@@ -23,6 +23,14 @@ description: >-
 
 **CRITICAL — Before executing, MUST read the shared protocol in [`../bailian-protocol/SKILL.md`](../bailian-protocol/SKILL.md): Provider selection and consent, Version & updates (pre-flight checklist), Call attribution (every Agent `bl` command), Setup & auth, and CLI errors: report an issue. If that protocol file is missing, stop and run `bl skill init`; do not guess auth/consent.**
 
+**Agent bash (mandatory):** Never run a bare `bl` in the shell. Prefix every invocation except `--help` and `--version`, including commands copied from the human examples or `reference/` below. Do not `export` these variables. Set `BAILIAN_CALLER_NAME` to this host's stable id (examples: `codex`, `qwen-code`, `claude-code`, `cursor`, `qoder`). Sample lines use `codex`; replace with your host. `BAILIAN_SKILL_VERSION` is this file's `metadata.version` (`2.5.0`).
+
+```bash
+BAILIAN_CALLER_TYPE=agent BAILIAN_CALLER_NAME=codex BAILIAN_SKILL_NAME=bailian-cli BAILIAN_SKILL_VERSION=2.5.0 bl text chat --message "Write a poem about spring"
+```
+
+Replace `codex` in the sample with this host's id. Reuse the same four-variable shape on every later `bl`, but set `BAILIAN_SKILL_NAME` to the owning skill for that command (see `bailian-protocol` Call attribution). Keep `BAILIAN_CALLER_NAME` as this host.
+
 > **Family hub** — This skill owns Bailian resource commands and the hub `reference/` (apps, knowledge, usage, auth, config, …).
 > Shared protocol → [`../bailian-protocol/SKILL.md`](../bailian-protocol/SKILL.md) (install the full family with `bl skill init`).
 > Soft hand-offs by skill name (Read if installed; else `bl … --help` / prompt `bl skill init`): `bailian-gen` (media) · `bailian-finetune` (training) · `bailian-managed-agent` (agents.yaml IaC) · `bailian-sandbox` (Sandbox lifecycle) · `bailian-web-search` (web search routing).
@@ -93,12 +101,21 @@ Use this table only after the decision table in [`bailian-protocol`](../bailian-
 | Bailian Sandbox instance / template lifecycle       | → skill `bailian-sandbox`                                                                                      | Fallback: `bl sandbox --help`                                                                                                      |
 | Web search (model-aware routing)                    | → skill `bailian-web-search`                                                                                   | Token Plan vs MCP path + fallback; fallback: `bl search web --help`                                                                |
 
-Flags, usage, and examples: see hub [`reference/`](reference/index.md) or `bl <command> --help` — do not guess flags. Domain command details live in the owning skill's `reference/`.
+Flags, usage, and examples: see hub [`reference/`](reference/index.md) or `bl <command> --help` — do not guess flags. Domain command details live in the owning skill's `reference/`. Examples in `reference/` are human documentation; an Agent runs them with the Agent bash prefix above.
 
