refactor(auth): improve API key validation error handling and response propagation

Author: hopelynd

docs/agents/auth-change.md

@@ -33,7 +33,7 @@ defineCommand({ auth }) → runtime/authStage → ctx.client → command.run(ctx
 
 `~/.bailian/config.json` 可同时保存 `api_key`、`access_token` 与 `access_key_*`。登录任一种方式不得删除另一种:
 
-- `bl auth login --api-key ...` 先通过只读 `GET /models` 校验 Key，校验成功后才原子写入 `api_key` 与实际匹配的 `base_url`。公共 DashScope 站点使用 `/api/v1/models?page_no=1&page_size=1`，`*.maas.aliyuncs.com`（Workspace 与 Token Plan）使用 `/compatible-mode/v1/models`。显式 `--base-url` 只校验该站点，不自动改写；未显式指定时，普通 `sk-*` / `sk-ws-*` 按“当前 Profile 已保存的同类站点 → 基于 `workspace_id` 构造的各地域 Workspace 专属站点 → 公共地域”顺序选择首个成功结果，`sk-sp-*` 并行探测国内站与新加坡 Token Plan，其他格式同时尝试两类候选。所有候选明确拒绝时返回 `AUTH`；网络、超时、非 JSON 或 5xx 视为校验无法确定并透传原错误。任一失败都不落盘、不激活 Profile
+- `bl auth login --api-key ...` 先通过只读 `GET /models` 校验 Key，校验成功后才原子写入 `api_key` 与实际匹配的 `base_url`。公共 DashScope 站点使用 `/api/v1/models?page_no=1&page_size=1`，`*.maas.aliyuncs.com`（Workspace 与 Token Plan）使用 `/compatible-mode/v1/models`。显式 `--base-url` 只校验该站点，不自动改写；未显式指定时，普通 `sk-*` / `sk-ws-*` 按“当前 Profile 已保存的同类站点 → 基于 `workspace_id` 构造的各地域 Workspace 专属站点 → 公共地域”顺序选择首个成功结果，`sk-sp-*` 并行探测国内站与新加坡 Token Plan，其他格式同时尝试两类候选。所有候选失败时按候选优先级透传首个原始错误；HTTP status、API code、request ID 与服务端 message 保持不变，不重新分类为 `AUTH`。任一失败都不落盘、不激活 Profile
 - 未显式传 `--config` 时，`sk-sp-*` 自动写入并激活 `token-plan`；普通 `sk-*` / `sk-ws-*` 仅在当前为 `token-plan` 时改写并激活 `default`，否则保留当前 Profile；其他格式不自动切换。显式 `--config` 始终优先。`sk-sp-*` 无论写入哪个 Profile 都会携带 Token Plan 的预设默认模型，并在保留已有项的基础上补齐 `api_key_capabilities`，不自动删除任何已有能力。登录仍不得删除其他鉴权域的凭证
 - `bl auth login --console` 更新 `access_token` 以及回调携带的 console 作用域字段；若所选 Profile 没有模型 API Key，会要求控制台页面创建并回传一个普通 API Key 与 Base URL 一并保存。该回调结果不重复执行 `/models` 校验，且不会创建或配置 Token Plan
 - `bl auth login --open-api ...` 调用 OpenAPI 生成 CLI `access_token`，通过目标 Console 网关的只读 `loginInfo` 校验后，才一并写入 `access_key_id` / `access_key_secret` / `access_token` 和实际 `console_region` / `console_site`；失败不覆盖原凭证、不激活 Profile。一次成功登录同时产生 `openapi` 与 `console` 域凭证

packages/commands/src/commands/auth/login-api-key.ts

@@ -1,6 +1,4 @@
 import {
-  BailianError,
-  ExitCode,
   getApiKeyLoginKind,
   normalizeModelBaseUrl,
   requestJson,
@@ -53,7 +51,6 @@ export interface ApiKeyValidationResult {
 }
 
 const API_KEY_VALIDATION_TIMEOUT_SECONDS = 5;
-const DEFINITIVE_VALIDATION_FAILURE_STATUSES = new Set([200, 400, 401, 403, 404, 405]);
 const ORDINARY_WORKSPACE_REGIONS = [
   "cn-beijing",
   "ap-southeast-1",
@@ -165,12 +162,6 @@ export function apiKeyValidationCandidates(
   return candidates;
 }
 
-function isDefinitiveCandidateFailure(error: unknown): boolean {
-  if (!(error instanceof BailianError)) return false;
-  const status = error.api?.httpStatus;
-  return status !== undefined && DEFINITIVE_VALIDATION_FAILURE_STATUSES.has(status);
-}
-
 /** Validate a key without consuming model quota and return the first matching endpoint. */
 export async function validateApiKey(
   deps: ApiKeyValidationDeps,
@@ -196,17 +187,10 @@ export async function validateApiKey(
   const success = results.find((result) => result.error === undefined);
   if (success) return { baseUrl: success.candidate.baseUrl, kind: success.candidate.kind };
 
