v)（DashScope 视频）",
-  () => {
-    test("video ref 缺少 --prompt 时打印子命令帮助并退出 (0)", async () => {
-      const { stderr, exitCode } = await runCli([
-        ...cliTimeoutPrefix(),
-        "video",
-        "ref",
-        "--model",
-        "happyhorse-1.1-r2v",
-        "--image",
-        "https://example.com/x.png",
-        "--non-interactive",
-      ]);
-      expect(exitCode).toBe(0);
-      expect(stderr).toMatch(/--prompt|Usage:/i);
-    });
-
-    test("video ref 缺少 --image 与 --ref-video 时退出为用法错误 (2)", async () => {
-      const { stderr, exitCode } = await runCli([
-        ...cliTimeoutPrefix(),
-        "video",
-        "ref",
-        "--model",
-        "happyhorse-1.1-r2v",
-        "--prompt",
-        "仅有描述无素材",
-        "--non-interactive",
-      ]);
-      expect(exitCode).toBe(2);
-      expect(stderr).toMatch(/--image|ref-video|At least one|required/i);
-    });
-
-    test("【happyhorse-1.1-r2v】视频参考生成", async () => {
-      const outDir = makeE2eOutputDir(e2eLabelFromMetaUrl(import.meta.url));
-      const gen = await runCli([
-        "image",
-        "generate",
-        "--model",
-        "qwen-image-2.0",
-        "--prompt",
-        "一片绿色的树叶，白底",
-        "--out-dir",
-        outDir,
-        "--out-prefix",
-        "e2e-gen",
-        "--non-interactive",
-        "--output",
-        "json",
-      ]);
-      expect(gen.exitCode, gen.stderr).toBe(0);
-      const genData = parseStdoutJson<{ saved?: string[] }>(gen.stdout);
-      const imagePath = genData.saved?.[0];
-      expect(imagePath).toBeTruthy();
-
-      const { stdout, stderr, exitCode } = await runCli([
-        ...cliTimeoutPrefix(),
-        "video",
-        "ref",
-        "--model",
-        "happyhorse-1.1-r2v",
-        "--prompt",
-        "图1在画面中心轻微晃动",
-        "--image",
-        imagePath!,
-        "--download",
-        join(outDir, "e2e-video-r2v.mp4"),
-        "--non-interactive",
-        "--output",
-        "json",
-      ]);
-      expect(exitCode, stderr).toBe(0);
-      const data = parseStdoutJson<{ status?: string; video_url?: string }>(stdout);
-      expect(data.status).toBe("SUCCEEDED");
-      expect(data.video_url?.startsWith("https://")).toBe(true);
-    }, 3_600_000);
-  },
-);

packages/cli/tests/fixtures/command-pack/commands.mjs

@@ -0,0 +1,58 @@
+const ping = {
+  description: "Ping the Command Pack fixture",
+  auth: "none",
+  flags: {
+    message: {
+      type: "string",
+      valueHint: "<text>",
+      required: true,
+      description: "Message returned by the fixture",
+    },
+  },
+  usageArgs: "--message <text>",
+  exampleArgs: ['--message "hello"'],
+  async run(ctx) {
+    process.stdout.write(`command-pack:${ctx.flags.message}\n`);
+  },
+};
+
+const credential = {
+  description: "Read an API key through the Command Pack host adapter",
+  auth: "apiKey",
+  async run(ctx) {
+    const apiKey = ctx.credentials.apiKey();
+    process.stdout.write(`credential-source:${apiKey.source}\n`);
+  },
+};
+
+const credentialDenied = {
+  description: "Verify credential access also requires command auth",
+  auth: "none",
+  async run(ctx) {
+    ctx.credentials.apiKey();
+  },
+};
+
+const output = {
+  description: "Exercise the Command Pack output helper",
+  auth: "none",
+  async run(ctx) {
+    ctx.output.result({ source: "command-pack", ok: true }, { text: "command-pack-output" });
+  },
+};
+
+const fail = {
+  description: "Exercise the Command Pack semantic error helper",
+  auth: "none",
+  async run(ctx) {
+    throw ctx.errors.usage("Command Pack fixture usage error.", "Use agent fail only in tests.");
+  },
+};
+
+export default {
+  "agent credential": credential,
+  "agent credential-denied": credentialDenied,
+  "agent fail": fail,
+  "agent output": output,
+  "agent ping": ping,
+};

packages/cli/tests/fixtures/command-pack/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@ali/bailian-plugin-agent",
+  "version": "0.0.0-test",
+  "private": true,
+  "type": "module",
+  "bailianCli": {
+    "type": "command-pack",
+    "apiVersion": 1,
+    "entry": "./commands.mjs",
+    "minCliVersion": "1.7.0"
+  }
+}

packages/cli/tests/install-doc.test.ts

@@ -0,0 +1,73 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { credentialFlagDefs, GLOBAL_FLAGS, type AnyCommand } from "bailian-cli-core";
+import { monorepoRoot } from "e2e/monorepo-root";
+import { describe, expect, test } from "vite-plus/test";
+import { commands } from "../src/commands.ts";
+
+const repositoryRoot = monorepoRoot();
+const installGuide = readFileSync(join(repositoryRoot, "INSTALL.md"), "utf8");
+const cliPackage = JSON.parse(
+  readFileSync(join(repositoryRoot, "packages/cli/package.json"), "utf8"),
+) as {
+  engines?: { node?: string };
+};
+
+function toFlagName(key: string): string {
+  return `--${key.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`)}`;
+}
+
+function findDocumentedCommand(snippet: string): {
+  commandPath?: string;
+  command?: AnyCommand;
+} {
+  const argumentText = snippet.slice("bl ".length).trim();
+  const commandPath = Object.keys(commands)
+    .sort((leftPath, rightPath) => rightPath.length - leftPath.length)
+    .find((candidatePath) => {
+      return argumentText === candidatePath || argumentText.startsWith(`${candidatePath} `);
+    });
+
+  return commandPath ? { commandPath, command: commands[commandPath] } : {};
+}
+
+function documentedCommandSnippets(): string[] {
+  const fencedCommands = installGuide
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.startsWith("bl "));
+  const inlineCommands = Array.from(installGuide.matchAll(/`(bl [^`\n]+)`/g), (match) => match[1]);
+  return [...new Set([...fencedCommands, ...inlineCommands])];
+}
+
+describe("INSTALL.md", () => {
+  test("发布包 Node.js 要求与安装文档一致", () => {
+    const nodeEngine = cliPackage.engines?.node;
+    expect(nodeEngine).toMatch(/^>=\d+\.\d+\.\d+$/);
+    expect(installGuide).toContain(`要求 **≥ ${nodeEngine?.slice(2)}**`);
+  });
+
+  test("示例只使用当前命令支持的 flags", () => {
+    for (const snippet of documentedCommandSnippets()) {
+      const { commandPath, command } = findDocumentedCommand(snippet);
+      const argumentText = snippet.slice("bl ".length).trim();
+
+      if (!commandPath || !command) {
+        expect(argumentText, `INSTALL.md 中存在未知命令：${snippet}`).toMatch(/^--/);
+      }
+
+      const supportedFlags = {
+        ...GLOBAL_FLAGS,
+        ...(command ? credentialFlagDefs(command) : {}),
+        ...command?.flags,
+      };
+      const supportedFlagNames = new Set(Object.keys(supportedFlags).map(toFlagName));
+      const usedFlagNames = Array.from(snippet.matchAll(/--[a-z0-9-]+/g), (match) => match[0]);
+      const unsupportedFlagNames = usedFlagNames.filter(
+        (flagName) => !supportedFlagNames.has(flagName),
+      );
+
+      expect(unsupportedFlagNames, `INSTALL.md 命令使用了未声明的 flag：${snippet}`).toEqual([]);
+    }
+  });
+});

packages/cli/tests/stress/lib/cli-runner.mjs

@@ -1,7 +1,8 @@
 /**
- * 子进程执行 CLI：spawn node main.ts，解析 stdout。
+ * 子进程执行 CLI：spawn 仓库本地 tsx main.ts，解析 stdout。
  */
 import { spawn } from "node:child_process";
+import { resolveTsxBin } from "./paths.mjs";
 import { truncateLog, extractError, isRateLimitFailure } from "./parsers.mjs";
 import { captureTraceIdsFromText, enrichTraceIdsAsync } from "./trace-ids.mjs";
 
@@ -51,12 +52,13 @@ export function executeSingleCli(ctx) {
     parseStdout,
     readFileOptional,
     asrOutPath,
+    TSX_BIN = resolveTsxBin(),
   } = ctx;
 
   const startedAt = Date.now();
 
   return new Promise((resolve) => {
-    const child = spawn("node", [MAIN_TS, ...stressCliArgs(cliArgs)], {
+    const child = spawn(TSX_BIN, [MAIN_TS, ...stressCliArgs(cliArgs)], {
       cwd: CLI_PACKAGE,
       env: process.env,
       stdio: ["ignore", "pipe", "pipe"],

packages/cli/tests/stress/lib/define-stress-target.mjs

@@ -6,7 +6,7 @@ import { join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 
-import { DEFAULT_CLI_PACKAGE, MONOREPO_ROOT, resolveMainTs } from "./paths.mjs";
+import { DEFAULT_CLI_PACKAGE, MONOREPO_ROOT, resolveMainTs, resolveTsxBin } from "./paths.mjs";
 import { parseStressArgv, optFrom } from "./argv-parse.mjs";
 import { resolveStressCountAndConcurrency } from "./stress-config.mjs";
 import { SubmissionRateLimiter } from "./rate-limit.mjs";
@@ -38,6 +38,7 @@ export function defineStressTarget(config) {
     const globals = ctx?.globals ?? {};
     const CLI_PACKAGE = optFrom(ARGV, "CLI_PACKAGE") || DEFAULT_CLI_PACKAGE;
     const MAIN_TS = resolveMainTs(CLI_PACKAGE);
+    const TSX_BIN = resolveTsxBin();
 
     const canonical = ctx?.canonicalTarget ?? config.canonical;
     const {
@@ -142,9 +143,9 @@ export function defineStressTarget(config) {
       return stressExit(ctx, 1);
     }
     try {
-      await execFileAsync("node", ["--version"], { encoding: "utf8" });
+      await execFileAsync(TSX_BIN, ["--version"], { encoding: "utf8" });
     } catch {
-      console.error("未找到 node。");
+      console.error("未找到仓库本地 tsx，请先运行 pnpm install。");
       return stressExit(ctx, 1);
     }
 
@@ -177,6 +178,7 @@ export function defineStressTarget(config) {
       return executeSingleCli({
         MAIN_TS,
         CLI_PACKAGE,
+        TSX_BIN,
         TIMEOUT_MS,
         MAX_LOG_CAPTURE,
         index,

packages/cli/tests/stress/lib/fixtures.mjs

@@ -97,7 +97,6 @@ export async function ensurePrerequisites(ctx) {
       "压测前置语音样本，用于语音识别链路。",
       "--out",
       outAudio,
-      "--non-interactive",
       "--output",
       "json",
     ];
@@ -137,7 +136,6 @@ export async function ensurePrerequisites(ctx) {
       fixturesDir,
       "--out-prefix",
       "stress-setup-image",
-      "--non-interactive",
       "--output",
       "json",
       "--timeout",
@@ -187,7 +185,6 @@ export async function ensurePrerequisites(ctx) {
       "5",
       "--download",
       downloadPath,
-      "--non-interactive",
       "--output",
       "json",
       "--timeout",

packages/cli/tests/stress/lib/parsers.mjs

@@ -78,7 +78,7 @@ export function parseImageResult(stdout) {
       const ids = data.task_ids ?? [data.task_id];
       return {
         ok: false,
-        error: `仅返回 task_id，未等待生成完成: ${ids.join(", ")}。请勿使用 --no-wait，或检查 ~/.bailian/config.json 是否开启 async`,
+        error: `仅返回 task_id，未等待生成完成: ${ids.join(", ")}。请勿使用 --async，或检查调用参数是否开启 async`,
       };
     }
     return { ok: false, error: "JSON 中无 urls / saved 字段（可能生成未完成）" };
@@ -169,7 +169,7 @@ export function parseVideoResult(stdout) {
       const ids = taskIds ?? [taskId];
       return {
         ok: false,
-        error: `仅返回 task_id，未等待生成完成: ${ids.join(", ")}。请勿使用 --no-wait，或检查 ~/.bailian/config.json 是否开启 async`,
+        error: `仅返回 task_id，未等待生成完成: ${ids.join(", ")}。请勿使用 --async，或检查调用参数是否开启 async`,
       };
     }
     return { ok: false, error: "JSON 中无 video_url / saved 字段（可能生成未完成）" };

packages/cli/tests/stress/lib/paths.mjs

@@ -16,7 +16,22 @@ export const DEFAULT_CLI_PACKAGE = join(STRESS_ROOT, "..", "..");
 /** monorepo 根目录 */
 export const MONOREPO_ROOT = join(DEFAULT_CLI_PACKAGE, "..", "..");
 
-/** CLI 入口 main.ts（ts-node 或直接 node ts 由项目脚本决定） */
+/** CLI 入口 main.ts（由仓库本地 tsx 执行） */
 export function resolveMainTs(cliPackage = DEFAULT_CLI_PACKAGE) {
   return join(cliPackage, "src", "main.ts");
 }
+
+/** monorepo 本地 bin 路径，避免 `pnpm run` 生命周期日志污染 stdout */
+export function resolveLocalBin(name) {
+  return join(
+    MONOREPO_ROOT,
+    "node_modules",
+    ".bin",
+    process.platform === "win32" ? `${name}.cmd` : name,
+  );
+}
+
+/** tsx 可执行文件路径 */
+export function resolveTsxBin() {
+  return resolveLocalBin("tsx");
+}

packages/cli/tests/stress/lib/suite-fixtures.mjs

@@ -59,7 +59,6 @@ export async function generateCombinedFixtures({ suiteRoot, cliPackage }) {
       "压测前置语音样本，用于语音识别链路。",
       "--out",
       outAudio,
-      "--non-interactive",
       "--output",
       "json",
     ],
@@ -95,7 +94,6 @@ export async function generateCombinedFixtures({ suiteRoot, cliPackage }) {
       fixturesDir,
       "--out-prefix",
       "stress-setup-image",
-      "--non-interactive",
       "--output",
       "json",
       "--timeout",
@@ -139,7 +137,6 @@ export async function generateCombinedFixtures({ suiteRoot, cliPackage }) {
       "5",
       "--download",
       downloadPath,
-      "--non-interactive",
       "--output",
       "json",
       "--timeout",

packages/cli/tests/stress/targets/image-edit.mjs

@@ -52,7 +52,6 @@ export const runStress = defineStressTarget({
     prompt,
     "--out-dir",
     runDir,
-    "--non-interactive",
     "--output",
     "json",
     "--timeout",

packages/cli/tests/stress/targets/image-generate.mjs

@@ -95,7 +95,6 @@ export const runStress = defineStressTarget({
     prompt,
     "--out-dir",
     runDir,
-    "--non-interactive",
     "--output",
     "json",
     "--timeout",

packages/cli/tests/stress/targets/speech-recognize.mjs

@@ -41,7 +41,6 @@ export const runStress = defineStressTarget({
     String(POLL_INTERVAL),
     "--out",
     join(runDir, "asr-result.json"),
-    "--non-interactive",
     "--timeout",
     String(CLI_TIMEOUT_SEC),
     "--language",

packages/cli/tests/stress/targets/speech-synthesize.mjs

@@ -45,7 +45,6 @@ export const runStress = defineStressTarget({
     prompt,
     "--out",
     `${runDir}/audio_${String(index + 1).padStart(3, "0")}.mp3`,
-    "--non-interactive",
     "--output",
     "json",
     "--timeout",

packages/cli/tests/stress/targets/text-chat.mjs

@@ -37,7 +37,6 @@ export const runStress = defineStressTarget({
     MODEL,
     "--message",
     prompt,
-    "--non-interactive",
     "--output",
     "json",
     "--timeout",

packages/cli/tests/stress/targets/video-edit.mjs

@@ -64,7 +64,6 @@ export const runStress = defineStressTarget({
     join(runDir, `edited_${String(index + 1).padStart(3, "0")}.mp4`),
     "--duration",
     String(extraParams.DURATION),
-    "--non-interactive",
     "--output",
     "json",
     "--timeout",

packages/cli/tests/stress/targets/video-i2v.mjs

@@ -66,7 +66,6 @@ export const runStress = defineStressTarget({
     join(runDir, `video_${String(index + 1).padStart(3, "0")}.mp4`),
     "--duration",
     String(extraParams.DURATION),
-    "--non-interactive",
     "--output",
     "json",
     "--timeout",

packages/cli/tests/stress/targets/video-ref.mjs

@@ -66,7 +66,6 @@ export const runStress = defineStressTarget({
     join(runDir, `ref_${String(index + 1).padStart(3, "0")}.mp4`),
     "--duration",
     String(extraParams.DURATION),
-    "--non-interactive",
     "--output",
     "json",
     "--timeout",

packages/cli/tests/stress/targets/video-t2v.mjs

@@ -79,7 +79,6 @@ export const runStress = defineStressTarget({
     join(runDir, `video_${String(index + 1).padStart(3, "0")}.mp4`),
     "--duration",
     String(extraParams.DURATION),
-    "--non-interactive",
     "--output",
     "json",
     "--timeout",

packages/cli/tsconfig.json

@@ -5,7 +5,6 @@
     "moduleDetection": "force",
     "module": "nodenext",
     "moduleResolution": "nodenext",
-    "customConditions": ["@bailian-cli/source"],
     "resolveJsonModule": true,
     "types": ["node"],
     "strict": true,

packages/cli/vite.config.ts

@@ -2,7 +2,7 @@ import { defineConfig } from "vite-plus";
 
 export default defineConfig({
   test: {
-    globalSetup: "./tests/e2e/global-setup.ts",
+    globalSetup: "../e2e/src/global-setup.ts",
     testTimeout: 60_000,
     hookTimeout: 60_000,
   },

packages/commands/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bailian-cli-commands",
-  "version": "1.5.0",
+  "version": "1.13.0",
   "description": "Command library for bailian-cli products (knowledge, memory, media, …). See https://www.npmjs.com/package/bailian-cli for usage.",
   "homepage": "https://bailian.console.aliyun.com/cli",
   "bugs": {
@@ -20,8 +20,8 @@
   "types": "./dist/index.d.mts",
   "exports": {
     ".": {
-      "@bailian-cli/source": "./src/index.ts",
-      "default": "./dist/index.mjs"
+      "types": "./src/index.ts",
+      "default": "./src/index.ts"
     },
     "./package.json": "./package.json"
   },
@@ -40,19 +40,22 @@
     "check": "vp check"
   },
   "dependencies": {
+    "@openagentpack/sdk": "0.3.1",
     "bailian-cli-core": "workspace:*",
     "bailian-cli-runtime": "workspace:*",
     "boxen": "catalog:",
     "chalk": "catalog:",
+    "smol-toml": "catalog:",
     "yaml": "catalog:"
   },
   "devDependencies": {
     "@types/node": "catalog:",
     "@typescript/native-preview": "7.0.0-dev.20260328.1",
+    "e2e": "workspace:*",
     "typescript": "^6.0.2",
     "vite-plus": "0.1.22"
   },
   "engines": {
-    "node": ">=22.12.0"
+    "node": ">=18.17.0"
   }
 }

packages/commands/src/commands/advisor/recommend.ts

@@ -1,25 +1,21 @@
 import {
   analyzeIntent,
   buildDocLink,
-  type Config,
   defineCommand,
   detectOutputFormat,
   type GetModelsOptions,
-  type GlobalFlags,
   getModels,
   type IntentProfile,
-  isInteractive,
   type PipelineStep,
   type RecommendedModel,
   type RecommendResult,
   rankModels,
   recallSemantic,
+  SEMANTIC_TOP_K,
 } from "bailian-cli-core";
 import boxen from "boxen";
 import chalk, { Chalk, type ChalkInstance } from "chalk";
-import { emitBare, emitResult } from "bailian-cli-runtime";
-import { createSpinner } from "bailian-cli-runtime";
-import { failIfMissing, promptText, cmdUsage } from "bailian-cli-runtime";
+import { createSpinner, emitBare, emitResult, supportsColor } from "bailian-cli-runtime";
 
 function formatContextWindow(tokens: number): string {
   if (tokens >= 1_000_000)
@@ -59,8 +55,13 @@ const PREFERENCE_MODE_LABELS: Record<string, string> = {
   alternative: "Alternative",
 };
 