 ---
 
 ## Quick examples
 
+**Agent shell** — copy this shape; replace `codex` with this host's id. Do not drop the variables. Reuse the four-variable shape on later commands; set `BAILIAN_SKILL_NAME` to the owning skill for that command.
+
+```bash
+BAILIAN_CALLER_TYPE=agent BAILIAN_CALLER_NAME=codex BAILIAN_SKILL_NAME=bailian-cli BAILIAN_SKILL_VERSION=2.5.0 bl text chat --message "Write a poem about spring in Chinese"
+BAILIAN_CALLER_TYPE=agent BAILIAN_CALLER_NAME=codex BAILIAN_SKILL_NAME=bailian-cli BAILIAN_SKILL_VERSION=2.5.0 bl usage stats
+```
+
+Human documentation only. Do not paste this fence into an Agent shell; prefix each `bl` line.
+
 ```bash
 bl text chat --message "Write a poem about spring in Chinese"
 bl decision --workspace-id <id> --state "Is this requesting a refund?" --questions '{"refund":{"type":"noul"}}'
@@ -116,6 +133,8 @@ More examples per command: see `reference/<group>.md` (e.g. [`reference/text.md`
 
 ### Find and call an app
 
+Run each `bl` with the Agent bash prefix. The lines below are the arguments only.
+
 1. `bl app list --name <keyword> --output json`
 2. Pick `code` (app ID); handle `user_prompt_params` via `--biz-params '{"key":"value"}'`
 3. `bl app call --app-id <code> --prompt "..."`
 
@@ -16,7 +16,15 @@ description: >-
 
 # Bailian fine-tuning pipeline (`bl dataset` / `bl finetune` / `bl deploy`)
 
-**CRITICAL — Before executing, MUST read the shared protocol in [`../bailian-protocol/SKILL.md`](../bailian-protocol/SKILL.md): Version & updates (pre-flight checklist), Call attribution (every Agent `bl` command), Setup & auth, and CLI errors: report an issue. Command details are authoritative in [`reference/`](reference/index.md) (dataset / finetune / deploy) and `bl <command> --help` — do not guess flags. The whole pipeline requires an API key. If that protocol file is missing, stop and run `bl skill init`; do not guess auth/consent.**
+**CRITICAL — Before executing, MUST read the shared protocol in [`../bailian-protocol/SKILL.md`](../bailian-protocol/SKILL.md): Version & updates (pre-flight checklist), Call attribution (every Agent `bl` command), Setup & auth, and CLI errors: report an issue. Command details are authoritative in [`reference/`](reference/index.md) (dataset / finetune / deploy) and `bl <command> --help` — do not guess flags. Examples in `reference/` are human documentation; prefix them before running. The whole pipeline requires an API key. If that protocol file is missing, stop and run `bl skill init`; do not guess auth/consent.**
+
+**Agent bash (mandatory):** Never run a bare `bl` in the shell. Prefix every invocation except `--help` and `--version`, including commands copied from the human examples or `reference/` below. Do not `export` these variables. Set `BAILIAN_CALLER_NAME` to this host's stable id (examples: `codex`, `qwen-code`, `claude-code`, `cursor`, `qoder`). Sample lines use `codex`; replace with your host. `BAILIAN_SKILL_VERSION` is this file's `metadata.version` (`2.5.0`).
+
+```bash
+BAILIAN_CALLER_TYPE=agent BAILIAN_CALLER_NAME=codex BAILIAN_SKILL_NAME=bailian-finetune BAILIAN_SKILL_VERSION=2.5.0 bl dataset validate --file train.jsonl
+```
+
+Replace `codex` in the sample with this host's id. Reuse the same four-variable shape on every later `bl`, but set `BAILIAN_SKILL_NAME` to the owning skill for that command (see `bailian-protocol` Call attribution). Keep `BAILIAN_CALLER_NAME` as this host. Example: after deploy, `bl text chat` uses `BAILIAN_SKILL_NAME=bailian-cli`, not `bailian-finetune`. The numbered workflow below is arguments only.
 
 ## End-to-end workflow (follow in order)
 
@@ -67,6 +75,15 @@ Flags, usage, and examples: see [`reference/`](reference/index.md) or `bl <comma
 
 ## Quick examples
 
+**Agent shell** — copy this shape; replace `codex` with this host's id. Do not drop the variables. Reuse the four-variable shape on later commands; set `BAILIAN_SKILL_NAME` to the owning skill for that command.
+
+```bash
+BAILIAN_CALLER_TYPE=agent BAILIAN_CALLER_NAME=codex BAILIAN_SKILL_NAME=bailian-finetune BAILIAN_SKILL_VERSION=2.5.0 bl dataset validate --file train.jsonl
+BAILIAN_CALLER_TYPE=agent BAILIAN_CALLER_NAME=codex BAILIAN_SKILL_NAME=bailian-finetune BAILIAN_SKILL_VERSION=2.5.0 bl dataset upload --file train.jsonl
+```
+
+Human documentation only. Do not paste this fence into an Agent shell.
+
 ```bash
 bl dataset validate --file train.jsonl
 bl dataset upload --file train.jsonl
 