-  const inconclusive = results.find((result) => !isDefinitiveCandidateFailure(result.error));
-  if (inconclusive?.error !== undefined) throw inconclusive.error;
+  const failure = results.find((result) => result.error !== undefined);
+  if (failure?.error !== undefined) throw failure.error;
 
-  const explicitHint = options.explicitBaseUrl
-    ? "Check that the API key belongs to this Base URL."
-    : "For a workspace-specific or custom endpoint, retry with --base-url <url>.";
-  throw new BailianError(
-    "API key validation failed: the key was not accepted by any supported model endpoint.",
-    ExitCode.AUTH,
-    explicitHint,
-  );
+  throw new TypeError("API key validation completed without a success or failure result.");
 }
 
 /**

packages/commands/tests/auth-api-key.test.ts

@@ -25,10 +25,10 @@ const settings: Settings = {
   telemetry: false,
 };
 
-function jsonResponse(body: unknown, status = 200): Response {
+function jsonResponse(body: unknown, status = 200, headers: Record<string, string> = {}): Response {
   return new Response(JSON.stringify(body), {
     status,
-    headers: { "content-type": "application/json" },
+    headers: { "content-type": "application/json", ...headers },
   });
 }
 
@@ -202,15 +202,53 @@ test("Token Plan 多地区并行校验选择实际接受 Key 的国际站点", a
   }
 });
 
-test("所有候选站点明确拒绝 Key 时返回 AUTH 校验失败", async () => {
+test("所有候选站点拒绝 Key 时透传首个服务端错误", async () => {
   const originalFetch = httpTransport.fetch;
-  httpTransport.fetch = async () =>
-    jsonResponse({ code: "InvalidApiKey", message: "invalid key" }, 401);
+  httpTransport.fetch = async (input) => {
+    const requestId = requestUrl(input).includes("cn-beijing")
+      ? "req-cn-rejected"
+      : "req-sg-rejected";
+    return jsonResponse(
+      { code: "InvalidApiKey", message: "invalid key", request_id: requestId },
+      401,
+    );
+  };
 
   try {
     const error = await captureValidationError("sk-sp-placeholder");
-    expect(error.exitCode).toBe(ExitCode.AUTH);
-    expect(error.message).toMatch(/API key validation failed/);
+    expect(error.exitCode).toBe(ExitCode.GENERAL);
+    expect(error.message).toBe("invalid key");
+    expect(error.api).toEqual({
+      httpStatus: 401,
+      apiCode: "InvalidApiKey",
+      requestId: "req-cn-rejected",
+    });
+  } finally {
+    httpTransport.fetch = originalFetch;
+  }
+});
+
+test("显式 Base URL 返回 404 时保留状态和 request ID", async () => {
+  const originalFetch = httpTransport.fetch;
+  httpTransport.fetch = async () =>
+    jsonResponse({ code: "NotFound", message: "models route not found" }, 404, {
+      "x-request-id": "req-route-not-found",
+    });
+
+  try {
+    const error = await validateApiKey({ identity, settings }, "sk-ws-placeholder", {
+      explicitBaseUrl: "https://ws-explicit.ap-southeast-1.maas.aliyuncs.com",
+    }).catch((caught) => caught);
+    expect(error).toBeInstanceOf(BailianError);
+    expect(error).toMatchObject({
+      exitCode: ExitCode.GENERAL,
+      message: "models route not found",
+      api: {
+        httpStatus: 404,
+        apiCode: "NotFound",
+        requestId: "req-route-not-found",
+      },
+    });
   } finally {
     httpTransport.fetch = originalFetch;
   }

packages/commands/tests/e2e/auth.e2e.test.ts

@@ -40,7 +40,10 @@ beforeAll(async () => {
       return;
     }
     if (request.headers.authorization === "Bearer sk-rejected-placeholder") {
-      response.writeHead(401, { "content-type": "application/json" });
+      response.writeHead(401, {
+        "content-type": "application/json",
+        "x-request-id": "req-auth-rejected",
+      });
       response.end(JSON.stringify({ code: "InvalidApiKey", message: "invalid key" }));
       return;
     }
@@ -991,8 +994,10 @@ describe("e2e: auth", () => {
         DASHSCOPE_BASE_URL: "",
       },
     );
-    expect(login.exitCode).toBe(3);
-    expect(login.stderr).toMatch(/API key validation failed/);
+    expect(login.exitCode).toBe(1);
+    expect(login.stderr).toMatch(/invalid key/);
+    expect(login.stderr).toMatch(/Status:\s+HTTP 401 \(InvalidApiKey\)/);
+    expect(login.stderr).toMatch(/Request ID:\s+req-auth-rejected/);
     expect(existsSync(join(configDir, "config.json"))).toBe(false);
   });