-function formatIntentSummary(intent: IntentProfile, noColor: boolean): string {
-  const colorize = noColor ? new Chalk({ level: 0 }) : chalk;
+function chalkFor(out: NodeJS.WriteStream): ChalkInstance {
+  return supportsColor(out) ? chalk : new Chalk({ level: 0 });
+}
+
+function formatIntentSummary(intent: IntentProfile): string {
+  const colorize = chalkFor(process.stdout);
+  const useColor = supportsColor(process.stdout);
 
   const lines: string[] = [];
   lines.push(colorize.cyan.bold("Intent Analysis"));
@@ -125,15 +126,20 @@ function formatIntentSummary(intent: IntentProfile, noColor: boolean): string {
   return boxen(lines.join("\n"), {
     padding: { top: 0, bottom: 0, left: 1, right: 1 },
     margin: { top: 0, bottom: 0, left: 1, right: 0 },
-    borderColor: "cyan",
+    borderColor: useColor ? "cyan" : undefined,
     borderStyle: "round",
-    dimBorder: true,
+    dimBorder: useColor,
   });
 }
 
 const RECOMMEND_LABELS = ["Best Pick", "Runner-Up", "Alternative"];
 
-function renderCard(rec: RecommendedModel, index: number, colorize: ChalkInstance): string {
+function renderCard(
+  rec: RecommendedModel,
+  index: number,
+  colorize: ChalkInstance,
+  useColor: boolean,
+): string {
   const labelColors = [colorize.green.bold, colorize.blue.bold, colorize.magenta.bold];
   const colorFn = labelColors[index] ?? colorize.white.bold;
   const label = RECOMMEND_LABELS[index] ?? `#${index + 1}`;
@@ -169,19 +175,21 @@ function renderCard(rec: RecommendedModel, index: number, colorize: ChalkInstanc
   return boxen(lines.join("\n"), {
     padding: { top: 0, bottom: 0, left: 1, right: 1 },
     margin: { top: 0, bottom: 0, left: 1, right: 0 },
-    borderColor: "gray",
+    borderColor: useColor ? "gray" : undefined,
     borderStyle: "round",
-    dimBorder: true,
+    dimBorder: useColor,
   });
 }
 
-function formatSingleResult(results: RecommendedModel[], noColor: boolean): string {
-  const colorize = noColor ? new Chalk({ level: 0 }) : chalk;
-  return results.map((rec, idx) => renderCard(rec, idx, colorize)).join("\n");
+function formatSingleResult(results: RecommendedModel[]): string {
+  const colorize = chalkFor(process.stdout);
+  const useColor = supportsColor(process.stdout);
+  return results.map((rec, idx) => renderCard(rec, idx, colorize, useColor)).join("\n");
 }
 
-function formatPipelineResult(summary: string, steps: PipelineStep[], noColor: boolean): string {
-  const colorize = noColor ? new Chalk({ level: 0 }) : chalk;
+function formatPipelineResult(summary: string, steps: PipelineStep[]): string {
+  const colorize = chalkFor(process.stdout);
+  const useColor = supportsColor(process.stdout);
   const lines: string[] = [];
   lines.push(`  ${colorize.yellow.bold("⚡ Pipeline")}  ${summary}`);
 
@@ -196,17 +204,19 @@ function formatPipelineResult(summary: string, steps: PipelineStep[], noColor: b
     }
 
     lines.push("");
-    lines.push(recommendations.map((rec, idx) => renderCard(rec, idx, colorize)).join("\n"));
+    lines.push(
+      recommendations.map((rec, idx) => renderCard(rec, idx, colorize, useColor)).join("\n"),
+    );
   }
 
   return lines.join("\n");
 }
 
-function formatResult(result: RecommendResult, noColor: boolean): string {
+function formatResult(result: RecommendResult): string {
   if (result.type === "pipeline") {
-    return formatPipelineResult(result.summary, result.steps, noColor);
+    return formatPipelineResult(result.summary, result.steps);
   }
-  return formatSingleResult(result.recommendations, noColor);
+  return formatSingleResult(result.recommendations);
 }
 
 function isEmptyResult(result: RecommendResult): boolean {
@@ -217,76 +227,105 @@ function isEmptyResult(result: RecommendResult): boolean {
 export default defineCommand({
   description:
     "Recommend the best models for your use case (intent analysis → candidate recall → LLM ranking)",
-  usageArgs: "<prompt> [flags]",
-  options: [
-    {
-      flag: "--message <text>",
-      description: "Describe your requirements (alternative to positional prompt)",
+  auth: "apiKey",
+  usageArgs: "--message <text> [flags]",
+  flags: {
+    message: {
+      type: "string",
+      valueHint: "<text>",
+      description: "Describe your requirements",
+      required: true,
     },
-    {
-      flag: "--dry-run",
-      description: "Show intent analysis and candidate list without LLM ranking",
-    },
-    {
-      flag: "--output <format>",
-      description: "Output format: text (default in TTY), json, yaml",
-    },
-  ],
+  },
   exampleArgs: [
     '--message "I need a visual-understanding chatbot"',
     '--message "Build an Agent that auto-generates animations"',
     '--message "Legal contract review, high precision required"',
-    '--message "Low-cost high-concurrency online customer service" --output json',
+    '--message "Low-cost high-concurrency online customer service" --output text',
     '--message "Long document summarization" --dry-run',
-    "                                          # Interactive input",
   ],
-  async run(config: Config, flags: GlobalFlags) {
-    const positional = ((flags as Record<string, unknown>)._positional as string[]) ?? [];
-    let userInput = (flags.message as string) || positional.join(" ");
-
-    if (!userInput.trim()) {
-      if (isInteractive({ nonInteractive: config.nonInteractive })) {
-        const hint = await promptText({ message: "Describe your requirement:" });
-        if (!hint) {
-          process.stderr.write("Cancelled.\n");
-          process.exit(1);
-        }
-        userInput = hint;
-      } else {
-        failIfMissing("message", cmdUsage(config, '"your requirement"'));
-      }
-    }
-
+  async run(ctx) {
+    const { settings, flags } = ctx;
+    const userInput = flags.message;
     const top = 3;
-    const format = detectOutputFormat(config.output);
+    // Default to JSON for structured output; render boxen cards only when the
+    // user explicitly asked for text output.
+    const format = settings.outputExplicit ? detectOutputFormat(settings.output) : "json";
+
+    // Stage 1: Intent Analysis + Model Loading (parallel)
+    const spinner = createSpinner("Agent: Loading model data & analyzing intent...");
+    spinner.start();
 
     const modelsOptions: GetModelsOptions = {
-      onPrepareStart: () => process.stderr.write("Initializing model data...\n"),
+      onPrepareStart: () => {},
     };
-    process.stderr.write("Analyzing your request...\n");
-    const [allModels, intent] = await Promise.all([
-      getModels(config, modelsOptions),
-      analyzeIntent(config, userInput),
-    ]);
+
+    // Track individual completions for spinner updates
+    let modelsReady = false;
+    let intentReady = false;
+
+    const getModelsPromise = getModels(settings, modelsOptions).then((result) => {
+      modelsReady = true;
+      if (!intentReady) {
+        spinner.update("Agent: Model data loaded, analyzing intent...");
+      }
+      return result;
+    });
+
+    const analyzeIntentPromise = analyzeIntent(ctx.client, userInput).then((result) => {
+      intentReady = true;
+      if (!modelsReady) {
+        spinner.update("Agent: Intent analyzed, loading model data...");
+      }
+      return result;
+    });
+
+    const [allModels, intent] = await Promise.all([getModelsPromise, analyzeIntentPromise]);
+
+    spinner.stop();
 
     if (intent.confidence === 0) {
       process.stderr.write("Intent analysis timed out, using defaults...\n");
-    } else {
-      process.stderr.write("\n");
     }
 
     // Stage 2: Candidate Recall (semantic recall, auto-builds embeddings on first run)
-    const candidates = await recallSemantic(config, allModels, userInput, 50, intent);
+    spinner.update("Agent: Recalling candidates...");
+    spinner.start();
 
-    if (config.dryRun) {
+    const candidates = await recallSemantic(
+      ctx.client,
+      allModels,
+      userInput,
+      SEMANTIC_TOP_K,
+      intent,
+    );
+
+    spinner.stop();
+
+    if (settings.dryRun) {
       emitResult(
         {
           userInput,
-          intent,
+          intent: {
+            taskSummary: intent.taskSummary,
+            scenarioHints: intent.scenarioHints,
+            complexity: intent.complexity,
+            inputModality: intent.inputModality,
+            outputModality: intent.outputModality,
+            requiredCapabilities: intent.requiredCapabilities,
+            budget: intent.budget,
+            qualityPreference: intent.qualityPreference,
+            modelPreference:
+              intent.modelPreference?.mode !== "unconstrained" ? intent.modelPreference : undefined,
+            segments: intent.segments,
+            semanticQuery: intent.semanticQuery,
+          },
           candidateCount: candidates.length,
-          candidates: candidates.map(({ model, score }) => ({
+          candidates: candidates.map(({ model, score, hardScore, softScore }) => ({
             model: model.model,
             score,
+            hardScore,
+            softScore,
           })),
           top,
         },
@@ -296,10 +335,10 @@ export default defineCommand({
     }
 
     // Stage 3: LLM Ranking
-    const spinner = createSpinner("Recommending best models...");
+    spinner.update("Agent: Ranking models...");
     spinner.start();
 
-    const result = await rankModels(config, candidates, intent, userInput, top);
+    const result = await rankModels(ctx.client, candidates, intent, userInput, top);
 
     spinner.stop();
 
@@ -323,6 +362,7 @@ export default defineCommand({
             modelPreference:
               intent.modelPreference?.mode !== "unconstrained" ? intent.modelPreference : undefined,
             segments: intent.segments,
+            semanticQuery: intent.semanticQuery,
           },
           result,
           candidates: candidates.length,
@@ -332,8 +372,8 @@ export default defineCommand({
       return;
     }
 
-    emitBare(formatIntentSummary(intent, config.noColor));
+    emitBare(formatIntentSummary(intent));
     emitBare("");
-    emitBare(formatResult(result, config.noColor));
+    emitBare(formatResult(result));
   },
 });

packages/commands/src/commands/app/call.ts

@@ -1,38 +1,61 @@
 import {
   defineCommand,
-  request,
-  requestJson,
-  appCompletionEndpoint,
+  UsageError,
+  appCompletionPath,
   parseSSE,
   detectOutputFormat,
-  type Config,
-  type GlobalFlags,
   type AppCompletionRequest,
   type AppStreamChunk,
   type AppCompletionResponse,
 } from "bailian-cli-core";
-import { failIfMissing, cmdUsage } from "bailian-cli-runtime";
-import { emitResult, emitBare } from "bailian-cli-runtime";
+import { ansi, emitResult, emitBare } from "bailian-cli-runtime";
 
 export default defineCommand({
   description: "Call a Bailian application (agent or workflow)",
+  auth: "apiKey",
   usageArgs: "--app-id <id> --prompt <text> [flags]",
-  options: [
-    { flag: "--app-id <id>", description: "Application ID (required)", required: true },
-    { flag: "--prompt <text>", description: "Input prompt text", required: true },
-    {
-      flag: "--image <url>",
-      description: "Image URL(s) to pass to the app (repeatable)",
-      type: "array",
+  flags: {
+    appId: {
+      type: "string",
+      valueHint: "<id>",
+      description: "Application ID (required)",
+      required: true,
     },
-    { flag: "--file-id <id>", description: "Pre-uploaded file ID(s) (repeatable)", type: "array" },
-    { flag: "--session-id <id>", description: "Session ID for multi-turn conversation" },
-    { flag: "--stream", description: "Stream response (default: on in TTY)" },
-    { flag: "--pipeline-ids <ids>", description: "Knowledge base pipeline IDs (comma-separated)" },
-    { flag: "--memory-id <id>", description: "Memory ID for long-term memory" },
-    { flag: "--biz-params <json>", description: "Business parameters JSON (workflow variables)" },
-    { flag: "--has-thoughts", description: "Show agent thinking process" },
-  ],
+    prompt: {
+      type: "string",
+      valueHint: "<text>",
+      description: "Input prompt text",
+      required: true,
+    },
+    image: {
+      type: "array",
+      valueHint: "<url>",
+      description: "Image URL(s) to pass to the app (repeatable)",
+    },
+    fileId: {
+      type: "array",
+      valueHint: "<id>",
+      description: "Pre-uploaded file ID(s) (repeatable)",
+    },
+    sessionId: {
+      type: "string",
+      valueHint: "<id>",
+      description: "Session ID for multi-turn conversation",
+    },
+    stream: { type: "switch", description: "Stream response (default: on in TTY)" },
+    pipelineIds: {
+      type: "string",
+      valueHint: "<ids>",
+      description: "Knowledge base pipeline IDs (comma-separated)",
+    },
+    memoryId: { type: "string", valueHint: "<id>", description: "Memory ID for long-term memory" },
+    bizParams: {
+      type: "string",
+      valueHint: "<json>",
+      description: "Business parameters JSON (workflow variables)",
+    },
+    hasThoughts: { type: "switch", description: "Show agent thinking process" },
+  },
   exampleArgs: [
     '--app-id abc123 --prompt "Hello"',
     '--app-id abc123 --prompt "Describe this image" --image https://example.com/photo.jpg',
@@ -41,16 +64,13 @@ export default defineCommand({
     '--app-id abc123 --prompt "Search for materials" --pipeline-ids pipe1,pipe2',
     '--app-id abc123 --prompt "Start" --biz-params \'{"key":"value"}\'',
   ],
-  async run(config: Config, flags: GlobalFlags) {
-    const appId = flags.appId as string;
-    if (!appId) failIfMissing("app-id", cmdUsage(config, "--app-id <id> --prompt <text>"));
+  async run(ctx) {
+    const { settings, flags } = ctx;
+    const appId = flags.appId;
+    const prompt = flags.prompt;
 
-    const prompt = flags.prompt as string;
-    if (!prompt) failIfMissing("prompt", cmdUsage(config, "--app-id <id> --prompt <text>"));
-
-    const shouldStream =
-      flags.stream === true || (flags.stream === undefined && process.stdout.isTTY);
-    const format = detectOutputFormat(config.output);
+    const shouldStream = flags.stream || process.stdout.isTTY;
+    const format = detectOutputFormat(settings.output);
 
     const body: AppCompletionRequest = {
       input: { prompt },
@@ -60,17 +80,17 @@ export default defineCommand({
     };
 
     if (flags.sessionId) {
-      body.input.session_id = flags.sessionId as string;
+      body.input.session_id = flags.sessionId;
     }
 
     // Pass image URLs via image_list
-    const imageUrls = flags.image as string[] | undefined;
+    const imageUrls = flags.image;
     if (imageUrls && imageUrls.length > 0) {
       body.input.image_list = imageUrls;
     }
 
     // Pass pre-uploaded file IDs
-    const fileIds = flags.fileId as string[] | undefined;
+    const fileIds = flags.fileId;
     if (fileIds && fileIds.length > 0) {
       body.input.file_ids = fileIds;
     }
@@ -80,7 +100,7 @@ export default defineCommand({
     }
 
     if (flags.pipelineIds) {
-      const ids = (flags.pipelineIds as string)
+      const ids = flags.pipelineIds
         .split(",")
         .map((s) => s.trim())
         .filter(Boolean);
@@ -88,29 +108,26 @@ export default defineCommand({
     }
 
     if (flags.memoryId) {
-      body.parameters!.memory_id = flags.memoryId as string;
+      body.parameters!.memory_id = flags.memoryId;
     }
 
     if (flags.bizParams) {
       try {
-        body.input.biz_params = JSON.parse(flags.bizParams as string);
+        body.input.biz_params = JSON.parse(flags.bizParams);
       } catch {
-        process.stderr.write("Error: --biz-params must be valid JSON\n");
-        process.exit(1);
+        throw new UsageError("--biz-params must be valid JSON");
       }
     }
 
-    if (config.dryRun) {
-      emitResult({ endpoint: appCompletionEndpoint(config.baseUrl, appId), request: body }, format);
+    if (settings.dryRun) {
+      emitResult({ endpoint: ctx.client.url(appCompletionPath(appId)), request: body }, format);
       return;
     }
 
-    const url = appCompletionEndpoint(config.baseUrl, appId);
-
     if (shouldStream) {
       const headers: Record<string, string> = { "X-DashScope-SSE": "enable" };
-      const res = await request(config, {
-        url,
+      const res = await ctx.client.request({
+        path: appCompletionPath(appId),
         method: "POST",
         body,
         headers,
@@ -120,8 +137,7 @@ export default defineCommand({
       let fullText = "";
       let sessionId = "";
       const writesStreamingStdout = format === "text";
-      const dim = config.noColor ? "" : "\x1b[2m";
-      const reset = config.noColor ? "" : "\x1b[0m";
+      const stderrColor = ansi(process.stderr);
 
       for await (const event of parseSSE(res)) {
         if (event.data === "[DONE]") break;
@@ -143,13 +159,14 @@ export default defineCommand({
           // Show thoughts if available
           if (chunk.output?.thoughts && flags.hasThoughts) {
             for (const t of chunk.output.thoughts) {
-              if (t.thought) process.stderr.write(`${dim}[Thinking] ${t.thought}${reset}\n`);
+              if (t.thought)
+                process.stderr.write(`${stderrColor.dim(`[Thinking] ${t.thought}`)}\n`);
               if (t.action_name)
                 process.stderr.write(
-                  `${dim}[Action] ${t.action_name}: ${t.action_input || ""}${reset}\n`,
+                  `${stderrColor.dim(`[Action] ${t.action_name}: ${t.action_input || ""}`)}\n`,
                 );
               if (t.observation)
-                process.stderr.write(`${dim}[Observation] ${t.observation}${reset}\n`);
+                process.stderr.write(`${stderrColor.dim(`[Observation] ${t.observation}`)}\n`);
             }
           }
         } catch {
@@ -158,8 +175,8 @@ export default defineCommand({
       }
 
       // Show session_id for multi-turn conversation
-      if (sessionId && !config.quiet) {
-        process.stderr.write(`${dim}Session ID: ${sessionId}${reset}\n`);
+      if (sessionId && !settings.quiet) {
+        process.stderr.write(`${stderrColor.dim(`Session ID: ${sessionId}`)}\n`);
       }
 
       if (format === "json") {
@@ -168,15 +185,15 @@ export default defineCommand({
         process.stdout.write("\n");
       }
     } else {
-      const response = await requestJson<AppCompletionResponse>(config, {
-        url,
+      const response = await ctx.client.requestJson<AppCompletionResponse>({
+        path: appCompletionPath(appId),
         method: "POST",
         body,
       });
 
       const text = response.output?.text ?? "";
 
-      if (config.quiet || format === "text") {
+      if (settings.quiet || format === "text") {
         emitBare(text);
       } else {
         emitResult(response, format);

packages/commands/src/commands/app/list.ts

@@ -1,53 +1,36 @@
-import {
-  defineCommand,
-  callConsoleGateway,
-  resolveConsoleGatewayCredential,
-  detectOutputFormat,
-  type Config,
-  type GlobalFlags,
-} from "bailian-cli-core";
+import { defineCommand, detectOutputFormat } from "bailian-cli-core";
 import { emitResult } from "bailian-cli-runtime";
 
 const APP_LIST_API = "zeldaEasy.broadscope-bailian.app-control.list";
 
 export default defineCommand({
   description: "List Bailian applications",
-  skipDefaultApiKeySetup: true,
+  auth: "console",
   usageArgs: "[flags]",
-  options: [
-    {
-      flag: "--name <name>",
+  flags: {
+    name: {
+      type: "string",
+      valueHint: "<name>",
       description: "Filter by app name (keyword search)",
     },
-    {
-      flag: "--page <n>",
+    page: {
+      type: "number",
+      valueHint: "<n>",
       description: "Page number (default: 1)",
-      type: "number",
     },
-    {
-      flag: "--page-size <n>",
+    pageSize: {
+      type: "number",
+      valueHint: "<n>",
       description: "Results per page (default: 30)",
-      type: "number",
     },
-    { flag: "--console-region <region>", description: "Console region" },
-    {
-      flag: "--console-site <site>",
-      description: "Console site: domestic, international",
-    },
-    {
-      flag: "--console-switch-agent <uid>",
-      description: "Switch agent UID",
-      type: "number",
-    },
-  ],
+  },
   exampleArgs: ["", "--name customer service", "--page 2 --page-size 10", "--output json"],
-  async run(config: Config, flags: GlobalFlags) {
-    const name = (flags.name as string) || "";
-    const pageNo = (flags.page as number) || 1;
-    const pageSize = (flags.pageSize as number) || 30;
-    const format = detectOutputFormat(config.output);
-
-    const credential = await resolveConsoleGatewayCredential(config);
+  async run(ctx) {
+    const { settings, flags } = ctx;
+    const name = flags.name || "";
+    const pageNo = flags.page || 1;
+    const pageSize = flags.pageSize || 30;
+    const format = detectOutputFormat(settings.output);
 
     const data = {
       reqDTO: {
@@ -60,15 +43,12 @@ export default defineCommand({
       },
     };
 
