From 6329427b4d1e9695a9c337b15a4b5b657c33a283 Mon Sep 17 00:00:00 2001 From: chenanran555 Date: Tue, 21 Jul 2026 10:43:22 +0800 Subject: [PATCH 01/21] feat(agent): add agent command group with session and state management --- packages/cli/src/commands.ts | 32 ++ packages/commands/package.json | 1 + .../commands/agent/_engine/address-utils.ts | 11 + .../commands/agent/_engine/config-loader.ts | 43 ++ .../commands/agent/_engine/console-capture.ts | 23 + .../src/commands/agent/_engine/credentials.ts | 18 + .../src/commands/agent/_engine/errors.ts | 19 + .../src/commands/agent/_engine/feedback.ts | 10 + .../agent/_engine/file-state-manager.ts | 24 + .../src/commands/agent/_engine/pagination.ts | 25 + .../commands/agent/_engine/session-render.ts | 83 ++++ packages/commands/src/commands/agent/apply.ts | 119 +++++ .../commands/src/commands/agent/destroy.ts | 88 ++++ packages/commands/src/commands/agent/init.ts | 141 ++++++ packages/commands/src/commands/agent/plan.ts | 97 ++++ .../src/commands/agent/session-create.ts | 78 +++ .../src/commands/agent/session-delete.ts | 44 ++ .../src/commands/agent/session-events.ts | 76 +++ .../src/commands/agent/session-get.ts | 53 ++ .../src/commands/agent/session-list.ts | 72 +++ .../src/commands/agent/session-run.ts | 81 ++++ .../src/commands/agent/session-send.ts | 64 +++ .../src/commands/agent/state-import.ts | 61 +++ .../commands/src/commands/agent/state-list.ts | 52 ++ .../commands/src/commands/agent/state-rm.ts | 56 +++ .../commands/src/commands/agent/state-show.ts | 54 +++ .../commands/src/commands/agent/validate.ts | 54 +++ packages/commands/src/index.ts | 16 + pnpm-lock.yaml | 250 +++++++++- skills/bailian-cli/reference/agent.md | 451 ++++++++++++++++++ skills/bailian-cli/reference/index.md | 75 +-- 31 files changed, 2230 insertions(+), 41 deletions(-) create mode 100644 packages/commands/src/commands/agent/_engine/address-utils.ts create mode 100644 packages/commands/src/commands/agent/_engine/config-loader.ts create mode 100644 packages/commands/src/commands/agent/_engine/console-capture.ts create mode 100644 packages/commands/src/commands/agent/_engine/credentials.ts create mode 100644 packages/commands/src/commands/agent/_engine/errors.ts create mode 100644 packages/commands/src/commands/agent/_engine/feedback.ts create mode 100644 packages/commands/src/commands/agent/_engine/file-state-manager.ts create mode 100644 packages/commands/src/commands/agent/_engine/pagination.ts create mode 100644 packages/commands/src/commands/agent/_engine/session-render.ts create mode 100644 packages/commands/src/commands/agent/apply.ts create mode 100644 packages/commands/src/commands/agent/destroy.ts create mode 100644 packages/commands/src/commands/agent/init.ts create mode 100644 packages/commands/src/commands/agent/plan.ts create mode 100644 packages/commands/src/commands/agent/session-create.ts create mode 100644 packages/commands/src/commands/agent/session-delete.ts create mode 100644 packages/commands/src/commands/agent/session-events.ts create mode 100644 packages/commands/src/commands/agent/session-get.ts create mode 100644 packages/commands/src/commands/agent/session-list.ts create mode 100644 packages/commands/src/commands/agent/session-run.ts create mode 100644 packages/commands/src/commands/agent/session-send.ts create mode 100644 packages/commands/src/commands/agent/state-import.ts create mode 100644 packages/commands/src/commands/agent/state-list.ts create mode 100644 packages/commands/src/commands/agent/state-rm.ts create mode 100644 packages/commands/src/commands/agent/state-show.ts create mode 100644 packages/commands/src/commands/agent/validate.ts create mode 100644 skills/bailian-cli/reference/agent.md diff --git a/packages/cli/src/commands.ts b/packages/cli/src/commands.ts index a7001adb..2674eadc 100644 --- a/packages/cli/src/commands.ts +++ b/packages/cli/src/commands.ts @@ -83,6 +83,22 @@ import { pluginLink, pluginList, pluginRemove, + agentInit, + agentValidate, + agentPlan, + agentApply, + agentDestroy, + agentStateList, + agentStateShow, + agentStateRm, + agentStateImport, + agentSessionCreate, + agentSessionList, + agentSessionGet, + agentSessionDelete, + agentSessionRun, + agentSessionSend, + agentSessionEvents, } from "bailian-cli-commands"; // Full bailian-cli product: every command, exposed under the `bl` binary. @@ -174,4 +190,20 @@ export const commands: Record = { "plugin link": pluginLink, "plugin list": pluginList, "plugin remove": pluginRemove, + "agent init": agentInit, + "agent validate": agentValidate, + "agent plan": agentPlan, + "agent apply": agentApply, + "agent destroy": agentDestroy, + "agent state list": agentStateList, + "agent state show": agentStateShow, + "agent state rm": agentStateRm, + "agent state import": agentStateImport, + "agent session create": agentSessionCreate, + "agent session list": agentSessionList, + "agent session get": agentSessionGet, + "agent session delete": agentSessionDelete, + "agent session run": agentSessionRun, + "agent session send": agentSessionSend, + "agent session events": agentSessionEvents, }; diff --git a/packages/commands/package.json b/packages/commands/package.json index 209c2f66..df326631 100644 --- a/packages/commands/package.json +++ b/packages/commands/package.json @@ -40,6 +40,7 @@ "check": "vp check" }, "dependencies": { + "@openagentpack/sdk": "0.1.0", "bailian-cli-core": "workspace:*", "bailian-cli-runtime": "workspace:*", "boxen": "catalog:", diff --git a/packages/commands/src/commands/agent/_engine/address-utils.ts b/packages/commands/src/commands/agent/_engine/address-utils.ts new file mode 100644 index 00000000..ff8fb315 --- /dev/null +++ b/packages/commands/src/commands/agent/_engine/address-utils.ts @@ -0,0 +1,11 @@ +import type { ResourceAddress } from "@openagentpack/sdk"; + +/** Full state address: provider.type.name */ +export function formatResourceAddress(address: ResourceAddress): string { + return `${address.provider}.${address.type}.${address.name}`; +} + +/** CLI display short label: type.name (provider) */ +export function formatResourceLabel(address: ResourceAddress): string { + return `${address.type}.${address.name} (${address.provider})`; +} diff --git a/packages/commands/src/commands/agent/_engine/config-loader.ts b/packages/commands/src/commands/agent/_engine/config-loader.ts new file mode 100644 index 00000000..0e754948 --- /dev/null +++ b/packages/commands/src/commands/agent/_engine/config-loader.ts @@ -0,0 +1,43 @@ +import { + createProjectRuntime, + type ProjectRuntimeContext, + resolveProjectConfig, + UserError, +} from "@openagentpack/sdk"; +import { ensureCredentials } from "./credentials.ts"; +import { loadFileState } from "./file-state-manager.ts"; + +/** + * Build a full ProjectRuntimeContext from a config file path — the standard + * entry point for agent commands that need the SDK engine. Mirrors OpenAgentPack + * CLI's buildCliRuntime: resolve config → load local state → assemble runtime. + */ +export async function buildAgentRuntime( + filePath: string, + options: { resolveEnv?: boolean; projectName?: string; statePath?: string } = {}, +): Promise { + ensureCredentials(); + const { config, configPath, projectName } = await resolveProjectConfig(filePath, options); + const state = await loadFileState(configPath, options.statePath, projectName); + const ctx = createProjectRuntime({ + projectName, + config, + state, + configPath, + providers: config.providers, + }); + return { ...ctx, configPath }; +} + +/** Ensure a user-supplied --provider value is actually configured in agents.yaml. */ +export function assertProviderConfigured( + ctx: ProjectRuntimeContext, + provider: string | undefined, +): void { + if (!provider || provider === "all") return; + if (ctx.providers.has(provider)) return; + const available = Array.from(ctx.providers.keys()).join(", ") || "none"; + throw new UserError( + `Provider '${provider}' is not configured. Available providers: ${available}.`, + ); +} diff --git a/packages/commands/src/commands/agent/_engine/console-capture.ts b/packages/commands/src/commands/agent/_engine/console-capture.ts new file mode 100644 index 00000000..aab32e19 --- /dev/null +++ b/packages/commands/src/commands/agent/_engine/console-capture.ts @@ -0,0 +1,23 @@ +/** + * Redirect `console.log` / `console.info` to stderr while `fn` runs. + * + * The OpenAgentPack SDK's provider adapters emit progress/debug logging via + * `console.log` (e.g. `[skill-upload]`), which would corrupt bl's stdout data + * channel in `--output json` mode. Wrapping SDK calls that may log keeps stdout + * a clean data channel. Restores the originals on completion. + */ +export async function withStdoutProtected(fn: () => Promise): Promise { + const originalLog = console.log; + const originalInfo = console.info; + const toStderr = (...args: unknown[]): void => { + process.stderr.write(`${args.map((arg) => String(arg)).join(" ")}\n`); + }; + console.log = toStderr; + console.info = toStderr; + try { + return await fn(); + } finally { + console.log = originalLog; + console.info = originalInfo; + } +} diff --git a/packages/commands/src/commands/agent/_engine/credentials.ts b/packages/commands/src/commands/agent/_engine/credentials.ts new file mode 100644 index 00000000..875d4331 --- /dev/null +++ b/packages/commands/src/commands/agent/_engine/credentials.ts @@ -0,0 +1,18 @@ +import { bootstrapRuntimeCredentialsSync } from "@openagentpack/sdk"; + +let bootstrapped = false; + +/** + * Lazily load `.env` and `~/.agents/config.json` into `process.env` so the + * OpenAgentPack SDK can resolve provider credentials (e.g. DASHSCOPE_API_KEY, + * BAILIAN_WORKSPACE_ID). Safe to call repeatedly — only the first call does I/O. + * + * NOTE: agent commands declare `auth: "none"` and let the SDK own credential + * resolution. This is the documented tradeoff of the wholesale SDK integration; + * bl's own `--api-key` / `bl auth login` flow is bridged separately as a follow-up. + */ +export function ensureCredentials(): void { + if (bootstrapped) return; + bootstrapped = true; + bootstrapRuntimeCredentialsSync(); +} diff --git a/packages/commands/src/commands/agent/_engine/errors.ts b/packages/commands/src/commands/agent/_engine/errors.ts new file mode 100644 index 00000000..18a40c82 --- /dev/null +++ b/packages/commands/src/commands/agent/_engine/errors.ts @@ -0,0 +1,19 @@ +import { UserError } from "@openagentpack/sdk"; +import { BailianError, ExitCode } from "bailian-cli-core"; + +/** + * Run an SDK-backed operation, translating SDK error types into BailianError so + * bl's error handler produces the right exit code and hint formatting. + * SDK `UserError` → USAGE/GENERAL; any other Error → GENERAL (message passed + * through, per bl's "don't translate server errors" boundary). + */ +export async function withAgentErrors(fn: () => Promise): Promise { + try { + return await fn(); + } catch (error) { + if (error instanceof BailianError) throw error; + if (error instanceof UserError) throw new BailianError(error.message, ExitCode.USAGE); + if (error instanceof Error) throw new BailianError(error.message, ExitCode.GENERAL); + throw error; + } +} diff --git a/packages/commands/src/commands/agent/_engine/feedback.ts b/packages/commands/src/commands/agent/_engine/feedback.ts new file mode 100644 index 00000000..1cf876d3 --- /dev/null +++ b/packages/commands/src/commands/agent/_engine/feedback.ts @@ -0,0 +1,10 @@ +import type { RuntimeFeedbackEvent } from "@openagentpack/sdk"; + +/** + * Render SDK runtime feedback to stderr, keeping stdout a clean data channel. + * Used as the `onFeedback` sink for plan/apply so progress messages don't mix + * with structured output. + */ +export function renderAgentFeedback(event: RuntimeFeedbackEvent): void { + process.stderr.write(`${event.message}\n`); +} diff --git a/packages/commands/src/commands/agent/_engine/file-state-manager.ts b/packages/commands/src/commands/agent/_engine/file-state-manager.ts new file mode 100644 index 00000000..72a8fd06 --- /dev/null +++ b/packages/commands/src/commands/agent/_engine/file-state-manager.ts @@ -0,0 +1,24 @@ +import { basename, dirname, resolve } from "node:path"; +import { + type IStateManager, + LocalFileStateBackend, + StateManager, + type StateScope, +} from "@openagentpack/sdk"; + +function createStateScope(configPath: string, projectName?: string): StateScope { + const resolved = resolve(configPath); + return { projectId: projectName ?? basename(dirname(resolved)) }; +} + +/** Load or initialize a file-based StateManager (mirrors OpenAgentPack CLI). */ +export async function loadFileState( + configPath: string, + statePath?: string, + projectName?: string, +): Promise { + const resolved = resolve(configPath); + const backend = new LocalFileStateBackend({ configPath: resolved, statePath }); + const path = backend.getStatePath(createStateScope(resolved, projectName)); + return StateManager.load(path); +} diff --git a/packages/commands/src/commands/agent/_engine/pagination.ts b/packages/commands/src/commands/agent/_engine/pagination.ts new file mode 100644 index 00000000..df2fd934 --- /dev/null +++ b/packages/commands/src/commands/agent/_engine/pagination.ts @@ -0,0 +1,25 @@ +export interface PagedResult { + items: T[]; + hasMore: boolean; + nextPage?: string; +} + +/** Fetch the first page, then follow cursors while `all` is true. */ +export async function fetchAllPages( + fetchPage: (page?: string) => Promise>, + all?: boolean, +): Promise> { + const first = await fetchPage(); + const items = [...first.items]; + let hasMore = first.hasMore; + let nextPage = first.nextPage; + + while (all && nextPage) { + const next = await fetchPage(nextPage); + items.push(...next.items); + hasMore = next.hasMore; + nextPage = next.nextPage; + } + + return { items, hasMore, nextPage }; +} diff --git a/packages/commands/src/commands/agent/_engine/session-render.ts b/packages/commands/src/commands/agent/_engine/session-render.ts new file mode 100644 index 00000000..0b08da0a --- /dev/null +++ b/packages/commands/src/commands/agent/_engine/session-render.ts @@ -0,0 +1,83 @@ +import { + type CollectedSessionEvents, + isTerminalSessionStatus, + type ProviderSessionEvent, +} from "@openagentpack/sdk"; +import { sanitizeSessionEvent, sanitizeSessionEvents } from "@openagentpack/sdk/session-events"; + +/** Skip user echo + thinking noise in live rendering (mirrors OpenAgentPack CLI). */ +function shouldRenderLiveEvent(event: ProviderSessionEvent): boolean { + return event.type !== "thinking" && !(event.type === "message" && event.role === "user"); +} + +function writeJsonLine(value: unknown): void { + process.stdout.write(`${JSON.stringify(value)}\n`); +} + +/** Assistant text → stdout (data channel); everything else → stderr (diagnostics). */ +function renderEvent(event: ProviderSessionEvent): void { + if (!shouldRenderLiveEvent(event)) return; + if (event.type === "message" && event.content) { + process.stdout.write(event.content); + } else if (event.type === "tool_use") { + process.stderr.write(`\n[tool] ${event.tool_name}\n`); + } else if (event.type === "tool_result" && event.content) { + const preview = + event.content.length > 200 ? `${event.content.slice(0, 200)}...` : event.content; + process.stderr.write(`${preview}\n`); + } else if (event.type === "status") { + if (event.status === "running") process.stderr.write("\n[session running]\n"); + } else if (event.type === "error") { + process.stderr.write(`\n[error] ${event.content ?? "unknown error"}\n`); + } +} + +function renderTerminalStatus(status: string, json: boolean): void { + if (json) return; + process.stderr.write(`\n[session ${status}]\n`); +} + +/** Consume an SSE stream, rendering live (text) or as JSONL (json). */ +export async function streamAndRenderEvents( + events: AsyncIterable, + json: boolean, +): Promise { + for await (const event of events) { + if (json) writeJsonLine(sanitizeSessionEvent(event)); + else renderEvent(event); + if (event.type === "status" && isTerminalSessionStatus(event.status)) { + renderTerminalStatus(event.status ?? "", json); + break; + } + } +} + +/** Render a polled (non-streaming) collected result. */ +export function renderCollectedEvents(result: CollectedSessionEvents, json: boolean): void { + if (json) { + process.stdout.write( + `${JSON.stringify( + { + events: sanitizeSessionEvents(result.result.events), + has_more: result.result.has_more, + next_page: result.result.next_page, + }, + null, + 2, + )}\n`, + ); + return; + } + for (const event of result.result.events) renderEvent(event); + renderTerminalStatus(result.terminalStatus, json); +} + +/** Split a comma-separated --memory-stores value. */ +export function parseMemoryStores(value?: string): string[] | undefined { + return value + ? value + .split(",") + .map((entry) => entry.trim()) + .filter(Boolean) + : undefined; +} diff --git a/packages/commands/src/commands/agent/apply.ts b/packages/commands/src/commands/agent/apply.ts new file mode 100644 index 00000000..809c9f56 --- /dev/null +++ b/packages/commands/src/commands/agent/apply.ts @@ -0,0 +1,119 @@ +import { + BailianError, + defineCommand, + detectOutputFormat, + ExitCode, + type FlagsDef, +} from "bailian-cli-core"; +import { emitBare, emitResult } from "bailian-cli-runtime"; +import { executePlannedProject, planProjectContext } from "@openagentpack/sdk"; +import { formatResourceLabel } from "./_engine/address-utils.ts"; +import { assertProviderConfigured, buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; +import { renderAgentFeedback } from "./_engine/feedback.ts"; + +const APPLY_FLAGS = { + file: { + type: "string", + valueHint: "", + description: "Config file path (default: agents.yaml)", + }, + provider: { + type: "string", + valueHint: "", + description: "Target provider (default: all configured)", + }, + yes: { + type: "switch", + description: "Confirm and apply without an interactive prompt (required to mutate)", + }, + noRefresh: { + type: "switch", + description: "Skip refreshing state from remote before planning", + }, + concurrency: { + type: "number", + valueHint: "", + description: "Max independent resources to apply in parallel (default 6, max 10)", + }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "Apply planned changes to create/update/delete agent resources", + auth: "none", + usageArgs: "[--file ] [--provider ] [--yes] [--concurrency ]", + flags: APPLY_FLAGS, + exampleArgs: ["--yes", "--provider bailian --yes"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + + const planned = await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + assertProviderConfigured(runtime, flags.provider); + return planProjectContext(runtime, { + provider: flags.provider, + refresh: !flags.noRefresh, + quiet: true, + onFeedback: renderAgentFeedback, + }); + }), + ); + + const plan = planned.plan; + if (plan.diagnostics.some((diag) => diag.severity === "error")) { + for (const diag of plan.diagnostics) { + if (diag.severity === "error") emitBare(`[error] ${diag.code}: ${diag.message}`); + } + throw new BailianError("Cannot apply: resolve the errors above first.", ExitCode.GENERAL); + } + + const actionable = plan.actions.filter((action) => action.action !== "no-op"); + if (actionable.length === 0) { + emitBare("No changes. Infrastructure is up-to-date."); + return; + } + + const creates = actionable.filter((action) => action.action === "create").length; + const updates = actionable.filter((action) => action.action === "update").length; + const deletes = planned.destructiveActions; + + for (const action of actionable) { + const icon = action.action === "create" ? "+" : action.action === "update" ? "~" : "-"; + emitBare(` ${icon} ${formatResourceLabel(action.address)}`); + } + + if (!flags.yes) { + throw new BailianError( + `Refusing to apply ${actionable.length} change(s) (${creates} create, ${updates} update, ${deletes.length} destroy) without confirmation.`, + ExitCode.USAGE, + "Review with `bl agent plan`, then re-run with --yes to apply.", + ); + } + + const result = await withAgentErrors(() => + withStdoutProtected(() => + executePlannedProject(planned, { + onFeedback: renderAgentFeedback, + policy: "force", + concurrency: flags.concurrency, + }), + ), + ); + + const succeeded = result.results.filter((entry) => entry.status === "success").length; + const failed = result.results.filter((entry) => entry.status === "failed").length; + const skipped = result.results.filter((entry) => entry.status === "skipped").length; + + if (format === "json") { + emitResult({ succeeded, failed, skipped, results: result.results }, format); + } else { + emitBare(`\nApply finished: ${succeeded} succeeded, ${failed} failed, ${skipped} skipped.`); + } + + if (failed > 0) throw new BailianError("Apply failed.", ExitCode.GENERAL); + }, +}); diff --git a/packages/commands/src/commands/agent/destroy.ts b/packages/commands/src/commands/agent/destroy.ts new file mode 100644 index 00000000..52fd3952 --- /dev/null +++ b/packages/commands/src/commands/agent/destroy.ts @@ -0,0 +1,88 @@ +import { + BailianError, + defineCommand, + detectOutputFormat, + ExitCode, + type FlagsDef, +} from "bailian-cli-core"; +import { emitBare, emitResult } from "bailian-cli-runtime"; +import { destroyPlannedProjectResources, planDestroyProjectContext } from "@openagentpack/sdk"; +import { formatResourceLabel } from "./_engine/address-utils.ts"; +import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; + +const DESTROY_FLAGS = { + file: { + type: "string", + valueHint: "", + description: "Config file path (default: agents.yaml)", + }, + yes: { + type: "switch", + description: "Confirm and destroy without an interactive prompt (required)", + }, + cascade: { + type: "switch", + description: "Auto-delete dependent resources (e.g. sessions referencing an environment)", + }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "Destroy all managed agent resources tracked in state", + auth: "none", + usageArgs: "[--file ] [--yes] [--cascade]", + flags: DESTROY_FLAGS, + exampleArgs: ["--yes", "--yes --cascade"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + + const planned = await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + return planDestroyProjectContext(runtime); + }), + ); + + const resources = planned.resources; + if (resources.length === 0) { + emitBare("No resources in state. Nothing to destroy."); + return; + } + + for (const resource of resources) { + emitBare(` - ${formatResourceLabel(resource.address)} [${resource.remote_id}]`); + } + + if (!flags.yes) { + throw new BailianError( + `Refusing to destroy ${resources.length} resource(s) without confirmation.