Merge remote-tracking branch 'origin/main' into release/2.7.0

Author: XXPermanentXX

docs/agents/auth-change.md

@@ -33,7 +33,7 @@ defineCommand({ auth }) → runtime/authStage → ctx.client → command.run(ctx
 
 `~/.bailian/config.json` 可同时保存 `api_key`、`access_token` 与 `access_key_*`。登录任一种方式不得删除另一种:
 
-- `bl auth login --api-key ...` 先通过只读 `GET /models` 校验 Key，校验成功后才原子写入 `api_key` 与实际匹配的 `base_url`。显式 `--base-url` 只校验该站点，不自动改写；未显式指定时，普通 `sk-*` / `sk-ws-*` 按“当前 Profile 已保存的同类站点 → 基于 `workspace_id` 构造的各地域 Workspace 专属站点 → 公共地域”顺序选择首个成功结果，`sk-sp-*` 并行探测国内站与新加坡 Token Plan，其他格式同时尝试两类候选。所有候选明确拒绝时返回 `AUTH`；网络、超时、非 JSON 或 5xx 视为校验无法确定并透传原错误。任一失败都不落盘、不激活 Profile
+- `bl auth login --api-key ...` 先通过只读 `GET /models` 校验 Key，校验成功后才原子写入 `api_key` 与实际匹配的 `base_url`。公共 DashScope 站点使用 `/api/v1/models?page_no=1&page_size=1`，`*.maas.aliyuncs.com`（Workspace 与 Token Plan）使用 `/compatible-mode/v1/models`。显式 `--base-url` 只校验该站点，不自动改写；未显式指定时，普通 `sk-*` / `sk-ws-*` 按“当前 Profile 已保存的同类站点 → 基于 `workspace_id` 构造的各地域 Workspace 专属站点 → 公共地域”顺序选择首个成功结果，`sk-sp-*` 并行探测国内站与新加坡 Token Plan，其他格式同时尝试两类候选。所有候选失败时选择最有诊断价值的原始错误透传：无 HTTP status 的网络、超时或响应解析错误优先，其次为 HTTP 429/5xx，最后为其他 HTTP 错误；同级保持候选顺序。HTTP status、API code、request ID 与服务端 message 保持不变，不重新分类为 `AUTH`。任一失败都不落盘、不激活 Profile
 - 未显式传 `--config` 时，`sk-sp-*` 自动写入并激活 `token-plan`；普通 `sk-*` / `sk-ws-*` 仅在当前为 `token-plan` 时改写并激活 `default`，否则保留当前 Profile；其他格式不自动切换。显式 `--config` 始终优先。`sk-sp-*` 无论写入哪个 Profile 都会携带 Token Plan 的预设默认模型，并在保留已有项的基础上补齐 `api_key_capabilities`，不自动删除任何已有能力。登录仍不得删除其他鉴权域的凭证
 - `bl auth login --console` 更新 `access_token` 以及回调携带的 console 作用域字段；若所选 Profile 没有模型 API Key，会要求控制台页面创建并回传一个普通 API Key 与 Base URL 一并保存。该回调结果不重复执行 `/models` 校验，且不会创建或配置 Token Plan
 - `bl auth login --open-api ...` 调用 OpenAPI 生成 CLI `access_token`，通过目标 Console 网关的只读 `loginInfo` 校验后，才一并写入 `access_key_id` / `access_key_secret` / `access_token` 和实际 `console_region` / `console_site`；失败不覆盖原凭证、不激活 Profile。一次成功登录同时产生 `openapi` 与 `console` 域凭证