-    if (config.dryRun) {
-      emitResult({ api: APP_LIST_API, data, token: credential.token.slice(0, 8) + "..." }, format);
+    if (settings.dryRun) {
+      emitResult({ api: APP_LIST_API, data }, format);
       return;
     }
 
-    const result = (await callConsoleGateway(config, credential.token, {
-      api: APP_LIST_API,
-      data,
-    })) as any;
+    const result = await ctx.client.console<any>(APP_LIST_API, data);
 
     const list: unknown[] = result?.data?.DataV2?.data?.data?.list ?? [];
     const total: number = result?.data?.DataV2?.data?.data?.total ?? 0;

packages/commands/src/commands/auth/console-ui.ts

@@ -0,0 +1,79 @@
+import { maskToken, type AuthStore, type Identity, type Settings } from "bailian-cli-core";
+import { runConsoleLogin, resolveConsoleOrigin } from "./login-console.ts";
+
+/** Read-only auth snapshot the config UI account widget renders. bl stores no
+ * user profile (name/avatar), so this exposes only which credential domains
+ * resolve, the console region/site, and a masked token. */
+export interface AuthUiStatus {
+  authenticated: boolean;
+  methods: { apiKey: boolean; console: boolean; openapi: boolean };
+  primary: "console" | "apiKey" | "openapi" | null;
+  region?: string;
+  site?: "domestic" | "international";
+  masked?: string;
+}
+
+/**
+ * The auth capability surface the config UI is allowed to use. All `authStore`
+ * access is kept inside this module (commands/auth/**), which the lint boundary
+ * permits; commands/config/** consumes only this opaque bridge and never
+ * touches `authStore` directly.
+ */
+export interface AuthUiBridge {
+  status(): AuthUiStatus;
+  /** Start browser-based console login (fire-and-forget; UI polls status). */
+  startConsoleLogin(): void;
+  /** Clear all stored credentials. Returns whether anything changed. */
+  logout(): Promise<boolean>;
+}
+
+/** Build the bridge from a command context (identity/settings/authStore). */
+export function makeAuthUiBridge(ctx: {
+  identity: Identity;
+  settings: Settings;
+  authStore: AuthStore;
+}): AuthUiBridge {
+  const { identity, settings, authStore } = ctx;
+  return {
+    status() {
+      const a = authStore.describe();
+      const methods = { apiKey: !!a.apiKey, console: !!a.console, openapi: !!a.openapi };
+      let masked: string | undefined;
+      if (a.console) masked = maskToken(a.console.token);
+      else if (a.apiKey) masked = maskToken(a.apiKey.token);
+      else if (a.openapi) masked = maskToken(a.openapi.accessKeyId);
+      const primary = a.console ? "console" : a.apiKey ? "apiKey" : a.openapi ? "openapi" : null;
+      return {
+        authenticated: methods.apiKey || methods.console || methods.openapi,
+        methods,
+        primary,
+        region: a.console?.region,
+        site: a.console?.site,
+        masked,
+      };
+    },
+    startConsoleLogin() {
+      const origin = resolveConsoleOrigin(authStore.describe().console?.site);
+      // Mirror the CLI (`bl auth login --console`): request an api_key from the
+      // console only when one isn't already stored, so a first console login in
+      // the config UI also provisions the model api_key (not just access_token).
+      const hasApiKey = !!authStore.stored().apiKey;
+      // runConsoleLogin opens the browser and runs its own callback server
+      // (up to 15 min). We don't await it — the config UI polls the status
+      // endpoint to detect completion. Errors are logged, not surfaced.
+      void runConsoleLogin(
+        origin,
+        { identity, settings, authStore },
+        {
+          needApiKey: !hasApiKey,
+        },
+      ).catch((err: unknown) => {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`console login failed: ${msg}\n`);
+      });
+    },
+    logout() {
+      return authStore.logout("all");
+    },
+  };
+}

packages/commands/src/commands/auth/generate-access-token.ts

@@ -0,0 +1,50 @@
+import {
+  defineCommand,
+  detectOutputFormat,
+  generateCLIAccessToken,
+  type FlagsDef,
+} from "bailian-cli-core";
+import { emitResult } from "bailian-cli-runtime";
+
+const FLAGS = {
+  accessKeyId: {
+    type: "string",
+    valueHint: "<id>",
+    description: "Alibaba Cloud Access Key ID",
+    required: true,
+  },
+  accessKeySecret: {
+    type: "string",
+    valueHint: "<secret>",
+    description: "Alibaba Cloud Access Key Secret",
+    required: true,
+  },
+  securityToken: {
+    type: "string",
+    valueHint: "<token>",
+    description: "Alibaba Cloud STS Security Token to store (optional)",
+  },
+} satisfies FlagsDef;
+
+export default defineCommand({
+  description: "Generate a CLI access token using OpenAPI AK/SK",
+  auth: "none",
+  usageArgs: "--access-key-id <id> --access-key-secret <secret> --security-token <token>",
+  flags: FLAGS,
+  exampleArgs: ["--access-key-id LTAIxxxxx --access-key-secret xxxxx --security-token <token>"],
+  async run(ctx) {
+    const { identity, settings, flags } = ctx;
+    const format = detectOutputFormat(settings.output);
+
+    const resp = await generateCLIAccessToken({
+      identity,
+      settings,
+      baseUrl: ctx.client.baseUrl,
+      accessKeyId: flags.accessKeyId,
+      accessKeySecret: flags.accessKeySecret,
+      securityToken: flags.securityToken || undefined,
+    });
+
+    emitResult(resp, format);
+  },
+});

packages/commands/src/commands/auth/login-api-key.ts

@@ -0,0 +1,99 @@
+import {
+  BailianError,
+  ExitCode,
+  chatPath,
+  requestJson,
+  normalizeModelBaseUrl,
+  type AuthPersistPatch,
+  type AuthStore,
+  type Identity,
+  type Settings,
+} from "bailian-cli-core";
+
+interface ApiKeyLoginDeps {
+  identity: Identity;
+  settings: Settings;
+  authStore: AuthStore;
+}
+
+interface ApiKeyLoginProfile {
+  baseUrl: string;
+  persistBaseUrl?: string;
+  defaultTextModel?: string;
+  defaultVideoModel?: string;
+  defaultImageToVideoModel?: string;
+  defaultReferenceToVideoModel?: string;
+  defaultImageModel?: string;
+  persistPatch?: AuthPersistPatch;
+}
+
+const RETRY_DELAY_BASE_MS = 500;
+
+function canRetry(error: unknown): boolean {
+  if (error instanceof BailianError) {
+    if (error.exitCode === ExitCode.NETWORK || error.exitCode === ExitCode.TIMEOUT) return true;
+    const status = error.api?.httpStatus;
+    return status === 401 || (status !== undefined && status >= 500);
+  }
+  if (error instanceof Error) {
+    return (
+      error.name === "AbortError" ||
+      error.name === "TimeoutError" ||
+      error.message.includes("timed out") ||
+      error.message === "fetch failed"
+    );
+  }
+  return false;
+}
+
+export async function validateAndPersistApiKey(
+  deps: ApiKeyLoginDeps,
+  key: string,
+  profile: ApiKeyLoginProfile,
+): Promise<void> {
+  process.stderr.write("Testing key... ");
+  const httpDeps = { identity: deps.identity, settings: deps.settings };
+  const baseUrl = normalizeModelBaseUrl(profile.baseUrl);
+  const persistBaseUrl = profile.persistBaseUrl
+    ? normalizeModelBaseUrl(profile.persistBaseUrl)
+    : undefined;
+  const validationModel = "qwen3.7-max";
+  const requestOpts = {
+    url: baseUrl + chatPath(),
+    method: "POST",
+    headers: { Authorization: `Bearer ${key}` },
+    timeout: Math.min(deps.settings.timeout, 30),
+    body: {
+      model: validationModel,
+      messages: [{ role: "user", content: "hi" }],
+      max_tokens: 1,
+      stream: false,
+    },
+  };
+
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    try {
+      await requestJson<unknown>(httpDeps, requestOpts);
+      break;
+    } catch (error) {
+      if (attempt >= 3 || !canRetry(error)) {
+        process.stderr.write("Failed\n");
+        throw error;
+      }
+      const delayMs = RETRY_DELAY_BASE_MS * 2 ** (attempt - 1);
+      await new Promise((resolve) => setTimeout(resolve, delayMs));
+    }
+  }
+
+  process.stderr.write("Valid\n");
+  await deps.authStore.login({
+    ...profile.persistPatch,
+    api_key: key,
+    base_url: persistBaseUrl,
+    default_text_model: profile.defaultTextModel,
+    default_video_model: profile.defaultVideoModel,
+    default_image_to_video_model: profile.defaultImageToVideoModel,
+    default_reference_to_video_model: profile.defaultReferenceToVideoModel,
+    default_image_model: profile.defaultImageModel,
+  });
+}

packages/commands/src/commands/auth/login-console.ts

@@ -1,20 +1,30 @@
-import { execFile } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import http from "node:http";
 
 import {
   BailianError,
   ExitCode,
-  chatEndpoint,
-  getConfigPath,
-  readConfigFile,
-  requestJson,
-  writeConfigFile,
-  type Config,
+  type AuthPersistPatch,
+  type AuthStore,
+  type ConfigFile,
+  type Identity,
+  type Settings,
 } from "bailian-cli-core";
+import { listenLocalServer, openInBrowser } from "../shared/local-server.ts";
+import { validateAndPersistApiKey } from "./login-api-key.ts";
+
+/** 登录流程的能力面:身份(UA)、有效配置(timeout 等)、auth 域落盘。 */
+export interface LoginDeps {
+  identity: Identity;
+  settings: Settings;
+  authStore: AuthStore;
+}
 
 const CONSOLE_LOGIN_TIMEOUT_MS = 15 * 60 * 1000;
 const MAX_AUTH_CALLBACK_BODY = 65536;
+// Regex for double newline (\r\n\r\n or \n\n); built via RegExp to avoid
+// literal multi-line splitting in source.
+const REGEX_DOUBLE_NEWLINE = new RegExp("\r\n\r\n|\n\n");
 
 const CONSOLE_ORIGINS: Record<string, string> = {
   domestic: "https://bailian.console.aliyun.com",
@@ -68,7 +78,7 @@ function parseAccessTokenFromMultipart(raw: string, boundaryValue: string): stri
   for (let i = 1; i < segments.length; i++) {
     const part = segments[i]!;
     if (!/name\s*=\s*["'](?:access_token|accessToken)["']/i.test(part)) continue;
-    const sep = part.match(/\r\n\r\n|\n\n/);
+    const sep = part.match(REGEX_DOUBLE_NEWLINE);
     if (!sep || sep.index === undefined) continue;
     let value = part.slice(sep.index + sep[0].length);
     value = value
@@ -351,96 +361,12 @@ async function extractCredentialsFromRequest(
 }
 
 function listenServerOnFreeLocalPort(server: http.Server): Promise<number> {
-  return new Promise((resolve, reject) => {
-    const onErr = (e: Error) => reject(e);
-    server.once("error", onErr);
-    server.listen({ port: 0, host: "127.0.0.1", exclusive: true }, () => {
-      server.off("error", onErr);
-      const addr = server.address();
-      if (!addr || typeof addr === "string") {
-        reject(new Error("Expected TCP socket address"));
-        return;
-      }
-      resolve(addr.port);
-    });
-  });
-}
-
-function openInBrowser(url: string): Promise<void> {
-  const platform = process.platform;
-  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
-  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
-
-  return new Promise((resolve, reject) => {
-    execFile(cmd, args, { windowsHide: true }, (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
-  });
-}
-
-const RETRY_DELAY_BASE_MS = 500;
-
-function canRetry(err: unknown): boolean {
-  if (err instanceof BailianError) {
-    if (err.exitCode === ExitCode.NETWORK || err.exitCode === ExitCode.TIMEOUT) return true;
-    const status = err.api?.httpStatus;
-    return status === 401 || (status !== undefined && status >= 500);
-  }
-  if (err instanceof Error) {
-    return (
-      err.name === "AbortError" ||
-      err.name === "TimeoutError" ||
-      err.message.includes("timed out") ||
-      err.message === "fetch failed"
-    );
-  }
-  return false;
-}
-
-export async function validateAndPersistApiKey(
-  config: Config,
-  key: string,
-  baseUrl: string,
-): Promise<void> {
-  process.stderr.write("Testing key... ");
-  const testConfig = { ...config, apiKey: key, baseUrl };
-  const requestOpts = {
-    url: chatEndpoint(testConfig.baseUrl),
-    method: "POST",
-    timeout: Math.min(config.timeout, 30),
-    body: {
-      model: "qwen3.7-max",
-      messages: [{ role: "user", content: "hi" }],
-      max_tokens: 1,
-    },
-  };
-
-  for (let attempt = 1; attempt <= 3; attempt++) {
-    try {
-      await requestJson<unknown>(testConfig, requestOpts);
-      break;
-    } catch (err) {
-      if (attempt >= 3 || !canRetry(err)) {
-        process.stderr.write("Failed\n");
-        throw new BailianError("API key validation failed", ExitCode.AUTH, "Invalid API key.", {
-          cause: err,
-        });
-      }
-      const delayMs = RETRY_DELAY_BASE_MS * 2 ** (attempt - 1);
-      await new Promise((resolve) => setTimeout(resolve, delayMs));
-    }
-  }
-
-  process.stderr.write("Valid\n");
-  const existing = readConfigFile() as Record<string, unknown>;
-  existing.api_key = key;
-  await writeConfigFile(existing);
+  return listenLocalServer(server);
 }
 
 export async function runConsoleLogin(
   consoleOrigin: string,
-  config: Config,
+  deps: LoginDeps,
   opts?: { needApiKey?: boolean },
 ): Promise<void> {
   const state = randomBytes(16).toString("hex");
@@ -479,20 +405,27 @@ export async function runConsoleLogin(
 
       if (hasConfig || apiKey) {
         try {
-          if (hasConfig) {
-            const existing = readConfigFile() as Record<string, unknown>;
-            if (accessToken) existing.access_token = accessToken;
-            if (baseUrl) existing.base_url = baseUrl;
-            if (consoleSite) existing.console_site = consoleSite;
-            if (consoleRegion) existing.console_region = consoleRegion;
-            if (consoleSwitchAgent) existing.console_switch_agent = Number(consoleSwitchAgent);
-            if (workspaceId) existing.workspace_id = workspaceId;
-            await writeConfigFile(existing);
-            process.stderr.write(`Config saved to ${getConfigPath()}\n`);
-          }
+          const callbackPatch: AuthPersistPatch = {
+            access_token: accessToken || undefined,
+            console_site: (consoleSite || undefined) as ConfigFile["console_site"],
+            console_region: consoleRegion || undefined,
+            console_switch_agent: consoleSwitchAgent ? Number(consoleSwitchAgent) : undefined,
+            workspace_id: workspaceId || undefined,
+          };
           if (apiKey) {
-            const testBaseUrl = baseUrl || config.baseUrl;
-            await validateAndPersistApiKey(config, apiKey, testBaseUrl);
+            const testBaseUrl = baseUrl || deps.authStore.resolveBaseUrl();
+            await validateAndPersistApiKey(deps, apiKey, {
+              baseUrl: testBaseUrl,
+              persistBaseUrl: baseUrl || undefined,
+              persistPatch: callbackPatch,
+            });
+            process.stderr.write(`Config saved to ${deps.authStore.path}\n`);
+          } else if (hasConfig) {
+            await deps.authStore.login({
+              ...callbackPatch,
+              base_url: baseUrl || undefined,
+            });
+            process.stderr.write(`Config saved to ${deps.authStore.path}\n`);
           }
         } catch (err: unknown) {
           callbackError = err;

packages/commands/src/commands/auth/login.ts

@@ -1,90 +1,163 @@
 import {
   defineCommand,
-  isInteractive,
-  maskToken,
-  readConfigFile,
-  writeConfigFile,
-  type Config,
-  type GlobalFlags,
+  generateCLIAccessToken,
+  getModelProfilePreset,
+  normalizeModelBaseUrl,
 } from "bailian-cli-core";
-import { printQuickStart } from "bailian-cli-runtime";
 import { emitBare } from "bailian-cli-runtime";
-import { promptConfirm } from "bailian-cli-runtime";
-import { printCurrentCommandHelp } from "bailian-cli-runtime";
-import {
-  resolveConsoleOrigin,
-  runConsoleLogin,
-  validateAndPersistApiKey,
-} from "./login-console.ts";
+import { validateAndPersistApiKey } from "./login-api-key.ts";
+import { resolveConsoleOrigin, runConsoleLogin } from "./login-console.ts";
+
+const LOGIN_MODE_HINT = "Choose exactly one login mode: --api-key, --console, or --open-api";
+
+function hasValue(value: unknown): value is string {
+  return typeof value === "string" && value.trim().length > 0;
+}
 
 export default defineCommand({
-  description: "Authenticate with API key or console browser login (credentials can coexist)",
-  skipDefaultApiKeySetup: true,
-  usageArgs: "--api-key <key> | --console",
-  options: [
-    { flag: "--api-key <key>", description: "DashScope API key to store" },
-    {
-      flag: "--base-url <url>",
-      description: "DashScope API base URL (used with --api-key for validation)",
+  description:
+    "Authenticate with API key, console browser login, or OpenAPI AK/SK (credentials can coexist)",
+  auth: "none",
+  usageArgs:
+    "--api-key <key> | --console | --open-api --access-key-id <id> --access-key-secret <secret>",
+  flags: {
+    apiKey: {
+      type: "string",
+      valueHint: "<key>",
+      description: "Model API key to store",
     },
-    {
-      flag: "--console",
+    baseUrl: {
+      type: "string",
+      valueHint: "<url>",
+      description: "Model API base URL (used with --api-key for validation)",
+    },
+    console: {
+      type: "switch",
       description:
         "Sign in via browser; use --console-site to choose domestic (default) or international",
     },
+    consoleSite: {
+      type: "string",
+      valueHint: "<site>",
+      description: "Console site: domestic, international",
+    },
+    openApi: {
+      type: "switch",
+      description: "Store Alibaba Cloud OpenAPI AK/SK credentials",
+    },
+    accessKeyId: {
+      type: "string",
+      valueHint: "<id>",
+      description: "Alibaba Cloud Access Key ID to store",
+    },
+    accessKeySecret: {
+      type: "string",
+      valueHint: "<secret>",
+      description: "Alibaba Cloud Access Key Secret to store",
+    },
+  },
+  exampleArgs: [
+    "--api-key sk-xxxxx",
+    "--config token-plan --api-key sk-sp-xxxxx",
+    "--console",
+    "--open-api --access-key-id LTAIxxxxx --access-key-secret xxxxx",
   ],
-  exampleArgs: ["--api-key sk-xxxxx", "--console"],
-  async run(config: Config, flags: GlobalFlags) {
+  validate: (f) => {
+    const apiKeyMode = hasValue(f.apiKey);
+    const consoleMode = f.console === true;
+    const openApiMode = f.openApi === true;
+
+    // Mode-specific options must not imply a login mode by themselves; this keeps
+    // `auth login` explicit and avoids silently ignoring flags from another mode.
+    if (!apiKeyMode && hasValue(f.baseUrl)) {
+      return "Use --base-url only with --api-key";
+    }
+    if (!consoleMode && hasValue(f.consoleSite)) {
+      return "Use --console-site only with --console";
+    }
+    if (!openApiMode && (hasValue(f.accessKeyId) || hasValue(f.accessKeySecret))) {
+      return "Use --open-api with --access-key-id and --access-key-secret";
+    }
+
+    // Login writes one credential domain per invocation. Multi-mode inputs such
+    // as `--console --api-key` are rejected instead of partly applying one path.
+    const modeCount = [apiKeyMode, consoleMode, openApiMode].filter(Boolean).length;
+    if (modeCount !== 1) return LOGIN_MODE_HINT;
+
+    // AK/SK are a credential pair. `auth login --open-api` persists exactly what
+    // the user typed and does not fill the missing half from env/config.
+    if (openApiMode && (!hasValue(f.accessKeyId) || !hasValue(f.accessKeySecret))) {
+      return "Provide --access-key-id and --access-key-secret with --open-api";
+    }
+
+    return undefined;
+  },
+  async run(ctx) {
+    const { identity, settings, flags } = ctx;
+    const store = ctx.authStore;
+    const deps = { identity, settings, authStore: store };
+    const key = flags.apiKey;
+    const baseUrl = flags.baseUrl ? normalizeModelBaseUrl(flags.baseUrl) : undefined;
+
     if (flags.console) {
-      if (config.dryRun) {
+      if (settings.dryRun) {
         emitBare(
           "Would bind a free port on 127.0.0.1 and open the console login URL in your browser.",
         );
         return;
       }
-      const hasApiKey = !!(config.apiKey || config.fileApiKey);
-      await runConsoleLogin(resolveConsoleOrigin(config.consoleSite || "domestic"), config, {
+      const hasApiKey = !!(key || store.stored().apiKey);
+      // 本次登录站点:参数缺省时用配置默认(file 里上次登录存的站点)。
+      const site = flags.consoleSite || settings.consoleSite || "domestic";
+      await runConsoleLogin(resolveConsoleOrigin(site), deps, {
         needApiKey: !hasApiKey,
       });
       return;
     }
 