`, + ExitCode.USAGE, + "Re-run with --yes to destroy (add --cascade to remove dependents).", + ); + } + + const result = await withAgentErrors(() => + withStdoutProtected(() => + destroyPlannedProjectResources(planned, { + cascade: flags.cascade, + onCascadeRequired: async () => Boolean(flags.cascade), + onResourceResult: (item) => { + const label = formatResourceLabel(item.resource.address); + process.stderr.write(` ${item.status === "success" ? "✓" : "✗"} ${label}\n`); + }, + }), + ), + ); + + if (format === "json") { + emitResult({ destroyed: result.destroyed, total: result.resources.length }, format); + } else { + emitBare( + `\nDestroy complete. ${result.destroyed}/${result.resources.length} resources removed.`, + ); + } + }, +}); diff --git a/packages/commands/src/commands/agent/init.ts b/packages/commands/src/commands/agent/init.ts new file mode 100644 index 00000000..dc16f65c --- /dev/null +++ b/packages/commands/src/commands/agent/init.ts @@ -0,0 +1,141 @@ +import { existsSync } from "node:fs"; +import { readFile, writeFile } from "node:fs/promises"; +import { + BailianError, + defineCommand, + detectOutputFormat, + ExitCode, + type FlagsDef, +} from "bailian-cli-core"; +import { emitBare, emitResult } from "bailian-cli-runtime"; + +const GITIGNORE_ADDITIONS = ` +# agents +agents.state.json +.env +`; + +const PROVIDERS = ["bailian", "claude", "qoder", "ark", "all"] as const; + +const PROVIDER_BLOCKS: Record = { + bailian: ` bailian:\n api_key: \${DASHSCOPE_API_KEY}\n workspace_id: \${BAILIAN_WORKSPACE_ID}`, + claude: ` claude:\n api_key: \${ANTHROPIC_API_KEY}`, + qoder: ` qoder:\n api_key: \${QODER_PAT}\n gateway: "https://api.qoder.com/api/v1/cloud"`, + ark: ` ark:\n api_key: \${ARK_API_KEY}`, +}; + +const SINGLE_MODEL: Record = { + bailian: ` model: qwen3.7-max`, + claude: ` model: claude-sonnet-4-6`, + qoder: ` model: ultimate`, + ark: ` model: doubao-seed-2-1-pro-260628`, +}; + +function buildTemplate(options: { provider: string; agentName: string }): string { + const providerBlock = + options.provider === "all" + ? `${PROVIDER_BLOCKS.bailian}\n${PROVIDER_BLOCKS.claude}\n${PROVIDER_BLOCKS.qoder}\n${PROVIDER_BLOCKS.ark}` + : PROVIDER_BLOCKS[options.provider]!; + + const modelBlock = + options.provider === "all" + ? ` model:\n bailian: qwen3.7-max\n claude: claude-sonnet-4-6\n qoder: ultimate\n ark: doubao-seed-2-1-pro-260628` + : SINGLE_MODEL[options.provider]!; + + const toolBlock = + options.provider === "bailian" + ? "[bash, read, glob, grep]" + : "[read, glob, grep, web_search, web_fetch]"; + + return `version: "1" + +providers: +${providerBlock} + +defaults: + provider: ${options.provider === "all" ? "all" : options.provider} + +environments: + dev: + config: + type: cloud + networking: + type: unrestricted + +agents: + ${options.agentName}: + description: "General-purpose assistant" +${modelBlock} + instructions: | + You are a helpful assistant. + environment: dev + tools: + builtin: ${toolBlock} +`; +} + +const INIT_FLAGS = { + provider: { + type: "string", + valueHint: "", + description: "Provider: bailian, claude, qoder, ark, all (default: bailian)", + choices: PROVIDERS, + }, + agentName: { + type: "string", + valueHint: "", + description: "Name of the first agent (default: assistant)", + }, + file: { + type: "string", + valueHint: "", + description: "Output config path (default: agents.yaml)", + }, + force: { + type: "switch", + description: "Overwrite an existing config file", + }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "Create a new agents.yaml template", + auth: "none", + usageArgs: "[--provider ] [--agent-name ] [--file ] [--force]", + flags: INIT_FLAGS, + exampleArgs: ["", "--provider bailian --agent-name assistant", "--provider all"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const provider = flags.provider ?? "bailian"; + const agentName = flags.agentName ?? "assistant"; + const file = flags.file ?? "agents.yaml"; + + if (existsSync(file) && !flags.force) { + throw new BailianError( + `${file} already exists.`, + ExitCode.USAGE, + "Pass --force to overwrite.", + ); + } + + const template = buildTemplate({ provider, agentName }); + await writeFile(file, template, "utf8"); + + const gitignorePath = ".gitignore"; + if (existsSync(gitignorePath)) { + const content = await readFile(gitignorePath, "utf8"); + if (!content.includes("agents.state.json")) { + await writeFile(gitignorePath, content + GITIGNORE_ADDITIONS, "utf8"); + } + } else { + await writeFile(gitignorePath, `${GITIGNORE_ADDITIONS.trim()}\n`, "utf8"); + } + + if (format === "json") { + emitResult({ created: file, provider, agent: agentName }, format); + } else { + emitBare(`Created ${file}`); + emitBare("Next: edit agents.yaml, then run `bl agent plan`."); + } + }, +}); diff --git a/packages/commands/src/commands/agent/plan.ts b/packages/commands/src/commands/agent/plan.ts new file mode 100644 index 00000000..4ded10e7 --- /dev/null +++ b/packages/commands/src/commands/agent/plan.ts @@ -0,0 +1,97 @@ +import { + BailianError, + defineCommand, + detectOutputFormat, + ExitCode, + type FlagsDef, +} from "bailian-cli-core"; +import { emitBare, emitResult } from "bailian-cli-runtime"; +import { planProjectContext } from "@openagentpack/sdk"; +import { formatResourceLabel } from "./_engine/address-utils.ts"; +import { assertProviderConfigured, buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; +import { renderAgentFeedback } from "./_engine/feedback.ts"; + +const PLAN_FLAGS = { + file: { + type: "string", + valueHint: "", + description: "Config file path (default: agents.yaml)", + }, + provider: { + type: "string", + valueHint: "", + description: "Target provider (default: all configured)", + }, + noRefresh: { + type: "switch", + description: "Skip refreshing state from remote before planning", + }, + refreshOnly: { + type: "switch", + description: "Refresh state and show drift without planning remote mutations", + }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "Show what changes would be applied to agent infrastructure", + auth: "none", + usageArgs: "[--file ] [--provider ] [--no-refresh] [--refresh-only]", + flags: PLAN_FLAGS, + exampleArgs: ["", "--provider bailian", "--no-refresh"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + + const planned = await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + assertProviderConfigured(runtime, flags.provider); + return planProjectContext(runtime, { + provider: flags.provider, + refresh: !flags.noRefresh, + quiet: format === "json", + onFeedback: format === "json" ? undefined : renderAgentFeedback, + }); + }), + ); + + const plan = planned.plan; + const hasErrors = plan.diagnostics.some((diag) => diag.severity === "error"); + + if (format === "json") { + emitResult(plan, format); + if (hasErrors) throw new BailianError("Plan contains errors.", ExitCode.GENERAL); + return; + } + + for (const diag of plan.diagnostics) { + emitBare(`[${diag.severity}] ${diag.code}: ${diag.message}`); + } + if (hasErrors) throw new BailianError("Plan contains errors.", ExitCode.GENERAL); + + const creates = plan.actions.filter((action) => action.action === "create"); + const updates = plan.actions.filter((action) => action.action === "update"); + const deletes = plan.actions.filter((action) => action.action === "delete"); + + if (creates.length + updates.length + deletes.length === 0) { + emitBare("No changes. Infrastructure is up-to-date."); + if (flags.refreshOnly) emitBare("Refresh-only mode: no remote mutations were performed."); + return; + } + + emitBare("\nPlanned actions:\n"); + for (const action of creates) emitBare(` + ${formatResourceLabel(action.address)}`); + for (const action of updates) { + emitBare(` ~ ${formatResourceLabel(action.address)}`); + if (action.reason) emitBare(` ${action.reason}`); + } + for (const action of deletes) emitBare(` - ${formatResourceLabel(action.address)}`); + emitBare( + `\nPlan: ${creates.length} to create, ${updates.length} to update, ${deletes.length} to destroy.`, + ); + if (flags.refreshOnly) emitBare("Refresh-only mode: no remote mutations will be performed."); + }, +}); diff --git a/packages/commands/src/commands/agent/session-create.ts b/packages/commands/src/commands/agent/session-create.ts new file mode 100644 index 00000000..faf082e8 --- /dev/null +++ b/packages/commands/src/commands/agent/session-create.ts @@ -0,0 +1,78 @@ +import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; +import { emitBare, emitResult } from "bailian-cli-runtime"; +import { createSessionForAgent } from "@openagentpack/sdk"; +import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; +import { parseMemoryStores } from "./_engine/session-render.ts"; + +const SESSION_CREATE_FLAGS = { + file: { + type: "string", + valueHint: "", + description: "Config file path (default: agents.yaml)", + }, + agent: { + type: "string", + valueHint: "", + description: "Agent name (auto-detected when only one agent is configured)", + }, + environment: { + type: "string", + valueHint: "", + description: "Override agent's declared environment", + }, + vault: { type: "string", valueHint: "", description: "Override agent's declared vault" }, + memoryStores: { + type: "string", + valueHint: "", + description: "Override agent's memory stores (comma-separated)", + }, + title: { type: "string", valueHint: "", description: "Session title" }, + provider: { + type: "string", + valueHint: "<name>", + description: "Target provider (multi-provider agents)", + }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "Create a new session for an agent", + auth: "none", + usageArgs: "[--agent <name>] [--environment <name>] [--title <title>] [--file <path>]", + flags: SESSION_CREATE_FLAGS, + exampleArgs: ["", "--agent assistant", "--agent assistant --title 'debug run'"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + + const run = await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + return createSessionForAgent(runtime, { + agent: flags.agent, + provider: flags.provider, + environment: flags.environment, + vault: flags.vault, + memoryStores: parseMemoryStores(flags.memoryStores), + title: flags.title, + }); + }), + ); + + const { agentName, session } = run; + if (format === "json") { + emitResult({ agent: agentName, session }, format); + return; + } + emitBare(`Session created: ${session.id}`); + emitBare(` Agent: ${agentName}`); + emitBare(` Environment: ${session.environment_id}`); + emitBare(` Status: ${session.status}`); + if (session.vault_ids.length) emitBare(` Vaults: ${session.vault_ids.join(", ")}`); + if (session.memory_store_ids.length) { + emitBare(` Memory: ${session.memory_store_ids.join(", ")}`); + } + }, +}); diff --git a/packages/commands/src/commands/agent/session-delete.ts b/packages/commands/src/commands/agent/session-delete.ts new file mode 100644 index 00000000..e85e754b --- /dev/null +++ b/packages/commands/src/commands/agent/session-delete.ts @@ -0,0 +1,44 @@ +import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; +import { emitBare, emitResult } from "bailian-cli-runtime"; +import { deleteSession } from "@openagentpack/sdk"; +import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; + +const SESSION_DELETE_FLAGS = { + sessionId: { + type: "string", + valueHint: "<id>", + description: "Session ID (required)", + required: true, + }, + file: { + type: "string", + valueHint: "<path>", + description: "Config file path (default: agents.yaml)", + }, + provider: { type: "string", valueHint: "<name>", description: "Target provider" }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "Delete a session", + auth: "none", + usageArgs: "--session-id <id> [--provider <name>] [--file <path>]", + flags: SESSION_DELETE_FLAGS, + exampleArgs: ["--session-id sess_abc123"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + + await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + await deleteSession(runtime, flags.sessionId, flags.provider); + }), + ); + + if (format === "json") emitResult({ deleted: flags.sessionId }, format); + else emitBare(`Session ${flags.sessionId} deleted.`); + }, +}); diff --git a/packages/commands/src/commands/agent/session-events.ts b/packages/commands/src/commands/agent/session-events.ts new file mode 100644 index 00000000..8887a351 --- /dev/null +++ b/packages/commands/src/commands/agent/session-events.ts @@ -0,0 +1,76 @@ +import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; +import { emitBare, emitResult, formatTable } from "bailian-cli-runtime"; +import { listSessionEvents } from "@openagentpack/sdk"; +import { sanitizeSessionEvents } from "@openagentpack/sdk/session-events"; +import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; +import { fetchAllPages } from "./_engine/pagination.ts"; + +const SESSION_EVENTS_FLAGS = { + sessionId: { + type: "string", + valueHint: "<id>", + description: "Session ID (required)", + required: true, + }, + file: { + type: "string", + valueHint: "<path>", + description: "Config file path (default: agents.yaml)", + }, + provider: { type: "string", valueHint: "<name>", description: "Target provider" }, + limit: { type: "number", valueHint: "<n>", description: "Maximum number of events to fetch" }, + all: { type: "switch", description: "Fetch all pages by following the cursor" }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "List event history for a session", + auth: "none", + usageArgs: "--session-id <id> [--limit <n>] [--all] [--file <path>]", + flags: SESSION_EVENTS_FLAGS, + exampleArgs: ["--session-id sess_abc123", "--session-id sess_abc123 --all"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + + const { items: events, hasMore } = await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + return fetchAllPages(async (page) => { + const result = await listSessionEvents(runtime, flags.sessionId, { + provider: flags.provider, + limit: flags.limit, + page_token: page, + }); + return { items: result.events, hasMore: result.has_more, nextPage: result.next_page }; + }, flags.all); + }), + ); + + if (format === "json") { + emitResult({ events: sanitizeSessionEvents(events), has_more: hasMore }, format); + return; + } + if (events.length === 0) { + emitBare("No events found."); + return; + } + + const headers = ["#", "TYPE", "CONTENT"]; + const rows = events.map((event, index) => { + let preview = ""; + if (event.type === "message") preview = (event.content ?? "").slice(0, 60); + else if (event.type === "tool_use") preview = event.tool_name ?? ""; + else if (event.type === "tool_result") preview = (event.content ?? "").slice(0, 60); + else if (event.type === "status") preview = event.status ?? ""; + else if (event.type === "error") preview = (event.content ?? "").slice(0, 60); + else preview = event.raw_type; + return [String(index + 1), event.type, preview]; + }); + for (const line of formatTable(headers, rows)) emitBare(line); + emitBare(`\nTotal: ${events.length}`); + if (hasMore) emitBare("More events available. Use --all to fetch all."); + }, +}); diff --git a/packages/commands/src/commands/agent/session-get.ts b/packages/commands/src/commands/agent/session-get.ts new file mode 100644 index 00000000..203facb8 --- /dev/null +++ b/packages/commands/src/commands/agent/session-get.ts @@ -0,0 +1,53 @@ +import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; +import { emitBare, emitResult } from "bailian-cli-runtime"; +import { getSession } from "@openagentpack/sdk"; +import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; + +const SESSION_GET_FLAGS = { + sessionId: { + type: "string", + valueHint: "<id>", + description: "Session ID (required)", + required: true, + }, + file: { + type: "string", + valueHint: "<path>", + description: "Config file path (default: agents.yaml)", + }, + provider: { type: "string", valueHint: "<name>", description: "Target provider" }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "Get details of a session", + auth: "none", + usageArgs: "--session-id <id> [--provider <name>] [--file <path>]", + flags: SESSION_GET_FLAGS, + exampleArgs: ["--session-id sess_abc123"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + + const session = await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + return getSession(runtime, flags.sessionId, flags.provider); + }), + ); + + if (format === "json") { + emitResult(session, format); + return; + } + emitBare(` ID: ${session.id}`); + emitBare(` Agent: ${session.agent_id}`); + emitBare(` Environment: ${session.environment_id}`); + emitBare(` Status: ${session.status}`); + if (session.title) emitBare(` Title: ${session.title}`); + emitBare(` Created: ${session.created_at}`); + emitBare(` Updated: ${session.updated_at}`); + }, +}); diff --git a/packages/commands/src/commands/agent/session-list.ts b/packages/commands/src/commands/agent/session-list.ts new file mode 100644 index 00000000..0686c6b0 --- /dev/null +++ b/packages/commands/src/commands/agent/session-list.ts @@ -0,0 +1,72 @@ +import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; +import { emitBare, emitResult, formatTable } from "bailian-cli-runtime"; +import { listSessionSummaries } from "@openagentpack/sdk"; +import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; +import { fetchAllPages } from "./_engine/pagination.ts"; + +const SESSION_LIST_FLAGS = { + file: { + type: "string", + valueHint: "<path>", + description: "Config file path (default: agents.yaml)", + }, + agent: { type: "string", valueHint: "<name>", description: "Filter by agent name" }, + all: { type: "switch", description: "Fetch all pages by following the cursor" }, + provider: { type: "string", valueHint: "<name>", description: "Target provider" }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "List sessions from the provider", + auth: "none", + usageArgs: "[--agent <name>] [--all] [--provider <name>] [--file <path>]", + flags: SESSION_LIST_FLAGS, + exampleArgs: ["", "--agent assistant", "--all"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + + const { items: summaries, hasMore } = await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + return fetchAllPages(async (page) => { + const result = await listSessionSummaries(runtime, { + agent: flags.agent, + provider: flags.provider, + filter: page ? { page } : undefined, + }); + return { items: result.summaries, hasMore: result.hasMore, nextPage: result.nextPage }; + }, flags.all); + }), + ); + + const sessions = summaries.map((summary) => summary.session); + if (format === "json") { + emitResult({ sessions, has_more: hasMore }, format); + return; + } + if (sessions.length === 0) { + emitBare("No sessions found."); + return; + } + + const agentNames = new Map( + summaries + .filter((summary) => summary.agentName) + .map((summary) => [summary.session.id, summary.agentName!]), + ); + const headers = ["ID", "TITLE", "AGENT", "STATUS", "CREATED"]; + const rows = sessions.map((session) => [ + session.id, + (session.title ?? "").slice(0, 20), + agentNames.get(session.id) ?? session.agent_id.slice(0, 12), + session.status, + session.created_at, + ]); + for (const line of formatTable(headers, rows)) emitBare(line); + emitBare(`\nTotal: ${sessions.length}`); + if (hasMore) emitBare("More sessions available. Use --all to fetch all."); + }, +}); diff --git a/packages/commands/src/commands/agent/session-run.ts b/packages/commands/src/commands/agent/session-run.ts new file mode 100644 index 00000000..5f75e59c --- /dev/null +++ b/packages/commands/src/commands/agent/session-run.ts @@ -0,0 +1,81 @@ +import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; +import { startSessionRun, startSessionRunPolling } from "@openagentpack/sdk"; +import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; +import { + parseMemoryStores, + renderCollectedEvents, + streamAndRenderEvents, +} from "./_engine/session-render.ts"; + +const SESSION_RUN_FLAGS = { + prompt: { + type: "string", + valueHint: "<text>", + description: "Prompt to send (required)", + required: true, + }, + file: { + type: "string", + valueHint: "<path>", + description: "Config file path (default: agents.yaml)", + }, + agent: { + type: "string", + valueHint: "<name>", + description: "Agent name (auto-detected when only one agent is configured)", + }, + environment: { + type: "string", + valueHint: "<name>", + description: "Override agent's declared environment", + }, + vault: { type: "string", valueHint: "<name>", description: "Override agent's declared vault" }, + memoryStores: { + type: "string", + valueHint: "<names>", + description: "Override agent's memory stores (comma-separated)", + }, + title: { type: "string", valueHint: "<title>", description: "Session title" }, + provider: { type: "string", valueHint: "<name>", description: "Target provider" }, + noStream: { type: "switch", description: "Use polling instead of SSE streaming" }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "Create a session, send a message, and stream the response", + auth: "none", + usageArgs: "--prompt <text> [--agent <name>] [--no-stream] [--file <path>]", + flags: SESSION_RUN_FLAGS, + exampleArgs: ['--prompt "hello"', '--agent assistant --prompt "summarize this repo"'], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + const asJson = format === "json"; + + const runOptions = { + agent: flags.agent, + provider: flags.provider, + environment: flags.environment, + vault: flags.vault, + memoryStores: parseMemoryStores(flags.memoryStores), + title: flags.title, + }; + + await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + if (flags.noStream) { + const run = await startSessionRunPolling(runtime, flags.prompt, runOptions); + if (!asJson) process.stderr.write(`Session created: ${run.session.id}\n`); + renderCollectedEvents(run, asJson); + } else { + const run = await startSessionRun(runtime, flags.prompt, runOptions); + if (!asJson) process.stderr.write(`Session created: ${run.session.id}\n`); + await streamAndRenderEvents(run.events, asJson); + } + }), + ); + }, +}); diff --git a/packages/commands/src/commands/agent/session-send.ts b/packages/commands/src/commands/agent/session-send.ts new file mode 100644 index 00000000..a0b2611a --- /dev/null +++ b/packages/commands/src/commands/agent/session-send.ts @@ -0,0 +1,64 @@ +import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; +import { sendSessionMessagePolling, sendSessionMessageStreaming } from "@openagentpack/sdk"; +import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; +import { renderCollectedEvents, streamAndRenderEvents } from "./_engine/session-render.ts"; + +const SESSION_SEND_FLAGS = { + sessionId: { + type: "string", + valueHint: "<id>", + description: "Session ID (required)", + required: true, + }, + message: { + type: "string", + valueHint: "<text>", + description: "Message to send (required)", + required: true, + }, + file: { + type: "string", + valueHint: "<path>", + description: "Config file path (default: agents.yaml)", + }, + provider: { type: "string", valueHint: "<name>", description: "Target provider" }, + noStream: { type: "switch", description: "Use polling instead of SSE streaming" }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "Send a message to an existing session and stream the response", + auth: "none", + usageArgs: "--session-id <id> --message <text> [--no-stream] [--file <path>]", + flags: SESSION_SEND_FLAGS, + exampleArgs: ['--session-id sess_abc123 --message "continue"'], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + const asJson = format === "json"; + + await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + if (flags.noStream) { + const result = await sendSessionMessagePolling(runtime, flags.sessionId, flags.message, { + provider: flags.provider, + }); + renderCollectedEvents(result, asJson); + } else { + const events = await sendSessionMessageStreaming( + runtime, + flags.sessionId, + flags.message, + { + provider: flags.provider, + }, + ); + await streamAndRenderEvents(events, asJson); + } + }), + ); + }, +}); diff --git a/packages/commands/src/commands/agent/state-import.ts b/packages/commands/src/commands/agent/state-import.ts new file mode 100644 index 00000000..8d4fabae --- /dev/null +++ b/packages/commands/src/commands/agent/state-import.ts @@ -0,0 +1,61 @@ +import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; +import { emitBare, emitResult } from "bailian-cli-runtime"; +import { importResource, parseStateAddress } from "@openagentpack/sdk"; +import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; + +const STATE_IMPORT_FLAGS = { + address: { + type: "string", + valueHint: "<provider.type.name>", + description: "Resource state address (required)", + required: true, + }, + remoteId: { + type: "string", + valueHint: "<id>", + description: "Existing remote resource ID to import (required)", + required: true, + }, + resourceVersion: { + type: "number", + valueHint: "<n>", + description: "Resource version (for versioned resources like agents)", + }, + file: { + type: "string", + valueHint: "<path>", + description: "Config file path (default: agents.yaml)", + }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "Import an existing remote resource into agents state", + auth: "none", + usageArgs: + "--address <provider.type.name> --remote-id <id> [--resource-version <n>] [--file <path>]", + flags: STATE_IMPORT_FLAGS, + exampleArgs: ["--address bailian.agent.assistant --remote-id agent-abc123"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + + await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + const parsed = parseStateAddress(flags.address, { requireProvider: true }); + await importResource(runtime, parsed, flags.remoteId, { + resourceVersion: flags.resourceVersion, + }); + }), + ); + + if (format === "json") { + emitResult({ imported: flags.address, remote_id: flags.remoteId }, format); + } else { + emitBare(`Imported ${flags.address} (remote_id: ${flags.remoteId}) into state.