@@ -20,7 +20,15 @@ description: >-
 
 # Bailian media generation & understanding (`bl image` / `bl video` / `bl speech` / `bl omni` / `bl vision`)
 
-**CRITICAL — Before executing, MUST read the shared protocol in [`../bailian-protocol/SKILL.md`](../bailian-protocol/SKILL.md): Provider selection and consent (one-time ask templates), Version & updates (pre-flight checklist), Call attribution (every Agent `bl` command), and CLI errors: report an issue. Command details are authoritative in [`reference/`](reference/index.md) and `bl <command> --help` — do not guess flags. If that protocol file is missing, stop and run `bl skill init`; do not guess auth/consent.**
+**CRITICAL — Before executing, MUST read the shared protocol in [`../bailian-protocol/SKILL.md`](../bailian-protocol/SKILL.md): Provider selection and consent (one-time ask templates), Version & updates (pre-flight checklist), Call attribution (every Agent `bl` command), and CLI errors: report an issue. Command details are authoritative in [`reference/`](reference/index.md) and `bl <command> --help` — do not guess flags. Examples in `reference/` are human documentation; prefix them before running. If that protocol file is missing, stop and run `bl skill init`; do not guess auth/consent.**
+
+**Agent bash (mandatory):** Never run a bare `bl` in the shell. Prefix every invocation except `--help` and `--version`, including commands copied from the human examples or `reference/` below. Do not `export` these variables. Set `BAILIAN_CALLER_NAME` to this host's stable id (examples: `codex`, `qwen-code`, `claude-code`, `cursor`, `qoder`). Sample lines use `codex`; replace with your host. `BAILIAN_SKILL_VERSION` is this file's `metadata.version` (`2.5.0`).
+
+```bash
+BAILIAN_CALLER_TYPE=agent BAILIAN_CALLER_NAME=codex BAILIAN_SKILL_NAME=bailian-gen BAILIAN_SKILL_VERSION=2.5.0 bl image generate --prompt "A cat in space" --out-dir ./out/
+```
+
+Replace `codex` in the sample with this host's id. Reuse the same four-variable shape on every later `bl`, but set `BAILIAN_SKILL_NAME` to the owning skill for that command (see `bailian-protocol` Call attribution). Keep `BAILIAN_CALLER_NAME` as this host.
 
 ## Consent (short version; full rules in bailian-protocol)
 
@@ -54,22 +62,24 @@ Flags, usage, and examples: see [`reference/`](reference/index.md) or `bl <comma
 
 ## Watermark configuration
 
-Image generation and editing, video generation and editing, and reference-to-video enable watermarks by default. Change the default for the active Profile with:
+Image generation and editing, video generation and editing, and reference-to-video enable watermarks by default. Change the default for the active Profile with the Agent bash shape. `bl config` is owned by `bailian-cli` (`BAILIAN_SKILL_NAME=bailian-cli`). Sample uses `codex`; replace with this host's id.
 
 ```bash
-bl config set --key watermark --value false
+BAILIAN_CALLER_TYPE=agent BAILIAN_CALLER_NAME=codex BAILIAN_SKILL_NAME=bailian-cli BAILIAN_SKILL_VERSION=2.5.0 bl config set --key watermark --value false
 ```
 
 Set it to `true` to enable watermarks again. To update a named Profile without switching Profiles, add `--config <name>`:
 
 ```bash
-bl config set --config media --key watermark --value false
+BAILIAN_CALLER_TYPE=agent BAILIAN_CALLER_NAME=codex BAILIAN_SKILL_NAME=bailian-cli BAILIAN_SKILL_VERSION=2.5.0 bl config set --config media --key watermark --value false
 ```
 
 ## Local files (mandatory)
 
 Any command that accepts a **file URL** also accepts a **local path**; the CLI uploads to DashScope temporary storage (`oss://`, 48h) automatically. If the user gives a local file, pass the path directly — never ask them to upload or host a URL first.
 