-    const envKey = process.env.DASHSCOPE_API_KEY;
-    if (envKey && !flags.apiKey) {
-      const maskedEnvKey = maskToken(envKey);
-      if (isInteractive({ nonInteractive: config.nonInteractive })) {
-        const proceed = await promptConfirm({
-          message: `Detected DASHSCOPE_API_KEY in environment (${maskedEnvKey}).\nYou are already authenticated via env.\nDo you still want to configure local persistent credentials?`,
-          initialValue: false,
-        });
-        if (!proceed) {
-          process.stdout.write("Login skipped. Using environment variables.\n");
-          process.exit(0);
-        }
-      } else {
-        process.stderr.write(`Warning: DASHSCOPE_API_KEY is already set in environment.\n`);
+    if (flags.openApi) {
+      if (settings.dryRun) {
+        emitBare("Would save OpenAPI AK/SK credentials and generate CLI access token.");
+        return;
       }
+      const resolvedBaseUrl = store.resolveBaseUrl();
+      process.stderr.write("Generating CLI access token... ");
+      const resp = await generateCLIAccessToken({
+        identity,
+        settings,
+        baseUrl: resolvedBaseUrl,
+        accessKeyId: flags.accessKeyId!,
+        accessKeySecret: flags.accessKeySecret!,
+      });
+      const accessToken = resp.cliAccessToken;
+      await store.login({
+        access_key_id: flags.accessKeyId,
+        access_key_secret: flags.accessKeySecret,
+        access_token: accessToken,
+      });
+      process.stderr.write(`OpenAPI credentials saved to ${store.path}\n`);
+      return;
     }
 
-    const key = (flags.apiKey as string) || config.apiKey;
-    if (!key) {
-      printCurrentCommandHelp(process.stderr);
-      process.exit(0);
-    }
+    // --api-key path; validate() guarantees apiKey on the non-console branch.
+    if (!key) return;
 
-    const baseUrl = (flags.baseUrl as string) || undefined;
-    const effectiveConfig = baseUrl ? { ...config, baseUrl } : config;
-
-    if (!config.dryRun) {
-      if (baseUrl) {
-        const existing = readConfigFile() as Record<string, unknown>;
-        existing.base_url = baseUrl;
-        await writeConfigFile(existing);
-      }
-      await validateAndPersistApiKey(effectiveConfig, key, effectiveConfig.baseUrl);
-      printQuickStart();
-    } else {
+    if (settings.dryRun) {
       emitBare("Would validate and save API key.");
+      return;
     }
+    const profilePreset = getModelProfilePreset(settings.configName);
+    const storedBaseUrl = store.stored().baseUrl;
+    const resolvedBaseUrl = baseUrl || store.resolveBaseUrl(profilePreset?.baseUrl);
+    const persistBaseUrl = baseUrl || (!storedBaseUrl ? profilePreset?.baseUrl : undefined);
+    await validateAndPersistApiKey(deps, key, {
+      baseUrl: resolvedBaseUrl,
+      persistBaseUrl,
+      defaultTextModel: profilePreset?.defaultTextModel,
+      defaultVideoModel: profilePreset?.defaultVideoModel,
+      defaultImageToVideoModel: profilePreset?.defaultImageToVideoModel,
+      defaultReferenceToVideoModel: profilePreset?.defaultReferenceToVideoModel,
+      defaultImageModel: profilePreset?.defaultImageModel,
+    });
   },
 });

packages/commands/src/commands/auth/logout.ts

@@ -1,50 +1,38 @@
-import {
-  defineCommand,
-  clearApiKey,
-  readConfigFile,
-  writeConfigFile,
-  getConfigPath,
-  type Config,
-  type GlobalFlags,
-} from "bailian-cli-core";
+import { defineCommand } from "bailian-cli-core";
 import { emitBare } from "bailian-cli-runtime";
 
-async function clearConsoleToken(): Promise<boolean> {
-  const file = readConfigFile() as Record<string, unknown>;
-  if (!file.access_token) return false;
-  delete file.access_token;
-  await writeConfigFile(file);
-  return true;
-}
-
 export default defineCommand({
-  description: "Clear stored credentials",
-  skipDefaultApiKeySetup: true,
-  usageArgs: "[--console] [--yes] [--dry-run]",
-  options: [
-    {
-      flag: "--console",
+  description: "Clear stored credentials; full logout also clears the model Base URL",
+  auth: "none",
+  usageArgs: "[--console | --open-api] [--dry-run]",
+  flags: {
+    console: {
+      type: "switch",
       description: "Only clear the console access_token, keep api_key intact",
-      type: "boolean",
     },
-    { flag: "--yes", description: "Skip confirmation prompt" },
-  ],
-  exampleArgs: ["", "--console", "--dry-run", "--yes"],
-  async run(config: Config, flags: GlobalFlags) {
-    const file = readConfigFile();
+    openApi: {
+      type: "switch",
+      description: "Only clear OpenAPI AK/SK/STS credentials, keep other credentials intact",
+    },
+  },
+  exampleArgs: ["", "--console", "--open-api", "--dry-run"],
+  validate: (f) =>
+    f.console && f.openApi ? "Use only one scope: --console or --open-api" : undefined,
+  async run(ctx) {
+    const { settings, flags } = ctx;
+    const store = ctx.authStore;
+    const stored = store.stored();
 
     if (flags.console) {
-      const hasToken = !!file.access_token;
-      if (config.dryRun) {
-        if (hasToken) emitBare("Would clear access_token from ~/.bailian/config.json");
+      if (settings.dryRun) {
+        if (stored.console) emitBare(`Would clear access_token from ${store.path}`);
         else emitBare("No console access_token to clear.");
         emitBare("No changes made.");
         return;
       }
-      if (hasToken) {
-        await clearConsoleToken();
-        process.stderr.write(`Cleared access_token from ${getConfigPath()}\n`);
-        if (file.api_key) {
+      if (await store.logout("console")) {
+        process.stderr.write(`Cleared access_token from ${store.path}\n`);
+        if (stored.apiKey) {
           process.stderr.write(
             "api_key is still configured and will be used for authentication.\n",
           );
@@ -55,20 +43,49 @@ export default defineCommand({
       return;
     }
 
-    const hasKey = !!(file.api_key || file.access_token);
+    if (flags.openApi) {
+      if (settings.dryRun) {
+        if (stored.openapi)
+          emitBare(
+            `Would clear access_key_id / access_key_secret / security_token from ${store.path}`,
+          );
+        else emitBare("No OpenAPI AK/SK credentials to clear.");
+        emitBare("No changes made.");
+        return;
+      }
+      if (await store.logout("openapi")) {
+        process.stderr.write(
+          `Cleared access_key_id / access_key_secret / security_token from ${store.path}\n`,
+        );
+        if (stored.apiKey || stored.console) {
+          process.stderr.write(
+            "Other credentials are still configured and will be used for authentication.\n",
+          );
+        }
+      } else {
+        process.stderr.write("No OpenAPI AK/SK credentials to clear.\n");
+      }
+      return;
+    }
 
-    if (config.dryRun) {
-      if (hasKey) emitBare("Would clear api_key / access_token from ~/.bailian/config.json");
-      else emitBare("No credentials to clear.");
+    const hasStoredAuth = stored.apiKey || stored.console || stored.openapi || !!stored.baseUrl;
+
+    if (settings.dryRun) {
+      if (hasStoredAuth)
+        emitBare(
+          `Would clear api_key / base_url / access_token / access_key_id / access_key_secret / security_token from ${store.path}`,
+        );
+      else emitBare("No credentials or model Base URL to clear.");
       emitBare("No changes made.");
       return;
     }
 
-    if (hasKey) {
-      await clearApiKey();
-      process.stderr.write("Cleared api_key / access_token from ~/.bailian/config.json\n");
+    if (await store.logout("all")) {
+      process.stderr.write(
+        `Cleared api_key / base_url / access_token / access_key_id / access_key_secret / security_token from ${store.path}\n`,
+      );
     } else {
-      process.stderr.write("No credentials to clear.\n");
+      process.stderr.write("No credentials or model Base URL to clear.\n");
     }
   },
 });

packages/commands/src/commands/auth/status.ts

@@ -1,182 +1,98 @@
-import {
-  defineCommand,
-  resolveCredential,
-  resolveConsoleGatewayCredential,
-  detectOutputFormat,
-  maskToken,
-  type Config,
-  type GlobalFlags,
-  type ResolvedCredential,
-} from "bailian-cli-core";
+import { defineCommand, detectOutputFormat, maskToken } from "bailian-cli-core";
 import { emitResult, emitBare } from "bailian-cli-runtime";
 import { API_KEY_PAGE } from "bailian-cli-runtime";
 
-interface StoredCredential {
-  configured: boolean;
-  source?: string;
-  masked?: string;
-}
-
-interface AuthStatusPayload {
-  api_key: StoredCredential;
-  access_token: StoredCredential;
-  dashscope_commands?: { method: string; source: string; masked: string };
-  console_gateway_commands?: { method: string; source: string; masked: string };
-}
-
-function storedApiKey(config: Config): StoredCredential {
-  if (config.apiKey) {
-    return { configured: true, source: "flag", masked: maskToken(config.apiKey) };
-  }
-  if (config.fileApiKey) {
-    return { configured: true, source: "config.json", masked: maskToken(config.fileApiKey) };
-  }
-  const env = process.env.DASHSCOPE_API_KEY?.trim();
-  if (env) {
-    return { configured: true, source: "DASHSCOPE_API_KEY", masked: maskToken(env) };
-  }
-  return { configured: false };
-}
-
-function storedAccessToken(config: Config): StoredCredential {
-  if (config.accessTokenEnv) {
-    return {
-      configured: true,
-      source: "DASHSCOPE_ACCESS_TOKEN",
-      masked: maskToken(config.accessTokenEnv),
-    };
-  }
-  if (config.fileAccessToken) {
-    return {
-      configured: true,
-      source: "config.json",
-      masked: maskToken(config.fileAccessToken),
-    };
-  }
-  return { configured: false };
-}
-
-async function tryResolveDashscope(config: Config): Promise<ResolvedCredential | undefined> {
-  try {
-    return await resolveCredential(config);
-  } catch {
-    return undefined;
-  }
-}
-
-async function tryResolveConsole(config: Config): Promise<ResolvedCredential | undefined> {
-  try {
-    return await resolveConsoleGatewayCredential(config);
-  } catch {
-    return undefined;
-  }
-}
-
-async function buildStatus(config: Config): Promise<AuthStatusPayload> {
-  const status: AuthStatusPayload = {
-    api_key: storedApiKey(config),
-    access_token: storedAccessToken(config),
-  };
-
-  const dashscope = await tryResolveDashscope(config);
-  if (dashscope) {
-    status.dashscope_commands = {
-      method: dashscope.method,
-      source: dashscope.source,
-      masked: maskToken(dashscope.token),
-    };
-  }
-
-  const consoleGw = await tryResolveConsole(config);
-  if (consoleGw) {
-    status.console_gateway_commands = {
-      method: consoleGw.method,
-      source: consoleGw.source,
-      masked: maskToken(consoleGw.token),
-    };
-  }
-
-  return status;
-}
-
-function hasAnyAuth(status: AuthStatusPayload): boolean {
-  return (
-    status.api_key.configured ||
-    status.access_token.configured ||
-    !!status.dashscope_commands ||
-    !!status.console_gateway_commands
-  );
-}
-
-function emitTextStatus(status: AuthStatusPayload, config: Config): void {
-  emitBare("Authentication Status:");
-  emitBare("  Stored credentials (can coexist):");
-  if (status.api_key.configured) {
-    emitBare(`    API key:         ${status.api_key.source}  ${status.api_key.masked}`);
-  } else {
-    emitBare("    API key:         not configured");
-  }
-  if (status.access_token.configured) {
-    emitBare(`    Console token:   ${status.access_token.source}  ${status.access_token.masked}`);
-  } else {
-    emitBare("    Console token:   not configured");
-  }
-  emitBare("  Effective credential per command family:");
-  if (status.dashscope_commands) {
-    emitBare(
-      `    DashScope API:   ${status.dashscope_commands.method} (${status.dashscope_commands.source})  ${status.dashscope_commands.masked}`,
-    );
-  } else {
-    emitBare("    DashScope API:   unavailable");
-  }
-  if (status.console_gateway_commands) {
-    emitBare(
-      `    Console gateway: ${status.console_gateway_commands.method} (${status.console_gateway_commands.source})  ${status.console_gateway_commands.masked}`,
-    );
-  } else {
-    emitBare(`    Console gateway: unavailable (run ${config.binName} auth login --console)`);
-  }
-}
-
 export default defineCommand({
   description: "Show current authentication state",
-  options: [
-    { flag: "--console-region <region>", description: "Console region" },
-    {
-      flag: "--console-site <site>",
-      description: "Console site: domestic, international",
-    },
-    {
-      flag: "--console-switch-agent <uid>",
-      description: "Switch agent UID",
-      type: "number",
-    },
-  ],
+  auth: "none",
   exampleArgs: ["", "--output json"],
-  async run(config: Config, _flags: GlobalFlags) {
-    const format = detectOutputFormat(config.output);
-    const status = await buildStatus(config);
+  async run(ctx) {
+    const { identity, settings } = ctx;
+    const format = detectOutputFormat(settings.output);
+    const auth = ctx.authStore.describe();
 
-    if (!hasAnyAuth(status)) {
-      const result = {
-        authenticated: false,
-        message: "Not authenticated.",
-        hint: [
-          `DashScope API: ${config.binName} auth login --api-key <key> or DASHSCOPE_API_KEY`,
-          `Console gateway: ${config.binName} auth login --console or DASHSCOPE_ACCESS_TOKEN`,
-          `Get API Key: ${API_KEY_PAGE}`,
-        ].join("\n"),
-        ...status,
-      };
-      emitResult(result, format);
+    const apiKey = auth.apiKey
+      ? {
+          source: auth.apiKey.source,
+          masked: maskToken(auth.apiKey.token),
+          base_url: auth.apiKey.baseUrl,
+        }
+      : undefined;
+    const consoleCred = auth.console
+      ? {
+          source: auth.console.source,
+          masked: maskToken(auth.console.token),
+          region: auth.console.region,
+          site: auth.console.site,
+        }
+      : undefined;
+    const openapi = auth.openapi
+      ? {
+          source: auth.openapi.source,
+          access_key_id: maskToken(auth.openapi.accessKeyId),
+          access_key_secret: maskToken(auth.openapi.accessKeySecret),
+        }
+      : undefined;
+
+    const authenticated = !!(apiKey || consoleCred || openapi);
+    const configName = settings.configName ?? "default";
+    const configFile = ctx.authStore.path;
+
+    if (!authenticated) {
+      emitResult(
+        {
+          authenticated: false,
+          config: configName,
+          config_file: configFile,
+          message: "Not authenticated.",
+          hint: [
+            `API key (model):   ${identity.binName} auth login --api-key <key> or DASHSCOPE_API_KEY`,
+            `Console gateway:   ${identity.binName} auth login --console`,
+            `OpenAPI (AK/SK):   ${identity.binName} auth login --open-api --access-key-id <id> --access-key-secret <secret>`,
+            `Get API Key: ${API_KEY_PAGE}`,
+          ].join("\n"),
+        },
+        format,
+      );
       return;
     }
 
     if (format !== "text") {
-      emitResult({ authenticated: true, ...status }, format);
+      emitResult(
+        {
+          authenticated: true,
+          config: configName,
+          config_file: configFile,
+          api_key: apiKey,
+          console: consoleCred,
+          openapi,
+        },
+        format,
+      );
       return;
     }
 
-    emitTextStatus(status, config);
+    emitBare(`Config: ${configName}`);
+    emitBare(`Config file: ${configFile}`);
+    emitBare("Authentication Status:");
+    if (apiKey) {
+      emitBare(`  API key (model):  ${apiKey.source}  ${apiKey.masked}`);
+    } else {
+      emitBare("  API key (model):  not configured");
+    }
+    if (consoleCred) {
+      emitBare(
+        `  Console gateway:  ${consoleCred.source}  ${consoleCred.masked}  (${consoleCred.region}, ${consoleCred.site})`,
+      );
+    } else {
+      emitBare(`  Console gateway:  not configured (run ${identity.binName} auth login --console)`);
+    }
+    if (openapi) {
+      emitBare(`  OpenAPI (AK/SK):  ${openapi.source}  ${openapi.access_key_id}`);
+    } else {
+      emitBare(
+        `  OpenAPI (AK/SK):  not configured (run ${identity.binName} auth login --open-api)`,
+      );
+    }
   },
 });

packages/commands/src/commands/config/agent-launch.ts

@@ -0,0 +1,131 @@
+/**
+ * Best-effort local launcher for coding-agent CLIs surfaced in the config UI.
+ *
+ * The command for each agent is taken from a fixed allowlist keyed by the
+ * agent id, so no user-controlled string is ever executed. Every child process
+ * is spawned via `execFile` (array args, no shell) to avoid injection.
+ */
+import { execFile } from "node:child_process";
+
+/** Fixed allowlist: agent id -> launch binary. Keys match `AGENT_PROBES` ids. */
+export const AGENT_COMMANDS: Record<string, string> = {
+  "claude-code": "claude",
+  "qwen-code": "qwen",
+  opencode: "opencode",
+  openclaw: "openclaw",
+  hermes: "hermes",
+  codex: "codex",
+};
+
+/** The launch binary for a known agent id, or undefined when unknown. */
+export function agentCommand(id: string): string | undefined {
+  return Object.prototype.hasOwnProperty.call(AGENT_COMMANDS, id) ? AGENT_COMMANDS[id] : undefined;
+}
+
+/**
+ * Per-agent argv that passes an initial task prompt while keeping the agent
+ * interactive in the terminal. Only verified contracts are listed; an agent
+ * absent here cannot be dispatched a prompt (its bare launch still works).
+ *   - qwen-code:   `qwen -i "<prompt>"`   (execute prompt, stay interactive)
+ *   - claude-code: `claude "<prompt>"`    (positional initial prompt)
+ *   - codex:       `codex "<prompt>"`     (positional initial prompt)
+ */
+const AGENT_PROMPT_ARGV: Record<string, (prompt: string) => string[]> = {
+  "qwen-code": (p) => ["-i", p],
+  "claude-code": (p) => [p],
+  codex: (p) => [p],
+};
+
+/** Whether a known agent supports being dispatched an initial task prompt. */
+export function agentSupportsPrompt(id: string): boolean {
+  return Object.prototype.hasOwnProperty.call(AGENT_PROMPT_ARGV, id);
+}
+
+/** Resolve whether a binary is reachable on PATH (via `which`/`where`). */
+function onPath(bin: string): Promise<boolean> {
+  const cmd = process.platform === "win32" ? "where" : "which";
+  return new Promise((resolve) => {
+    execFile(cmd, [bin], { windowsHide: true }, (err) => resolve(!err));
+  });
+}
+
+/**
+ * Whether a known agent can actually be quick-launched right now: its id maps to
+ * a launch binary and that binary is reachable on PATH. Unknown ids resolve to
+ * false. Used to gate the UI's Quick launch button so "Connected" agents whose
+ * CLI is not installed do not offer a launch that would immediately fail.
+ */
+export function agentLaunchable(id: string): Promise<boolean> {
+  const command = agentCommand(id);
+  if (!command) return Promise.resolve(false);
+  return onPath(command);
+}
+
+/** Single-quote a path for a POSIX shell command line. */
+function shQuote(p: string): string {
+  return `'${p.replace(/'/g, "'\\''")}'`;
+}
+
+/** Open a new OS terminal window that cd's into `cwd` and runs `command`. */
+function spawnTerminal(command: string, cwd: string): Promise<void> {
+  const platform = process.platform;
+  return new Promise((resolve, reject) => {
+    if (platform === "darwin") {
+      const inner = `cd ${shQuote(cwd)} && ${command}`;
+      const escaped = inner.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+      const args = [
+        "-e",
+        `tell application "Terminal" to do script "${escaped}"`,
+        "-e",
+        'tell application "Terminal" to activate',
+      ];
+      execFile("osascript", args, { windowsHide: true }, (err) => (err ? reject(err) : resolve()));
+      return;
+    }
+    if (platform === "win32") {
+      const args = ["/c", "start", "", "cmd", "/k", `cd /d ${cwd} && ${command}`];
+      execFile("cmd", args, { windowsHide: true }, (err) => (err ? reject(err) : resolve()));
+      return;
+    }
+    // Linux / other: best-effort via the distro's default terminal emulator.
+    const inner = `cd ${shQuote(cwd)} && ${command}; exec $SHELL`;
+    execFile("x-terminal-emulator", ["-e", "bash", "-lc", inner], { windowsHide: true }, (err) =>
+      err ? reject(new Error("No supported terminal emulator was found")) : resolve(),
+    );
+  });
+}
+
+export interface LaunchResult {
+  launched: boolean;
+  command: string;
+}
+
+/**
+ * Launch a known coding agent's local CLI in a new terminal window. When
+ * `prompt` is provided, it is passed as a single quoted argument using the
+ * agent's verified prompt contract so the agent starts with that task.
+ * Rejects when the id is unknown, the binary is missing from PATH, the agent
+ * does not support prompt dispatch, or the platform terminal could not open.
+ */
+export async function launchAgent(
+  id: string,
+  cwd: string = process.cwd(),
+  prompt?: string,
+): Promise<LaunchResult> {
+  const command = agentCommand(id);
+  if (!command) throw new Error(`Unknown agent: ${id}`);
+  if (!(await onPath(command))) {
+    throw new Error(`\`${command}\` was not found on your PATH — install ${id} first.`);
+  }
+  let fullCommand = command;
+  const task = (prompt ?? "").trim();
+  if (task) {
+    const build = AGENT_PROMPT_ARGV[id];
+    if (!build) throw new Error(`${id} does not support dispatching a task prompt.`);
+    // shQuote keeps the whole prompt as one shell argument (no injection); the
+    // platform terminal layer escapes the resulting command line separately.
+    fullCommand = [command, ...build(task).map(shQuote)].join(" ");
+  }
+  await spawnTerminal(fullCommand, cwd);
+  return { launched: true, command: fullCommand };
+}