`); + } + }, +}); diff --git a/packages/commands/src/commands/agent/state-list.ts b/packages/commands/src/commands/agent/state-list.ts new file mode 100644 index 00000000..68d26ed5 --- /dev/null +++ b/packages/commands/src/commands/agent/state-list.ts @@ -0,0 +1,52 @@ +import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; +import { emitBare, emitResult, formatTable } from "bailian-cli-runtime"; +import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; + +const STATE_LIST_FLAGS = { + file: { + type: "string", + valueHint: "<path>", + description: "Config file path (default: agents.yaml)", + }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "List resources tracked in agents state", + auth: "none", + usageArgs: "[--file <path>]", + flags: STATE_LIST_FLAGS, + exampleArgs: ["", "--file agents.yaml"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + + const resources = await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + return runtime.state.listResources(); + }), + ); + + if (format === "json") { + emitResult({ resources }, format); + return; + } + if (resources.length === 0) { + emitBare("No resources tracked in state."); + return; + } + + const headers = ["TYPE", "NAME", "PROVIDER", "REMOTE ID"]; + const rows = resources.map((resource) => [ + resource.address.type, + resource.address.name, + resource.address.provider, + resource.remote_id ?? "(local)", + ]); + for (const line of formatTable(headers, rows)) emitBare(line); + emitBare(`\nTotal: ${resources.length}`); + }, +}); diff --git a/packages/commands/src/commands/agent/state-rm.ts b/packages/commands/src/commands/agent/state-rm.ts new file mode 100644 index 00000000..44022d14 --- /dev/null +++ b/packages/commands/src/commands/agent/state-rm.ts @@ -0,0 +1,56 @@ +import { + BailianError, + defineCommand, + detectOutputFormat, + ExitCode, + type FlagsDef, +} from "bailian-cli-core"; +import { emitBare, emitResult } from "bailian-cli-runtime"; +import { parseStateAddress } from "@openagentpack/sdk"; +import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; + +const STATE_RM_FLAGS = { + address: { + type: "string", + valueHint: "<provider.type.name>", + description: "Resource state address (required)", + required: true, + }, + file: { + type: "string", + valueHint: "<path>", + description: "Config file path (default: agents.yaml)", + }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "Remove a resource from state without destroying it remotely", + auth: "none", + usageArgs: "--address <provider.type.name> [--file <path>]", + flags: STATE_RM_FLAGS, + exampleArgs: ["--address bailian.agent.assistant"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + + await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + const parsed = parseStateAddress(flags.address, { requireProvider: false }); + const found = runtime.state.findResource(parsed); + if (!found) { + throw new BailianError(`Resource not found: ${flags.address}`, ExitCode.GENERAL); + } + runtime.state.removeResource(found.address); + await runtime.state.save(); + }), + ); + + const message = `Removed ${flags.address} from state (remote resource not deleted).`; + if (format === "json") emitResult({ removed: flags.address }, format); + else emitBare(message); + }, +}); diff --git a/packages/commands/src/commands/agent/state-show.ts b/packages/commands/src/commands/agent/state-show.ts new file mode 100644 index 00000000..5a5f2dd3 --- /dev/null +++ b/packages/commands/src/commands/agent/state-show.ts @@ -0,0 +1,54 @@ +import { + BailianError, + defineCommand, + detectOutputFormat, + ExitCode, + type FlagsDef, +} from "bailian-cli-core"; +import { emitBare, emitResult } from "bailian-cli-runtime"; +import { parseStateAddress } from "@openagentpack/sdk"; +import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; + +const STATE_SHOW_FLAGS = { + address: { + type: "string", + valueHint: "<provider.type.name>", + description: "Resource state address (required)", + required: true, + }, + file: { + type: "string", + valueHint: "<path>", + description: "Config file path (default: agents.yaml)", + }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "Show details of a resource in agents state", + auth: "none", + usageArgs: "--address <provider.type.name> [--file <path>]", + flags: STATE_SHOW_FLAGS, + exampleArgs: ["--address bailian.agent.assistant"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + + const found = await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(file); + const parsed = parseStateAddress(flags.address, { requireProvider: false }); + return runtime.state.findResource(parsed); + }), + ); + + if (!found) { + throw new BailianError(`Resource not found: ${flags.address}`, ExitCode.GENERAL); + } + + if (format === "json") emitResult(found, format); + else emitBare(JSON.stringify(found, null, 2)); + }, +}); diff --git a/packages/commands/src/commands/agent/validate.ts b/packages/commands/src/commands/agent/validate.ts new file mode 100644 index 00000000..195c02b0 --- /dev/null +++ b/packages/commands/src/commands/agent/validate.ts @@ -0,0 +1,54 @@ +import { + BailianError, + defineCommand, + detectOutputFormat, + ExitCode, + type FlagsDef, +} from "bailian-cli-core"; +import { emitBare, emitResult } from "bailian-cli-runtime"; +import { resolveProjectConfig, validateProjectConfig } from "@openagentpack/sdk"; +import { ensureCredentials } from "./_engine/credentials.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; + +const VALIDATE_FLAGS = { + file: { + type: "string", + valueHint: "<path>", + description: "Config file path (default: agents.yaml)", + }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "Validate an agents.yaml configuration (offline)", + auth: "none", + usageArgs: "[--file <path>]", + flags: VALIDATE_FLAGS, + exampleArgs: ["", "--file agents.yaml"], + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + + const diagnostics = await withAgentErrors(async () => { + ensureCredentials(); + const { config } = await resolveProjectConfig(file); + return validateProjectConfig(config); + }); + + const errorCount = diagnostics.filter((diag) => diag.severity === "error").length; + + if (format === "json") { + emitResult({ valid: errorCount === 0, diagnostics }, format); + } else { + for (const diag of diagnostics) { + const where = diag.resource ? ` (${diag.resource.type}.${diag.resource.name})` : ""; + emitBare(`[${diag.severity}] ${diag.message}${where}`); + } + if (errorCount === 0) emitBare("Configuration is valid."); + } + + if (errorCount > 0) { + throw new BailianError(`Validation failed with ${errorCount} error(s).`, ExitCode.GENERAL); + } + }, +}); diff --git a/packages/commands/src/index.ts b/packages/commands/src/index.ts index 2579847f..a3094786 100644 --- a/packages/commands/src/index.ts +++ b/packages/commands/src/index.ts @@ -86,6 +86,22 @@ export { default as tokenPlanListSeats } from "./commands/token-plan/list-seats. export { default as tokenPlanCreateKey } from "./commands/token-plan/create-key.ts"; export { default as tokenPlanAssignSeats } from "./commands/token-plan/assign-seats.ts"; export { default as tokenPlanAddMember } from "./commands/token-plan/add-member.ts"; +export { default as agentInit } from "./commands/agent/init.ts"; +export { default as agentValidate } from "./commands/agent/validate.ts"; +export { default as agentPlan } from "./commands/agent/plan.ts"; +export { default as agentApply } from "./commands/agent/apply.ts"; +export { default as agentDestroy } from "./commands/agent/destroy.ts"; +export { default as agentStateList } from "./commands/agent/state-list.ts"; +export { default as agentStateShow } from "./commands/agent/state-show.ts"; +export { default as agentStateRm } from "./commands/agent/state-rm.ts"; +export { default as agentStateImport } from "./commands/agent/state-import.ts"; +export { default as agentSessionCreate } from "./commands/agent/session-create.ts"; +export { default as agentSessionList } from "./commands/agent/session-list.ts"; +export { default as agentSessionGet } from "./commands/agent/session-get.ts"; +export { default as agentSessionDelete } from "./commands/agent/session-delete.ts"; +export { default as agentSessionRun } from "./commands/agent/session-run.ts"; +export { default as agentSessionSend } from "./commands/agent/session-send.ts"; +export { default as agentSessionEvents } from "./commands/agent/session-events.ts"; export { default as pluginInstall } from "./commands/plugin/install.ts"; export { default as pluginLink } from "./commands/plugin/link.ts"; export { default as pluginList } from "./commands/plugin/list.ts"; diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a4340666..4213c8ae 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -50,7 +50,7 @@ importers: version: 4.23.0 vite-plus: specifier: 'catalog:' - version: 0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.8.3))(yaml@2.8.3) + version: 0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.9.0))(yaml@2.9.0) packages/cli: dependencies: @@ -100,6 +100,9 @@ importers: packages/commands: dependencies: + '@openagentpack/sdk': + specifier: 0.1.0 + version: 0.1.0 bailian-cli-core: specifier: workspace:* version: link:../core @@ -171,7 +174,7 @@ importers: version: 6.0.3 vite-plus: specifier: 0.1.22 - version: 0.1.22(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.8.3))(yaml@2.8.3) + version: 0.1.22(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.9.0))(yaml@2.9.0) packages/kscli: dependencies: @@ -440,6 +443,10 @@ packages: '@emnapi/core': ^1.7.1 '@emnapi/runtime': ^1.7.1 + '@openagentpack/sdk@0.1.0': + resolution: {integrity: sha512-6IsFwOyuLnB/WIW9CGtpaJaRcGylYIs6UPW/Yz1gZveiuTTFdEWOi8LQ52JmOHB10J1lar+TrW2DJBEejxxu0Q==} + engines: {node: '>=22'} + '@oxc-project/runtime@0.129.0': resolution: {integrity: sha512-0+S67blQakgeNqoKGozOUp5rQBrz2ynXZ2QIINXZPiafsD0YL0UogB9hAWc1S7k6VSNwKYC/N7MqT0V6IzpHkQ==} engines: {node: ^20.19.0 || >=22.12.0} @@ -1073,6 +1080,9 @@ packages: resolution: {integrity: sha512-/lzGpEWL/8PfI0BmBOPRwp0c/wFNX1RdUML3jK/RcSBA9T8mZDdQpqYBKtCFTOfQbwPqWEOpjqW+Fnayc0969g==} engines: {node: '>=10'} + core-util-is@1.0.3: + resolution: {integrity: sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==} + detect-libc@2.1.2: resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==} engines: {node: '>=8'} @@ -1115,10 +1125,19 @@ packages: resolution: {integrity: sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA==} engines: {node: '>=18'} + immediate@3.0.6: + resolution: {integrity: sha512-XXOFtyqDjNDAQxVfYxuF7g9Il/IbWmmlQg2MYKOH8ExIT1qg6xc4zyS3HaEEATgs1btfzxq15ciUiY7gjSXRGQ==} + + inherits@2.0.4: + resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==} + is-fullwidth-code-point@3.0.0: resolution: {integrity: sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==} engines: {node: '>=8'} + isarray@1.0.0: + resolution: {integrity: sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==} + jiti@2.6.1: resolution: {integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==} hasBin: true @@ -1126,6 +1145,12 @@ packages: json-schema-traverse@1.0.0: resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==} + jszip@3.10.1: + resolution: {integrity: sha512-xXDvecyTpGLrqFrvkrUSoxxfJI5AH7U8zxxtVclpsUtMCq4JQ290LY8AW5c7Ggnr/Y/oK+bQMbqK2qmtk3pN4g==} + + lie@3.3.0: + resolution: {integrity: sha512-UaiMJzeWRlEujzAuw5LokY1L5ecNQYZKfmyZ9L7wDHb/p5etKaxXhohBcrw0EYby+G/NA52vRSN4N39dxHAIwQ==} + lightningcss-android-arm64@1.32.0: resolution: {integrity: sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==} engines: {node: '>= 12.0.0'} @@ -1231,6 +1256,9 @@ packages: oxlint-tsgolint: optional: true + pako@1.0.11: + resolution: {integrity: sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw==} + pend@1.2.0: resolution: {integrity: sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==} @@ -1253,6 +1281,12 @@ packages: resolution: {integrity: sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==} engines: {node: ^10 || ^12 || >=14} + process-nextick-args@2.0.1: + resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==} + + readable-stream@2.3.8: + resolution: {integrity: sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==} + require-from-string@2.0.2: resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==} engines: {node: '>=0.10.0'} @@ -1262,6 +1296,12 @@ packages: engines: {node: ^20.19.0 || >=22.12.0} hasBin: true + safe-buffer@5.1.2: + resolution: {integrity: sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==} + + setimmediate@1.0.5: + resolution: {integrity: sha512-MATJdZp8sLqDl/68LfQmbP8zKPLQNV6BIZoIgrscFDQ+RsvK/BxeDQOgyxKKoh0y/8h3BqVFnCqQ/gd+reiIXA==} + sirv@3.0.2: resolution: {integrity: sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g==} engines: {node: '>=18'} @@ -1284,6 +1324,9 @@ packages: resolution: {integrity: sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==} engines: {node: '>=18'} + string_decoder@1.1.1: + resolution: {integrity: sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==} + strip-ansi@6.0.1: resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==} engines: {node: '>=8'} @@ -1338,6 +1381,9 @@ packages: resolution: {integrity: sha512-RNHlB4fxZK0IrkhBsxhlbx7s8kFWwr7rzzOqj5nvZugw3ig3RsB7KW3zVlV0eu8POl+rx5d1hmL7rRg0z1owow==} engines: {node: '>=22.19.0'} + util-deprecate@1.0.2: + resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==} + vite-plus@0.1.22: resolution: {integrity: sha512-fCCmEKjI+Hv74PdL/MKcrBkdYPHFNcqD5568KxwN0sa4SGxtcbs55i/577LxKs0w5zIjuLRZZ0zQPu9MO+9itg==} engines: {node: ^20.19.0 || >=22.12.0} @@ -1411,10 +1457,18 @@ packages: engines: {node: '>= 14.6'} hasBin: true + yaml@2.9.0: + resolution: {integrity: sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==} + engines: {node: '>= 14.6'} + hasBin: true + yauzl@3.4.0: resolution: {integrity: sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==} engines: {node: '>=12'} + zod@4.4.3: + resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==} + snapshots: '@clack/core@0.3.5': @@ -1529,6 +1583,12 @@ snapshots: '@tybys/wasm-util': 0.10.1 optional: true + '@openagentpack/sdk@0.1.0': + dependencies: + jszip: 3.10.1 + yaml: 2.9.0 + zod: 4.4.3 + '@oxc-project/runtime@0.129.0': {} '@oxc-project/types@0.127.0': {} @@ -1794,7 +1854,22 @@ snapshots: typescript: 6.0.3 yaml: 2.8.3 - '@voidzero-dev/vite-plus-core@0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(yaml@2.8.3)': + '@voidzero-dev/vite-plus-core@0.1.22(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(yaml@2.9.0)': + dependencies: + '@oxc-project/runtime': 0.129.0 + '@oxc-project/types': 0.129.0 + lightningcss: 1.32.0 + postcss: 8.5.12 + optionalDependencies: + '@types/node': 24.12.2 + esbuild: 0.28.1 + fsevents: 2.3.3 + jiti: 2.6.1 + tsx: 4.23.0 + typescript: 6.0.3 + yaml: 2.9.0 + + '@voidzero-dev/vite-plus-core@0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(yaml@2.9.0)': dependencies: '@oxc-project/runtime': 0.129.0 '@oxc-project/types': 0.129.0 @@ -1807,7 +1882,7 @@ snapshots: jiti: 2.6.1 tsx: 4.23.0 typescript: 6.0.3 - yaml: 2.8.3 + yaml: 2.9.0 '@voidzero-dev/vite-plus-darwin-arm64@0.1.22': optional: true @@ -1867,11 +1942,51 @@ snapshots: - utf-8-validate - yaml - '@voidzero-dev/vite-plus-test@0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.8.3))(yaml@2.8.3)': + '@voidzero-dev/vite-plus-test@0.1.22(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.9.0))(yaml@2.9.0)': + dependencies: + '@standard-schema/spec': 1.1.0 + '@types/chai': 5.2.3 + '@voidzero-dev/vite-plus-core': 0.1.22(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(yaml@2.9.0) + es-module-lexer: 1.7.0 + obug: 2.1.1 + pixelmatch: 7.2.0 + pngjs: 7.0.0 + sirv: 3.0.2 + std-env: 4.1.0 + tinybench: 2.9.0 + tinyexec: 1.1.2 + tinyglobby: 0.2.16 + vite: 8.0.10(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.9.0) + ws: 8.20.0 + optionalDependencies: + '@types/node': 24.12.2 + transitivePeerDependencies: + - '@arethetypeswrong/core' + - '@tsdown/css' + - '@tsdown/exe' + - '@vitejs/devtools' + - bufferutil + - esbuild + - jiti + - less + - publint + - sass + - sass-embedded + - stylus + - sugarss + - terser + - tsx + - typescript + - unplugin-unused + - unrun + - utf-8-validate + - yaml + + '@voidzero-dev/vite-plus-test@0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.9.0))(yaml@2.9.0)': dependencies: '@standard-schema/spec': 1.1.0 '@types/chai': 5.2.3 - '@voidzero-dev/vite-plus-core': 0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(yaml@2.8.3) + '@voidzero-dev/vite-plus-core': 0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(yaml@2.9.0) es-module-lexer: 1.7.0 obug: 2.1.1 pixelmatch: 7.2.0 @@ -1881,7 +1996,7 @@ snapshots: tinybench: 2.9.0 tinyexec: 1.1.2 tinyglobby: 0.2.16 - vite: 8.0.10(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.8.3) + vite: 8.0.10(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.9.0) ws: 8.20.0 optionalDependencies: '@types/node': 25.6.0 @@ -1949,6 +2064,8 @@ snapshots: cli-boxes@3.0.0: {} + core-util-is@1.0.3: {} + detect-libc@2.1.2: {} emoji-regex@10.6.0: {} @@ -1999,13 +2116,30 @@ snapshots: get-east-asian-width@1.6.0: {} + immediate@3.0.6: {} + + inherits@2.0.4: {} + is-fullwidth-code-point@3.0.0: {} + isarray@1.0.0: {} + jiti@2.6.1: optional: true json-schema-traverse@1.0.0: {} + jszip@3.10.1: + dependencies: + lie: 3.3.0 + pako: 1.0.11 + readable-stream: 2.3.8 + setimmediate: 1.0.5 + + lie@3.3.0: + dependencies: + immediate: 3.0.6 + lightningcss-android-arm64@1.32.0: optional: true @@ -2117,6 +2251,8 @@ snapshots: '@oxlint/binding-win32-x64-msvc': 1.63.0 oxlint-tsgolint: 0.22.1 + pako@1.0.11: {} + pend@1.2.0: {} picocolors@1.1.1: {} @@ -2135,6 +2271,18 @@ snapshots: picocolors: 1.1.1 source-map-js: 1.2.1 + process-nextick-args@2.0.1: {} + + readable-stream@2.3.8: + dependencies: + core-util-is: 1.0.3 + inherits: 2.0.4 + isarray: 1.0.0 + process-nextick-args: 2.0.1 + safe-buffer: 5.1.2 + string_decoder: 1.1.1 + util-deprecate: 1.0.2 + require-from-string@2.0.2: {} rolldown@1.0.0-rc.17: @@ -2158,6 +2306,10 @@ snapshots: '@rolldown/binding-win32-arm64-msvc': 1.0.0-rc.17 '@rolldown/binding-win32-x64-msvc': 1.0.0-rc.17 + safe-buffer@5.1.2: {} + + setimmediate@1.0.5: {} + sirv@3.0.2: dependencies: '@polka/url': 1.0.0-next.29 @@ -2182,6 +2334,10 @@ snapshots: get-east-asian-width: 1.6.0 strip-ansi: 7.2.0 + string_decoder@1.1.1: + dependencies: + safe-buffer: 5.1.2 + strip-ansi@6.0.1: dependencies: ansi-regex: 5.0.1 @@ -2222,6 +2378,8 @@ snapshots: undici@8.4.1: {} + util-deprecate@1.0.2: {} + vite-plus@0.1.22(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.8.3))(yaml@2.8.3): dependencies: '@oxc-project/types': 0.129.0 @@ -2271,12 +2429,61 @@ snapshots: - vite - yaml - vite-plus@0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.8.3))(yaml@2.8.3): + vite-plus@0.1.22(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.9.0))(yaml@2.9.0): dependencies: '@oxc-project/types': 0.129.0 '@oxlint/plugins': 1.61.0 - '@voidzero-dev/vite-plus-core': 0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(yaml@2.8.3) - '@voidzero-dev/vite-plus-test': 0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.8.3))(yaml@2.8.3) + '@voidzero-dev/vite-plus-core': 0.1.22(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(yaml@2.9.0) + '@voidzero-dev/vite-plus-test': 0.1.22(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.9.0))(yaml@2.9.0) + oxfmt: 0.48.0 + oxlint: 1.63.0(oxlint-tsgolint@0.22.1) + oxlint-tsgolint: 0.22.1 + optionalDependencies: + '@voidzero-dev/vite-plus-darwin-arm64': 0.1.22 + '@voidzero-dev/vite-plus-darwin-x64': 0.1.22 + '@voidzero-dev/vite-plus-linux-arm64-gnu': 0.1.22 + '@voidzero-dev/vite-plus-linux-arm64-musl': 0.1.22 + '@voidzero-dev/vite-plus-linux-x64-gnu': 0.1.22 + '@voidzero-dev/vite-plus-linux-x64-musl': 