+Human documentation. Agent shell: prefix each `bl` line with the Agent bash block above. Do not paste this fence as-is.
+
 ```bash
 bl image edit --image ./photo.png --prompt "Add sunset"
 bl video edit --video ./clip.mp4 --prompt "Anime style"
@@ -80,6 +90,15 @@ bl speech recognize --url ./meeting.wav
 
 ## Quick examples
 
+**Agent shell** — copy this shape; replace `codex` with this host's id. Do not drop the variables. Reuse the four-variable shape on later commands; set `BAILIAN_SKILL_NAME` to the owning skill for that command. If `bl` is inside `$(...)`, put the four variables inside the substitution.
+
+```bash
+BAILIAN_CALLER_TYPE=agent BAILIAN_CALLER_NAME=codex BAILIAN_SKILL_NAME=bailian-gen BAILIAN_SKILL_VERSION=2.5.0 bl image generate --prompt "A cat in space" --out-dir ./out/
+BAILIAN_CALLER_TYPE=agent BAILIAN_CALLER_NAME=codex BAILIAN_SKILL_NAME=bailian-gen BAILIAN_SKILL_VERSION=2.5.0 bl video generate --prompt "Sunset on the beach" --download sunset.mp4
+```
+
+Human documentation only. Do not paste this fence into an Agent shell.
+
 ```bash
 bl image generate --prompt "A cat in space" --out-dir ./out/
 bl video generate --prompt "Sunset on the beach" --download sunset.mp4
 
@@ -18,7 +18,15 @@ description: >-
 
 # Bailian managed agent IaC (`bl managed-agent`)
 
-**CRITICAL — Before executing, MUST read the shared protocol in [`../bailian-protocol/SKILL.md`](../bailian-protocol/SKILL.md): High-risk operation confirmation, Version & updates (pre-flight checklist), Call attribution (every Agent `bl` command), and CLI errors: report an issue. Command details are authoritative in [`reference/managed-agent.md`](reference/managed-agent.md) and `bl managed-agent --help` — do not guess flags. If that protocol file is missing, stop and run `bl skill init`; do not guess auth/consent.**
+**CRITICAL — Before executing, MUST read the shared protocol in [`../bailian-protocol/SKILL.md`](../bailian-protocol/SKILL.md): High-risk operation confirmation, Version & updates (pre-flight checklist), Call attribution (every Agent `bl` command), and CLI errors: report an issue. Command details are authoritative in [`reference/managed-agent.md`](reference/managed-agent.md) and `bl managed-agent --help` — do not guess flags. Examples in `reference/` are human documentation; prefix them before running. If that protocol file is missing, stop and run `bl skill init`; do not guess auth/consent.**
+
+**Agent bash (mandatory):** Never run a bare `bl` in the shell. Prefix every invocation except `--help` and `--version`, including commands copied from the human fences below. Do not `export` these variables. Set `BAILIAN_CALLER_NAME` to this host's stable id (examples: `codex`, `qwen-code`, `claude-code`, `cursor`, `qoder`). Sample lines use `codex`; replace with your host. `BAILIAN_SKILL_VERSION` is this file's `metadata.version` (`2.5.0`).
+
+```bash
+BAILIAN_CALLER_TYPE=agent BAILIAN_CALLER_NAME=codex BAILIAN_SKILL_NAME=bailian-managed-agent BAILIAN_SKILL_VERSION=2.5.0 bl managed-agent plan
+```
+
+Replace `codex` in the sample with this host's id. Reuse the same four-variable shape on every later `bl`, but set `BAILIAN_SKILL_NAME` to the owning skill for that command (see `bailian-protocol` Call attribution). Keep `BAILIAN_CALLER_NAME` as this host.
 
 ## Safety guardrail (the most important rule)
 
@@ -103,6 +111,8 @@ for explicit confirmation before re-running with `--yes`.
 