packages/commands/src/commands/config/agent/decode-key.ts

@@ -0,0 +1,153 @@
+import { BailianError, ExitCode } from "bailian-cli-core";
+
+/**
+ * Decoder for the obfuscated API key ("o1_…") produced by the Model Studio web
+ * console. Ported verbatim from the frontend `encodeTokenPlanKey` counterpart:
+ * token = "o1_" + salt(6) + feistel-obfuscated payload + crc32 checksum(6),
+ * all over a 65-character alphabet. Pure logic, no dependencies; the CLI only
+ * ever needs the decode direction.
+ */
+
+const TOKEN_PREFIX = "o1_";
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.";
+const ALPHABET_SIZE = ALPHABET.length;
+const ALPHABET_INDEX = new Map(ALPHABET.split("").map((character, index) => [character, index]));
+const KEY_PATTERN = /^[A-Za-z0-9._-]+$/;
+const SALT_LENGTH = 6;
+const CHECKSUM_LENGTH = 6;
+const FEISTEL_ROUNDS = 8;
+
+function invalidCredential(): BailianError {
+  return new BailianError(
+    "Invalid obfuscated API key.",
+    ExitCode.USAGE,
+    '--key expects the obfuscated key copied from the web console (starts with "o1_").',
+  );
+}
+
+function toDigits(value: string): number[] {
+  const digits: number[] = [];
+  for (const character of value) {
+    const digit = ALPHABET_INDEX.get(character);
+    if (digit === undefined) throw invalidCredential();
+    digits.push(digit);
+  }
+  return digits;
+}
+
+function fromDigits(digits: number[]): string {
+  return digits.map((digit) => ALPHABET[digit]).join("");
+}
+
+function mixState(state: number, value: number): number {
+  return Math.imul((state ^ value) >>> 0, 0x01000193) >>> 0;
+}
+
+function nextState(state: number): number {
+  let next = state >>> 0;
+  next ^= next << 13;
+  next ^= next >>> 17;
+  next ^= next << 5;
+  return next >>> 0;
+}
+
+function createRoundMask(right: number[], salt: string, round: number, length: number): number[] {
+  let state = (0x811c9dc5 ^ Math.imul(round + 1, 0x9e3779b1)) >>> 0;
+
+  state = mixState(state, right.length);
+  state = mixState(state, length);
+  for (const character of salt) {
+    state = mixState(state, (ALPHABET_INDEX.get(character) ?? -1) + 1);
+  }
+  for (const digit of right) {
+    state = mixState(state, digit + 1);
+  }
+
+  state ^= state >>> 16;
+  state = Math.imul(state, 0x85ebca6b) >>> 0;
+  state ^= state >>> 13;
+  state = Math.imul(state, 0xc2b2ae35) >>> 0;
+  state ^= state >>> 16;
+  state = state >>> 0 || 0x6d2b79f5;
+
+  const mask: number[] = [];
+  for (let index = 0; index < length; index += 1) {
+    state = (state + Math.imul(index + 1, 0x9e3779b1)) >>> 0;
+    state = nextState(state);
+    mask.push(state % ALPHABET_SIZE);
+  }
+  return mask;
+}
+
+function deobfuscatePayload(payload: string, salt: string): string {
+  const digits = toDigits(payload);
+  const midpoint = Math.floor(digits.length / 2);
+  let left = digits.slice(0, midpoint);
+  let right = digits.slice(midpoint);
+
+  for (let round = FEISTEL_ROUNDS - 1; round >= 0; round -= 1) {
+    const previousRight = left;
+    const mask = createRoundMask(previousRight, salt, round, right.length);
+    const previousLeft = right.map(
+      (digit, index) => (digit - mask[index] + ALPHABET_SIZE) % ALPHABET_SIZE,
+    );
+    left = previousLeft;
+    right = previousRight;
+  }
+
+  return fromDigits([...left, ...right]);
+}
+
+function crc32(value: string): number {
+  let checksum = 0xffffffff;
+  for (let index = 0; index < value.length; index += 1) {
+    checksum ^= value.charCodeAt(index);
+    for (let bit = 0; bit < 8; bit += 1) {
+      const mask = -(checksum & 1);
+      checksum = (checksum >>> 1) ^ (0xedb88320 & mask);
+    }
+  }
+  return (checksum ^ 0xffffffff) >>> 0;
+}
+
+function encodeBase65Number(value: number, length: number): string {
+  let remaining = value >>> 0;
+  const encoded = Array<string>(length).fill(ALPHABET[0]);
+
+  for (let index = length - 1; index >= 0; index -= 1) {
+    encoded[index] = ALPHABET[remaining % ALPHABET_SIZE];
+    remaining = Math.floor(remaining / ALPHABET_SIZE);
+  }
+  if (remaining !== 0) throw invalidCredential();
+  return encoded.join("");
+}
+
+function validateSalt(salt: string): void {
+  if (salt.length !== SALT_LENGTH || !KEY_PATTERN.test(salt)) {
+    throw invalidCredential();
+  }
+}
+
+/** Decode an "o1_…" obfuscated token back into the plain API key. */
+export function decodeTokenPlanKey(token: string): string {
+  const minimumLength = TOKEN_PREFIX.length + SALT_LENGTH + CHECKSUM_LENGTH + 1;
+  if (token.length < minimumLength || !token.startsWith(TOKEN_PREFIX)) {
+    throw invalidCredential();
+  }
+
+  const body = token.slice(TOKEN_PREFIX.length);
+  if (!KEY_PATTERN.test(body)) throw invalidCredential();
+
+  const salt = body.slice(0, SALT_LENGTH);
+  const payload = body.slice(SALT_LENGTH, -CHECKSUM_LENGTH);
+  const checksum = body.slice(-CHECKSUM_LENGTH);
+  validateSalt(salt);
+  if (!payload) throw invalidCredential();
+
+  const apiKey = deobfuscatePayload(payload, salt);
+  if (!KEY_PATTERN.test(apiKey)) throw invalidCredential();
+
+  const expectedChecksum = encodeBase65Number(crc32(apiKey), CHECKSUM_LENGTH);
+  if (checksum !== expectedChecksum) throw invalidCredential();
+  return apiKey;
+}

packages/commands/src/commands/config/agent/index.ts

@@ -0,0 +1,128 @@
+import { platform } from "os";
+import { defineCommand, detectOutputFormat, maskToken, type FlagsDef } from "bailian-cli-core";
+import { emitResult, emitBare } from "bailian-cli-runtime";
+import { AGENTS, VALID_AGENT_NAMES, type WriteParams } from "./writers.ts";
+import { decodeTokenPlanKey } from "./decode-key.ts";
+import { resolveRegionBaseUrl } from "./writers/utils.ts";
+
+const FLAGS = {
+  agent: {
+    type: "string",
+    valueHint: "<name>",
+    description: `Target agent: ${VALID_AGENT_NAMES.join(", ")}`,
+    required: true,
+    choices: VALID_AGENT_NAMES,
+  },
+  baseUrl: {
+    type: "string",
+    valueHint: "<url>",
+    description: "API base URL",
+  },
+  region: {
+    type: "string",
+    valueHint: "<region>",
+    description:
+      "Model Studio region (e.g. cn-beijing, ap-southeast-1); converted into --base-url. Token Plan only",
+  },
+  apiKey: {
+    type: "string",
+    valueHint: "<key>",
+    description: "API key",
+  },
+  key: {
+    type: "string",
+    valueHint: "<encoded>",
+    description:
+      'Obfuscated API key from the web console (starts with "o1_"); decoded into --api-key',
+  },
+  model: {
+    type: "string",
+    valueHint: "<model>",
+    description: "Default model name",
+    required: true,
+  },
+  contextWindow: {
+    type: "number",
+    valueHint: "<tokens>",
+    description: "OpenClaw only: model context window in tokens (default: 256000)",
+  },
+  wireApi: {
+    type: "string",
+    valueHint: "<api>",
+    description:
+      'Codex only: wire protocol (default: responses). "chat" only works with legacy Codex <= 0.80.0',
+    choices: ["chat", "responses"],
+  },
+} satisfies FlagsDef;
+
+export default defineCommand({
+  description: "Configure a coding agent to use DashScope API",
+  auth: "none",
+  usageArgs:
+    "--agent <name> (--base-url <url> | --region <region>) (--api-key <key> | --key <encoded>) --model <model>",
+  flags: FLAGS,
+  exampleArgs: [
+    "--agent claude-code --base-url https://dashscope.aliyuncs.com/apps/anthropic --api-key sk-xxxxx --model qwen3-max",
+    "--agent qwen-code --base-url https://dashscope.aliyuncs.com/compatible-mode/v1 --api-key sk-xxxxx --model qwen3-coder-plus",
+    "--agent codex --base-url https://dashscope.aliyuncs.com/compatible-mode/v1 --api-key sk-xxxxx --model qwen3-coder-plus",
+  ],
+  validate(flags) {
+    if (!flags.baseUrl && !flags.region) return "one of --base-url or --region is required";
+    if (flags.baseUrl && flags.region) return "--base-url and --region are mutually exclusive";
+    if (!flags.apiKey && !flags.key) return "one of --api-key or --key is required";
+    if (flags.apiKey && flags.key) return "--api-key and --key are mutually exclusive";
+    return undefined;
+  },
+  async run(ctx) {
+    const { settings, flags } = ctx;
+    const agentName = flags.agent;
+    const { model, contextWindow, wireApi } = flags;
+    // --region is a Token Plan convenience: convert it into a base URL and use
+    // it exactly as --base-url would be.
+    const baseUrl = flags.region ? resolveRegionBaseUrl(flags.region) : flags.baseUrl!;
+    // --key carries the web console's obfuscated form; decode it up front so
+    // even --dry-run validates the token.
+    const apiKey = flags.key ? decodeTokenPlanKey(flags.key) : flags.apiKey!;
+    const agentDef = AGENTS[agentName];
+    const format = detectOutputFormat(settings.output);
+
+    // Hermes has no native Windows support.
+    if (agentName === "hermes" && platform() === "win32") {
+      process.stderr.write(
+        "Warning: Hermes Agent does not support native Windows. Please use WSL2.\n",
+      );
+    }
+
+    if (settings.dryRun) {
+      emitResult(
+        {
+          agent: agentName,
+          label: agentDef.label,
+          base_url: baseUrl,
+          api_key: maskToken(apiKey),
+          model,
+        },
+        format,
+      );
+      return;
+    }
+
+    const params: WriteParams = {
+      baseUrl,
+      apiKey,
+      model,
+      contextWindow,
+      wireApi,
+    };
+    const summary = agentDef.write(params);
+
+    if (!settings.quiet) {
+      emitBare(`${agentDef.label} configured successfully.`);
+      for (const path of summary.paths) emitBare(`  Written: ${path}`);
+      emitBare(`  ${summary.nextStep}`);
+      for (const warning of summary.warnings ?? []) {
+        process.stderr.write(`Warning: ${warning}\n`);
+      }
+    }
+  },
+});

packages/commands/src/commands/config/agent/writers.ts

@@ -0,0 +1,20 @@
+export type { WriteParams, WriteSummary, AgentDef } from "./writers/utils.ts";
+
+import type { AgentDef } from "./writers/utils.ts";
+import claudeCode from "./writers/claude-code.ts";
+import qwenCode from "./writers/qwen-code.ts";
+import opencode from "./writers/opencode.ts";
+import openclaw from "./writers/openclaw.ts";
+import hermes from "./writers/hermes.ts";
+import codex from "./writers/codex.ts";
+
+export const AGENTS: Record<string, AgentDef> = {
+  "claude-code": claudeCode,
+  "qwen-code": qwenCode,
+  opencode,
+  openclaw,
+  hermes,
+  codex,
+};
+
+export const VALID_AGENT_NAMES = Object.keys(AGENTS) as [string, ...string[]];

packages/commands/src/commands/config/agent/writers/claude-code.ts

@@ -0,0 +1,68 @@
+import { homedir } from "os";
+import { join } from "path";
+import {
+  backup,
+  readJson,
+  writeJsonAtomic,
+  resolveClaudeCodeBaseUrl,
+  type AgentDef,
+} from "./utils.ts";
+
+/** Fill a tier/default model env only when the user has not set it yet. */
+function setModelEnvIfAbsent(env: Record<string, string>, key: string, model: string): void {
+  const current = env[key];
+  if (current === undefined || current.trim() === "") {
+    env[key] = model;
+  }
+}
+
+export default {
+  label: "Claude Code",
+  write({ baseUrl, apiKey, model }) {
+    // Claude Code honors CLAUDE_CONFIG_DIR for its settings location.
+    const configDir = process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude");
+    const settingsPath = join(configDir, "settings.json");
+    const onboardingPath = join(homedir(), ".claude.json");
+    const warnings: string[] = [];
+
+    const resolved = resolveClaudeCodeBaseUrl(baseUrl);
+    if (resolved.rewrittenFrom) {
+      warnings.push(
+        `Rewrote base URL for Claude Code: "${resolved.rewrittenFrom}" → "${resolved.url}" ` +
+          `(Claude Code needs /apps/anthropic, not OpenAI compatible-mode).`,
+      );
+    }
+
+    // settings.json — merge env. Base URL + auth token connect Claude Code to
+    // the Anthropic-compatible endpoint; primary model always updates, while
+    // tier/subagent defaults are filled only when absent so existing setups
+    // (e.g. Token Plan Haiku/Subagent splits) are not wiped.
+    backup(settingsPath);
+    const settings = readJson(settingsPath);
+    const env = (settings.env ?? {}) as Record<string, string>;
+    env.ANTHROPIC_BASE_URL = resolved.url;
+    env.ANTHROPIC_AUTH_TOKEN = apiKey;
+    // AUTH_TOKEN and API_KEY are mutually exclusive credential fields — drop a
+    // stale ANTHROPIC_API_KEY so it cannot shadow the token we just wrote.
+    delete env.ANTHROPIC_API_KEY;
+    env.ANTHROPIC_MODEL = model;
+    setModelEnvIfAbsent(env, "ANTHROPIC_DEFAULT_HAIKU_MODEL", model);
+    setModelEnvIfAbsent(env, "ANTHROPIC_DEFAULT_SONNET_MODEL", model);
+    setModelEnvIfAbsent(env, "ANTHROPIC_DEFAULT_OPUS_MODEL", model);
+    setModelEnvIfAbsent(env, "CLAUDE_CODE_SUBAGENT_MODEL", model);
+    settings.env = env;
+    writeJsonAtomic(settingsPath, settings);
+
+    // .claude.json — skip the onboarding prompt on first launch.
+    backup(onboardingPath);
+    const onboarding = readJson(onboardingPath);
+    onboarding.hasCompletedOnboarding = true;
+    writeJsonAtomic(onboardingPath, onboarding);
+
+    return {
+      paths: [settingsPath, onboardingPath],
+      nextStep: "Run `claude` to start using Claude Code with DashScope.",
+      warnings: warnings.length > 0 ? warnings : undefined,
+    };
+  },
+} satisfies AgentDef;

packages/commands/src/commands/config/agent/writers/codex.ts

@@ -0,0 +1,72 @@
+import { homedir } from "os";
+import { join } from "path";
+import { existsSync, readFileSync } from "fs";
+import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+import { backup, readJson, writeJsonAtomic, writeTextAtomic, type AgentDef } from "./utils.ts";
+
+const PROVIDER_KEY = "bailian-cli";
+
+export default {
+  label: "Codex",
+  write({ baseUrl, apiKey, model, wireApi: wireApiParam }) {
+    const configPath = join(homedir(), ".codex", "config.toml");
+    const warnings: string[] = [];
+
+    // config.toml — merge into existing config so unrelated settings
+    // (mcp_servers, approval_policy, other providers, ...) are preserved.
+    backup(configPath);
+    let config: Record<string, unknown> = {};
+    if (existsSync(configPath)) {
+      try {
+        config = parseToml(readFileSync(configPath, "utf-8")) as Record<string, unknown>;
+      } catch {
+        config = {};
+      }
+    }
+
+    config.model_provider = PROVIDER_KEY;
+    config.model = model;
+
+    // wire_api — current Codex releases only load `wire_api = "responses"`
+    // ("chat" is rejected at config load, see openai/codex discussion #7782).
+    // "chat" remains an explicit opt-in for users pinned to legacy Codex
+    // <= 0.80.0 (the Model Studio path for models without Responses support).
+    const wireApi = wireApiParam === "chat" ? "chat" : "responses";
+    if (wireApi === "chat") {
+      warnings.push(
+        'Current Codex releases refuse to load `wire_api = "chat"`; ' +
+          "only use --wire-api chat with legacy Codex <= 0.80.0 " +
+          "(e.g. `npm install -g @openai/codex@0.80.0`).",
+      );
+    }
+
+    const providers = (config.model_providers ?? {}) as Record<string, unknown>;
+    const existing = (providers[PROVIDER_KEY] ?? {}) as Record<string, unknown>;
+    providers[PROVIDER_KEY] = {
+      ...existing,
+      name: PROVIDER_KEY,
+      base_url: baseUrl,
+      // env_key is the official-doc credential mechanism: Codex resolves the
+      // key from the OPENAI_API_KEY env var, falling back to auth.json below.
+      env_key: "OPENAI_API_KEY",
+      wire_api: wireApi,
+      requires_openai_auth: true,
+    };
+    config.model_providers = providers;
+
+    writeTextAtomic(configPath, stringifyToml(config) + "\n");
+
+    // auth.json — Codex reads OPENAI_API_KEY from here when the env var is unset.
+    const authPath = join(homedir(), ".codex", "auth.json");
+    backup(authPath);
+    const auth = readJson(authPath);
+    auth.OPENAI_API_KEY = apiKey;
+    writeJsonAtomic(authPath, auth);
+
+    return {
+      paths: [configPath, authPath],
+      nextStep: "Run `codex` to start using Codex with DashScope.",
+      warnings: warnings.length > 0 ? warnings : undefined,
+    };
+  },
+} satisfies AgentDef;

packages/commands/src/commands/config/agent/writers/hermes.ts

@@ -0,0 +1,43 @@
+import { homedir } from "os";
+import { join } from "path";
+import { existsSync, readFileSync } from "fs";
+import yaml from "yaml";
+import { backup, writeTextAtomic, isAnthropicEndpoint, type AgentDef } from "./utils.ts";
+
+export default {
+  label: "Hermes Agent",
+  write({ baseUrl, apiKey, model }) {
+    const configPath = join(homedir(), ".hermes", "config.yaml");
+
+    backup(configPath);
+
+    let config: Record<string, unknown> = {};
+    if (existsSync(configPath)) {
+      try {
+        config = (yaml.parse(readFileSync(configPath, "utf-8")) ?? {}) as Record<string, unknown>;
+      } catch {
+        config = {};
+      }
+    }
+
+    // Official Model Studio doc shape: a single flat `model` block holding the
+    // active endpoint + credentials. `api_mode: anthropic_messages` is required
+    // for /apps/anthropic endpoints; for the OpenAI-compatible endpoint the
+    // doc says to omit api_mode entirely (chat completions is the default).
+    const block: Record<string, unknown> = {
+      default: model,
+      provider: "custom",
+      base_url: baseUrl,
+      api_key: apiKey,
+    };
+    if (isAnthropicEndpoint(baseUrl)) block.api_mode = "anthropic_messages";
+    config.model = block;
+
+    writeTextAtomic(configPath, yaml.stringify(config));
+
+    return {
+      paths: [configPath],
+      nextStep: 'Run `hermes chat -q "hello"` to verify.',
+    };
+  },
+} satisfies AgentDef;