docs/agents/config-profile-change.md

@@ -49,6 +49,8 @@
 - 新增/重命名命令时同步 `packages/commands/src/index.ts` 和产品入口 `packages/cli/src/commands.ts`。
 - `config list` 标识所有 Profile 与当前激活项。
 - `config show`、`auth status` 只输出本次最终选择的 `config` 和 `config_file`，不重复携带激活状态。
+- `config show` 额外展示 `DASHSCOPE_API_KEY` / `DASHSCOPE_BASE_URL`（有值才输出，key 脱敏）；JSON 字段值保持干净，另用 `active: { api_key?, base_url? }` 标生效源；text 模式才在生效层值后追加 `(active)` / `（active）`。`base_url` 展示文件层或内置默认，不再被 client 生效值覆盖来源语义。
+- 模型域 `api_key` 与显式 `base_url` 来自不同优先级层级时，仅 `auth: "apiKey"` 命令在 `authStage` 向 stderr 告警一次（`--quiet` 抑制；`--output json` 为 `API_KEY_BASE_URL_SOURCE_MISMATCH`）；同源或仅一端显式配置不告。排查建议指向 `{binName} config show`。
 - `config ui` 从持久化元数据读取激活项，提供显式激活操作，并在删除激活项后刷新为 `default`。
 - `config ui` 展示并可编辑完整 `ConfigFile`（含 `console_*`、`telemetry`），保存时按类型（数字/布尔/枚举）归一化写回；`config set` 仍只暴露较窄的 `VALID_KEYS`。UI 未管理的顶层元数据（如 `active_config`）不进入 Profile block，仍由写盘逻辑单独保留。
 - `config ui` 只读展示本地 agent 生态：Skills 跨全部 agent skill 目录（`~/.agents/skills` 及各 agent 的 `skills/`，含软链接）按 id 聚合并标注安装来源；MCP、Agents 从各 agent 本地配置读取。
@@ -72,7 +74,8 @@
 - Console/OpenAPI/none 命令不参与 API Key capability fallback；fallback 后的 Client 特殊端点行为必须跟随最终解析的 `base_url`，不能根据原 `settings.configName` 推断端点类型。
 - Fallback 反馈只描述 CLI 能权威确认的本地行为：当前 Profile 不支持空格分隔的用户可见叶子命令，本次将从 `default` 读取 API Key 配置；不得声称整个 Profile 已切换，也不得展示 capability ID 或 `<undeclared>` 等内部值。存在 `--api-key` / `--base-url` 或 `DASHSCOPE_API_KEY` / `DASHSCOPE_BASE_URL` 任一显式覆盖时必须跳过 fallback 且不输出反馈。
 - Fallback 反馈写 stderr，`--quiet` 抑制；text 模式输出本地化句子，`--output json` 输出两空格缩进的多行 `warning` 对象。dry-run 和后续鉴权失败仍保留反馈；JSON 模式下多个 diagnostics 以空行分隔，任何模式都不得输出凭证值。
-- `config list/show/use/ui`、`auth status` 和依赖默认模型的消费命令覆盖对应 E2E。
+- 跨源告警覆盖：env key + file base_url、flag/env 与另一层组合；同源与「仅 key + 默认 base_url」不告；quiet / json 形态与 fallback 一致。
+- `config list/show/use/ui`、`auth status` 和依赖默认模型的消费命令覆盖对应 E2E；`config show` 覆盖 env 脱敏与 active 标记。
 - `config ui` 覆盖保存时保留顶层元数据（如 `active_config`），继续允许空值清除字段，并覆盖 `console_*`/`telemetry` 的类型归一化与枚举校验。
 - Assets:`listAssets` 覆盖分类归类、时间倒序、目录缺失返回空；`resolveAssetPath` 覆盖目录穿越拦截;`contentType` 覆盖常见扩展名映射。
 