0.1.22 + '@voidzero-dev/vite-plus-win32-arm64-msvc': 0.1.22 + '@voidzero-dev/vite-plus-win32-x64-msvc': 0.1.22 + transitivePeerDependencies: + - '@arethetypeswrong/core' + - '@edge-runtime/vm' + - '@opentelemetry/api' + - '@tsdown/css' + - '@tsdown/exe' + - '@types/node' + - '@vitejs/devtools' + - '@vitest/coverage-istanbul' + - '@vitest/coverage-v8' + - '@vitest/ui' + - bufferutil + - esbuild + - happy-dom + - jiti + - jsdom + - less + - publint + - sass + - sass-embedded + - stylus + - sugarss + - terser + - tsx + - typescript + - unplugin-unused + - unrun + - utf-8-validate + - vite + - yaml + + vite-plus@0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.9.0))(yaml@2.9.0): + dependencies: + '@oxc-project/types': 0.129.0 + '@oxlint/plugins': 1.61.0 + '@voidzero-dev/vite-plus-core': 0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(yaml@2.9.0) + '@voidzero-dev/vite-plus-test': 0.1.22(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(typescript@6.0.3)(vite@8.0.10(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.9.0))(yaml@2.9.0) oxfmt: 0.48.0 oxlint: 1.63.0(oxlint-tsgolint@0.22.1) oxlint-tsgolint: 0.22.1 @@ -2335,7 +2542,22 @@ snapshots: tsx: 4.23.0 yaml: 2.8.3 - vite@8.0.10(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.8.3): + vite@8.0.10(@types/node@24.12.2)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.9.0): + dependencies: + lightningcss: 1.32.0 + picomatch: 4.0.4 + postcss: 8.5.12 + rolldown: 1.0.0-rc.17 + tinyglobby: 0.2.16 + optionalDependencies: + '@types/node': 24.12.2 + esbuild: 0.28.1 + fsevents: 2.3.3 + jiti: 2.6.1 + tsx: 4.23.0 + yaml: 2.9.0 + + vite@8.0.10(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.6.1)(tsx@4.23.0)(yaml@2.9.0): dependencies: lightningcss: 1.32.0 picomatch: 4.0.4 @@ -2348,7 +2570,7 @@ snapshots: fsevents: 2.3.3 jiti: 2.6.1 tsx: 4.23.0 - yaml: 2.8.3 + yaml: 2.9.0 widest-line@5.0.0: dependencies: @@ -2364,6 +2586,10 @@ snapshots: yaml@2.8.3: {} + yaml@2.9.0: {} + yauzl@3.4.0: dependencies: pend: 1.2.0 + + zod@4.4.3: {} diff --git a/skills/bailian-cli/reference/agent.md b/skills/bailian-cli/reference/agent.md new file mode 100644 index 00000000..c7abb325 --- /dev/null +++ b/skills/bailian-cli/reference/agent.md @@ -0,0 +1,451 @@ +# `bl agent` commands + +> Auto-generated from `packages/cli/src/commands.ts`. Do not edit by hand. +> Regenerate: `pnpm --filter bailian-cli run generate:reference`. + +Index: [index.md](index.md) + +## Commands in this group + +| Command | Description | +| ------------------------- | ------------------------------------------------------------- | +| `bl agent apply` | Apply planned changes to create/update/delete agent resources | +| `bl agent destroy` | Destroy all managed agent resources tracked in state | +| `bl agent init` | Create a new agents.yaml template | +| `bl agent plan` | Show what changes would be applied to agent infrastructure | +| `bl agent session create` | Create a new session for an agent | +| `bl agent session delete` | Delete a session | +| `bl agent session events` | List event history for a session | +| `bl agent session get` | Get details of a session | +| `bl agent session list` | List sessions from the provider | +| `bl agent session run` | Create a session, send a message, and stream the response | +| `bl agent session send` | Send a message to an existing session and stream the response | +| `bl agent state import` | Import an existing remote resource into agents state | +| `bl agent state list` | List resources tracked in agents state | +| `bl agent state rm` | Remove a resource from state without destroying it remotely | +| `bl agent state show` | Show details of a resource in agents state | +| `bl agent validate` | Validate an agents.yaml configuration (offline) | + +## Command details + +### `bl agent apply` + +| Field | Value | +| --------------- | -------------------------------------------------------------------------------- | +| **Name** | `agent apply` | +| **Description** | Apply planned changes to create/update/delete agent resources | +| **Usage** | `bl agent apply [--file <path>] [--provider <name>] [--yes] [--concurrency <n>]` | + +#### Flags + +| Flag | Type | Required | Description | +| ------------------- | ------ | -------- | -------------------------------------------------------------------- | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--provider <name>` | string | no | Target provider (default: all configured) | +| `--yes` | switch | no | Confirm and apply without an interactive prompt (required to mutate) | +| `--no-refresh` | switch | no | Skip refreshing state from remote before planning | +| `--concurrency <n>` | number | no | Max independent resources to apply in parallel (default 6, max 10) | + +#### Examples + +```bash +bl agent apply --yes +``` + +```bash +bl agent apply --provider bailian --yes +``` + +### `bl agent destroy` + +| Field | Value | +| --------------- | ------------------------------------------------------ | +| **Name** | `agent destroy` | +| **Description** | Destroy all managed agent resources tracked in state | +| **Usage** | `bl agent destroy [--file <path>] [--yes] [--cascade]` | + +#### Flags + +| Flag | Type | Required | Description | +| --------------- | ------ | -------- | -------------------------------------------------------------------------- | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--yes` | switch | no | Confirm and destroy without an interactive prompt (required) | +| `--cascade` | switch | no | Auto-delete dependent resources (e.g. sessions referencing an environment) | + +#### Examples + +```bash +bl agent destroy --yes +``` + +```bash +bl agent destroy --yes --cascade +``` + +### `bl agent init` + +| Field | Value | +| --------------- | ----------------------------------------------------------------------------------- | +| **Name** | `agent init` | +| **Description** | Create a new agents.yaml template | +| **Usage** | `bl agent init [--provider <name>] [--agent-name <name>] [--file <path>] [--force]` | + +#### Flags + +| Flag | Type | Required | Description | +| ----------------------------------------------- | ------ | -------- | ------------------------------------------------------------- | +| `--provider <bailian\|claude\|qoder\|ark\|all>` | string | no | Provider: bailian, claude, qoder, ark, all (default: bailian) | +| `--agent-name <name>` | string | no | Name of the first agent (default: assistant) | +| `--file <path>` | string | no | Output config path (default: agents.yaml) | +| `--force` | switch | no | Overwrite an existing config file | + +#### Examples + +```bash +bl agent init +``` + +```bash +bl agent init --provider bailian --agent-name assistant +``` + +```bash +bl agent init --provider all +``` + +### `bl agent plan` + +| Field | Value | +| --------------- | ----------------------------------------------------------------------------------- | +| **Name** | `agent plan` | +| **Description** | Show what changes would be applied to agent infrastructure | +| **Usage** | `bl agent plan [--file <path>] [--provider <name>] [--no-refresh] [--refresh-only]` | + +#### Flags + +| Flag | Type | Required | Description | +| ------------------- | ------ | -------- | -------------------------------------------------------------- | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--provider <name>` | string | no | Target provider (default: all configured) | +| `--no-refresh` | switch | no | Skip refreshing state from remote before planning | +| `--refresh-only` | switch | no | Refresh state and show drift without planning remote mutations | + +#### Examples + +```bash +bl agent plan +``` + +```bash +bl agent plan --provider bailian +``` + +```bash +bl agent plan --no-refresh +``` + +### `bl agent session create` + +| Field | Value | +| --------------- | --------------------------------------------------------------------------------------------------- | +| **Name** | `agent session create` | +| **Description** | Create a new session for an agent | +| **Usage** | `bl agent session create [--agent <name>] [--environment <name>] [--title <title>] [--file <path>]` | + +#### Flags + +| Flag | Type | Required | Description | +| ------------------------- | ------ | -------- | ------------------------------------------------------------ | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--agent <name>` | string | no | Agent name (auto-detected when only one agent is configured) | +| `--environment <name>` | string | no | Override agent's declared environment | +| `--vault <name>` | string | no | Override agent's declared vault | +| `--memory-stores <names>` | string | no | Override agent's memory stores (comma-separated) | +| `--title <title>` | string | no | Session title | +| `--provider <name>` | string | no | Target provider (multi-provider agents) | + +#### Examples + +```bash +bl agent session create +``` + +```bash +bl agent session create --agent assistant +``` + +```bash +bl agent session create --agent assistant --title 'debug run' +``` + +### `bl agent session delete` + +| Field | Value | +| --------------- | ------------------------------------------------------------------------------- | +| **Name** | `agent session delete` | +| **Description** | Delete a session | +| **Usage** | `bl agent session delete --session-id <id> [--provider <name>] [--file <path>]` | + +#### Flags + +| Flag | Type | Required | Description | +| ------------------- | ------ | -------- | --------------------------------------- | +| `--session-id <id>` | string | yes | Session ID (required) | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--provider <name>` | string | no | Target provider | + +#### Examples + +```bash +bl agent session delete --session-id sess_abc123 +``` + +### `bl agent session events` + +| Field | Value | +| --------------- | --------------------------------------------------------------------------------- | +| **Name** | `agent session events` | +| **Description** | List event history for a session | +| **Usage** | `bl agent session events --session-id <id> [--limit <n>] [--all] [--file <path>]` | + +#### Flags + +| Flag | Type | Required | Description | +| ------------------- | ------ | -------- | --------------------------------------- | +| `--session-id <id>` | string | yes | Session ID (required) | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--provider <name>` | string | no | Target provider | +| `--limit <n>` | number | no | Maximum number of events to fetch | +| `--all` | switch | no | Fetch all pages by following the cursor | + +#### Examples + +```bash +bl agent session events --session-id sess_abc123 +``` + +```bash +bl agent session events --session-id sess_abc123 --all +``` + +### `bl agent session get` + +| Field | Value | +| --------------- | ---------------------------------------------------------------------------- | +| **Name** | `agent session get` | +| **Description** | Get details of a session | +| **Usage** | `bl agent session get --session-id <id> [--provider <name>] [--file <path>]` | + +#### Flags + +| Flag | Type | Required | Description | +| ------------------- | ------ | -------- | --------------------------------------- | +| `--session-id <id>` | string | yes | Session ID (required) | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--provider <name>` | string | no | Target provider | + +#### Examples + +```bash +bl agent session get --session-id sess_abc123 +``` + +### `bl agent session list` + +| Field | Value | +| --------------- | ------------------------------------------------------------------------------------ | +| **Name** | `agent session list` | +| **Description** | List sessions from the provider | +| **Usage** | `bl agent session list [--agent <name>] [--all] [--provider <name>] [--file <path>]` | + +#### Flags + +| Flag | Type | Required | Description | +| ------------------- | ------ | -------- | --------------------------------------- | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--agent <name>` | string | no | Filter by agent name | +| `--all` | switch | no | Fetch all pages by following the cursor | +| `--provider <name>` | string | no | Target provider | + +#### Examples + +```bash +bl agent session list +``` + +```bash +bl agent session list --agent assistant +``` + +```bash +bl agent session list --all +``` + +### `bl agent session run` + +| Field | Value | +| --------------- | ------------------------------------------------------------------------------------- | +| **Name** | `agent session run` | +| **Description** | Create a session, send a message, and stream the response | +| **Usage** | `bl agent session run --prompt <text> [--agent <name>] [--no-stream] [--file <path>]` | + +#### Flags + +| Flag | Type | Required | Description | +| ------------------------- | ------ | -------- | ------------------------------------------------------------ | +| `--prompt <text>` | string | yes | Prompt to send (required) | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--agent <name>` | string | no | Agent name (auto-detected when only one agent is configured) | +| `--environment <name>` | string | no | Override agent's declared environment | +| `--vault <name>` | string | no | Override agent's declared vault | +| `--memory-stores <names>` | string | no | Override agent's memory stores (comma-separated) | +| `--title <title>` | string | no | Session title | +| `--provider <name>` | string | no | Target provider | +| `--no-stream` | switch | no | Use polling instead of SSE streaming | + +#### Examples + +```bash +bl agent session run --prompt "hello" +``` + +```bash +bl agent session run --agent assistant --prompt "summarize this repo" +``` + +### `bl agent session send` + +| Field | Value | +| --------------- | ---------------------------------------------------------------------------------------- | +| **Name** | `agent session send` | +| **Description** | Send a message to an existing session and stream the response | +| **Usage** | `bl agent session send --session-id <id> --message <text> [--no-stream] [--file <path>]` | + +#### Flags + +| Flag | Type | Required | Description | +| ------------------- | ------ | -------- | --------------------------------------- | +| `--session-id <id>` | string | yes | Session ID (required) | +| `--message <text>` | string | yes | Message to send (required) | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--provider <name>` | string | no | Target provider | +| `--no-stream` | switch | no | Use polling instead of SSE streaming | + +#### Examples + +```bash +bl agent session send --session-id sess_abc123 --message "continue" +``` + +### `bl agent state import` + +| Field | Value | +| --------------- | ---------------------------------------------------------------------------------------------------------------- | +| **Name** | `agent state import` | +| **Description** | Import an existing remote resource into agents state | +| **Usage** | `bl agent state import --address <provider.type.name> --remote-id <id> [--resource-version <n>] [--file <path>]` | + +#### Flags + +| Flag | Type | Required | Description | +| -------------------------------- | ------ | -------- | ------------------------------------------------------ | +| `--address <provider.type.name>` | string | yes | Resource state address (required) | +| `--remote-id <id>` | string | yes | Existing remote resource ID to import (required) | +| `--resource-version <n>` | number | no | Resource version (for versioned resources like agents) | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | + +#### Examples + +```bash +bl agent state import --address bailian.agent.assistant --remote-id agent-abc123 +``` + +### `bl agent state list` + +| Field | Value | +| --------------- | -------------------------------------- | +| **Name** | `agent state list` | +| **Description** | List resources tracked in agents state | +| **Usage** | `bl agent state list [--file <path>]` | + +#### Flags + +| Flag | Type | Required | Description | +| --------------- | ------ | -------- | --------------------------------------- | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | + +#### Examples + +```bash +bl agent state list +``` + +```bash +bl agent state list --file agents.yaml +``` + +### `bl agent state rm` + +| Field | Value | +| --------------- | ------------------------------------------------------------------ | +| **Name** | `agent state rm` | +| **Description** | Remove a resource from state without destroying it remotely | +| **Usage** | `bl agent state rm --address <provider.type.name> [--file <path>]` | + +#### Flags + +| Flag | Type | Required | Description | +| -------------------------------- | ------ | -------- | --------------------------------------- | +| `--address <provider.type.name>` | string | yes | Resource state address (required) | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | + +#### Examples + +```bash +bl agent state rm --address bailian.agent.assistant +``` + +### `bl agent state show` + +| Field | Value | +| --------------- | -------------------------------------------------------------------- | +| **Name** | `agent state show` | +| **Description** | Show details of a resource in agents state | +| **Usage** | `bl agent state show --address <provider.type.name> [--file <path>]` | + +#### Flags + +| Flag | Type | Required | Description | +| -------------------------------- | ------ | -------- | --------------------------------------- | +| `--address <provider.type.name>` | string | yes | Resource state address (required) | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | + +#### Examples + +```bash +bl agent state show --address bailian.agent.assistant +``` + +### `bl agent validate` + +| Field | Value | +| --------------- | ----------------------------------------------- | +| **Name** | `agent validate` | +| **Description** | Validate an agents.yaml configuration (offline) | +| **Usage** | `bl agent validate [--file <path>]` | + +#### Flags + +| Flag | Type | Required | Description | +| --------------- | ------ | -------- | --------------------------------------- | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | + +#### Examples + +```bash +bl agent validate +``` + +```bash +bl agent validate --file agents.yaml +``` diff --git a/skills/bailian-cli/reference/index.md b/skills/bailian-cli/reference/index.md index 6a19b713..f6b3a022 100644 --- a/skills/bailian-cli/reference/index.md +++ b/skills/bailian-cli/reference/index.md @@ -11,6 +11,22 @@ Use this index for the full quick index and global flags. | Command | Description | Detail | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | | `bl advisor recommend` | Recommend the best models for your use case (intent analysis → candidate recall → LLM ranking) | [advisor.md](advisor.md) | +| `bl agent apply` | Apply planned changes to create/update/delete agent resources | [agent.md](agent.md) | +| `bl agent destroy` | Destroy all managed agent resources tracked in state | [agent.md](agent.md) | +| `bl agent init` | Create a new agents.yaml template | [agent.md](agent.md) | +| `bl agent plan` | Show what changes would be applied to agent infrastructure | [agent.md](agent.md) | +| `bl agent session create` | Create a new session for an agent | [agent.md](agent.md) | +| `bl agent session delete` | Delete a session | [agent.md](agent.md) | +| `bl agent session events` | List event history for a session | [agent.md](agent.md) | +| `bl agent session get` | Get details of a session | [agent.md](agent.md) | +| `bl agent session list` | List sessions from the provider | [agent.md](agent.md) | +| `bl agent session run` | Create a session, send a message, and stream the response | [agent.md](agent.md) | +| `bl agent session send` | Send a message to an existing session and stream the response | [agent.md](agent.md) | +| `bl agent state import` | Import an existing remote resource into agents state | [agent.md](agent.md) | +| `bl agent state list` | List resources tracked in agents state | [agent.md](agent.md) | +| `bl agent state rm` | Remove a resource from state without destroying it remotely | [agent.md](agent.md) | +| `bl agent state show` | Show details of a resource in agents state | [agent.md](agent.md) | +| `bl agent validate` | Validate an agents.yaml configuration (offline) | [agent.md](agent.md) | | `bl app call` | Call a Bailian application (agent or workflow) | [app.md](app.md) | | `bl app list` | List Bailian applications | [app.md](app.md) | | `bl auth login` | Authenticate with API key, console browser login, or OpenAPI AK/SK (credentials can coexist) | [auth.md](auth.md) | @@ -96,35 +112,36 @@ Use this index for the full quick index and global flags. ## By group -| Group | Commands | Reference | -| ------------ | ---------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | -| `advisor` | `recommend` | [advisor.md](advisor.md) | -| `app` | `call`, `list` | [app.md](app.md) | -| `auth` | `login`, `logout`, `status` | [auth.md](auth.md) | -| `config` | `set`, `show` | [config.md](config.md) | -| `console` | `call` | [console.md](console.md) | -| `dataset` | `delete`, `get`, `list`, `upload`, `validate` | [dataset.md](dataset.md) | -| `deploy` | `audio create`, `delete`, `get`, `image create`, `list`, `models`, `scale`, `text create`, `update` | [deploy.md](deploy.md) | -| `file` | `upload` | [file.md](file.md) | -| `finetune` | `audio create`, `cancel`, `capability`, `checkpoints`, `delete`, `export`, `get`, `image create`, `list`, `logs`, `text create`, `watch` | [finetune.md](finetune.md) | -| `image` | `edit`, `generate` | [image.md](image.md) | -| `knowledge` | `chat`, `retrieve`, `search` | [knowledge.md](knowledge.md) | -| `mcp` | `call`, `list`, `tools` | [mcp.md](mcp.md) | -| `memory` | `add`, `delete`, `list`, `profile create`, `profile get`, `search`, `update` | [memory.md](memory.md) | -| `model` | `list` | [model.md](model.md) | -| `omni` | `(root)` | [omni.md](omni.md) | -| `pipeline` | `run`, `validate` | [pipeline.md](pipeline.md) | -| `plugin` | `install`, `link`, `list`, `remove` | [plugin.md](plugin.md) | -| `quota` | `check`, `history`, `list`, `request` | [quota.md](quota.md) | -| `search` | `web` | [search.md](search.md) | -| `speech` | `recognize`, `synthesize` | [speech.md](speech.md) | -| `text` | `chat` | [text.md](text.md) | -| `token-plan` | `add-member`, `assign-seats`, `create-key`, `list-seats` | [token-plan.md](token-plan.md) | -| `update` | `(root)` | [update.md](update.md) | -| `usage` | `free`, `freetier`, `stats`, `summary` | [usage.md](usage.md) | -| `video` | `download`, `edit`, `generate`, `ref`, `task get` | [video.md](video.md) | -| `vision` | `describe` | [vision.md](vision.md) | -| `workspace` | `list` | [workspace.md](workspace.md) | +| Group | Commands | Reference | +| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | +| `advisor` | `recommend` | [advisor.md](advisor.md) | +| `agent` | `apply`, `destroy`, `init`, `plan`, `session create`, `session delete`, `session events`, `session get`, `session list`, `session run`, `session send`, `state import`, `state list`, `state rm`, `state show`, `validate` | [agent.md](agent.md) | +| `app` | `call`, `list` | [app.md](app.md) | +| `auth` | `login`, `logout`, `status` | [auth.md](auth.md) | +| `config` | `set`, `show` | [config.md](config.md) | +| `console` | `call` | [console.md](console.md) | +| `dataset` | `delete`, `get`, `list`, `upload`, `validate` | [dataset.md](dataset.md) | +| `deploy` | `audio create`, `delete`, `get`, `image create`, `list`, `models`, `scale`, `text create`, `update` | [deploy.md](deploy.md) | +| `file` | `upload` | [file.md](file.md) | +| `finetune` | `audio create`, `cancel`, `capability`, `checkpoints`, `delete`, `export`, `get`, `image create`, `list`, `logs`, `text create`, `watch` | [finetune.md](finetune.md) | +| `image` | `edit`, `generate` | [image.md](image.md) | +| `knowledge` | `chat`, `retrieve`, `search` | [knowledge.md](knowledge.md) | +| `mcp` | `call`, `list`, `tools` | [mcp.md](mcp.md) | +| `memory` | `add`, `delete`, `list`, `profile create`, `profile get`, `search`, `update` | [memory.md](memory.md) | +| `model` | `list` | [model.md](model.md) | +| `omni` | `(root)` | [omni.md](omni.md) | +| `pipeline` | `run`, `validate` | [pipeline.md](pipeline.md) | +| `plugin` | `install`, `link`, `list`, `remove` | [plugin.md](plugin.md) | +| `quota` | `check`, `history`, `list`, `request` | [quota.md](quota.md) | +| `search` | `web` | [search.md](search.md) | +| `speech` | `recognize`, `synthesize` | [speech.md](speech.md) | +| `text` | `chat` | [text.md](text.md) | +| `token-plan` | `add-member`, `assign-seats`, `create-key`, `list-seats` | [token-plan.md](token-plan.md) | +| `update` | `(root)` | [update.md](update.md) | +| `usage` | `free`, `freetier`, `stats`, `summary` | [usage.md](usage.md) | +| `video` | `download`, `edit`, `generate`, `ref`, `task get` | [video.md](video.md) | +| `vision` | `describe` | [vision.md](vision.md) | +| `workspace` | `list` | [workspace.md](workspace.md) | ## Global flags From d6bd38a46a685dd185d76326d34dbab99699b1eb Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Wed, 22 Jul 2026 13:40:28 +0800 Subject: [PATCH 02/21] =?UTF-8?q?feat(agent):=20agent=E7=9B=B8=E5=85=B3cli?