packages/commands/src/commands/config/agent/writers/openclaw.ts

@@ -0,0 +1,83 @@
+import { homedir } from "os";
+import { join } from "path";
+import { backup, readJson, writeJsonAtomic, isAnthropicEndpoint, type AgentDef } from "./utils.ts";
+
+// Safe default when --context-window is not given: most Model Studio models
+// offer ≥256K context; users can raise it per model via the flag.
+const DEFAULT_CONTEXT_WINDOW = 256000;
+
+const PROVIDER_ID = "bailian-cli";
+
+function readPrimary(defaults: Record<string, unknown>): string | undefined {
+  const model = defaults.model;
+  if (!model || typeof model !== "object") return undefined;
+  const primary = (model as Record<string, unknown>).primary;
+  return typeof primary === "string" && primary.trim() !== "" ? primary.trim() : undefined;
+}
+
+export default {
+  label: "OpenClaw",
+  write({ baseUrl, apiKey, model, contextWindow }) {
+    const configPath = join(homedir(), ".openclaw", "openclaw.json");
+    const warnings: string[] = [];
+    const modelRef = `${PROVIDER_ID}/${model}`;
+
+    backup(configPath);
+    const config = readJson(configPath);
+
+    // models.providers["bailian-cli"] — upsert without removing other providers
+    // (e.g. an existing working bailian-token-plan setup).
+    const models = (config.models ?? {}) as Record<string, unknown>;
+    models.mode = "merge";
+    const providers = (models.providers ?? {}) as Record<string, unknown>;
+    const api = isAnthropicEndpoint(baseUrl) ? "anthropic-messages" : "openai-completions";
+    providers[PROVIDER_ID] = {
+      baseUrl,
+      apiKey,
+      api,
+      models: [
+        {
+          id: model,
+          name: model,
+          contextWindow: contextWindow ?? DEFAULT_CONTEXT_WINDOW,
+          cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        },
+      ],
+    };
+    models.providers = providers;
+    config.models = models;
+
+    // agents.defaults — register the model in the allow-list. Only set primary
+    // when unset, or when primary already points at bailian-cli (reconfigure).
+    // Never steal primary away from another provider such as bailian-token-plan.
+    const agents = (config.agents ?? {}) as Record<string, unknown>;
+    const defaults = (agents.defaults ?? {}) as Record<string, unknown>;
+    const allowedModels = (defaults.models ?? {}) as Record<string, unknown>;
+    allowedModels[modelRef] = allowedModels[modelRef] ?? {};
+    defaults.models = allowedModels;
+
+    const existingPrimary = readPrimary(defaults);
+    if (!existingPrimary) {
+      defaults.model = { primary: modelRef };
+    } else if (existingPrimary.startsWith(`${PROVIDER_ID}/`)) {
+      defaults.model = { primary: modelRef };
+    } else {
+      warnings.push(
+        `Left existing primary model unchanged ("${existingPrimary}"). ` +
+          `Added provider "${PROVIDER_ID}" — switch to "${modelRef}" in OpenClaw if you want to use it.`,
+      );
+    }
+
+    agents.defaults = defaults;
+    config.agents = agents;
+
+    writeJsonAtomic(configPath, config);
+
+    return {
+      paths: [configPath],
+      nextStep:
+        "Run `openclaw gateway restart`, then `openclaw` to start using OpenClaw with DashScope.",
+      warnings: warnings.length > 0 ? warnings : undefined,
+    };
+  },
+} satisfies AgentDef;

packages/commands/src/commands/config/agent/writers/opencode.ts

@@ -0,0 +1,33 @@
+import { homedir } from "os";
+import { join } from "path";
+import { backup, readJsonc, writeJsonAtomic, isAnthropicEndpoint, type AgentDef } from "./utils.ts";
+
+export default {
+  label: "OpenCode",
+  write({ baseUrl, apiKey, model }) {
+    const configPath = join(homedir(), ".config", "opencode", "opencode.json");
+
+    // opencode.json is JSONC — tolerate comments and trailing commas on read.
+    backup(configPath);
+    const config = readJsonc(configPath);
+
+    if (!config.$schema) config.$schema = "https://opencode.ai/config.json";
+
+    const provider = (config.provider ?? {}) as Record<string, unknown>;
+    const npm = isAnthropicEndpoint(baseUrl) ? "@ai-sdk/anthropic" : "@ai-sdk/openai-compatible";
+    provider["bailian-cli"] = {
+      npm,
+      name: "Alibaba Cloud Model Studio",
+      options: { baseURL: baseUrl, apiKey, setCacheKey: true },
+      models: { [model]: { name: model } },
+    };
+    config.provider = provider;
+
+    writeJsonAtomic(configPath, config);
+
+    return {
+      paths: [configPath],
+      nextStep: "Run `opencode` then type `/models` to select your model.",
+    };
+  },
+} satisfies AgentDef;

packages/commands/src/commands/config/agent/writers/qwen-code.ts

@@ -0,0 +1,119 @@
+import { homedir } from "os";
+import { join } from "path";
+import { backup, readJson, writeJsonAtomic, isAnthropicEndpoint, type AgentDef } from "./utils.ts";
+
+const ENV_KEY = "DASHSCOPE_API_KEY";
+
+function displayName(model: string): string {
+  return `[Bailian] ${model}`;
+}
+
+/** Entries we previously wrote, or still own via envKey / display brand. */
+function isBailianCliEntry(entry: Record<string, unknown>): boolean {
+  if (entry.envKey === ENV_KEY) return true;
+  const name = typeof entry.name === "string" ? entry.name : "";
+  return name === "bailian-cli" || name.startsWith("[Bailian]");
+}
+
+/**
+ * Qwen Code keys `modelProviders` and `security.auth.selectedType` by the SDK
+ * protocol (an AuthType string), not by a free-form provider id — the runtime
+ * resolver indexes credentials/defaults by protocol. The `bailian-cli` brand
+ * therefore lives in the env var name (`BAILIAN_CLI_API_KEY`) and the display
+ * label (`[Bailian] …`); Qwen Code keys models by id (+ baseUrl), never by name.
+ *
+ * Qwen Code does not support duplicate model `id`s (only the first loads), so
+ * we must never overwrite a pre-existing Token Plan / third-party entry that
+ * shares the same id.
+ *
+ * Credentials are written to BOTH `env` (via the entry's `envKey`) and
+ * `security.auth` — the resolver reads `security.auth.apiKey/baseUrl` as a
+ * lower-priority layer, which stops a stray system `OPENAI_API_KEY` from being
+ * picked up when the provider→envKey path does not resolve first. The active
+ * `model` also carries its `baseUrl`, as Qwen Code requires to disambiguate
+ * same-id providers.
+ */
+export default {
+  label: "Qwen Code",
+  write({ baseUrl, apiKey, model }) {
+    const settingsPath = join(homedir(), ".qwen", "settings.json");
+    const protocol = isAnthropicEndpoint(baseUrl) ? "anthropic" : "openai";
+    const warnings: string[] = [];
+
+    backup(settingsPath);
+    const settings = readJson(settingsPath);
+
+    // $version — Qwen Code v3 settings schema (official Model Studio doc shape).
+    settings.$version = 3;
+
+    // env — API key read by the provider entry's envKey.
+    // Qwen Code treats settings.json `env` as lowest priority; a process/shell
+    // value for the same key wins and can make the first launch fail.
+    const env = (settings.env ?? {}) as Record<string, string>;
+    env[ENV_KEY] = apiKey;
+    settings.env = env;
+
+    const processEnvValue = process.env[ENV_KEY];
+    if (processEnvValue !== undefined && processEnvValue !== apiKey) {
+      warnings.push(
+        `Shell/environment ${ENV_KEY} is set and overrides settings.json. ` +
+          `Unset it (e.g. \`unset ${ENV_KEY}\`) so the key written here takes effect.`,
+      );
+    }
+
+    // modelProviders[<protocol>] — upsert only bailian-cli-owned entries.
+    const providers = (settings.modelProviders ?? {}) as Record<
+      string,
+      Array<Record<string, unknown>>
+    >;
+    const entries = (providers[protocol] ?? []) as Array<Record<string, unknown>>;
+    const owned = entries.find((entry) => isBailianCliEntry(entry) && entry.id === model);
+    const conflicting = entries.find((entry) => !isBailianCliEntry(entry) && entry.id === model);
+
+    if (owned) {
+      owned.baseUrl = baseUrl;
+      owned.envKey = ENV_KEY;
+      const currentName = typeof owned.name === "string" ? owned.name.trim() : "";
+      if (!currentName || currentName === "bailian-cli") owned.name = displayName(model);
+    } else if (conflicting) {
+      const existingName =
+        typeof conflicting.name === "string" && conflicting.name.length > 0
+          ? conflicting.name
+          : String(conflicting.id);
+      warnings.push(
+        `Model id "${model}" already exists as "${existingName}"; left unchanged ` +
+          `(Qwen Code loads only the first entry per id). Remove or rename that ` +
+          `entry if you want bailian-cli to own this model.`,
+      );
+    } else {
+      entries.push({
+        id: model,
+        name: displayName(model),
+        baseUrl,
+        envKey: ENV_KEY,
+      });
+    }
+    providers[protocol] = entries;
+    settings.modelProviders = providers;
+
+    // security.auth — select the protocol AND keep credentials as a fallback
+    // layer (see the file-level note): without this, a stray system
+    // OPENAI_API_KEY can win when the provider→envKey lookup does not resolve.
+    const security = (settings.security ?? {}) as Record<string, unknown>;
+    security.auth = { selectedType: protocol, apiKey, baseUrl };
+    settings.security = security;
+
+    // model — active model. baseUrl MUST be written alongside name; Qwen Code
+    // uses it to disambiguate same-id providers, and omitting it can misroute
+    // to a different entry (and thus a different credential).
+    settings.model = { name: model, baseUrl };
+
+    writeJsonAtomic(settingsPath, settings);
+
+    return {
+      paths: [settingsPath],
+      nextStep: "Run `qwen` to start using Qwen Code with DashScope.",
+      warnings: warnings.length > 0 ? warnings : undefined,
+    };
+  },
+} satisfies AgentDef;

packages/commands/src/commands/config/agent/writers/utils.ts

@@ -0,0 +1,215 @@
+import { dirname } from "path";
+import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, copyFileSync } from "fs";
+import { BailianError, ExitCode } from "bailian-cli-core";
+
+/** Parameters shared by every agent writer. */
+export interface WriteParams {
+  baseUrl: string;
+  apiKey: string;
+  model: string;
+  /** OpenClaw model entry context window (tokens). */
+  contextWindow?: number;
+  /** Codex provider wire protocol: "responses" or "chat". */
+  wireApi?: string;
+}
+
+/** What a writer reports back after configuring an agent. */
+export interface WriteSummary {
+  paths: string[];
+  nextStep: string;
+  /** Non-fatal issues the command should surface to the user. */
+  warnings?: string[];
+}
+
+/** An agent configuration writer: a human label plus a `write` that applies it. */
+export interface AgentDef {
+  label: string;
+  write(params: WriteParams): WriteSummary;
+}
+
+/**
+ * Strip JSONC syntax (line / block comments and trailing commas) so the result
+ * parses with `JSON.parse`. String contents are preserved verbatim.
+ */
+export function stripJsonc(text: string): string {
+  // Pass 1 — drop comments (string contents preserved verbatim).
+  let uncommented = "";
+  let index = 0;
+  let inString = false;
+  while (index < text.length) {
+    const char = text[index];
+    const next = text[index + 1];
+    if (inString) {
+      uncommented += char;
+      if (char === "\\") {
+        uncommented += next ?? "";
+        index += 2;
+        continue;
+      }
+      if (char === '"') inString = false;
+      index += 1;
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      uncommented += char;
+      index += 1;
+      continue;
+    }
+    if (char === "/" && next === "/") {
+      while (index < text.length && text[index] !== "\n") index += 1;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      index += 2;
+      while (index < text.length && !(text[index] === "*" && text[index + 1] === "/")) index += 1;
+      index += 2;
+      continue;
+    }
+    uncommented += char;
+    index += 1;
+  }
+
+  // Pass 2 — drop trailing commas (a comma whose next non-whitespace char
+  // closes an object/array). Runs after comment removal so a trailing comment
+  // cannot hide the closing bracket.
+  let output = "";
+  index = 0;
+  inString = false;
+  while (index < uncommented.length) {
+    const char = uncommented[index];
+    if (inString) {
+      output += char;
+      if (char === "\\") {
+        output += uncommented[index + 1] ?? "";
+        index += 2;
+        continue;
+      }
+      if (char === '"') inString = false;
+      index += 1;
+      continue;
+    }
+    if (char === '"') inString = true;
+    if (char === ",") {
+      let lookahead = index + 1;
+      while (lookahead < uncommented.length && /\s/.test(uncommented[lookahead])) lookahead += 1;
+      if (uncommented[lookahead] === "}" || uncommented[lookahead] === "]") {
+        index += 1;
+        continue;
+      }
+    }
+    output += char;
+    index += 1;
+  }
+  return output;
+}
+
+/** Read a JSON object file, returning `{}` when missing or unparseable. */
+export function readJson(path: string): Record<string, unknown> {
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf-8")) as Record<string, unknown>;
+  } catch {
+    return {};
+  }
+}
+
+/** Like {@link readJson}, but tolerates JSONC (comments / trailing commas). */
+export function readJsonc(path: string): Record<string, unknown> {
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(stripJsonc(readFileSync(path, "utf-8"))) as Record<string, unknown>;
+  } catch {
+    return {};
+  }
+}
+
+/** Atomically write `data` as pretty JSON with owner-only permissions. */
+export function writeJsonAtomic(path: string, data: unknown): void {
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = path + ".tmp";
+  writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n", { mode: 0o600 });
+  renameSync(tmp, path);
+}
+
+/** Atomically write raw text with owner-only permissions. */
+export function writeTextAtomic(path: string, content: string): void {
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = path + ".tmp";
+  writeFileSync(tmp, content, { mode: 0o600 });
+  renameSync(tmp, path);
+}
+
+/** Copy an existing file to a timestamped `.bak.<epoch>` sibling. No-op if absent. */
+export function backup(path: string): void {
+  if (!existsSync(path)) return;
+  const timestamp = Math.floor(Date.now() / 1000);
+  copyFileSync(path, `${path}.bak.${timestamp}`);
+}
+
+/** Whether a base URL targets the Anthropic-messages compatible endpoint. */
+export function isAnthropicEndpoint(baseUrl: string): boolean {
+  return baseUrl.includes("/apps/anthropic");
+}
+
+/**
+ * Claude Code speaks Anthropic Messages only. Users often paste the OpenAI
+ * compatible-mode URL; rewrite that to `/apps/anthropic` when possible, otherwise
+ * fail with a clear USAGE error before writing a broken config.
+ */
+export function resolveClaudeCodeBaseUrl(baseUrl: string): {
+  url: string;
+  rewrittenFrom?: string;
+} {
+  const trimmed = baseUrl.trim().replace(/\/+$/, "");
+
+  if (isAnthropicEndpoint(trimmed)) {
+    return { url: trimmed };
+  }
+
+  if (trimmed.includes("/compatible-mode")) {
+    const rewritten = trimmed.replace(/\/compatible-mode(?:\/v\d+)?/, "/apps/anthropic");
+    return { url: rewritten, rewrittenFrom: baseUrl.trim() };
+  }
+
+  try {
+    const parsed = new URL(trimmed);
+    const host = parsed.hostname;
+    const isDashScopeHost =
+      host.includes("dashscope") ||
+      host.includes("maas.aliyuncs.com") ||
+      host.includes("token-plan");
+    if (isDashScopeHost && (parsed.pathname === "/" || parsed.pathname === "")) {
+      return {
+        url: `${parsed.origin}/apps/anthropic`,
+        rewrittenFrom: baseUrl.trim(),
+      };
+    }
+  } catch {
+    // Fall through to the USAGE error below.
+  }
+
+  throw new BailianError(
+    `Claude Code requires an Anthropic-compatible base URL, got "${baseUrl}".`,
+    ExitCode.USAGE,
+    "Use a URL ending in /apps/anthropic (not /compatible-mode/v1). Example: https://dashscope.aliyuncs.com/apps/anthropic",
+  );
+}
+
+/**
+ * Convert a Model Studio region id into a Token Plan base URL, used in place of
+ * --base-url. Produces the OpenAI-compatible endpoint; the claude-code writer
+ * rewrites it to /apps/anthropic on its own, and the other writers consume the
+ * compatible-mode URL directly.
+ */
+export function resolveRegionBaseUrl(region: string): string {
+  const normalized = region.trim();
+  if (!/^[a-z0-9-]+$/.test(normalized)) {
+    throw new BailianError(
+      `Invalid --region "${region}".`,
+      ExitCode.USAGE,
+      "Use a Model Studio region id, e.g. cn-beijing or ap-southeast-1.",
+    );
+  }
+  return `https://token-plan.${normalized}.maas.aliyuncs.com/compatible-mode/v1`;
+}

packages/commands/src/commands/config/assets.ts

@@ -0,0 +1,160 @@
+// Read/manage the local assets that `bl` writes into the output directory
+// (default ~/bailian-output, overridable via the `output_dir` config key).
+// Generated media may live directly under the base or in any subfolder (bl's
+// own images/, videos/, speech/, omni/, or user-created folders). This module
+// recursively discovers every file under the base, classifies each by type,
+// derives its category from the top-level folder, and provides safe path
+// resolution for serving/deleting individual assets.
+import { readdirSync, statSync, existsSync, type Dirent } from "node:fs";
+import { homedir } from "node:os";
+import { join, extname, relative, resolve, sep } from "node:path";
+
+export type AssetKind = "image" | "video" | "audio" | "other";
+
+/** One generated file discovered under the output directory. */
+export interface AssetInfo {
+  name: string;
+  /** Category folder the file lives in: images | videos | speech | omni | other. */
+  category: string;
+  kind: AssetKind;
+  /** Path relative to the output base (used as the API handle). */
+  relPath: string;
+  size: number;
+  /** Modification time in epoch milliseconds ~= generation time. */
+  mtime: number;
+  ext: string;
+}
+
+/** Max directory depth to descend from the output base when scanning. */
+const MAX_SCAN_DEPTH = 8;
+
+const KIND_BY_EXT: Record<string, AssetKind> = {
+  ".png": "image",
+  ".jpg": "image",
+  ".jpeg": "image",
+  ".webp": "image",
+  ".gif": "image",
+  ".bmp": "image",
+  ".svg": "image",
+  ".mp4": "video",
+  ".mov": "video",
+  ".webm": "video",
+  ".mkv": "video",
+  ".avi": "video",
+  ".mp3": "audio",
+  ".wav": "audio",
+  ".m4a": "audio",
+  ".aac": "audio",
+  ".flac": "audio",
+  ".ogg": "audio",
+};
+
+const CONTENT_TYPE: Record<string, string> = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".webp": "image/webp",
+  ".gif": "image/gif",
+  ".bmp": "image/bmp",
+  ".svg": "image/svg+xml",
+  ".mp4": "video/mp4",
+  ".mov": "video/quicktime",
+  ".webm": "video/webm",
+  ".mkv": "video/x-matroska",
+  ".avi": "video/x-msvideo",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".m4a": "audio/mp4",
+  ".aac": "audio/aac",
+  ".flac": "audio/flac",
+  ".ogg": "audio/ogg",
+};
+
+/** The default output base when `output_dir` is not configured. */
+export function defaultOutputBase(home: string = homedir()): string {
+  return join(home, "bailian-output");
+}
+
+function kindOf(ext: string): AssetKind {
+  return KIND_BY_EXT[ext.toLowerCase()] ?? "other";
+}
+
+/** MIME type for serving an asset; falls back to a safe binary type. */
+export function contentType(ext: string): string {
+  return CONTENT_TYPE[ext.toLowerCase()] ?? "application/octet-stream";
+}
+
+/** Recursively collect regular files under `dir`, descending at most `depth` levels. */
+function walk(dir: string, depth: number, out: string[]): void {
+  let entries: Dirent[];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    const full = join(dir, e.name);
+    if (e.isDirectory()) {
+      if (depth > 0) walk(full, depth - 1, out);
+    } else if (e.isFile() || e.isSymbolicLink()) {
+      out.push(full);
+    }
+  }
+}
+
+/**
+ * List generated assets under `base`, newest first. Recursively scans every
+ * subfolder under the base (plus loose files at the root), so assets in bl's
+ * own category dirs and any user-created folders are all discovered. Each
+ * file's `category` is its top-level folder name, or "other" for root files.
+ * Returns the resolved base so callers can surface it in the UI.
+ */
+export function listAssets(base: string = defaultOutputBase()): {
+  base: string;
+  assets: AssetInfo[];
+} {
+  const assets: AssetInfo[] = [];
+  if (!existsSync(base)) return { base, assets };
+
+  const files: string[] = [];
+  walk(base, MAX_SCAN_DEPTH, files);
+
+  for (const full of files) {
+    let st;
+    try {
+      st = statSync(full);
+    } catch {
+      continue;
+    }
+    if (!st.isFile()) continue;
+    const rel = relative(base, full);
+    const segments = rel.split(sep);
+    const category = segments.length > 1 ? segments[0]! : "other";
+    const ext = extname(full);
+    assets.push({
+      name: full.split(sep).pop() ?? full,
+      category,
+      kind: kindOf(ext),
+      relPath: rel,
+      size: st.size,
+      mtime: st.mtimeMs,
+      ext: ext.replace(/^\./, "").toLowerCase(),
+    });
+  }
+
+  assets.sort((a, b) => b.mtime - a.mtime);
+  return { base, assets };
+}
+
+/**
+ * Resolve a client-supplied relative path to an absolute path strictly inside
+ * `base`. Returns null for empty input or any path that would escape the base
+ * (path traversal guard).
+ */
+export function resolveAssetPath(base: string, relPath: string): string | null {
+  if (typeof relPath !== "string" || relPath.length === 0) return null;
+  const root = resolve(base);
+  const abs = resolve(root, relPath);
+  if (abs !== root && !abs.startsWith(root + sep)) return null;
+  return abs;
+}