packages/cli/tests/e2e/config-profile.e2e.test.ts

@@ -153,6 +153,9 @@ describe("e2e: named config", () => {
           });
         } else {
           expect(leadingData.base_url).toBe("https://work.example.test");
+          expect(leadingData.api_key).toBeDefined();
+          expect(String(leadingData.api_key)).not.toMatch(/active/);
+          expect(leadingData.active).toEqual({ api_key: "config", base_url: "config" });
           expect(leadingData.workspace_id).toBe("work-space-review");
         }
         expect(JSON.parse(readFileSync(join(configDir, "config.json"), "utf8"))).toEqual(
@@ -227,13 +230,20 @@ describe("e2e: named config", () => {
       });
       const { stdout, stderr, exitCode } = await runCli(
         ["config", "show", "--config", "default", "--output", "json"],
-        { BAILIAN_CONFIG_DIR: dir },
+        {
+          BAILIAN_CONFIG_DIR: dir,
+          DASHSCOPE_API_KEY: "",
+          DASHSCOPE_BASE_URL: "",
+        },
       );
       expect(exitCode, stderr).toBe(0);
       const data = parseStdoutJson<Record<string, unknown>>(stdout);
       expect(data.config).toBe("default");
-      expect(data.active).toBeUndefined();
+      // `active` is credential-source provenance, not profile activation metadata.
+      expect(data.active).toEqual({ api_key: "config" });
+      expect(data).not.toHaveProperty("active_config");
       expect(data.api_key).toBeDefined();
+      expect(String(data.api_key)).not.toMatch(/active/);
       const raw = JSON.parse(readFileSync(join(dir, "config.json"), "utf8")) as Record<
         string,
         unknown

packages/commands/src/commands/auth/login-api-key.ts

@@ -1,6 +1,5 @@
 import {
   BailianError,
-  ExitCode,
   getApiKeyLoginKind,
   normalizeModelBaseUrl,
   requestJson,
@@ -53,7 +52,6 @@ export interface ApiKeyValidationResult {
 }
 
 const API_KEY_VALIDATION_TIMEOUT_SECONDS = 5;
-const DEFINITIVE_VALIDATION_FAILURE_STATUSES = new Set([200, 400, 401, 403, 404, 405]);
 const ORDINARY_WORKSPACE_REGIONS = [
   "cn-beijing",
   "ap-southeast-1",
@@ -76,12 +74,15 @@ const KNOWN_BASE_URLS: Readonly<Record<ApiKeyEndpointKind, readonly string[]>> =
   ],
 };
 
+function usesCompatibleModelsApi(baseUrl: string, kind: ApiKeyEndpointKind): boolean {
+  const hostname = new URL(normalizeModelBaseUrl(baseUrl)).hostname;
+  return kind === "token-plan" || hostname.endsWith(".maas.aliyuncs.com");
+}
+
 function modelsUrl(baseUrl: string, kind: ApiKeyEndpointKind): string {
-  const url = new URL(
-    kind === "token-plan" ? "/compatible-mode/v1/models" : "/api/v1/models",
-    `${baseUrl}/`,
-  );
-  if (kind === "ordinary") {
+  const compatible = usesCompatibleModelsApi(baseUrl, kind);
+  const url = new URL(compatible ? "/compatible-mode/v1/models" : "/api/v1/models", `${baseUrl}/`);
+  if (!compatible) {
     url.searchParams.set("page_no", "1");
     url.searchParams.set("page_size", "1");
   }
@@ -97,6 +98,14 @@ function isTokenPlanBaseUrl(baseUrl: string): boolean {
   return new URL(normalizeModelBaseUrl(baseUrl)).hostname.startsWith("token-plan.");
 }
 
+function kindsForBaseUrl(
+  kinds: readonly ApiKeyEndpointKind[],
+  baseUrl: string,
+): ApiKeyEndpointKind[] {
+  if (!isTokenPlanBaseUrl(baseUrl) || !kinds.includes("token-plan")) return [...kinds];
+  return ["token-plan", ...kinds.filter((kind) => kind !== "token-plan")];
+}
+
 function addCandidate(
   candidates: ApiKeyValidationCandidate[],
   seenUrls: Set<string>,
@@ -120,13 +129,15 @@ export function apiKeyValidationCandidates(
   const seenUrls = new Set<string>();
 