 `vault credential create --secret-env <ENV_NAME>` 中的参数是变量名，不是 Secret 明文。Secret 可来自 Shell export、CI Secret 注入或可选的 `.env`；CLI 会从当前目录向上自动加载最近的 `.env`，用户不必创建该文件。
 
+Human documentation. Agent shell: prefix the `bl` line with the Agent bash variables above. Do not paste this fence as-is. Do not `export` the `BAILIAN_*` variables; `export` below is only for the credential value.
+
 ```bash
 export PROD_API_TOKEN="..."
 bl managed-agent vault credential create \
@@ -191,6 +201,8 @@ Managed Agents 的子线程通过 Event 中的 `session_thread_id` 暴露；公
 - Deployment currently supports File Resources only. An effective Memory mount, including one inherited from the Agent, is rejected. / Deployment 本期仅支持 File，不能继承或直接挂载记忆库。
 - Preview memory writes with `--dry-run`, then obtain confirmation before adding `--yes`. Version redaction permanently removes that version's content. / 版本擦除不可撤销，必须先预览并确认。
 
+Human documentation. Agent shell: prefix each `bl` line with the Agent bash variables above. Do not paste this fence as-is.
+
 ```bash
 bl managed-agent memory-store create --name Notes --dry-run
 bl managed-agent memory-store memories list --workspace-id ws-example --store-id memstore-example --view full
@@ -208,6 +220,8 @@ Command fields and pagination are authoritative in `reference/managed-agent.md`
 - `webhook events` uses `--limit` (1–100) and the opaque `--page` cursor; pass `next_page` back unchanged. / 事件分页游标保持原样传回，不转换成数字页码。
 - Successful `create` and `reset-secret` responses can contain `signing_secret`. Store that response securely for signature verification; do not paste it into logs, issue reports, or source files. Verbose diagnostics and errors must not expose secrets. / 创建或重置密钥的成功响应可能包含签名密钥；请安全保存，不写入日志或代码。
 
+Human documentation. Agent shell: prefix each `bl` line with the Agent bash variables above. Do not paste this fence as-is.
+
 ```bash
 bl managed-agent webhook list --workspace-id ws-example --output json
 bl managed-agent webhook create \
 
@@ -21,6 +21,14 @@ description: >-
 
 执行任何 `bl` 命令前，先读取共享协议 [bailian-protocol](../bailian-protocol/SKILL.md)，遵循鉴权、版本预检、调用归因和高风险确认。协议缺失不妨碍识别记忆意图或解释启用流程；但执行命令前须补齐，提示 `bl skill init`，不能静默退回内置记忆并声称本服务已工作。
 
+**Agent bash (mandatory):** Never run a bare `bl` in the shell. Prefix every invocation except `--help` and `--version`, including commands copied from `reference/memory.md`. Do not `export` these variables. Set `BAILIAN_CALLER_NAME` to this host's stable id (examples: `codex`, `qwen-code`, `claude-code`, `cursor`, `qoder`). Sample lines use `codex`; replace with your host. `BAILIAN_SKILL_VERSION` is this file's `metadata.version` (`2.5.0`). Examples in `reference/` are human documentation.
+
+```bash
+BAILIAN_CALLER_TYPE=agent BAILIAN_CALLER_NAME=codex BAILIAN_SKILL_NAME=bailian-memory BAILIAN_SKILL_VERSION=2.5.0 bl memory list --user-id <bound-user-id> --workspace-id <bound-workspace-id> --page-size 1 --output json
+```
+
+Fill `<bound-user-id>` and `<bound-workspace-id>` from `~/.bailian/personal-memory/config.json` (`user_id`, `workspace_id`). Do not invent a temporary user id. Replace `codex` in the sample with this host's id. Reuse the same four-variable shape on every later `bl`, but set `BAILIAN_SKILL_NAME` to the owning skill for that command (see `bailian-protocol` Call attribution). Keep `BAILIAN_CALLER_NAME` as this host. Command names in the tables below are arguments only.
+
 ## 入口与范围
 
 - 个人记忆：遇到上述触发意图，先读取用户级 `~/.bailian/personal-memory/config.json`；不能在读取前以“用户尚未启用”为由跳过本 Skill。同一会话状态已知可复用，启用/暂停后刷新。状态定义与旧配置迁移见 [初始化](references/setup.md#状态与旧配置)。