packages/commands/src/commands/config/list.ts

@@ -0,0 +1,31 @@
+import { defineCommand, detectOutputFormat } from "bailian-cli-core";
+import { emitBare, emitResult } from "bailian-cli-runtime";
+
+export default defineCommand({
+  description: "List config profiles and show the active profile",
+  auth: "none",
+  exampleArgs: ["", "--output json"],
+  async run(ctx) {
+    const profiles = ctx.configStore.profiles();
+    const names = ["default", ...Object.keys(profiles.named).sort()];
+    const format = detectOutputFormat(ctx.settings.output);
+
+    if (format === "json") {
+      emitResult(
+        {
+          active_config: profiles.active,
+          profiles: names,
+          config_file: ctx.configStore.path,
+        },
+        format,
+      );
+      return;
+    }
+
+    const nameWidth = Math.max("NAME".length, ...names.map((name) => name.length));
+    emitBare(`${"NAME".padEnd(nameWidth)}  ACTIVE`);
+    for (const name of names) {
+      emitBare(`${name.padEnd(nameWidth)}  ${name === profiles.active ? "*" : ""}`);
+    }
+  },
+});

packages/commands/src/commands/config/qr.ts

@@ -0,0 +1,353 @@
+/**
+ * Minimal, dependency-free QR Code encoder used by the config UI to show a
+ * scannable code for the current session URL.
+ *
+ * Scope is deliberately narrow: byte mode, error-correction level L, versions
+ * 1–5 (21x21 … 37x37). Restricting to level L keeps every supported version a
+ * single Reed–Solomon block, so no codeword interleaving is required. Version 5
+ * (level L) holds up to 108 data bytes, comfortably more than a
+ * `http://127.0.0.1:<port>/?token=<hex>` URL.
+ *
+ * The output is an SVG string with a 4-module quiet zone and a `viewBox` only
+ * (no fixed width/height), so the caller sizes it via CSS.
+ */
+
+// --- GF(256) arithmetic (primitive polynomial 0x11D) ---
+
+const EXP = new Uint8Array(512);
+const LOG = new Uint8Array(256);
+(() => {
+  let x = 1;
+  for (let i = 0; i < 255; i++) {
+    EXP[i] = x;
+    LOG[x] = i;
+    x <<= 1;
+    if (x & 0x100) x ^= 0x11d;
+  }
+  for (let i = 255; i < 512; i++) EXP[i] = EXP[i - 255];
+})();
+
+function gmul(a: number, b: number): number {
+  if (a === 0 || b === 0) return 0;
+  return EXP[LOG[a] + LOG[b]];
+}
+
+/** Reed–Solomon generator polynomial for `degree` EC codewords (alpha exponents). */
+export function rsGeneratorExp(degree: number): number[] {
+  let poly = [1];
+  for (let i = 0; i < degree; i++) {
+    const next: number[] = Array.from({ length: poly.length + 1 }, () => 0);
+    for (let j = 0; j < poly.length; j++) {
+      next[j] ^= poly[j];
+      next[j + 1] ^= gmul(poly[j], EXP[i]);
+    }
+    poly = next;
+  }
+  return poly.map((v) => LOG[v]);
+}
+
+/** Compute `ecLen` Reed–Solomon error-correction codewords for `data`. */
+export function rsEncode(data: number[], ecLen: number): number[] {
+  const gen = rsGeneratorExp(ecLen);
+  const res = new Uint8Array(data.length + ecLen);
+  res.set(data, 0);
+  for (let i = 0; i < data.length; i++) {
+    const coef = res[i];
+    if (coef !== 0) {
+      const lead = LOG[coef];
+      for (let j = 0; j < gen.length; j++) res[i + j] ^= EXP[(gen[j] + lead) % 255];
+    }
+  }
+  return Array.from(res.slice(data.length));
+}
+
+// --- Capacity table: [data codewords, EC codewords] per version at level L ---
+
+const CAP_L: Array<[number, number]> = [
+  [19, 7], // V1 (21x21)
+  [34, 10], // V2 (25x25)
+  [55, 15], // V3 (29x29)
+  [80, 20], // V4 (33x33)
+  [108, 26], // V5 (37x37)
+];
+
+const EC_BITS_L = 0b01; // format-info error-correction level bits for L
+
+function pickVersion(byteLen: number): number {
+  const bits = 4 + 8 + byteLen * 8; // mode + 8-bit count (V1–9) + payload
+  for (let v = 0; v < CAP_L.length; v++) {
+    if (CAP_L[v][0] * 8 >= bits) return v + 1;
+  }
+  throw new Error("qr: data too large for supported versions (max 108 bytes)");
+}
+
+// --- Bit/codeword assembly ---
+
+function toCodewords(bytes: Uint8Array, version: number): number[] {
+  const [dataCw] = CAP_L[version - 1];
+  const bits: number[] = [];
+  const put = (val: number, len: number) => {
+    for (let i = len - 1; i >= 0; i--) bits.push((val >> i) & 1);
+  };
+  put(0b0100, 4); // byte mode
+  put(bytes.length, 8); // character count (versions 1–9)
+  for (const b of bytes) put(b, 8);
+
+  const capBits = dataCw * 8;
+  put(0, Math.min(4, capBits - bits.length)); // terminator
+  while (bits.length % 8 !== 0) bits.push(0); // pad to byte
+
+  const data: number[] = [];
+  for (let i = 0; i < bits.length; i += 8) {
+    let v = 0;
+    for (let j = 0; j < 8; j++) v = (v << 1) | bits[i + j];
+    data.push(v);
+  }
+  const pads = [0xec, 0x11];
+  for (let p = 0; data.length < dataCw; p++) data.push(pads[p % 2]);
+
+  return data.concat(rsEncode(data, CAP_L[version - 1][1]));
+}
+
+// --- Matrix construction ---
+
+interface Grid {
+  size: number;
+  mod: Uint8Array; // 0/1
+  fn: Uint8Array; // 1 = function/reserved module (skip during data placement)
+}
+
+function newGrid(size: number): Grid {
+  return { size, mod: new Uint8Array(size * size), fn: new Uint8Array(size * size) };
+}
+
+function setFn(g: Grid, r: number, c: number, dark: number): void {
+  g.mod[r * g.size + c] = dark;
+  g.fn[r * g.size + c] = 1;
+}
+
+function drawFinder(g: Grid, r: number, c: number): void {
+  for (let dr = -1; dr <= 7; dr++) {
+    for (let dc = -1; dc <= 7; dc++) {
+      const rr = r + dr;
+      const cc = c + dc;
+      if (rr < 0 || rr >= g.size || cc < 0 || cc >= g.size) continue;
+      const inRing = dr >= 0 && dr <= 6 && dc >= 0 && dc <= 6;
+      const isDark =
+        inRing &&
+        (dr === 0 ||
+          dr === 6 ||
+          dc === 0 ||
+          dc === 6 ||
+          (dr >= 2 && dr <= 4 && dc >= 2 && dc <= 4));
+      setFn(g, rr, cc, isDark ? 1 : 0);
+    }
+  }
+}
+
+function drawAlignment(g: Grid, cr: number, cc: number): void {
+  for (let dr = -2; dr <= 2; dr++) {
+    for (let dc = -2; dc <= 2; dc++) {
+      const ring = Math.max(Math.abs(dr), Math.abs(dc));
+      setFn(g, cr + dr, cc + dc, ring === 1 ? 0 : 1);
+    }
+  }
+}
+
+function drawFunctionPatterns(g: Grid, version: number): void {
+  const size = g.size;
+  // Timing patterns.
+  for (let i = 0; i < size; i++) {
+    setFn(g, 6, i, i % 2 === 0 ? 1 : 0);
+    setFn(g, i, 6, i % 2 === 0 ? 1 : 0);
+  }
+  // Finder patterns + separators (drawn as the -1 border above).
+  drawFinder(g, 0, 0);
+  drawFinder(g, 0, size - 7);
+  drawFinder(g, size - 7, 0);
+  // Alignment pattern (single, centered) for versions 2–5.
+  if (version >= 2) {
+    const pos = size - 7; // e.g. 18 (V2), 22 (V3), 26 (V4), 30 (V5)
+    drawAlignment(g, pos, pos);
+  }
+  // Reserve format-info areas (values written later).
+  for (let i = 0; i < 9; i++) {
+    if (!(i === 6)) g.fn[8 * size + i] = 1;
+    if (!(i === 6)) g.fn[i * size + 8] = 1;
+  }
+  g.fn[8 * size + 6] = 1;
+  g.fn[6 * size + 8] = 1;
+  for (let i = 0; i < 8; i++) g.fn[(size - 1 - i) * size + 8] = 1;
+  for (let i = 0; i < 8; i++) g.fn[8 * size + (size - 1 - i)] = 1;
+  // Dark module.
+  setFn(g, size - 8, 8, 1);
+}
+
+function placeData(g: Grid, codewords: number[]): void {
+  const size = g.size;
+  const stream: number[] = [];
+  for (const cw of codewords) for (let i = 7; i >= 0; i--) stream.push((cw >> i) & 1);
+  let idx = 0;
+  let upward = true;
+  for (let col = size - 1; col >= 1; col -= 2) {
+    if (col === 6) col = 5; // skip the vertical timing column
+    for (let i = 0; i < size; i++) {
+      const row = upward ? size - 1 - i : i;
+      for (const off of [0, 1]) {
+        const cc = col - off;
+        if (g.fn[row * size + cc]) continue;
+        g.mod[row * size + cc] = idx < stream.length ? stream[idx++] : 0;
+      }
+    }
+    upward = !upward;
+  }
+}
+
+const MASKS: Array<(r: number, c: number) => boolean> = [
+  (r, c) => (r + c) % 2 === 0,
+  (r) => r % 2 === 0,
+  (_r, c) => c % 3 === 0,
+  (r, c) => (r + c) % 3 === 0,
+  (r, c) => (Math.floor(r / 2) + Math.floor(c / 3)) % 2 === 0,
+  (r, c) => ((r * c) % 2) + ((r * c) % 3) === 0,
+  (r, c) => (((r * c) % 2) + ((r * c) % 3)) % 2 === 0,
+  (r, c) => (((r + c) % 2) + ((r * c) % 3)) % 2 === 0,
+];
+
+function applyMask(g: Grid, mask: number): void {
+  const cond = MASKS[mask];
+  for (let r = 0; r < g.size; r++) {
+    for (let c = 0; c < g.size; c++) {
+      if (!g.fn[r * g.size + c] && cond(r, c)) g.mod[r * g.size + c] ^= 1;
+    }
+  }
+}
+
+function penalty(g: Grid): number {
+  const size = g.size;
+  const at = (r: number, c: number) => g.mod[r * size + c];
+  let score = 0;
+  // Rule 1: runs of >=5 same-color modules in rows and columns.
+  for (let r = 0; r < size; r++) {
+    let runC = 1;
+    let runR = 1;
+    for (let c = 1; c < size; c++) {
+      if (at(r, c) === at(r, c - 1)) runC++;
+      else {
+        if (runC >= 5) score += runC - 2;
+        runC = 1;
+      }
+      if (at(c, r) === at(c - 1, r)) runR++;
+      else {
+        if (runR >= 5) score += runR - 2;
+        runR = 1;
+      }
+    }
+    if (runC >= 5) score += runC - 2;
+    if (runR >= 5) score += runR - 2;
+  }
+  // Rule 2: 2x2 blocks of the same color.
+  for (let r = 0; r < size - 1; r++) {
+    for (let c = 0; c < size - 1; c++) {
+      const v = at(r, c);
+      if (v === at(r, c + 1) && v === at(r + 1, c) && v === at(r + 1, c + 1)) score += 3;
+    }
+  }
+  // Rule 3: finder-like 1:1:3:1:1 patterns.
+  const pat1 = [1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 0];
+  const pat2 = [0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1];
+  const match = (get: (k: number) => number, start: number, pat: number[]) => {
+    for (let k = 0; k < pat.length; k++) if (get(start + k) !== pat[k]) return false;
+    return true;
+  };
+  for (let r = 0; r < size; r++) {
+    for (let c = 0; c <= size - 11; c++) {
+      if (match((k) => at(r, k), c, pat1) || match((k) => at(r, k), c, pat2)) score += 40;
+      if (match((k) => at(k, r), c, pat1) || match((k) => at(k, r), c, pat2)) score += 40;
+    }
+  }
+  // Rule 4: proportion of dark modules.
+  let dark = 0;
+  for (let i = 0; i < size * size; i++) dark += g.mod[i];
+  const percent = (dark * 100) / (size * size);
+  const k = Math.floor(Math.abs(percent - 50) / 5);
+  score += k * 10;
+  return score;
+}
+
+function formatBits(mask: number): number {
+  const data = (EC_BITS_L << 3) | mask; // 5 bits
+  let rem = data << 10;
+  for (let i = 14; i >= 10; i--) if ((rem >> i) & 1) rem ^= 0x537 << (i - 10);
+  return ((data << 10) | rem) ^ 0x5412;
+}
+
+function drawFormat(g: Grid, mask: number): void {
+  const size = g.size;
+  const fmt = formatBits(mask);
+  const bit = (i: number) => (fmt >> i) & 1;
+  // First copy: around the top-left finder. Bits 0–5 run down column 8
+  // (rows 0–5); bits 9–14 run left along row 8 (cols 5–0).
+  for (let i = 0; i <= 5; i++) g.mod[i * size + 8] = bit(i);
+  g.mod[7 * size + 8] = bit(6);
+  g.mod[8 * size + 8] = bit(7);
+  g.mod[8 * size + 7] = bit(8);
+  for (let i = 9; i < 15; i++) g.mod[8 * size + (14 - i)] = bit(i);
+  // Second copy: split across top-right and bottom-left.
+  for (let i = 0; i < 8; i++) g.mod[(size - 1 - i) * size + 8] = bit(i);
+  for (let i = 8; i < 15; i++) g.mod[8 * size + (size - 15 + i)] = bit(i);
+  g.mod[(size - 8) * size + 8] = 1; // dark module stays set
+}
+
+/** Build the final QR module matrix (true = dark) for `text`. */
+export function qrMatrix(text: string): boolean[][] {
+  const bytes = new TextEncoder().encode(text);
+  const version = pickVersion(bytes.length);
+  const codewords = toCodewords(bytes, version);
+  const g = newGrid(17 + 4 * version);
+  drawFunctionPatterns(g, version);
+  placeData(g, codewords);
+
+  let best = 0;
+  let bestScore = Infinity;
+  for (let m = 0; m < 8; m++) {
+    applyMask(g, m);
+    drawFormat(g, m);
+    const s = penalty(g);
+    if (s < bestScore) {
+      bestScore = s;
+      best = m;
+    }
+    applyMask(g, m); // undo (XOR is its own inverse)
+  }
+  applyMask(g, best);
+  drawFormat(g, best);
+
+  const out: boolean[][] = [];
+  for (let r = 0; r < g.size; r++) {
+    const row: boolean[] = [];
+    for (let c = 0; c < g.size; c++) row.push(g.mod[r * g.size + c] === 1);
+    out.push(row);
+  }
+  return out;
+}
+
+/** Render `text` as an SVG QR code string (4-module quiet zone, viewBox only). */
+export function qrSvg(text: string): string {
+  const m = qrMatrix(text);
+  const size = m.length;
+  const quiet = 4;
+  const dim = size + quiet * 2;
+  let rects = "";
+  for (let r = 0; r < size; r++) {
+    for (let c = 0; c < size; c++) {
+      if (m[r][c]) rects += `<rect x="${c + quiet}" y="${r + quiet}" width="1" height="1"/>`;
+    }
+  }
+  return (
+    `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${dim} ${dim}" ` +
+    `shape-rendering="crispEdges" role="img" aria-label="QR code">` +
+    `<rect width="${dim}" height="${dim}" fill="#ffffff"/>` +
+    `<g fill="#000000">${rects}</g></svg>`
+  );
+}