   if (options.explicitBaseUrl) {
-    for (const kind of kinds) addCandidate(candidates, seenUrls, options.explicitBaseUrl, kind);
+    for (const kind of kindsForBaseUrl(kinds, options.explicitBaseUrl)) {
+      addCandidate(candidates, seenUrls, options.explicitBaseUrl, kind);
+    }
     return candidates;
   }
 
   if (options.storedBaseUrl) {
     const storedIsTokenPlan = isTokenPlanBaseUrl(options.storedBaseUrl);
-    for (const kind of kinds) {
+    for (const kind of kindsForBaseUrl(kinds, options.storedBaseUrl)) {
       if (apiKeyKind === "unknown" || storedIsTokenPlan === (kind === "token-plan")) {
         addCandidate(candidates, seenUrls, options.storedBaseUrl, kind);
       }
@@ -152,10 +163,25 @@ export function apiKeyValidationCandidates(
   return candidates;
 }
 
-function isDefinitiveCandidateFailure(error: unknown): boolean {
-  if (!(error instanceof BailianError)) return false;
-  const status = error.api?.httpStatus;
-  return status !== undefined && DEFINITIVE_VALIDATION_FAILURE_STATUSES.has(status);
+function validationFailurePriority(error: unknown): number {
+  if (!(error instanceof BailianError) || error.api?.httpStatus === undefined) return 0;
+  const status = error.api.httpStatus;
+  if (status === 429 || status >= 500) return 1;
+  return 2;
+}
+
+function selectValidationFailure(results: readonly { error?: unknown }[]): unknown {
+  let selectedError: unknown;
+  let selectedPriority = Number.POSITIVE_INFINITY;
+  for (const result of results) {
+    if (result.error === undefined) continue;
+    const priority = validationFailurePriority(result.error);
+    if (priority < selectedPriority) {
+      selectedError = result.error;
+      selectedPriority = priority;
+    }
+  }
+  return selectedError;
 }
 
 /** Validate a key without consuming model quota and return the first matching endpoint. */
@@ -183,17 +209,10 @@ export async function validateApiKey(
   const success = results.find((result) => result.error === undefined);
   if (success) return { baseUrl: success.candidate.baseUrl, kind: success.candidate.kind };
 
-  const inconclusive = results.find((result) => !isDefinitiveCandidateFailure(result.error));
-  if (inconclusive?.error !== undefined) throw inconclusive.error;
+  const failure = selectValidationFailure(results);
+  if (failure !== undefined) throw failure;
 
-  const explicitHint = options.explicitBaseUrl
-    ? "Check that the API key belongs to this Base URL."
-    : "For a workspace-specific or custom endpoint, retry with --base-url <url>.";
-  throw new BailianError(
-    "API key validation failed: the key was not accepted by any supported model endpoint.",
-    ExitCode.AUTH,
-    explicitHint,
-  );
+  throw new TypeError("API key validation completed without a success or failure result.");
 }
 
 /**

packages/commands/src/commands/config/show.ts

@@ -1,32 +1,127 @@
-import { DEFAULT_LANGUAGE, defineCommand, detectOutputFormat, maskToken } from "bailian-cli-core";
-import { emitResult } from "bailian-cli-runtime";
+import {
+  DEFAULT_LANGUAGE,
+  defineCommand,
+  detectOutputFormat,
+  formatOutput,
+  maskToken,
+  normalizeModelBaseUrl,
+  REGIONS,
+  resolveModelConnectionProvenance,
+  type CredentialSource,
+  type ResolutionSources,
+} from "bailian-cli-core";
+import { ansi } from "bailian-cli-runtime";
 import { SECRET_KEYS } from "./shared.ts";
 
+function markActive(value: string, isActive: boolean, suffix: string): string {
+  return isActive ? `${value}${suffix}` : value;
+}
+
 export default defineCommand({
   description: { "en-US": "Display current configuration", "zh-CN": "显示当前配置" },
   auth: "none",
   exampleArgs: ["", "--output json"],
   async run(ctx) {
-    const { settings, client } = ctx;
+    const { settings, localize } = ctx;
     const store = ctx.configStore;
     const file = store.read();
     const format = detectOutputFormat(settings.output);
+    const activeSuffix = localize({
+      "en-US": " (active)",
+      "zh-CN": "（active）",
+    });
+
+    // auth:none — no credential flags; file + env match the dispatch resolution chain.
+    const sources: ResolutionSources = {
+      flags: {},
+      file,
+      env: process.env,
+      configName: settings.configName,
+      configPath: store.path,
+    };
+    const provenance = resolveModelConnectionProvenance(sources);
+
+    const envApiKey = process.env.DASHSCOPE_API_KEY?.trim();
+    const envBaseUrl = process.env.DASHSCOPE_BASE_URL?.trim();
 
     const result: Record<string, unknown> = {
       ...file,
       language: file.language ?? DEFAULT_LANGUAGE,
-      base_url: client.baseUrl,
       output: settings.output,
       timeout: settings.timeout,
       watermark: settings.watermark,
       config: settings.configName ?? "default",
       config_file: store.path,
     };
 
+    // Keep field values machine-clean; decorate only for text output below.
+    if (typeof file.api_key === "string") {
+      result.api_key = maskToken(file.api_key);
+    }
+
+    if (envApiKey) {
+      result.DASHSCOPE_API_KEY = maskToken(envApiKey);
+    }
+
+    if (typeof file.base_url === "string") {
+      result.base_url = file.base_url;
+    } else {
+      // Always show the built-in default when the file omits base_url.
+      result.base_url = REGIONS.cn;
+    }
+
+    if (envBaseUrl) {
+      // Match the request path: origin only, so userinfo/query/fragment are not printed.
+      result.DASHSCOPE_BASE_URL = normalizeModelBaseUrl(envBaseUrl);
+    }
+
     for (const key of SECRET_KEYS) {
-      if (typeof result[key] === "string") result[key] = maskToken(result[key]);
+      if (key === "api_key") continue;
+      if (typeof result[key] === "string") result[key] = maskToken(result[key] as string);
+    }
+
+    const active: { api_key?: CredentialSource; base_url?: CredentialSource } = {};
+    if (provenance.apiKeySource) active.api_key = provenance.apiKeySource;
+    if (provenance.baseUrlSource) active.base_url = provenance.baseUrlSource;
+
+    if (format === "json") {
+      result.active = active;
+      process.stdout.write(formatOutput(result, format) + "\n");
+      return;
+    }
+
+    // Text: append (active) to the winning layer's displayed value.
+    if (typeof result.api_key === "string") {
+      result.api_key = markActive(
+        result.api_key,
+        provenance.apiKeySource === "config",
+        activeSuffix,
+      );
+    }
+    if (typeof result.DASHSCOPE_API_KEY === "string") {
+      result.DASHSCOPE_API_KEY = markActive(
+        result.DASHSCOPE_API_KEY,
+        provenance.apiKeySource === "env",
+        activeSuffix,
+      );
+    }
+    if (typeof result.base_url === "string") {
+      const baseUrlActive =
+        provenance.baseUrlSource === "config" || provenance.baseUrlSource === undefined;
+      result.base_url = markActive(result.base_url, baseUrlActive, activeSuffix);
+    }
+    if (typeof result.DASHSCOPE_BASE_URL === "string") {
+      result.DASHSCOPE_BASE_URL = markActive(
+        result.DASHSCOPE_BASE_URL,
+        provenance.baseUrlSource === "env",
+        activeSuffix,
+      );
     }
 
-    emitResult(result, format);
+    // Color after render so YAML does not escape ANSI into values.
+    const rendered = formatOutput(result, format);
+    process.stdout.write(
+      rendered.replaceAll(activeSuffix, ansi(process.stdout).cyan(activeSuffix)) + "\n",
+    );
   },
 });