packages/commands/src/commands/config/scenarios.ts

@@ -0,0 +1,166 @@
+/**
+ * Curated "Playground" scenarios surfaced in the config UI.
+ *
+ * Each scenario is a fixed, reviewable prompt template that the UI can dispatch
+ * to a connected local coding agent (e.g. qwen-code), which then runs it in a
+ * new terminal. Optional `{{inputs}}` are filled by the user before dispatch.
+ *
+ * Prompts are defined here and never accepted as free-form text from the web,
+ * so the instruction handed to a local agent is always known and auditable.
+ */
+export interface ScenarioInput {
+  key: string;
+  label: string;
+  placeholder?: string;
+}
+
+export interface Scenario {
+  id: string;
+  title: string;
+  description: string;
+  category: string;
+  prompt: string;
+  inputs?: ScenarioInput[];
+}
+
+export const SCENARIOS: Scenario[] = [
+  // ---- 图像 ----
+  {
+    id: "image-generate",
+    title: "文生图",
+    description: "一键生成一张示例图片并保存到输出目录。",
+    category: "图像",
+    prompt:
+      "请使用 bl 的图像生成能力（如 `bl image generate` 命令）生成一张示例图片：一只在雨中撑伞的柯基，水彩风格，光线柔和。保存到输出目录后告诉我文件路径。",
+  },
+  {
+    id: "image-describe",
+    title: "图片理解",
+    description: "从输出目录任选一张图片，详细描述内容与风格。",
+    category: "图像",
+    prompt:
+      "请在输出目录（默认 output/images）中任选一张图片，用中文详细描述它的内容、主体、构图、色彩与风格，并推测它适合的使用场景。若目录为空请说明。",
+  },
+  {
+    id: "image-alt-batch",
+    title: "批量 Alt 文本",
+    description: "为输出目录下的图片批量生成无障碍 alt 文本。",
+    category: "图像",
+    prompt:
+      "请扫描输出目录（默认 output/images）下的所有图片，逐张生成简洁、准确的 alt 无障碍描述，最后以「文件名 → alt 文本」的表格汇总。若目录为空请说明。",
+  },
+  {
+    id: "image-to-code",
+    title: "截图转代码",
+    description: "把输出目录里的界面截图还原成 HTML+CSS。",
+    category: "图像",
+    prompt:
+      "请在输出目录（默认 output/images）中查找一张界面截图，用 HTML + CSS 尽可能还原它的布局、间距与配色，输出为一个可直接在浏览器打开的单文件，并简述还原思路。若没有找到截图请说明。",
+  },
+  // ---- 音频 ----
+  {
+    id: "speech-generate",
+    title: "文字转语音",
+    description: "把一句示例文字合成为自然语音。",
+    category: "音频",
+    prompt:
+      "请使用 bl 的语音合成能力（如 `bl speech` 相关命令）把下面这句话合成为自然语音，保存到输出目录，并告诉我音频文件路径：欢迎使用阿里云百炼命令行工具，让多模态创作更简单。",
+  },
+  {
+    id: "audio-summarize",
+    title: "音频转写总结",
+    description: "转写输出目录里的音频并提炼要点。",
+    category: "音频",
+    prompt:
+      "请在输出目录（默认 output/speech）中找到一个音频文件，转写其内容，先给出完整文字，再用要点列表总结关键信息。若目录为空或缺少转写能力，请说明并尝试用可用的能力完成。",
+  },
+  // ---- 视频 ----
+  {
+    id: "video-generate",
+    title: "文生视频",
+    description: "一键生成一段示例短视频。",
+    category: "视频",
+    prompt:
+      "请使用 bl 的视频生成能力（如 `bl video generate` 命令）生成一段示例短视频：日落时分海边奔跑的少年，电影质感，慢动作。保存到输出目录后告诉我视频文件路径。",
+  },
+  {
+    id: "video-storyboard",
+    title: "视频分镜脚本",
+    description: "围绕示例主题产出可用于文生视频的分镜。",
+    category: "视频",
+    prompt:
+      "围绕主题「城市清晨的第一杯咖啡」，为一支 15-30 秒的短视频撰写分镜脚本：逐镜头给出画面描述、时长、字幕或旁白，并为每个镜头附上可直接用于文生视频的英文 prompt。",
+  },
+  // ---- 多模态 ----
+  {
+    id: "media-prompt-craft",
+    title: "多模态提示词",
+    description: "把一个示例创意扩展成图/视频/语音提示词。",
+    category: "多模态",
+    prompt:
+      "把创意「未来赛博城市的夜市」扩展成三组高质量生成提示词：1) 文生图；2) 文生视频；3) 语音风格描述。每组给出中英对照，并简要说明关键参数建议。",
+  },
+  {
+    id: "image-story-narration",
+    title: "图片配音文案",
+    description: "为输出目录里的图片写解说词并给出可合成文本。",
+    category: "多模态",
+    prompt:
+      "请在输出目录（默认 output/images）中任选一张图片，为它撰写一段 60 秒左右的中文解说词（适合配音），语气生动。随后给出可直接用于语音合成的纯文本版本。若目录为空请说明。",
+  },
+  // ---- 代码 ----
+  {
+    id: "summarize-project",
+    title: "总结当前项目",
+    description: "让 agent 阅读当前目录，总结架构、技术栈与主要模块。",
+    category: "代码",
+    prompt:
+      "请阅读当前工作目录的项目结构和关键源码，用简洁的中文总结：1) 它是做什么的；2) 技术栈；3) 主要模块及其职责；4) 值得注意的设计。先浏览再下结论，不要臆测。",
+  },
+  {
+    id: "write-tests",
+    title: "为核心模块写单测",
+    description: "自动挑选缺测试的核心模块并补全单元测试。",
+    category: "代码",
+    prompt:
+      "请在当前项目中挑选一个核心且缺少测试（或测试薄弱）的模块，为它编写全面的单元测试，覆盖主要逻辑分支和边界情况，并遵循本项目现有的测试框架与风格。先阅读相关文件及其依赖，再编写测试。",
+  },
+  {
+    id: "code-review",
+    title: "代码审查",
+    description: "审查当前项目核心代码，指出问题与改进建议。",
+    category: "代码",
+    prompt:
+      "请审查当前项目的核心源码，指出潜在的 bug、安全隐患、性能与可维护性问题，并给出具体、可操作的改进建议，按严重程度排序。先浏览项目结构，选取关键文件再审查。",
+  },
+  {
+    id: "explain-code",
+    title: "解释核心代码",
+    description: "挑选入口或核心模块，解释其实现与依赖。",
+    category: "代码",
+    prompt:
+      "请挑选当前项目的入口文件或核心模块，解释它的实现：职责是什么、关键流程如何运转、依赖了哪些模块。用清晰的中文说明，必要时给出调用关系。",
+  },
+  // ---- 文档 ----
+  {
+    id: "generate-readme",
+    title: "生成 README",
+    description: "阅读代码后生成结构清晰、与实现一致的 README.md。",
+    category: "文档",
+    prompt:
+      "为当前工作目录的项目生成一个结构清晰的 README.md，包含：项目简介、安装步骤、使用示例、目录结构说明。请先阅读现有代码与配置再撰写，内容必须与实际实现一致。",
+  },
+];
+
+/** Look up a scenario by id, or undefined when unknown. */
+export function getScenario(id: string): Scenario | undefined {
+  return SCENARIOS.find((s) => s.id === id);
+}
+
+/** Fill a scenario's `{{placeholder}}` tokens from user-provided values. */
+export function renderScenarioPrompt(scenario: Scenario, values: Record<string, string>): string {
+  return scenario.prompt.replace(/\{\{(\w+)\}\}/g, (_match, key: string) => {
+    const v = values[key];
+    return typeof v === "string" ? v.trim() : "";
+  });
+}

packages/commands/src/commands/config/set.ts

@@ -1,127 +1,68 @@
-import {
-  defineCommand,
-  detectOutputFormat,
-  maskToken,
-  readConfigFile,
-  writeConfigFile,
-  BailianError,
-  type Config,
-  type GlobalFlags,
-  ExitCode,
-} from "bailian-cli-core";
-import { emitResult, cmdUsage } from "bailian-cli-runtime";
-
-const VALID_KEYS = [
-  "base_url",
-  "output",
-  "output_dir",
-  "timeout",
-  "api_key",
-  "access_token",
-  "default_text_model",
-  "default_video_model",
-  "default_image_model",
-  "default_speech_model",
-  "default_omni_model",
-  "access_key_id",
-  "access_key_secret",
-  "workspace_id",
-];
-
-// Keys whose values are secrets. Their stored value must never be echoed back in
-// cleartext (CI logs, pipes, shared terminals); show a masked form instead — the
-// same policy `config show` and `auth status` already follow.
-const SECRET_KEYS = new Set(["api_key", "access_token", "access_key_id", "access_key_secret"]);
-
-// Allow hyphen-style keys (e.g. default-text-model → default_text_model)
-const KEY_ALIASES: Record<string, string> = {
-  "base-url": "base_url",
-  "output-dir": "output_dir",
-  "api-key": "api_key",
-  "access-token": "access_token",
-  "default-text-model": "default_text_model",
-  "default-video-model": "default_video_model",
-  "default-image-model": "default_image_model",
-  "default-speech-model": "default_speech_model",
-  "default-omni-model": "default_omni_model",
-  "access-key-id": "access_key_id",
-  "access-key-secret": "access_key_secret",
-  "workspace-id": "workspace_id",
-};
+import { defineCommand, detectOutputFormat, maskToken, type ConfigFile } from "bailian-cli-core";
+import { emitResult } from "bailian-cli-runtime";
+import { SECRET_KEYS, resolveKey, validateAndCoerce } from "./shared.ts";
 
 export default defineCommand({
   description: "Set a config value",
-  skipDefaultApiKeySetup: true,
+  auth: "none",
   usageArgs: "--key <key> --value <value>",
-  options: [
-    {
-      flag: "--key <key>",
+  flags: {
+    key: {
+      type: "string",
+      valueHint: "<key>",
       description:
-        "Config key (base_url, output, output_dir, timeout, api_key, access_token, default_*_model, access_key_id, access_key_secret, workspace_id)",
+        "Config key (base_url, output, output_dir, timeout, api_key, access_token, access_key_id, access_key_secret, security_token, default_*_model, workspace_id)",
+      required: true,
     },
-    { flag: "--value <value>", description: "Value to set" },
-  ],
+    value: {
+      type: "string",
+      valueHint: "<value>",
+      description: "Value to set",
+      required: true,
+    },
+  },
   exampleArgs: [
     "--key output --value json",
     "--key timeout --value 600",
     "--key base_url --value https://dashscope.aliyuncs.com",
   ],
-  async run(config: Config, flags: GlobalFlags) {
-    const key = flags.key as string | undefined;
-    const value = flags.value as string | undefined;
+  async run(ctx) {
+    const { settings, flags } = ctx;
+    const key = flags.key;
+    const value = flags.value;
 
-    if (!key || value === undefined) {
-      throw new BailianError(
-        "--key and --value are required.",
-        ExitCode.USAGE,
-        cmdUsage(config, "--key <key> --value <value>"),
+    // Resolve hyphen aliases to underscore keys and validate/coerce the value.
+    const resolvedKey: string = resolveKey(key);
+    const coerced = validateAndCoerce(key, value);
+
+    const format = detectOutputFormat(settings.output);
+
+    if (settings.dryRun) {
+      emitResult(
+        {
+          would_set: { [resolvedKey]: coerced },
+          config: settings.configName ?? "default",
+          config_file: ctx.configStore.path,
+        },
+        format,
       );
-    }
-
-    // Resolve hyphen aliases to underscore keys
-    const resolvedKey: string = KEY_ALIASES[key] || key;
-
-    if (!VALID_KEYS.includes(resolvedKey)) {
-      throw new BailianError(
-        `Invalid config key "${key}". Valid keys: ${VALID_KEYS.join(", ")}`,
-        ExitCode.USAGE,
-      );
-    }
-
-    // Validate specific values
-    if (resolvedKey === "output" && !["text", "json"].includes(value)) {
-      throw new BailianError(
-        `Invalid output format "${value}". Valid values: text, json`,
-        ExitCode.USAGE,
-      );
-    }
-
-    if (resolvedKey === "timeout") {
-      const num = Number(value);
-      if (isNaN(num) || num <= 0) {
-        throw new BailianError(
-          `Invalid timeout "${value}". Must be a positive number.`,
-          ExitCode.USAGE,
-        );
-      }
-    }
-
-    const format = detectOutputFormat(config.output);
-
-    if (config.dryRun) {
-      emitResult({ would_set: { [resolvedKey]: value } }, format);
       return;
     }
 
-    const existing = readConfigFile() as Record<string, unknown>;
-    existing[resolvedKey] = resolvedKey === "timeout" ? Number(value) : value;
-    await writeConfigFile(existing);
+    await ctx.configStore.write({
+      [resolvedKey]: coerced,
+    } as Partial<ConfigFile>);
 
-    if (!config.quiet) {
-      const shown = SECRET_KEYS.has(resolvedKey)
-        ? maskToken(String(existing[resolvedKey]))
-        : existing[resolvedKey];
-      emitResult({ [resolvedKey]: shown }, format);
+    if (!settings.quiet) {
+      const shown = SECRET_KEYS.has(resolvedKey) ? maskToken(String(coerced)) : coerced;
+      emitResult(
+        {
+          [resolvedKey]: shown,
+          config: settings.configName ?? "default",
+          config_file: ctx.configStore.path,
+        },
+        format,
+      );
     }
   },
 });

packages/commands/src/commands/config/shared.ts

@@ -0,0 +1,219 @@
+import { BailianError, ExitCode, normalizeModelBaseUrl } from "bailian-cli-core";
+
+/** Config keys that `config set` / `config ui` accept for read/write. */
+export const VALID_KEYS = [
+  "base_url",
+  "output",
+  "output_dir",
+  "timeout",
+  "api_key",
+  "access_token",
+  "access_key_id",
+  "access_key_secret",
+  "security_token",
+  "default_text_model",
+  "default_video_model",
+  "default_image_to_video_model",
+  "default_reference_to_video_model",
+  "default_image_model",
+  "default_speech_model",
+  "default_omni_model",
+  "workspace_id",
+] as const;
+
+// Keys whose values are secrets. `config set` / `config show` mask these; the
+// web UI renders them as password fields (values are still sent in cleartext
+// over the token-gated localhost socket).
+export const SECRET_KEYS = new Set<string>([
+  "api_key",
+  "access_token",
+  "access_key_id",
+  "access_key_secret",
+  "security_token",
+]);
+
+// The web UI edits the full ConfigFile, so it exposes these extra keys on top
+// of VALID_KEYS (which `config set` keeps as its narrower, documented surface).
+// This lets `config ui` surface and edit every field that lives in config.json
+// rather than silently hiding console/telemetry settings.
+export const UI_EXTRA_KEYS = [
+  "console_site",
+  "console_region",
+  "console_switch_agent",
+  "telemetry",
+] as const;
+
+export const UI_VALID_KEYS = [...VALID_KEYS, ...UI_EXTRA_KEYS] as const;
+
+// Keys the UI renders as a fixed-choice dropdown instead of a free-text input.
+export const UI_ENUM_KEYS: Record<string, string[]> = {
+  output: ["text", "json"],
+  console_site: ["domestic", "international"],
+};
+
+// Keys the UI renders as a true/false dropdown and stores as a boolean.
+export const UI_BOOLEAN_KEYS = new Set<string>(["telemetry"]);
+
+// Default model each `default_*_model` key falls back to when left unset. These
+// mirror the inline `|| "<model>"` fallbacks in the generation commands
+// (text/chat, image/generate, video/generate, speech/synthesize, omni/chat) and
+// are surfaced as input placeholders so users can see the effective default
+// without persisting a value that would pin the model.
+export const UI_MODEL_DEFAULTS: Record<string, string> = {
+  default_text_model: "qwen3.7-max",
+  default_image_model: "qwen-image-2.0",
+  default_video_model: "happyhorse-1.1-t2v",
+  default_speech_model: "cosyvoice-v3-flash",
+  default_omni_model: "qwen3.5-omni-plus",
+};
+
+/** One selectable model plus a short note on where the CLI uses it. */
+export interface ModelOption {
+  id: string;
+  role: string;
+}
+
+// A per-category catalog of the model names the `bl` pipeline actually
+// references (packages/runtime/src/pipeline/steps/bl-api.ts, plus the advisor
+// and agent-writer helpers). The UI groups these under each `default_*_model`
+// field as click-to-fill suggestions; the first entry is the fallback default.
+// Only names present in the codebase are listed here — no invented models.
+export const UI_MODEL_CATALOG: Record<string, ModelOption[]> = {
+  default_text_model: [
+    { id: "qwen3.7-max", role: "text/chat default" },
+    { id: "qwen3-coder-plus", role: "coding-oriented (agent config)" },
+    { id: "qwen-flash", role: "fast · advisor ranking" },
+    { id: "qwen3.6-flash", role: "fast · advisor intent" },
+  ],
+  default_image_model: [
+    { id: "qwen-image-2.0", role: "image/generate default · sync" },
+    { id: "qwen-image-max", role: "image/generate · sync" },
+    { id: "qwen-image-edit-2.0", role: "image/edit · sync" },
+    { id: "wanx2.x", role: "image/generate · async series" },
+  ],
+  default_video_model: [
+    { id: "happyhorse-1.1-t2v", role: "video/generate default · text-to-video" },
+    { id: "happyhorse-1.1-i2v", role: "video/generate · image-to-video" },
+  ],
+  default_speech_model: [
+    { id: "cosyvoice-v3-flash", role: "speech/synthesize (TTS) default" },
+    { id: "fun-asr", role: "speech/recognize (ASR)" },
+  ],
+  default_omni_model: [
+    { id: "qwen3.5-omni-plus", role: "omni/chat default" },
+    { id: "qwen3-vl-plus", role: "vision/describe · multimodal input" },
+  ],
+};
+
+// Allow hyphen-style keys (e.g. default-text-model → default_text_model).
+export const KEY_ALIASES: Record<string, string> = {
+  "base-url": "base_url",
+  "output-dir": "output_dir",
+  "api-key": "api_key",
+  "access-token": "access_token",
+  "access-key-id": "access_key_id",
+  "access-key-secret": "access_key_secret",
+  "security-token": "security_token",
+  "default-text-model": "default_text_model",
+  "default-video-model": "default_video_model",
+  "default-image-to-video-model": "default_image_to_video_model",
+  "default-reference-to-video-model": "default_reference_to_video_model",
+  "default-image-model": "default_image_model",
+  "default-speech-model": "default_speech_model",
+  "default-omni-model": "default_omni_model",
+  "workspace-id": "workspace_id",
+};
+
+/** Resolve a hyphen alias to its underscore config key. */
+export function resolveKey(key: string): string {
+  return KEY_ALIASES[key] || key;
+}
+
+/**
+ * Validate a single config entry and coerce its value to the stored type.
+ * Throws BailianError(USAGE) for unknown keys or invalid values.
+ */
+export function validateAndCoerce(key: string, value: string): string | number {
+  const resolvedKey = resolveKey(key);
+
+  if (!(VALID_KEYS as readonly string[]).includes(resolvedKey)) {
+    throw new BailianError(
+      `Invalid config key "${key}". Valid keys: ${VALID_KEYS.join(", ")}`,
+      ExitCode.USAGE,
+    );
+  }
+
+  if (resolvedKey === "output" && !["text", "json"].includes(value)) {
+    throw new BailianError(
+      `Invalid output format "${value}". Valid values: text, json`,
+      ExitCode.USAGE,
+    );
+  }
+
+  if (resolvedKey === "timeout") {
+    const num = Number(value);
+    if (isNaN(num) || num <= 0) {
+      throw new BailianError(
+        `Invalid timeout "${value}". Must be a positive number.`,
+        ExitCode.USAGE,
+      );
+    }
+    return num;
+  }
+
+  if (resolvedKey === "base_url") return normalizeModelBaseUrl(value);
+
+  return value;
+}
+
+/**
+ * Validate/coerce a value for the wider set of keys the web UI can edit
+ * (UI_VALID_KEYS). Standard keys delegate to `validateAndCoerce`; the UI-only
+ * extras (console_*, telemetry) are validated here. Booleans are returned as
+ * real booleans so they persist correctly in config.json.
+ */
+export function validateAndCoerceUi(key: string, value: string): string | number | boolean {
+  const resolvedKey = resolveKey(key);
+
+  if ((VALID_KEYS as readonly string[]).includes(resolvedKey)) {
+    return validateAndCoerce(key, value);
+  }
+
+  if (resolvedKey === "console_site") {
+    if (!["domestic", "international"].includes(value)) {
+      throw new BailianError(
+        `Invalid console_site "${value}". Valid values: domestic, international`,
+        ExitCode.USAGE,
+      );
+    }
+    return value;
+  }
+
+  if (resolvedKey === "console_region") return value;
+
+  if (resolvedKey === "console_switch_agent") {
+    const num = Number(value);
+    if (!Number.isFinite(num) || num <= 0) {
+      throw new BailianError(
+        `Invalid console_switch_agent "${value}". Must be a positive number.`,
+        ExitCode.USAGE,
+      );
+    }
+    return num;
+  }
+
+  if (resolvedKey === "telemetry") {
+    if (value !== "true" && value !== "false") {
+      throw new BailianError(
+        `Invalid telemetry "${value}". Valid values: true, false`,
+        ExitCode.USAGE,
+      );
+    }
+    return value === "true";
+  }
+
+  throw new BailianError(
+    `Invalid config key "${key}". Valid keys: ${UI_VALID_KEYS.join(", ")}`,
+    ExitCode.USAGE,
+  );
+}

packages/commands/src/commands/config/show.ts

@@ -1,37 +1,28 @@
-import {
-  defineCommand,
-  readConfigFile as loadConfigFile,
-  getConfigPath,
-  detectOutputFormat,
-  maskToken,
-  type Config,
-  type GlobalFlags,
-} from "bailian-cli-core";
+import { defineCommand, detectOutputFormat, maskToken } from "bailian-cli-core";
 import { emitResult } from "bailian-cli-runtime";
+import { SECRET_KEYS } from "./shared.ts";
 
 export default defineCommand({
   description: "Display current configuration",
-  skipDefaultApiKeySetup: true,
+  auth: "none",
   exampleArgs: ["", "--output json"],
-  async run(config: Config, _flags: GlobalFlags) {
-    const file = loadConfigFile();
-    const format = detectOutputFormat(config.output);
+  async run(ctx) {
+    const { settings, client } = ctx;
+    const store = ctx.configStore;
+    const file = store.read();
+    const format = detectOutputFormat(settings.output);
 
     const result: Record<string, unknown> = {
       ...file,
-      base_url: config.baseUrl,
-      output: config.output,
-      timeout: config.timeout,
-      config_file: getConfigPath(),
+      base_url: client.baseUrl,
+      output: settings.output,
+      timeout: settings.timeout,
+      config: settings.configName ?? "default",
+      config_file: store.path,
     };
 
-    if (typeof result.api_key === "string") result.api_key = maskToken(result.api_key);
-    if (typeof result.access_token === "string")
-      result.access_token = maskToken(result.access_token);
-    if (typeof result.access_key_id === "string")
-      result.access_key_id = maskToken(result.access_key_id);
-    if (typeof result.access_key_secret === "string") {
-      result.access_key_secret = maskToken(result.access_key_secret);
+    for (const key of SECRET_KEYS) {
+      if (typeof result[key] === "string") result[key] = maskToken(result[key]);
     }
 
     emitResult(result, format);