= =?UTF-8?q?=E5=91=BD=E4=BB=A4=E7=9A=84client=E5=B1=82=E5=8A=9F=E8=83=BD?= =?UTF-8?q?=EF=BC=8C=E5=AF=B9=E9=BD=90cli=20client=E7=9A=84=E5=9F=BA?= =?UTF-8?q?=E7=A1=80=E8=83=BD=E5=8A=9B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/agents/auth-change.md | 4 + packages/cli/.gitignore | 5 +- packages/cli/agents.yaml | 26 +++++ .../commands/agent/_engine/config-loader.ts | 13 ++- .../src/commands/agent/_engine/credentials.ts | 47 ++++++++- .../src/commands/agent/_engine/errors.ts | 44 ++++++++- .../src/commands/agent/_engine/transport.ts | 29 ++++++ packages/commands/src/commands/agent/apply.ts | 9 +- .../commands/src/commands/agent/destroy.ts | 5 +- packages/commands/src/commands/agent/init.ts | 7 +- packages/commands/src/commands/agent/plan.ts | 9 +- .../src/commands/agent/session-create.ts | 11 ++- .../src/commands/agent/session-delete.ts | 11 ++- .../src/commands/agent/session-events.ts | 28 ++++-- .../src/commands/agent/session-get.ts | 11 ++- .../src/commands/agent/session-list.ts | 28 ++++-- .../src/commands/agent/session-run.ts | 22 ++++- .../src/commands/agent/session-send.ts | 16 +++- .../src/commands/agent/state-import.ts | 9 +- .../commands/src/commands/agent/state-list.ts | 5 +- .../commands/src/commands/agent/state-rm.ts | 9 +- .../commands/src/commands/agent/state-show.ts | 9 +- .../commands/src/commands/agent/validate.ts | 3 +- packages/commands/tests/agent-errors.test.ts | 88 +++++++++++++++++ .../commands/tests/credentials-bridge.test.ts | 95 +++++++++++++++++++ packages/core/src/client/index.ts | 3 +- .../core/src/client/instrumented-fetch.ts | 76 +++++++++++++++ .../core/tests/instrumented-fetch.test.ts | 84 ++++++++++++++++ skills/bailian-cli/reference/agent.md | 75 +++++++++++++++ 29 files changed, 723 insertions(+), 58 deletions(-) create mode 100644 packages/cli/agents.yaml create mode 100644 packages/commands/src/commands/agent/_engine/transport.ts create mode 100644 packages/commands/tests/agent-errors.test.ts create mode 100644 packages/commands/tests/credentials-bridge.test.ts create mode 100644 packages/core/src/client/instrumented-fetch.ts create mode 100644 packages/core/tests/instrumented-fetch.test.ts diff --git a/docs/agents/auth-change.md b/docs/agents/auth-change.md index fde61017..ccc1aa8e 100644 --- a/docs/agents/auth-change.md +++ b/docs/agents/auth-change.md @@ -50,6 +50,10 @@ defineCommand({ auth }) → runtime/authStage → ctx.client → command.run(ctx 命令不要直接解析 token、env 或 config。业务请求统一走 `ctx.client`;登录/配置命令通过 `ctx.authStore` / `ctx.configStore` 的窄接口操作落盘。 +### 例外:agent 命令的 SDK 凭证桥接 + +`bl agent *` 命令声明 `auth: "none"`,凭证由 `@openagentpack/sdk` 自主从 env 解析(agents.yaml 的 `${DASHSCOPE_API_KEY}` / `${BAILIAN_WORKSPACE_ID}` 插值)。为让 bl 登录态复用,`packages/commands/src/commands/agent/_engine/credentials.ts` 的 `bridgeBailianCredentials()` 会**直接 `readConfigFile()`**,把 config 的 `api_key` / `workspace_id` 作为最低优先级兜底填入对应 env,仅填空值,不覆盖已有。这是唯一允许命令层直接读 config 的场景(SDK 只认 env,不走 `ctx.client`);优先级链:`~/.agents/config.json` > shell env > `.env` > `~/.bailian/config.json`。 + ## 必查清单 ### A. core 层(类型 + 解析) diff --git a/packages/cli/.gitignore b/packages/cli/.gitignore index 3e9713e3..fccd164c 100644 --- a/packages/cli/.gitignore +++ b/packages/cli/.gitignore @@ -2,4 +2,7 @@ node_modules dist *.log .DS_Store -outputs/ \ No newline at end of file +outputs/ +# agents +agents.state.json +.env diff --git a/packages/cli/agents.yaml b/packages/cli/agents.yaml new file mode 100644 index 00000000..e86f410b --- /dev/null +++ b/packages/cli/agents.yaml @@ -0,0 +1,26 @@ +version: "1" + +providers: + bailian: + api_key: ${DASHSCOPE_API_KEY} + workspace_id: ${BAILIAN_WORKSPACE_ID} + +defaults: + provider: bailian + +environments: + dev: + config: + type: cloud + networking: + type: unrestricted + +agents: + assistant: + description: "General-purpose assistant" + model: qwen3.7-max + instructions: | + You are a helpful assistant. + environment: dev + tools: + builtin: [bash, read, glob, grep] diff --git a/packages/commands/src/commands/agent/_engine/config-loader.ts b/packages/commands/src/commands/agent/_engine/config-loader.ts index 0e754948..433549d9 100644 --- a/packages/commands/src/commands/agent/_engine/config-loader.ts +++ b/packages/commands/src/commands/agent/_engine/config-loader.ts @@ -6,16 +6,27 @@ import { } from "@openagentpack/sdk"; import { ensureCredentials } from "./credentials.ts"; import { loadFileState } from "./file-state-manager.ts"; +import { type HostContext, installSdkTransport } from "./transport.ts"; + +export { CREDENTIALS_NOTE } from "./credentials.ts"; /** * Build a full ProjectRuntimeContext from a config file path — the standard * entry point for agent commands that need the SDK engine. Mirrors OpenAgentPack * CLI's buildCliRuntime: resolve config → load local state → assemble runtime. + * Takes the host context first so every SDK-engine command wires the + * instrumented transport (UA / tracking headers / verbose) by construction. */ export async function buildAgentRuntime( + host: HostContext, filePath: string, - options: { resolveEnv?: boolean; projectName?: string; statePath?: string } = {}, + options: { + resolveEnv?: boolean; + projectName?: string; + statePath?: string; + } = {}, ): Promise<ProjectRuntimeContext & { configPath: string }> { + installSdkTransport(host); ensureCredentials(); const { config, configPath, projectName } = await resolveProjectConfig(filePath, options); const state = await loadFileState(configPath, options.statePath, projectName); diff --git a/packages/commands/src/commands/agent/_engine/credentials.ts b/packages/commands/src/commands/agent/_engine/credentials.ts index 875d4331..1c1cc63e 100644 --- a/packages/commands/src/commands/agent/_engine/credentials.ts +++ b/packages/commands/src/commands/agent/_engine/credentials.ts @@ -1,18 +1,59 @@ import { bootstrapRuntimeCredentialsSync } from "@openagentpack/sdk"; +import { readConfigFile } from "bailian-cli-core"; let bootstrapped = false; +/** + * Shared `--help` note documenting where agent commands get provider + * credentials. Mirrors the credential-source hint bl's native commands surface + * (knowledge / usage / token-plan), adapted for the SDK's env-based resolution + * and the {@link bridgeBailianCredentials} fallback. Attach to every command + * that loads agents.yaml. `bl` prefix is safe: agent commands ship on `bl` only. + */ +export const CREDENTIALS_NOTE = [ + "Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}).", + "For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`.", +]; + +/** + * Bridge bl's own login state into the env vars the OpenAgentPack SDK reads for + * the bailian provider. bl persists `api_key` / `workspace_id` in + * `~/.bailian/config.json` (via `bl auth login` / `bl config set`); mirror them + * onto `DASHSCOPE_API_KEY` / `BAILIAN_WORKSPACE_ID` so users don't have to + * re-declare the same credentials for `bl agent *`. + * + * Lowest priority: only fills a var that is still unset, so anything already in + * the environment (shell export, `.env`, or `~/.agents/config.json` — which the + * SDK bootstrap has already applied) wins. Missing values are left alone; the + * SDK surfaces its own error when interpolation can't resolve, and non-bailian + * providers (claude/qoder/ark) don't need DashScope credentials at all. + */ +export function bridgeBailianCredentials(): void { + const file = readConfigFile(); + if (!process.env.DASHSCOPE_API_KEY?.trim() && file.api_key) { + process.env.DASHSCOPE_API_KEY = file.api_key; + } + if (!process.env.BAILIAN_WORKSPACE_ID?.trim() && file.workspace_id) { + process.env.BAILIAN_WORKSPACE_ID = file.workspace_id; + } +} + /** * Lazily load `.env` and `~/.agents/config.json` into `process.env` so the * OpenAgentPack SDK can resolve provider credentials (e.g. DASHSCOPE_API_KEY, - * BAILIAN_WORKSPACE_ID). Safe to call repeatedly — only the first call does I/O. + * BAILIAN_WORKSPACE_ID), then bridge bl's own config as a fallback. Safe to call + * repeatedly — only the first call does I/O. + * + * Effective precedence for bailian provider fields: + * ~/.agents/config.json > shell env > .env > ~/.bailian/config.json * * NOTE: agent commands declare `auth: "none"` and let the SDK own credential - * resolution. This is the documented tradeoff of the wholesale SDK integration; - * bl's own `--api-key` / `bl auth login` flow is bridged separately as a follow-up. + * resolution. The bl-config bridge is a best-effort fallback; it never overrides + * a value the SDK bootstrap already resolved. */ export function ensureCredentials(): void { if (bootstrapped) return; bootstrapped = true; bootstrapRuntimeCredentialsSync(); + bridgeBailianCredentials(); } diff --git a/packages/commands/src/commands/agent/_engine/errors.ts b/packages/commands/src/commands/agent/_engine/errors.ts index 18a40c82..b02d54e5 100644 --- a/packages/commands/src/commands/agent/_engine/errors.ts +++ b/packages/commands/src/commands/agent/_engine/errors.ts @@ -1,11 +1,46 @@ import { UserError } from "@openagentpack/sdk"; -import { BailianError, ExitCode } from "bailian-cli-core"; +import { type ApiErrorBody, BailianError, ExitCode, mapApiError } from "bailian-cli-core"; + +/** + * Structural shape of the SDK's `ApiError` (thrown by provider clients on HTTP + * 4xx/5xx). Matched on fields instead of `instanceof` because the installed SDK + * version does not export the class yet, and structural matching keeps this + * check stable across SDK versions either way. + */ +interface SdkApiErrorLike extends Error { + statusCode: number; + responseBody: string; +} + +function isSdkApiError(error: Error): error is SdkApiErrorLike { + const candidate = error as Partial<SdkApiErrorLike>; + return typeof candidate.statusCode === "number" && typeof candidate.responseBody === "string"; +} + +/** + * The SDK embeds the raw response body in its error message; recover the + * structured fields (message / code / request_id) when the body is JSON so + * `mapApiError` surfaces a clean server message plus api metadata. Non-JSON + * bodies pass through verbatim as the message. + */ +function parseSdkResponseBody(raw: string): ApiErrorBody { + try { + const parsed: unknown = JSON.parse(raw); + if (parsed && typeof parsed === "object") return parsed as ApiErrorBody; + } catch { + /* non-JSON body */ + } + return { message: raw.trim() || undefined }; +} /** * Run an SDK-backed operation, translating SDK error types into BailianError so * bl's error handler produces the right exit code and hint formatting. - * SDK `UserError` → USAGE/GENERAL; any other Error → GENERAL (message passed - * through, per bl's "don't translate server errors" boundary). + * SDK `UserError` → USAGE; SDK `ApiError` (server HTTP error) → GENERAL via + * `mapApiError` (server message passed through verbatim, with + * httpStatus/apiCode/requestId metadata for --output json); any other Error → + * GENERAL (message passed through, per bl's "don't translate server errors" + * boundary). */ export async function withAgentErrors<T>(fn: () => Promise<T>): Promise<T> { try { @@ -13,6 +48,9 @@ export async function withAgentErrors<T>(fn: () => Promise<T>): Promise<T> { } catch (error) { if (error instanceof BailianError) throw error; if (error instanceof UserError) throw new BailianError(error.message, ExitCode.USAGE); + if (error instanceof Error && isSdkApiError(error)) { + throw mapApiError(error.statusCode, parseSdkResponseBody(error.responseBody)); + } if (error instanceof Error) throw new BailianError(error.message, ExitCode.GENERAL); throw error; } diff --git a/packages/commands/src/commands/agent/_engine/transport.ts b/packages/commands/src/commands/agent/_engine/transport.ts new file mode 100644 index 00000000..1d99e5ce --- /dev/null +++ b/packages/commands/src/commands/agent/_engine/transport.ts @@ -0,0 +1,29 @@ +import * as sdk from "@openagentpack/sdk"; +import { + createInstrumentedFetch, + type FetchImplementation, + type Identity, + type Settings, +} from "bailian-cli-core"; + +/** The slice of CommandContext the transport wrapper needs (UA identity + verbose). */ +export interface HostContext { + identity: Identity; + settings: Settings; +} + +let installed = false; + +/** + * Route the SDK's provider-client requests through the CLI's instrumented + * fetch (UA, host-gated tracking headers, --verbose logging). Feature-detected: + * `setDefaultFetch` landed after @openagentpack/sdk 0.1.0 — on older versions + * this is a silent no-op and the SDK keeps using the global fetch as before. + */ +export function installSdkTransport(host: HostContext): void { + if (installed) return; + const setDefaultFetch = (sdk as Record<string, unknown>).setDefaultFetch; + if (typeof setDefaultFetch !== "function") return; + (setDefaultFetch as (fetchImpl: FetchImplementation) => void)(createInstrumentedFetch(host)); + installed = true; +} diff --git a/packages/commands/src/commands/agent/apply.ts b/packages/commands/src/commands/agent/apply.ts index 809c9f56..cd66f1a6 100644 --- a/packages/commands/src/commands/agent/apply.ts +++ b/packages/commands/src/commands/agent/apply.ts @@ -8,7 +8,11 @@ import { import { emitBare, emitResult } from "bailian-cli-runtime"; import { executePlannedProject, planProjectContext } from "@openagentpack/sdk"; import { formatResourceLabel } from "./_engine/address-utils.ts"; -import { assertProviderConfigured, buildAgentRuntime } from "./_engine/config-loader.ts"; +import { + assertProviderConfigured, + buildAgentRuntime, + CREDENTIALS_NOTE, +} from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; import { renderAgentFeedback } from "./_engine/feedback.ts"; @@ -45,6 +49,7 @@ export default defineCommand({ usageArgs: "[--file <path>] [--provider <name>] [--yes] [--concurrency <n>]", flags: APPLY_FLAGS, exampleArgs: ["--yes", "--provider bailian --yes"], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -52,7 +57,7 @@ export default defineCommand({ const planned = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); + const runtime = await buildAgentRuntime(ctx, file); assertProviderConfigured(runtime, flags.provider); return planProjectContext(runtime, { provider: flags.provider, diff --git a/packages/commands/src/commands/agent/destroy.ts b/packages/commands/src/commands/agent/destroy.ts index 52fd3952..6b5e6fa6 100644 --- a/packages/commands/src/commands/agent/destroy.ts +++ b/packages/commands/src/commands/agent/destroy.ts @@ -8,7 +8,7 @@ import { import { emitBare, emitResult } from "bailian-cli-runtime"; import { destroyPlannedProjectResources, planDestroyProjectContext } from "@openagentpack/sdk"; import { formatResourceLabel } from "./_engine/address-utils.ts"; -import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; @@ -34,6 +34,7 @@ export default defineCommand({ usageArgs: "[--file <path>] [--yes] [--cascade]", flags: DESTROY_FLAGS, exampleArgs: ["--yes", "--yes --cascade"], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -41,7 +42,7 @@ export default defineCommand({ const planned = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); + const runtime = await buildAgentRuntime(ctx, file); return planDestroyProjectContext(runtime); }), ); diff --git a/packages/commands/src/commands/agent/init.ts b/packages/commands/src/commands/agent/init.ts index dc16f65c..467caee2 100644 --- a/packages/commands/src/commands/agent/init.ts +++ b/packages/commands/src/commands/agent/init.ts @@ -18,7 +18,7 @@ agents.state.json const PROVIDERS = ["bailian", "claude", "qoder", "ark", "all"] as const; const PROVIDER_BLOCKS: Record<string, string> = { - bailian: ` bailian:\n api_key: \${DASHSCOPE_API_KEY}\n workspace_id: \${BAILIAN_WORKSPACE_ID}`, + bailian: ` bailian:\n # bl auth login sets DASHSCOPE_API_KEY; bl config set workspace_id <id> sets BAILIAN_WORKSPACE_ID\n api_key: \${DASHSCOPE_API_KEY}\n workspace_id: \${BAILIAN_WORKSPACE_ID}`, claude: ` claude:\n api_key: \${ANTHROPIC_API_KEY}`, qoder: ` qoder:\n api_key: \${QODER_PAT}\n gateway: "https://api.qoder.com/api/v1/cloud"`, ark: ` ark:\n api_key: \${ARK_API_KEY}`, @@ -135,6 +135,11 @@ export default defineCommand({ emitResult({ created: file, provider, agent: agentName }, format); } else { emitBare(`Created ${file}`); + if (provider === "bailian" || provider === "all") { + emitBare( + "Credentials: run `bl auth login` and `bl config set workspace_id <id>`, or set DASHSCOPE_API_KEY / BAILIAN_WORKSPACE_ID.", + ); + } emitBare("Next: edit agents.yaml, then run `bl agent plan`."); } }, diff --git a/packages/commands/src/commands/agent/plan.ts b/packages/commands/src/commands/agent/plan.ts index 4ded10e7..ceec1103 100644 --- a/packages/commands/src/commands/agent/plan.ts +++ b/packages/commands/src/commands/agent/plan.ts @@ -8,7 +8,11 @@ import { import { emitBare, emitResult } from "bailian-cli-runtime"; import { planProjectContext } from "@openagentpack/sdk"; import { formatResourceLabel } from "./_engine/address-utils.ts"; -import { assertProviderConfigured, buildAgentRuntime } from "./_engine/config-loader.ts"; +import { + assertProviderConfigured, + buildAgentRuntime, + CREDENTIALS_NOTE, +} from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; import { renderAgentFeedback } from "./_engine/feedback.ts"; @@ -40,6 +44,7 @@ export default defineCommand({ usageArgs: "[--file <path>] [--provider <name>] [--no-refresh] [--refresh-only]", flags: PLAN_FLAGS, exampleArgs: ["", "--provider bailian", "--no-refresh"], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -47,7 +52,7 @@ export default defineCommand({ const planned = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); + const runtime = await buildAgentRuntime(ctx, file); assertProviderConfigured(runtime, flags.provider); return planProjectContext(runtime, { provider: flags.provider, diff --git a/packages/commands/src/commands/agent/session-create.ts b/packages/commands/src/commands/agent/session-create.ts index faf082e8..af6a92d6 100644 --- a/packages/commands/src/commands/agent/session-create.ts +++ b/packages/commands/src/commands/agent/session-create.ts @@ -1,7 +1,7 @@ import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; import { emitBare, emitResult } from "bailian-cli-runtime"; import { createSessionForAgent } from "@openagentpack/sdk"; -import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; import { parseMemoryStores } from "./_engine/session-render.ts"; @@ -22,7 +22,11 @@ const SESSION_CREATE_FLAGS = { valueHint: "<name>", description: "Override agent's declared environment", }, - vault: { type: "string", valueHint: "<name>", description: "Override agent's declared vault" }, + vault: { + type: "string", + valueHint: "<name>", + description: "Override agent's declared vault", + }, memoryStores: { type: "string", valueHint: "<names>", @@ -42,6 +46,7 @@ export default defineCommand({ usageArgs: "[--agent <name>] [--environment <name>] [--title <title>] [--file <path>]", flags: SESSION_CREATE_FLAGS, exampleArgs: ["", "--agent assistant", "--agent assistant --title 'debug run'"], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -49,7 +54,7 @@ export default defineCommand({ const run = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); + const runtime = await buildAgentRuntime(ctx, file); return createSessionForAgent(runtime, { agent: flags.agent, provider: flags.provider, diff --git a/packages/commands/src/commands/agent/session-delete.ts b/packages/commands/src/commands/agent/session-delete.ts index e85e754b..e12f53df 100644 --- a/packages/commands/src/commands/agent/session-delete.ts +++ b/packages/commands/src/commands/agent/session-delete.ts @@ -1,7 +1,7 @@ import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; import { emitBare, emitResult } from "bailian-cli-runtime"; import { deleteSession } from "@openagentpack/sdk"; -import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; @@ -17,7 +17,11 @@ const SESSION_DELETE_FLAGS = { valueHint: "<path>", description: "Config file path (default: agents.yaml)", }, - provider: { type: "string", valueHint: "<name>", description: "Target provider" }, + provider: { + type: "string", + valueHint: "<name>", + description: "Target provider", + }, } satisfies FlagsDef; export default defineCommand({ @@ -26,6 +30,7 @@ export default defineCommand({ usageArgs: "--session-id <id> [--provider <name>] [--file <path>]", flags: SESSION_DELETE_FLAGS, exampleArgs: ["--session-id sess_abc123"], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -33,7 +38,7 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); + const runtime = await buildAgentRuntime(ctx, file); await deleteSession(runtime, flags.sessionId, flags.provider); }), ); diff --git a/packages/commands/src/commands/agent/session-events.ts b/packages/commands/src/commands/agent/session-events.ts index 8887a351..7a6cac7b 100644 --- a/packages/commands/src/commands/agent/session-events.ts +++ b/packages/commands/src/commands/agent/session-events.ts @@ -2,7 +2,7 @@ import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-co import { emitBare, emitResult, formatTable } from "bailian-cli-runtime"; import { listSessionEvents } from "@openagentpack/sdk"; import { sanitizeSessionEvents } from "@openagentpack/sdk/session-events"; -import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; import { fetchAllPages } from "./_engine/pagination.ts"; @@ -19,9 +19,20 @@ const SESSION_EVENTS_FLAGS = { valueHint: "<path>", description: "Config file path (default: agents.yaml)", }, - provider: { type: "string", valueHint: "<name>", description: "Target provider" }, - limit: { type: "number", valueHint: "<n>", description: "Maximum number of events to fetch" }, - all: { type: "switch", description: "Fetch all pages by following the cursor" }, + provider: { + type: "string", + valueHint: "<name>", + description: "Target provider", + }, + limit: { + type: "number", + valueHint: "<n>", + description: "Maximum number of events to fetch", + }, + all: { + type: "switch", + description: "Fetch all pages by following the cursor", + }, } satisfies FlagsDef; export default defineCommand({ @@ -30,6 +41,7 @@ export default defineCommand({ usageArgs: "--session-id <id> [--limit <n>] [--all] [--file <path>]", flags: SESSION_EVENTS_FLAGS, exampleArgs: ["--session-id sess_abc123", "--session-id sess_abc123 --all"], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -37,14 +49,18 @@ export default defineCommand({ const { items: events, hasMore } = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); + const runtime = await buildAgentRuntime(ctx, file); return fetchAllPages(async (page) => { const result = await listSessionEvents(runtime, flags.sessionId, { provider: flags.provider, limit: flags.limit, page_token: page, }); - return { items: result.events, hasMore: result.has_more, nextPage: result.next_page }; + return { + items: result.events, + hasMore: result.has_more, + nextPage: result.next_page, + }; }, flags.all); }), ); diff --git a/packages/commands/src/commands/agent/session-get.ts b/packages/commands/src/commands/agent/session-get.ts index 203facb8..6da3e67f 100644 --- a/packages/commands/src/commands/agent/session-get.ts +++ b/packages/commands/src/commands/agent/session-get.ts @@ -1,7 +1,7 @@ import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; import { emitBare, emitResult } from "bailian-cli-runtime"; import { getSession } from "@openagentpack/sdk"; -import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; @@ -17,7 +17,11 @@ const SESSION_GET_FLAGS = { valueHint: "<path>", description: "Config file path (default: agents.yaml)", }, - provider: { type: "string", valueHint: "<name>", description: "Target provider" }, + provider: { + type: "string", + valueHint: "<name>", + description: "Target provider", + }, } satisfies FlagsDef; export default defineCommand({ @@ -26,6 +30,7 @@ export default defineCommand({ usageArgs: "--session-id <id> [--provider <name>] [--file <path>]", flags: SESSION_GET_FLAGS, exampleArgs: ["--session-id sess_abc123"], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -33,7 +38,7 @@ export default defineCommand({ const session = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); + const runtime = await buildAgentRuntime(ctx, file); return getSession(runtime, flags.sessionId, flags.provider); }), ); diff --git a/packages/commands/src/commands/agent/session-list.ts b/packages/commands/src/commands/agent/session-list.ts index 0686c6b0..375feeb5 100644 --- a/packages/commands/src/commands/agent/session-list.ts +++ b/packages/commands/src/commands/agent/session-list.ts @@ -1,7 +1,7 @@ import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; import { emitBare, emitResult, formatTable } from "bailian-cli-runtime"; import { listSessionSummaries } from "@openagentpack/sdk"; -import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; import { fetchAllPages } from "./_engine/pagination.ts"; @@ -12,9 +12,20 @@ const SESSION_LIST_FLAGS = { valueHint: "<path>", description: "Config file path (default: agents.yaml)", }, - agent: { type: "string", valueHint: "<name>", description: "Filter by agent name" }, - all: { type: "switch", description: "Fetch all pages by following the cursor" }, - provider: { type: "string", valueHint: "<name>", description: "Target provider" }, + agent: { + type: "string", + valueHint: "<name>", + description: "Filter by agent name", + }, + all: { + type: "switch", + description: "Fetch all pages by following the cursor", + }, + provider: { + type: "string", + valueHint: "<name>", + description: "Target provider", + }, } satisfies FlagsDef; export default defineCommand({ @@ -23,6 +34,7 @@ export default defineCommand({ usageArgs: "[--agent <name>] [--all] [--provider <name>] [--file <path>]", flags: SESSION_LIST_FLAGS, exampleArgs: ["", "--agent assistant", "--all"], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -30,14 +42,18 @@ export default defineCommand({ const { items: summaries, hasMore } = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); + const runtime = await buildAgentRuntime(ctx, file); return fetchAllPages(async (page) => { const result = await listSessionSummaries(runtime, { agent: flags.agent, provider: flags.provider, filter: page ? { page } : undefined, }); - return { items: result.summaries, hasMore: result.hasMore, nextPage: result.nextPage }; + return { + items: result.summaries, + hasMore: result.hasMore, + nextPage: result.nextPage, + }; }, flags.all); }), ); diff --git a/packages/commands/src/commands/agent/session-run.ts b/packages/commands/src/commands/agent/session-run.ts index 5f75e59c..34824a3f 100644 --- a/packages/commands/src/commands/agent/session-run.ts +++ b/packages/commands/src/commands/agent/session-run.ts @@ -1,6 +1,6 @@ import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; import { startSessionRun, startSessionRunPolling } from "@openagentpack/sdk"; -import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; import { @@ -31,15 +31,26 @@ const SESSION_RUN_FLAGS = { valueHint: "<name>", description: "Override agent's declared environment", }, - vault: { type: "string", valueHint: "<name>", description: "Override agent's declared vault" }, + vault: { + type: "string", + valueHint: "<name>", + description: "Override agent's declared vault", + }, memoryStores: { type: "string", valueHint: "<names>", description: "Override agent's memory stores (comma-separated)", }, title: { type: "string", valueHint: "<title>", description: "Session title" }, - provider: { type: "string", valueHint: "<name>", description: "Target provider" }, - noStream: { type: "switch", description: "Use polling instead of SSE streaming" }, + provider: { + type: "string", + valueHint: "<name>", + description: "Target provider", + }, + noStream: { + type: "switch", + description: "Use polling instead of SSE streaming", + }, } satisfies FlagsDef; export default defineCommand({ @@ -48,6 +59,7 @@ export default defineCommand({ usageArgs: "--prompt <text> [--agent <name>] [--no-stream] [--file <path>]", flags: SESSION_RUN_FLAGS, exampleArgs: ['--prompt "hello"', '--agent assistant --prompt "summarize this repo"'], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -65,7 +77,7 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); + const runtime = await buildAgentRuntime(ctx, file); if (flags.noStream) { const run = await startSessionRunPolling(runtime, flags.prompt, runOptions); if (!asJson) process.stderr.write(`Session created: ${run.session.id}\n`); diff --git a/packages/commands/src/commands/agent/session-send.ts b/packages/commands/src/commands/agent/session-send.ts index a0b2611a..643f9fe3 100644 --- a/packages/commands/src/commands/agent/session-send.ts +++ b/packages/commands/src/commands/agent/session-send.ts @@ -1,6 +1,6 @@ import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; import { sendSessionMessagePolling, sendSessionMessageStreaming } from "@openagentpack/sdk"; -import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; import { renderCollectedEvents, streamAndRenderEvents } from "./_engine/session-render.ts"; @@ -23,8 +23,15 @@ const SESSION_SEND_FLAGS = { valueHint: "<path>", description: "Config file path (default: agents.yaml)", }, - provider: { type: "string", valueHint: "<name>", description: "Target provider" }, - noStream: { type: "switch", description: "Use polling instead of SSE streaming" }, + provider: { + type: "string", + valueHint: "<name>", + description: "Target provider", + }, + noStream: { + type: "switch", + description: "Use polling instead of SSE streaming", + }, } satisfies FlagsDef; export default defineCommand({ @@ -33,6 +40,7 @@ export default defineCommand({ usageArgs: "--session-id <id> --message <text> [--no-stream] [--file <path>]", flags: SESSION_SEND_FLAGS, exampleArgs: ['--session-id sess_abc123 --message "continue"'], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -41,7 +49,7 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); + const runtime = await buildAgentRuntime(ctx, file); if (flags.noStream) { const result = await sendSessionMessagePolling(runtime, flags.sessionId, flags.message, { provider: flags.provider, diff --git a/packages/commands/src/commands/agent/state-import.ts b/packages/commands/src/commands/agent/state-import.ts index 8d4fabae..69c33299 100644 --- a/packages/commands/src/commands/agent/state-import.ts +++ b/packages/commands/src/commands/agent/state-import.ts @@ -1,7 +1,7 @@ import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; import { emitBare, emitResult } from "bailian-cli-runtime"; import { importResource, parseStateAddress } from "@openagentpack/sdk"; -import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; @@ -37,6 +37,7 @@ export default defineCommand({ "--address <provider.type.name> --remote-id <id> [--resource-version <n>] [--file <path>]", flags: STATE_IMPORT_FLAGS, exampleArgs: ["--address bailian.agent.assistant --remote-id agent-abc123"], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -44,8 +45,10 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); - const parsed = parseStateAddress(flags.address, { requireProvider: true }); + const runtime = await buildAgentRuntime(ctx, file); + const parsed = parseStateAddress(flags.address, { + requireProvider: true, + }); await importResource(runtime, parsed, flags.remoteId, { resourceVersion: flags.resourceVersion, }); diff --git a/packages/commands/src/commands/agent/state-list.ts b/packages/commands/src/commands/agent/state-list.ts index 68d26ed5..49ff8a8d 100644 --- a/packages/commands/src/commands/agent/state-list.ts +++ b/packages/commands/src/commands/agent/state-list.ts @@ -1,6 +1,6 @@ import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; import { emitBare, emitResult, formatTable } from "bailian-cli-runtime"; -import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; @@ -18,6 +18,7 @@ export default defineCommand({ usageArgs: "[--file <path>]", flags: STATE_LIST_FLAGS, exampleArgs: ["", "--file agents.yaml"], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -25,7 +26,7 @@ export default defineCommand({ const resources = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); + const runtime = await buildAgentRuntime(ctx, file); return runtime.state.listResources(); }), ); diff --git a/packages/commands/src/commands/agent/state-rm.ts b/packages/commands/src/commands/agent/state-rm.ts index 44022d14..633d5db1 100644 --- a/packages/commands/src/commands/agent/state-rm.ts +++ b/packages/commands/src/commands/agent/state-rm.ts @@ -7,7 +7,7 @@ import { } from "bailian-cli-core"; import { emitBare, emitResult } from "bailian-cli-runtime"; import { parseStateAddress } from "@openagentpack/sdk"; -import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; @@ -31,6 +31,7 @@ export default defineCommand({ usageArgs: "--address <provider.type.name> [--file <path>]", flags: STATE_RM_FLAGS, exampleArgs: ["--address bailian.agent.assistant"], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -38,8 +39,10 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); - const parsed = parseStateAddress(flags.address, { requireProvider: false }); + const runtime = await buildAgentRuntime(ctx, file); + const parsed = parseStateAddress(flags.address, { + requireProvider: false, + }); const found = runtime.state.findResource(parsed); if (!found) { throw new BailianError(`Resource not found: ${flags.address}`, ExitCode.GENERAL); diff --git a/packages/commands/src/commands/agent/state-show.ts b/packages/commands/src/commands/agent/state-show.ts index 5a5f2dd3..316a1a68 100644 --- a/packages/commands/src/commands/agent/state-show.ts +++ b/packages/commands/src/commands/agent/state-show.ts @@ -7,7 +7,7 @@ import { } from "bailian-cli-core"; import { emitBare, emitResult } from "bailian-cli-runtime"; import { parseStateAddress } from "@openagentpack/sdk"; -import { buildAgentRuntime } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; @@ -31,6 +31,7 @@ export default defineCommand({ usageArgs: "--address <provider.type.name> [--file <path>]", flags: STATE_SHOW_FLAGS, exampleArgs: ["--address bailian.agent.assistant"], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -38,8 +39,10 @@ export default defineCommand({ const found = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(file); - const parsed = parseStateAddress(flags.address, { requireProvider: false }); + const runtime = await buildAgentRuntime(ctx, file); + const parsed = parseStateAddress(flags.address, { + requireProvider: false, + }); return runtime.state.findResource(parsed); }), ); diff --git a/packages/commands/src/commands/agent/validate.ts b/packages/commands/src/commands/agent/validate.ts index 195c02b0..7a746810 100644 --- a/packages/commands/src/commands/agent/validate.ts +++ b/packages/commands/src/commands/agent/validate.ts @@ -7,7 +7,7 @@ import { } from "bailian-cli-core"; import { emitBare, emitResult } from "bailian-cli-runtime"; import { resolveProjectConfig, validateProjectConfig } from "@openagentpack/sdk"; -import { ensureCredentials } from "./_engine/credentials.ts"; +import { CREDENTIALS_NOTE, ensureCredentials } from "./_engine/credentials.ts"; import { withAgentErrors } from "./_engine/errors.ts"; const VALIDATE_FLAGS = { @@ -24,6 +24,7 @@ export default defineCommand({ usageArgs: "[--file <path>]", flags: VALIDATE_FLAGS, exampleArgs: ["", "--file agents.yaml"], + notes: CREDENTIALS_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); diff --git a/packages/commands/tests/agent-errors.test.ts b/packages/commands/tests/agent-errors.test.ts new file mode 100644 index 00000000..c93e3b9e --- /dev/null +++ b/packages/commands/tests/agent-errors.test.ts @@ -0,0 +1,88 @@ +import { UserError } from "@openagentpack/sdk"; +import { BailianError, ExitCode } from "bailian-cli-core"; +import { expect, test } from "vite-plus/test"; +import { withAgentErrors } from "../src/commands/agent/_engine/errors.ts"; + +/** + * Structural stand-in for the SDK's internal `ApiError` (not exported by the + * installed SDK version): withAgentErrors matches on statusCode/responseBody + * fields, so any Error carrying them must map through mapApiError. + */ +class FakeSdkApiError extends Error { + constructor( + readonly statusCode: number, + readonly responseBody: string, + ) { + super(`Bailian API ${statusCode}: ${responseBody}`); + } +} + +async function catchMapped(error: unknown): Promise<BailianError> { + try { + await withAgentErrors(() => Promise.reject(error)); + } catch (mapped) { + expect(mapped).toBeInstanceOf(BailianError); + return mapped as BailianError; + } + throw new Error("expected withAgentErrors to throw"); +} + +test("BailianError passes through untouched", async () => { + const original = new BailianError("already mapped", ExitCode.AUTH); + const mapped = await catchMapped(original); + expect(mapped).toBe(original); +}); + +test("SDK UserError maps to USAGE", async () => { + const mapped = await catchMapped(new UserError("bad agents.yaml")); + expect(mapped.exitCode).toBe(ExitCode.USAGE); + expect(mapped.message).toBe("bad agents.yaml"); +}); + +test("SDK ApiError with DashScope-style JSON body surfaces clean message and api metadata", async () => { + const body = JSON.stringify({ + code: "InvalidParameter", + message: "agent name already exists", + request_id: "req-123", + }); + const mapped = await catchMapped(new FakeSdkApiError(400, body)); + expect(mapped.exitCode).toBe(ExitCode.GENERAL); + expect(mapped.message).toBe("agent name already exists"); + expect(mapped.api).toEqual({ + httpStatus: 400, + apiCode: "InvalidParameter", + requestId: "req-123", + }); +}); + +test("SDK ApiError with OpenAI-style error envelope extracts message and type", async () => { + const body = JSON.stringify({ + error: { message: "model does not exist", type: "invalid_request_error" }, + request_id: "req-456", + }); + const mapped = await catchMapped(new FakeSdkApiError(404, body)); + expect(mapped.exitCode).toBe(ExitCode.GENERAL); + expect(mapped.message).toBe("model does not exist"); + expect(mapped.api?.apiCode).toBe("invalid_request_error"); + expect(mapped.api?.requestId).toBe("req-456"); +}); + +test("SDK ApiError with non-JSON body passes raw text through as message", async () => { + const mapped = await catchMapped(new FakeSdkApiError(502, "Bad Gateway")); + expect(mapped.exitCode).toBe(ExitCode.GENERAL); + expect(mapped.message).toBe("Bad Gateway"); + expect(mapped.api?.httpStatus).toBe(502); +}); + +test("SDK ApiError with empty body falls back to HTTP status message", async () => { + const mapped = await catchMapped(new FakeSdkApiError(503, "")); + expect(mapped.message).toBe("HTTP 503"); + expect(mapped.api?.httpStatus).toBe(503); +}); + +test("plain Error maps to GENERAL with message passed through", async () => { + const mapped = await catchMapped(new Error("boom")); + expect(mapped.exitCode).toBe(ExitCode.GENERAL); + expect(mapped.message).toBe("boom"); + expect(mapped.api).toBeUndefined(); +}); diff --git a/packages/commands/tests/credentials-bridge.test.ts b/packages/commands/tests/credentials-bridge.test.ts new file mode 100644 index 00000000..9e18f141 --- /dev/null +++ b/packages/commands/tests/credentials-bridge.test.ts @@ -0,0 +1,95 @@ +import { mkdtempSync, rmSync, writeFileSync } from "fs"; +import { tmpdir } from "os"; +import { join } from "path"; +import { expect, test } from "vite-plus/test"; +import { bridgeBailianCredentials } from "../src/commands/agent/_engine/credentials.ts"; + +/** + * bridgeBailianCredentials 把 ~/.bailian/config.json 的 api_key / workspace_id + * 作为最低优先级兜底填入 DASHSCOPE_API_KEY / BAILIAN_WORKSPACE_ID。 + * 用临时 config dir + env 保存恢复隔离,验证优先级与不抛错语义。 + */ +async function inScenario( + scenario: { + config?: { api_key?: string; workspace_id?: string }; + env?: { DASHSCOPE_API_KEY?: string; BAILIAN_WORKSPACE_ID?: string }; + }, + assert: () => void, +): Promise<void> { + const savedConfigDir = process.env.BAILIAN_CONFIG_DIR; + const savedApiKey = process.env.DASHSCOPE_API_KEY; + const savedWorkspace = process.env.BAILIAN_WORKSPACE_ID; + + const dir = mkdtempSync(join(tmpdir(), "bl-cred-bridge-")); + process.env.BAILIAN_CONFIG_DIR = dir; + if (scenario.config) { + writeFileSync(join(dir, "config.json"), JSON.stringify(scenario.config), "utf-8"); + } + + // 显式设置/清除 env,避免继承宿主环境干扰断言 + if (scenario.env?.DASHSCOPE_API_KEY === undefined) delete process.env.DASHSCOPE_API_KEY; + else process.env.DASHSCOPE_API_KEY = scenario.env.DASHSCOPE_API_KEY; + if (scenario.env?.BAILIAN_WORKSPACE_ID === undefined) delete process.env.BAILIAN_WORKSPACE_ID; + else process.env.BAILIAN_WORKSPACE_ID = scenario.env.BAILIAN_WORKSPACE_ID; + + try { + assert(); + } finally { + restore("BAILIAN_CONFIG_DIR", savedConfigDir); + restore("DASHSCOPE_API_KEY", savedApiKey); + restore("BAILIAN_WORKSPACE_ID", savedWorkspace); + rmSync(dir, { recursive: true, force: true }); + } +} + +function restore(key: string, value: string | undefined): void { + if (value === undefined) delete process.env[key]; + else process.env[key] = value; +} + +test("bridge:env 已有值时不被 bl config 覆盖(最低优先级)", async () => { + await inScenario( + { + config: { api_key: "sk-from-config", workspace_id: "ws-from-config" }, + env: { DASHSCOPE_API_KEY: "sk-from-env", BAILIAN_WORKSPACE_ID: "ws-from-env" }, + }, + () => { + bridgeBailianCredentials(); + expect(process.env.DASHSCOPE_API_KEY).toBe("sk-from-env"); + expect(process.env.BAILIAN_WORKSPACE_ID).toBe("ws-from-env"); + }, + ); +}); + +test("bridge:env 缺失且 bl config 有值时填充", async () => { + await inScenario( + { config: { api_key: "sk-from-config", workspace_id: "ws-from-config" }, env: {} }, + () => { + bridgeBailianCredentials(); + expect(process.env.DASHSCOPE_API_KEY).toBe("sk-from-config"); + expect(process.env.BAILIAN_WORKSPACE_ID).toBe("ws-from-config"); + }, + ); +}); + +test("bridge:仅缺失项被填,已有项保留(逐字段独立)", async () => { + await inScenario( + { + config: { api_key: "sk-from-config", workspace_id: "ws-from-config" }, + env: { DASHSCOPE_API_KEY: "sk-from-env" }, + }, + () => { + bridgeBailianCredentials(); + expect(process.env.DASHSCOPE_API_KEY).toBe("sk-from-env"); + expect(process.env.BAILIAN_WORKSPACE_ID).toBe("ws-from-config"); + }, + ); +}); + +test("bridge:env 与 bl config 皆缺失时不抛错且不写入", async () => { + await inScenario({ env: {} }, () => { + expect(() => bridgeBailianCredentials()).not.toThrow(); + expect(process.env.DASHSCOPE_API_KEY).toBeUndefined(); + expect(process.env.BAILIAN_WORKSPACE_ID).toBeUndefined(); + }); +}); diff --git a/packages/core/src/client/index.ts b/packages/core/src/client/index.ts index b4308e39..03bfc836 100644 --- a/packages/core/src/client/index.ts +++ b/packages/core/src/client/index.ts @@ -19,8 +19,9 @@ export { videoGeneratePath, } from "./endpoints.ts"; export { CHANNEL, SOURCE_CONFIG, TAGS, trackingHeaders } from "./headers.ts"; -export type { RequestOpts } from "./http.ts"; +export type { HttpDeps, RequestOpts } from "./http.ts"; export { request, requestJson } from "./http.ts"; +export { createInstrumentedFetch, type FetchImplementation } from "./instrumented-fetch.ts"; export { Client, type ClientRequestOpts, type ClientOpenApiQueryOpts } from "./client.ts"; export { buildAcsCanonicalQuery, diff --git a/packages/core/src/client/instrumented-fetch.ts b/packages/core/src/client/instrumented-fetch.ts new file mode 100644 index 00000000..da27495b --- /dev/null +++ b/packages/core/src/client/instrumented-fetch.ts @@ -0,0 +1,76 @@ +import { maskToken } from "../utils/token.ts"; +import type { HttpDeps } from "./http.ts"; +import { trackingHeaders } from "./headers.ts"; + +/** + * fetch-compatible signature, structurally identical to the SDK-side `FetchLike` + * seam. Declared locally so core stays free of SDK imports. + */ +export type FetchImplementation = ( + input: string | URL | Request, + init?: RequestInit, +) => Promise<Response>; + +/** + * Tracking headers are DashScope-specific: only attach them to Alibaba Cloud + * hosts, never to third-party providers (Anthropic / Ark / Qoder) that an + * embedded SDK may also call through this fetch. + */ +function isAlibabaCloudHost(url: string): boolean { + try { + const { hostname } = new URL(url); + return hostname === "aliyuncs.com" || hostname.endsWith(".aliyuncs.com"); + } catch { + return false; + } +} + +function requestUrl(input: string | URL | Request): string { + if (typeof input === "string") return input; + if (input instanceof URL) return input.href; + return input.url; +} + +/** + * A transparent fetch wrapper carrying the client-layer cross-cutting request + * concerns (UA, tracking headers, `--verbose` logging) for network stacks that + * bypass {@link request} — e.g. an embedded SDK's provider clients. Deliberately + * transport-only: no auth injection, no baseUrl handling, no timeout, and no + * error mapping, so the caller's response semantics (status handling, SSE, + * conflict detection) stay intact. + */ +export function createInstrumentedFetch(deps: HttpDeps): FetchImplementation { + return async (input, init = {}) => { + const url = requestUrl(input); + const headers = new Headers( + init.headers ?? (input instanceof Request ? input.headers : undefined), + ); + + if (!headers.has("user-agent")) { + headers.set("User-Agent", `${deps.identity.clientName}/${deps.identity.version}`); + } + if (isAlibabaCloudHost(url)) { + for (const [name, value] of Object.entries(trackingHeaders())) { + headers.set(name, value); + } + } + + if (deps.settings.verbose) { + console.error(`> ${init.method ?? "GET"} ${url}`); + const auth = headers.get("authorization"); + if (auth) console.error(`> Auth: ${maskToken(auth.replace(/^Bearer /, ""))}`); + } + + const res = await fetch(input, { ...init, headers }); + + if (deps.settings.verbose) { + console.error(`< ${res.status} ${res.statusText}`); + const reqId = res.headers.get("x-request-id"); + if (reqId) { + console.error(`request_id: ${reqId}`); + } + } + + return res; + }; +} diff --git a/packages/core/tests/instrumented-fetch.test.ts b/packages/core/tests/instrumented-fetch.test.ts new file mode 100644 index 00000000..501c2622 --- /dev/null +++ b/packages/core/tests/instrumented-fetch.test.ts @@ -0,0 +1,84 @@ +import { expect, test } from "vite-plus/test"; +import type { Identity, Settings } from "../src/index.ts"; +import { createInstrumentedFetch, SOURCE_CONFIG } from "../src/index.ts"; + +const identity: Identity = { + binName: "bl", + clientName: "bailian-cli", + version: "1.2.3", + npmPackage: "bailian-cli", +}; + +const settings: Settings = { timeout: 60, verbose: false } as Settings; + +interface CapturedRequest { + url: string; + headers: Headers; +} + +/** Run the wrapper against a stubbed globalThis.fetch and capture what reaches it. */ +async function capture( + input: string | URL | Request, + init?: RequestInit, +): Promise<CapturedRequest> { + const originalFetch = globalThis.fetch; + let captured: CapturedRequest | undefined; + globalThis.fetch = (async (fetchInput: string | URL | Request, fetchInit?: RequestInit) => { + captured = { + url: + typeof fetchInput === "string" + ? fetchInput + : fetchInput instanceof URL + ? fetchInput.href + : fetchInput.url, + headers: new Headers(fetchInit?.headers), + }; + return new Response("{}", { status: 200 }); + }) as unknown as typeof fetch; + + try { + await createInstrumentedFetch({ identity, settings })(input, init); + } finally { + globalThis.fetch = originalFetch; + } + if (!captured) throw new Error("stubbed fetch was not called"); + return captured; +} + +test("adds UA and tracking header on Alibaba Cloud hosts", async () => { + const { headers } = await capture( + "https://ws-1.cn-beijing.maas.aliyuncs.com/api/v1/agentstudio/agents", + { method: "POST", headers: { Authorization: "Bearer k" } }, + ); + expect(headers.get("user-agent")).toBe("bailian-cli/1.2.3"); + expect(headers.get("x-dashscope-source-config")).toBe(SOURCE_CONFIG); + expect(headers.get("authorization")).toBe("Bearer k"); +}); + +test("adds UA but no tracking header on third-party hosts", async () => { + const { headers } = await capture("https://api.anthropic.com/v1/messages", { + method: "POST", + }); + expect(headers.get("user-agent")).toBe("bailian-cli/1.2.3"); + expect(headers.get("x-dashscope-source-config")).toBeNull(); +}); + +test("does not override a caller-provided User-Agent", async () => { + const { headers } = await capture("https://dashscope.aliyuncs.com/api/v1/tasks/t1", { + headers: { "User-Agent": "custom/9.9" }, + }); + expect(headers.get("user-agent")).toBe("custom/9.9"); +}); + +test("does not invent a Content-Type (FormData boundary safety)", async () => { + const { headers } = await capture("https://dashscope.aliyuncs.com/api/v1/files", { + method: "POST", + }); + expect(headers.get("content-type")).toBeNull(); +}); + +test("passes non-URL-parseable inputs through without tracking headers", async () => { + const { url, headers } = await capture("/relative/path"); + expect(url).toBe("/relative/path"); + expect(headers.get("x-dashscope-source-config")).toBeNull(); +}); diff --git a/skills/bailian-cli/reference/agent.md b/skills/bailian-cli/reference/agent.md index c7abb325..01df0f79 100644 --- a/skills/bailian-cli/reference/agent.md +++ b/skills/bailian-cli/reference/agent.md @@ -46,6 +46,11 @@ Index: [index.md](index.md) | `--no-refresh` | switch | no | Skip refreshing state from remote before planning | | `--concurrency <n>` | number | no | Max independent resources to apply in parallel (default 6, max 10) | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -72,6 +77,11 @@ bl agent apply --provider bailian --yes | `--yes` | switch | no | Confirm and destroy without an interactive prompt (required) | | `--cascade` | switch | no | Auto-delete dependent resources (e.g. sessions referencing an environment) | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -130,6 +140,11 @@ bl agent init --provider all | `--no-refresh` | switch | no | Skip refreshing state from remote before planning | | `--refresh-only` | switch | no | Refresh state and show drift without planning remote mutations | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -164,6 +179,11 @@ bl agent plan --no-refresh | `--title <title>` | string | no | Session title | | `--provider <name>` | string | no | Target provider (multi-provider agents) | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -194,6 +214,11 @@ bl agent session create --agent assistant --title 'debug run' | `--file <path>` | string | no | Config file path (default: agents.yaml) | | `--provider <name>` | string | no | Target provider | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -218,6 +243,11 @@ bl agent session delete --session-id sess_abc123 | `--limit <n>` | number | no | Maximum number of events to fetch | | `--all` | switch | no | Fetch all pages by following the cursor | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -244,6 +274,11 @@ bl agent session events --session-id sess_abc123 --all | `--file <path>` | string | no | Config file path (default: agents.yaml) | | `--provider <name>` | string | no | Target provider | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -267,6 +302,11 @@ bl agent session get --session-id sess_abc123 | `--all` | switch | no | Fetch all pages by following the cursor | | `--provider <name>` | string | no | Target provider | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -303,6 +343,11 @@ bl agent session list --all | `--provider <name>` | string | no | Target provider | | `--no-stream` | switch | no | Use polling instead of SSE streaming | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -331,6 +376,11 @@ bl agent session run --agent assistant --prompt "summarize this repo" | `--provider <name>` | string | no | Target provider | | `--no-stream` | switch | no | Use polling instead of SSE streaming | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -354,6 +404,11 @@ bl agent session send --session-id sess_abc123 --message "continue" | `--resource-version <n>` | number | no | Resource version (for versioned resources like agents) | | `--file <path>` | string | no | Config file path (default: agents.yaml) | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -374,6 +429,11 @@ bl agent state import --address bailian.agent.assistant --remote-id agent-abc123 | --------------- | ------ | -------- | --------------------------------------- | | `--file <path>` | string | no | Config file path (default: agents.yaml) | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -399,6 +459,11 @@ bl agent state list --file agents.yaml | `--address <provider.type.name>` | string | yes | Resource state address (required) | | `--file <path>` | string | no | Config file path (default: agents.yaml) | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -420,6 +485,11 @@ bl agent state rm --address bailian.agent.assistant | `--address <provider.type.name>` | string | yes | Resource state address (required) | | `--file <path>` | string | no | Config file path (default: agents.yaml) | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash @@ -440,6 +510,11 @@ bl agent state show --address bailian.agent.assistant | --------------- | ------ | -------- | --------------------------------------- | | `--file <path>` | string | no | Config file path (default: agents.yaml) | +#### Notes + +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. + #### Examples ```bash From 1c9dac24e975a3a6e9606c80036514eb61986194 Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Wed, 22 Jul 2026 14:20:24 +0800 Subject: [PATCH 03/21] =?UTF-8?q?feat(cma):=20login=E6=97=B6=E5=88=9D?= =?UTF-8?q?=E5=A7=8B=E5=8C=96agent=E7=9B=B8=E5=85=B3=E7=9A=84baseUrl?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../src/commands/agent/_engine/credentials.ts | 16 +++-- packages/commands/src/commands/agent/init.ts | 4 +- packages/commands/src/commands/auth/login.ts | 18 ++++- packages/commands/src/commands/config/set.ts | 15 +++- .../commands/tests/credentials-bridge.test.ts | 68 +++++++++++++++++-- packages/core/src/auth/store.ts | 1 + packages/core/src/config/schema.ts | 9 +++ skills/bailian-cli/reference/agent.md | 60 ++++++++-------- skills/bailian-cli/reference/auth.md | 19 +++--- skills/bailian-cli/reference/config.md | 8 +-- 10 files changed, 156 insertions(+), 62 deletions(-) diff --git a/packages/commands/src/commands/agent/_engine/credentials.ts b/packages/commands/src/commands/agent/_engine/credentials.ts index 1c1cc63e..92fb203e 100644 --- a/packages/commands/src/commands/agent/_engine/credentials.ts +++ b/packages/commands/src/commands/agent/_engine/credentials.ts @@ -11,16 +11,17 @@ let bootstrapped = false; * that loads agents.yaml. `bl` prefix is safe: agent commands ship on `bl` only. */ export const CREDENTIALS_NOTE = [ - "Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}).", - "For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`.", + "Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}).", + "For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`.", ]; /** * Bridge bl's own login state into the env vars the OpenAgentPack SDK reads for - * the bailian provider. bl persists `api_key` / `workspace_id` in - * `~/.bailian/config.json` (via `bl auth login` / `bl config set`); mirror them - * onto `DASHSCOPE_API_KEY` / `BAILIAN_WORKSPACE_ID` so users don't have to - * re-declare the same credentials for `bl agent *`. + * the bailian provider. bl persists `api_key` / `agentstudio_base_url` in + * `~/.bailian/config.json` (via `bl auth login`); mirror them onto + * `DASHSCOPE_API_KEY` / `BAILIAN_BASE_URL` so users don't have to re-declare the + * same credentials for `bl agent *`. `workspace_id` is still bridged for configs + * that predate the base_url flow (the SDK accepts either). * * Lowest priority: only fills a var that is still unset, so anything already in * the environment (shell export, `.env`, or `~/.agents/config.json` — which the @@ -33,6 +34,9 @@ export function bridgeBailianCredentials(): void { if (!process.env.DASHSCOPE_API_KEY?.trim() && file.api_key) { process.env.DASHSCOPE_API_KEY = file.api_key; } + if (!process.env.BAILIAN_BASE_URL?.trim() && file.agentstudio_base_url) { + process.env.BAILIAN_BASE_URL = file.agentstudio_base_url; + } if (!process.env.BAILIAN_WORKSPACE_ID?.trim() && file.workspace_id) { process.env.BAILIAN_WORKSPACE_ID = file.workspace_id; } diff --git a/packages/commands/src/commands/agent/init.ts b/packages/commands/src/commands/agent/init.ts index 467caee2..78ee8d45 100644 --- a/packages/commands/src/commands/agent/init.ts +++ b/packages/commands/src/commands/agent/init.ts @@ -18,7 +18,7 @@ agents.state.json const PROVIDERS = ["bailian", "claude", "qoder", "ark", "all"] as const; const PROVIDER_BLOCKS: Record<string, string> = { - bailian: ` bailian:\n # bl auth login sets DASHSCOPE_API_KEY; bl config set workspace_id <id> sets BAILIAN_WORKSPACE_ID\n api_key: \${DASHSCOPE_API_KEY}\n workspace_id: \${BAILIAN_WORKSPACE_ID}`, + bailian: ` bailian:\n # bl auth login --api-key <key> sets DASHSCOPE_API_KEY; --agentstudio-base-url <url> sets BAILIAN_BASE_URL\n api_key: \${DASHSCOPE_API_KEY}\n base_url: \${BAILIAN_BASE_URL}`, claude: ` claude:\n api_key: \${ANTHROPIC_API_KEY}`, qoder: ` qoder:\n api_key: \${QODER_PAT}\n gateway: "https://api.qoder.com/api/v1/cloud"`, ark: ` ark:\n api_key: \${ARK_API_KEY}`, @@ -137,7 +137,7 @@ export default defineCommand({ emitBare(`Created ${file}`); if (provider === "bailian" || provider === "all") { emitBare( - "Credentials: run `bl auth login` and `bl config set workspace_id <id>`, or set DASHSCOPE_API_KEY / BAILIAN_WORKSPACE_ID.", + "Credentials: run `bl auth login --api-key <key> --agentstudio-base-url <url>`, or set DASHSCOPE_API_KEY / BAILIAN_BASE_URL.", ); } emitBare("Next: edit agents.yaml, then run `bl agent plan`."); diff --git a/packages/commands/src/commands/auth/login.ts b/packages/commands/src/commands/auth/login.ts index ebf9ac9d..3e6e1cd1 100644 --- a/packages/commands/src/commands/auth/login.ts +++ b/packages/commands/src/commands/auth/login.ts @@ -19,12 +19,22 @@ export default defineCommand({ usageArgs: "--api-key <key> | --console | --open-api --access-key-id <id> --access-key-secret <secret>", flags: { - apiKey: { type: "string", valueHint: "<key>", description: "DashScope API key to store" }, + apiKey: { + type: "string", + valueHint: "<key>", + description: "DashScope API key to store", + }, baseUrl: { type: "string", valueHint: "<url>", description: "DashScope API base URL (used with --api-key for validation)", }, + agentstudioBaseUrl: { + type: "string", + valueHint: "<url>", + description: + "Bailian AgentStudio base URL for `bl agent` commands (sets BAILIAN_BASE_URL; used with --api-key)", + }, console: { type: "switch", description: @@ -65,6 +75,9 @@ export default defineCommand({ if (!apiKeyMode && hasValue(f.baseUrl)) { return "Use --base-url only with --api-key"; } + if (!apiKeyMode && hasValue(f.agentstudioBaseUrl)) { + return "Use --agentstudio-base-url only with --api-key"; + } if (!consoleMode && hasValue(f.consoleSite)) { return "Use --console-site only with --console"; } @@ -131,6 +144,9 @@ export default defineCommand({ if (baseUrl) { await store.login({ base_url: baseUrl }); } + if (flags.agentstudioBaseUrl) { + await store.login({ agentstudio_base_url: flags.agentstudioBaseUrl }); + } await validateAndPersistApiKey(deps, key, baseUrl || store.resolveBaseUrl()); }, }); diff --git a/packages/commands/src/commands/config/set.ts b/packages/commands/src/commands/config/set.ts index 99b3e831..7a3cd81a 100644 --- a/packages/commands/src/commands/config/set.ts +++ b/packages/commands/src/commands/config/set.ts @@ -23,6 +23,7 @@ const VALID_KEYS = [ "default_speech_model", "default_omni_model", "workspace_id", + "agentstudio_base_url", ]; // Keys whose values are secrets. Their stored value must never be echoed back in @@ -44,6 +45,7 @@ const KEY_ALIASES: Record<string, string> = { "default-speech-model": "default_speech_model", "default-omni-model": "default_omni_model", "workspace-id": "workspace_id", + "agentstudio-base-url": "agentstudio_base_url", }; export default defineCommand({ @@ -55,10 +57,15 @@ export default defineCommand({ type: "string", valueHint: "<key>", description: - "Config key (base_url, output, output_dir, timeout, api_key, access_token, access_key_id, access_key_secret, default_*_model, workspace_id)", + "Config key (base_url, output, output_dir, timeout, api_key, access_token, access_key_id, access_key_secret, default_*_model, workspace_id, agentstudio_base_url)", + required: true, + }, + value: { + type: "string", + valueHint: "<value>", + description: "Value to set", required: true, }, - value: { type: "string", valueHint: "<value>", description: "Value to set", required: true }, }, exampleArgs: [ "--key output --value json", @@ -106,7 +113,9 @@ export default defineCommand({ } const coerced = resolvedKey === "timeout" ? Number(value) : value; - await ctx.configStore.write({ [resolvedKey]: coerced } as Partial<ConfigFile>); + await ctx.configStore.write({ + [resolvedKey]: coerced, + } as Partial<ConfigFile>); if (!settings.quiet) { const shown = SECRET_KEYS.has(resolvedKey) ? maskToken(String(coerced)) : coerced; diff --git a/packages/commands/tests/credentials-bridge.test.ts b/packages/commands/tests/credentials-bridge.test.ts index 9e18f141..46f35ca0 100644 --- a/packages/commands/tests/credentials-bridge.test.ts +++ b/packages/commands/tests/credentials-bridge.test.ts @@ -5,20 +5,29 @@ import { expect, test } from "vite-plus/test"; import { bridgeBailianCredentials } from "../src/commands/agent/_engine/credentials.ts"; /** - * bridgeBailianCredentials 把 ~/.bailian/config.json 的 api_key / workspace_id - * 作为最低优先级兜底填入 DASHSCOPE_API_KEY / BAILIAN_WORKSPACE_ID。 - * 用临时 config dir + env 保存恢复隔离,验证优先级与不抛错语义。 + * bridgeBailianCredentials 把 ~/.bailian/config.json 的 api_key / agentstudio_base_url + * / workspace_id 作为最低优先级兜底填入 DASHSCOPE_API_KEY / BAILIAN_BASE_URL / + * BAILIAN_WORKSPACE_ID。用临时 config dir + env 保存恢复隔离,验证优先级与不抛错语义。 */ async function inScenario( scenario: { - config?: { api_key?: string; workspace_id?: string }; - env?: { DASHSCOPE_API_KEY?: string; BAILIAN_WORKSPACE_ID?: string }; + config?: { + api_key?: string; + workspace_id?: string; + agentstudio_base_url?: string; + }; + env?: { + DASHSCOPE_API_KEY?: string; + BAILIAN_WORKSPACE_ID?: string; + BAILIAN_BASE_URL?: string; + }; }, assert: () => void, ): Promise<void> { const savedConfigDir = process.env.BAILIAN_CONFIG_DIR; const savedApiKey = process.env.DASHSCOPE_API_KEY; const savedWorkspace = process.env.BAILIAN_WORKSPACE_ID; + const savedBaseUrl = process.env.BAILIAN_BASE_URL; const dir = mkdtempSync(join(tmpdir(), "bl-cred-bridge-")); process.env.BAILIAN_CONFIG_DIR = dir; @@ -31,6 +40,8 @@ async function inScenario( else process.env.DASHSCOPE_API_KEY = scenario.env.DASHSCOPE_API_KEY; if (scenario.env?.BAILIAN_WORKSPACE_ID === undefined) delete process.env.BAILIAN_WORKSPACE_ID; else process.env.BAILIAN_WORKSPACE_ID = scenario.env.BAILIAN_WORKSPACE_ID; + if (scenario.env?.BAILIAN_BASE_URL === undefined) delete process.env.BAILIAN_BASE_URL; + else process.env.BAILIAN_BASE_URL = scenario.env.BAILIAN_BASE_URL; try { assert(); @@ -38,6 +49,7 @@ async function inScenario( restore("BAILIAN_CONFIG_DIR", savedConfigDir); restore("DASHSCOPE_API_KEY", savedApiKey); restore("BAILIAN_WORKSPACE_ID", savedWorkspace); + restore("BAILIAN_BASE_URL", savedBaseUrl); rmSync(dir, { recursive: true, force: true }); } } @@ -51,7 +63,10 @@ test("bridge:env 已有值时不被 bl config 覆盖(最低优先级)", async () await inScenario( { config: { api_key: "sk-from-config", workspace_id: "ws-from-config" }, - env: { DASHSCOPE_API_KEY: "sk-from-env", BAILIAN_WORKSPACE_ID: "ws-from-env" }, + env: { + DASHSCOPE_API_KEY: "sk-from-env", + BAILIAN_WORKSPACE_ID: "ws-from-env", + }, }, () => { bridgeBailianCredentials(); @@ -63,7 +78,10 @@ test("bridge:env 已有值时不被 bl config 覆盖(最低优先级)", async () test("bridge:env 缺失且 bl config 有值时填充", async () => { await inScenario( - { config: { api_key: "sk-from-config", workspace_id: "ws-from-config" }, env: {} }, + { + config: { api_key: "sk-from-config", workspace_id: "ws-from-config" }, + env: {}, + }, () => { bridgeBailianCredentials(); expect(process.env.DASHSCOPE_API_KEY).toBe("sk-from-config"); @@ -93,3 +111,39 @@ test("bridge:env 与 bl config 皆缺失时不抛错且不写入", async () => { expect(process.env.BAILIAN_WORKSPACE_ID).toBeUndefined(); }); }); + +test("bridge:agentstudio_base_url 兜底填入 BAILIAN_BASE_URL", async () => { + await inScenario( + { + config: { + api_key: "sk-from-config", + agentstudio_base_url: "https://ws-x.cn-beijing.maas.aliyuncs.com/api/v1/agentstudio", + }, + env: {}, + }, + () => { + bridgeBailianCredentials(); + expect(process.env.BAILIAN_BASE_URL).toBe( + "https://ws-x.cn-beijing.maas.aliyuncs.com/api/v1/agentstudio", + ); + }, + ); +}); + +test("bridge:env 已有 BAILIAN_BASE_URL 时不被 bl config 覆盖", async () => { + await inScenario( + { + config: { + api_key: "sk-from-config", + agentstudio_base_url: "https://from-config.aliyuncs.com/api/v1/agentstudio", + }, + env: { + BAILIAN_BASE_URL: "https://from-env.aliyuncs.com/api/v1/agentstudio", + }, + }, + () => { + bridgeBailianCredentials(); + expect(process.env.BAILIAN_BASE_URL).toBe("https://from-env.aliyuncs.com/api/v1/agentstudio"); + }, + ); +}); diff --git a/packages/core/src/auth/store.ts b/packages/core/src/auth/store.ts index 45600e4d..94970611 100644 --- a/packages/core/src/auth/store.ts +++ b/packages/core/src/auth/store.ts @@ -18,6 +18,7 @@ export type AuthPersistPatch = Pick< | "access_key_id" | "access_key_secret" | "base_url" + | "agentstudio_base_url" | "console_site" | "console_region" | "console_switch_agent" diff --git a/packages/core/src/config/schema.ts b/packages/core/src/config/schema.ts index b76b9316..3c30e414 100644 --- a/packages/core/src/config/schema.ts +++ b/packages/core/src/config/schema.ts @@ -23,6 +23,13 @@ export interface ConfigFile { /** Alibaba Cloud OpenAPI AccessKey secret from `bl auth login --open-api`. */ access_key_secret?: string; base_url?: string; + /** + * Bailian AgentStudio API base URL for `bl agent` commands, e.g. + * `https://<workspace>.cn-beijing.maas.aliyuncs.com/api/v1/agentstudio`. + * Distinct from `base_url` (the DashScope model API): the agent path bridges + * this to the SDK's `BAILIAN_BASE_URL`, so a workspace_id is not required. + */ + agentstudio_base_url?: string; output?: "text" | "json"; output_dir?: string; timeout?: number; @@ -78,6 +85,8 @@ export function parseConfigFile(raw: unknown): ConfigFile { ) out.access_key_secret = obj.openapi_access_key_secret; if (typeof obj.base_url === "string" && isHttpUrl(obj.base_url)) out.base_url = obj.base_url; + if (typeof obj.agentstudio_base_url === "string" && isHttpUrl(obj.agentstudio_base_url)) + out.agentstudio_base_url = obj.agentstudio_base_url; if (typeof obj.output === "string" && VALID_OUTPUTS.has(obj.output)) out.output = obj.output as ConfigFile["output"]; if (typeof obj.output_dir === "string" && obj.output_dir.length > 0) diff --git a/skills/bailian-cli/reference/agent.md b/skills/bailian-cli/reference/agent.md index 01df0f79..bd73e5dc 100644 --- a/skills/bailian-cli/reference/agent.md +++ b/skills/bailian-cli/reference/agent.md @@ -48,8 +48,8 @@ Index: [index.md](index.md) #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -79,8 +79,8 @@ bl agent apply --provider bailian --yes #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -142,8 +142,8 @@ bl agent init --provider all #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -181,8 +181,8 @@ bl agent plan --no-refresh #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -216,8 +216,8 @@ bl agent session create --agent assistant --title 'debug run' #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -245,8 +245,8 @@ bl agent session delete --session-id sess_abc123 #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -276,8 +276,8 @@ bl agent session events --session-id sess_abc123 --all #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -304,8 +304,8 @@ bl agent session get --session-id sess_abc123 #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -345,8 +345,8 @@ bl agent session list --all #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -378,8 +378,8 @@ bl agent session run --agent assistant --prompt "summarize this repo" #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -406,8 +406,8 @@ bl agent session send --session-id sess_abc123 --message "continue" #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -431,8 +431,8 @@ bl agent state import --address bailian.agent.assistant --remote-id agent-abc123 #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -461,8 +461,8 @@ bl agent state list --file agents.yaml #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -487,8 +487,8 @@ bl agent state rm --address bailian.agent.assistant #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples @@ -512,8 +512,8 @@ bl agent state show --address bailian.agent.assistant #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_WORKSPACE_ID}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login` (API key) and `bl config set workspace_id <id>`. +- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). +- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. #### Examples diff --git a/skills/bailian-cli/reference/auth.md b/skills/bailian-cli/reference/auth.md index eda1496f..2da50b90 100644 --- a/skills/bailian-cli/reference/auth.md +++ b/skills/bailian-cli/reference/auth.md @@ -25,15 +25,16 @@ Index: [index.md](index.md) #### Flags -| Flag | Type | Required | Description | -| ------------------------------ | ------ | -------- | ------------------------------------------------------------------------------------- | -| `--api-key <key>` | string | no | DashScope API key to store | -| `--base-url <url>` | string | no | DashScope API base URL (used with --api-key for validation) | -| `--console` | switch | no | Sign in via browser; use --console-site to choose domestic (default) or international | -| `--console-site <site>` | string | no | Console site: domestic, international | -| `--open-api` | switch | no | Store Alibaba Cloud OpenAPI AK/SK credentials | -| `--access-key-id <id>` | string | no | Alibaba Cloud Access Key ID to store | -| `--access-key-secret <secret>` | string | no | Alibaba Cloud Access Key Secret to store | +| Flag | Type | Required | Description | +| ------------------------------ | ------ | -------- | ------------------------------------------------------------------------------------------------- | +| `--api-key <key>` | string | no | DashScope API key to store | +| `--base-url <url>` | string | no | DashScope API base URL (used with --api-key for validation) | +| `--agentstudio-base-url <url>` | string | no | Bailian AgentStudio base URL for `bl agent` commands (sets BAILIAN_BASE_URL; used with --api-key) | +| `--console` | switch | no | Sign in via browser; use --console-site to choose domestic (default) or international | +| `--console-site <site>` | string | no | Console site: domestic, international | +| `--open-api` | switch | no | Store Alibaba Cloud OpenAPI AK/SK credentials | +| `--access-key-id <id>` | string | no | Alibaba Cloud Access Key ID to store | +| `--access-key-secret <secret>` | string | no | Alibaba Cloud Access Key Secret to store | #### Examples diff --git a/skills/bailian-cli/reference/config.md b/skills/bailian-cli/reference/config.md index eb03de24..a08f0d23 100644 --- a/skills/bailian-cli/reference/config.md +++ b/skills/bailian-cli/reference/config.md @@ -24,10 +24,10 @@ Index: [index.md](index.md) #### Flags -| Flag | Type | Required | Description | -| ----------------- | ------ | -------- | -------------------------------------------------------------------------------------------------------------------------------------------- | -| `--key <key>` | string | yes | Config key (base*url, output, output_dir, timeout, api_key, access_token, access_key_id, access_key_secret, default*\*\_model, workspace_id) | -| `--value <value>` | string | yes | Value to set | +| Flag | Type | Required | Description | +| ----------------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| `--key <key>` | string | yes | Config key (base*url, output, output_dir, timeout, api_key, access_token, access_key_id, access_key_secret, default*\*\_model, workspace_id, agentstudio_base_url) | +| `--value <value>` | string | yes | Value to set | #### Examples From 9e59b013268555dd5290bf7b34070b960d219a83 Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Wed, 22 Jul 2026 17:01:14 +0800 Subject: [PATCH 04/21] feat: update openagentpack sdk --- packages/cli/agents.yaml | 26 -------------------------- packages/commands/package.json | 2 +- pnpm-lock.yaml | 14 +++++--------- 3 files changed, 6 insertions(+), 36 deletions(-) delete mode 100644 packages/cli/agents.yaml diff --git a/packages/cli/agents.yaml b/packages/cli/agents.yaml deleted file mode 100644 index e86f410b..00000000 --- a/packages/cli/agents.yaml +++ /dev/null @@ -1,26 +0,0 @@ -version: "1" - -providers: - bailian: - api_key: ${DASHSCOPE_API_KEY} - workspace_id: ${BAILIAN_WORKSPACE_ID} - -defaults: - provider: bailian - -environments: - dev: - config: - type: cloud - networking: - type: unrestricted - -agents: - assistant: - description: "General-purpose assistant" - model: qwen3.7-max - instructions: | - You are a helpful assistant. - environment: dev - tools: - builtin: [bash, read, glob, grep] diff --git a/packages/commands/package.json b/packages/commands/package.json index 2aed8b58..57f5b03a 100644 --- a/packages/commands/package.json +++ b/packages/commands/package.json @@ -40,7 +40,7 @@ "check": "vp check" }, "dependencies": { - "@openagentpack/sdk": "0.1.0", + "@openagentpack/sdk": "0.3.0-beta-8d9edcd-20260722", "bailian-cli-core": "workspace:*", "bailian-cli-runtime": "workspace:*", "boxen": "catalog:", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 58771368..2d5419c0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -40,10 +40,6 @@ catalogs: specifier: ^3.4.0 version: 3.4.0 -overrides: - vite: npm:@voidzero-dev/vite-plus-core@latest - vitest: npm:@voidzero-dev/vite-plus-test@latest - importers: .: @@ -104,8 +100,8 @@ importers: packages/commands: dependencies: '@openagentpack/sdk': - specifier: 0.1.0 - version: 0.1.0 + specifier: 0.3.0-beta-8d9edcd-20260722 + version: 0.3.0-beta-8d9edcd-20260722 bailian-cli-core: specifier: workspace:* version: link:../core @@ -449,8 +445,8 @@ packages: '@emnapi/core': ^1.7.1 '@emnapi/runtime': ^1.7.1 - '@openagentpack/sdk@0.1.0': - resolution: {integrity: sha512-6IsFwOyuLnB/WIW9CGtpaJaRcGylYIs6UPW/Yz1gZveiuTTFdEWOi8LQ52JmOHB10J1lar+TrW2DJBEejxxu0Q==} + '@openagentpack/sdk@0.3.0-beta-8d9edcd-20260722': + resolution: {integrity: sha512-WqF8srhE4Gu2fBRb6jFpuCNq+Bkzp/acPRW2TNsWOpb1qSwi7vRfrv2tBf8iMDXtDFOQP4jb/j7QS5/1/X5ShQ==} engines: {node: '>=22'} '@oxc-project/runtime@0.129.0': @@ -1593,7 +1589,7 @@ snapshots: '@tybys/wasm-util': 0.10.1 optional: true - '@openagentpack/sdk@0.1.0': + '@openagentpack/sdk@0.3.0-beta-8d9edcd-20260722': dependencies: jszip: 3.10.1 yaml: 2.9.0 From 1da3367de8d18f0a8af9b969089056200fb264fe Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Wed, 22 Jul 2026 17:44:50 +0800 Subject: [PATCH 05/21] feat: fix ci --- pnpm-lock.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 2d5419c0..bed1456b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -40,6 +40,10 @@ catalogs: specifier: ^3.4.0 version: 3.4.0 +overrides: + vite: npm:@voidzero-dev/vite-plus-core@latest + vitest: npm:@voidzero-dev/vite-plus-test@latest + importers: .: From 64335a6201f2070ee0dbfcc31c9c693798308e3c Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Thu, 23 Jul 2026 16:46:06 +0800 Subject: [PATCH 06/21] feat(agent): rename cli command to managed-agent --- docs/agents/auth-change.md | 2 +- packages/cli/agents.yaml | 27 ++ packages/cli/src/commands.ts | 64 ++-- packages/commands/src/commands/auth/login.ts | 8 +- .../_engine/address-utils.ts | 0 .../_engine/config-loader.ts | 0 .../_engine/console-capture.ts | 0 .../_engine/credentials.ts | 2 +- .../_engine/errors.ts | 0 .../_engine/feedback.ts | 0 .../_engine/file-state-manager.ts | 0 .../_engine/pagination.ts | 0 .../_engine/session-render.ts | 0 .../_engine/transport.ts | 0 .../{agent => managed-agent}/apply.ts | 2 +- .../{agent => managed-agent}/destroy.ts | 0 .../commands/{agent => managed-agent}/init.ts | 2 +- .../commands/{agent => managed-agent}/plan.ts | 0 .../session-create.ts | 0 .../session-delete.ts | 0 .../session-events.ts | 0 .../{agent => managed-agent}/session-get.ts | 0 .../{agent => managed-agent}/session-list.ts | 0 .../{agent => managed-agent}/session-run.ts | 0 .../{agent => managed-agent}/session-send.ts | 0 .../{agent => managed-agent}/state-import.ts | 0 .../{agent => managed-agent}/state-list.ts | 0 .../{agent => managed-agent}/state-rm.ts | 0 .../{agent => managed-agent}/state-show.ts | 0 .../{agent => managed-agent}/validate.ts | 0 packages/commands/src/index.ts | 32 +- .../commands/tests/credentials-bridge.test.ts | 2 +- ...s.test.ts => managed-agent-errors.test.ts} | 2 +- packages/core/src/config/schema.ts | 2 +- skills/bailian-cli/reference/auth.md | 20 +- skills/bailian-cli/reference/index.md | 274 ++++++++--------- .../reference/{agent.md => managed-agent.md} | 284 +++++++++--------- 37 files changed, 377 insertions(+), 346 deletions(-) create mode 100644 packages/cli/agents.yaml rename packages/commands/src/commands/{agent => managed-agent}/_engine/address-utils.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/_engine/config-loader.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/_engine/console-capture.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/_engine/credentials.ts (96%) rename packages/commands/src/commands/{agent => managed-agent}/_engine/errors.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/_engine/feedback.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/_engine/file-state-manager.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/_engine/pagination.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/_engine/session-render.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/_engine/transport.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/apply.ts (98%) rename packages/commands/src/commands/{agent => managed-agent}/destroy.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/init.ts (98%) rename packages/commands/src/commands/{agent => managed-agent}/plan.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/session-create.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/session-delete.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/session-events.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/session-get.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/session-list.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/session-run.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/session-send.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/state-import.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/state-list.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/state-rm.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/state-show.ts (100%) rename packages/commands/src/commands/{agent => managed-agent}/validate.ts (100%) rename packages/commands/tests/{agent-errors.test.ts => managed-agent-errors.test.ts} (97%) rename skills/bailian-cli/reference/{agent.md => managed-agent.md} (68%) diff --git a/docs/agents/auth-change.md b/docs/agents/auth-change.md index c4d477af..9523d698 100644 --- a/docs/agents/auth-change.md +++ b/docs/agents/auth-change.md @@ -55,7 +55,7 @@ defineCommand({ auth }) → runtime/authStage → ctx.client → command.run(ctx ### 例外:agent 命令的 SDK 凭证桥接 -`bl agent *` 命令声明 `auth: "none"`,凭证由 `@openagentpack/sdk` 自主从 env 解析(agents.yaml 的 `${DASHSCOPE_API_KEY}` / `${BAILIAN_WORKSPACE_ID}` 插值)。为让 bl 登录态复用,`packages/commands/src/commands/agent/_engine/credentials.ts` 的 `bridgeBailianCredentials()` 会**直接 `readConfigFile()`**,把 config 的 `api_key` / `workspace_id` 作为最低优先级兜底填入对应 env,仅填空值,不覆盖已有。这是唯一允许命令层直接读 config 的场景(SDK 只认 env,不走 `ctx.client`);优先级链:`~/.agents/config.json` > shell env > `.env` > `~/.bailian/config.json`。 +`bl managed-agent *` 命令声明 `auth: "none"`,凭证由 `@openagentpack/sdk` 自主从 env 解析(agents.yaml 的 `${DASHSCOPE_API_KEY}` / `${BAILIAN_WORKSPACE_ID}` 插值)。为让 bl 登录态复用,`packages/commands/src/commands/managed-agent/_engine/credentials.ts` 的 `bridgeBailianCredentials()` 会**直接 `readConfigFile()`**,把 config 的 `api_key` / `workspace_id` 作为最低优先级兜底填入对应 env,仅填空值,不覆盖已有。这是唯一允许命令层直接读 config 的场景(SDK 只认 env,不走 `ctx.client`);优先级链:`~/.agents/config.json` > shell env > `.env` > `~/.bailian/config.json`。 ## 必查清单 diff --git a/packages/cli/agents.yaml b/packages/cli/agents.yaml new file mode 100644 index 00000000..715470a4 --- /dev/null +++ b/packages/cli/agents.yaml @@ -0,0 +1,27 @@ +version: "1" + +providers: + bailian: + # bl auth login --api-key <key> sets DASHSCOPE_API_KEY; --agentstudio-base-url <url> sets BAILIAN_BASE_URL + api_key: ${DASHSCOPE_API_KEY} + base_url: ${BAILIAN_BASE_URL} + +defaults: + provider: bailian + +environments: + dev: + config: + type: cloud + networking: + type: unrestricted + +agents: + assistant: + description: "General-purpose assistant" + model: qwen3.7-max + instructions: | + You are a helpful assistant. + environment: dev + tools: + builtin: [bash, read, glob, grep] diff --git a/packages/cli/src/commands.ts b/packages/cli/src/commands.ts index 722424ea..8f4315df 100644 --- a/packages/cli/src/commands.ts +++ b/packages/cli/src/commands.ts @@ -89,22 +89,22 @@ import { pluginLink, pluginList, pluginRemove, - agentInit, - agentValidate, - agentPlan, - agentApply, - agentDestroy, - agentStateList, - agentStateShow, - agentStateRm, - agentStateImport, - agentSessionCreate, - agentSessionList, - agentSessionGet, - agentSessionDelete, - agentSessionRun, - agentSessionSend, - agentSessionEvents, + managedAgentInit, + managedAgentValidate, + managedAgentPlan, + managedAgentApply, + managedAgentDestroy, + managedAgentStateList, + managedAgentStateShow, + managedAgentStateRm, + managedAgentStateImport, + managedAgentSessionCreate, + managedAgentSessionList, + managedAgentSessionGet, + managedAgentSessionDelete, + managedAgentSessionRun, + managedAgentSessionSend, + managedAgentSessionEvents, } from "bailian-cli-commands"; // Full bailian-cli product: every command, exposed under the `bl` binary. @@ -202,20 +202,20 @@ export const commands: Record<string, AnyCommand> = { "plugin link": pluginLink, "plugin list": pluginList, "plugin remove": pluginRemove, - "agent init": agentInit, - "agent validate": agentValidate, - "agent plan": agentPlan, - "agent apply": agentApply, - "agent destroy": agentDestroy, - "agent state list": agentStateList, - "agent state show": agentStateShow, - "agent state rm": agentStateRm, - "agent state import": agentStateImport, - "agent session create": agentSessionCreate, - "agent session list": agentSessionList, - "agent session get": agentSessionGet, - "agent session delete": agentSessionDelete, - "agent session run": agentSessionRun, - "agent session send": agentSessionSend, - "agent session events": agentSessionEvents, + "managed-agent init": managedAgentInit, + "managed-agent validate": managedAgentValidate, + "managed-agent plan": managedAgentPlan, + "managed-agent apply": managedAgentApply, + "managed-agent destroy": managedAgentDestroy, + "managed-agent state list": managedAgentStateList, + "managed-agent state show": managedAgentStateShow, + "managed-agent state rm": managedAgentStateRm, + "managed-agent state import": managedAgentStateImport, + "managed-agent session create": managedAgentSessionCreate, + "managed-agent session list": managedAgentSessionList, + "managed-agent session get": managedAgentSessionGet, + "managed-agent session delete": managedAgentSessionDelete, + "managed-agent session run": managedAgentSessionRun, + "managed-agent session send": managedAgentSessionSend, + "managed-agent session events": managedAgentSessionEvents, }; diff --git a/packages/commands/src/commands/auth/login.ts b/packages/commands/src/commands/auth/login.ts index 640654a6..d8b6218b 100644 --- a/packages/commands/src/commands/auth/login.ts +++ b/packages/commands/src/commands/auth/login.ts @@ -21,7 +21,11 @@ export default defineCommand({ usageArgs: "--api-key <key> | --console | --open-api --access-key-id <id> --access-key-secret <secret>", flags: { - apiKey: { type: "string", valueHint: "<key>", description: "Model API key to store" }, + apiKey: { + type: "string", + valueHint: "<key>", + description: "Model API key to store", + }, baseUrl: { type: "string", valueHint: "<url>", @@ -31,7 +35,7 @@ export default defineCommand({ type: "string", valueHint: "<url>", description: - "Bailian AgentStudio base URL for `bl agent` commands (sets BAILIAN_BASE_URL; used with --api-key)", + "Bailian AgentStudio base URL for `bl managed-agent` commands (sets BAILIAN_BASE_URL; used with --api-key)", }, console: { type: "switch", diff --git a/packages/commands/src/commands/agent/_engine/address-utils.ts b/packages/commands/src/commands/managed-agent/_engine/address-utils.ts similarity index 100% rename from packages/commands/src/commands/agent/_engine/address-utils.ts rename to packages/commands/src/commands/managed-agent/_engine/address-utils.ts diff --git a/packages/commands/src/commands/agent/_engine/config-loader.ts b/packages/commands/src/commands/managed-agent/_engine/config-loader.ts similarity index 100% rename from packages/commands/src/commands/agent/_engine/config-loader.ts rename to packages/commands/src/commands/managed-agent/_engine/config-loader.ts diff --git a/packages/commands/src/commands/agent/_engine/console-capture.ts b/packages/commands/src/commands/managed-agent/_engine/console-capture.ts similarity index 100% rename from packages/commands/src/commands/agent/_engine/console-capture.ts rename to packages/commands/src/commands/managed-agent/_engine/console-capture.ts diff --git a/packages/commands/src/commands/agent/_engine/credentials.ts b/packages/commands/src/commands/managed-agent/_engine/credentials.ts similarity index 96% rename from packages/commands/src/commands/agent/_engine/credentials.ts rename to packages/commands/src/commands/managed-agent/_engine/credentials.ts index 92fb203e..19079e18 100644 --- a/packages/commands/src/commands/agent/_engine/credentials.ts +++ b/packages/commands/src/commands/managed-agent/_engine/credentials.ts @@ -20,7 +20,7 @@ export const CREDENTIALS_NOTE = [ * the bailian provider. bl persists `api_key` / `agentstudio_base_url` in * `~/.bailian/config.json` (via `bl auth login`); mirror them onto * `DASHSCOPE_API_KEY` / `BAILIAN_BASE_URL` so users don't have to re-declare the - * same credentials for `bl agent *`. `workspace_id` is still bridged for configs + * same credentials for `bl managed-agent *`. `workspace_id` is still bridged for configs * that predate the base_url flow (the SDK accepts either). * * Lowest priority: only fills a var that is still unset, so anything already in diff --git a/packages/commands/src/commands/agent/_engine/errors.ts b/packages/commands/src/commands/managed-agent/_engine/errors.ts similarity index 100% rename from packages/commands/src/commands/agent/_engine/errors.ts rename to packages/commands/src/commands/managed-agent/_engine/errors.ts diff --git a/packages/commands/src/commands/agent/_engine/feedback.ts b/packages/commands/src/commands/managed-agent/_engine/feedback.ts similarity index 100% rename from packages/commands/src/commands/agent/_engine/feedback.ts rename to packages/commands/src/commands/managed-agent/_engine/feedback.ts diff --git a/packages/commands/src/commands/agent/_engine/file-state-manager.ts b/packages/commands/src/commands/managed-agent/_engine/file-state-manager.ts similarity index 100% rename from packages/commands/src/commands/agent/_engine/file-state-manager.ts rename to packages/commands/src/commands/managed-agent/_engine/file-state-manager.ts diff --git a/packages/commands/src/commands/agent/_engine/pagination.ts b/packages/commands/src/commands/managed-agent/_engine/pagination.ts similarity index 100% rename from packages/commands/src/commands/agent/_engine/pagination.ts rename to packages/commands/src/commands/managed-agent/_engine/pagination.ts diff --git a/packages/commands/src/commands/agent/_engine/session-render.ts b/packages/commands/src/commands/managed-agent/_engine/session-render.ts similarity index 100% rename from packages/commands/src/commands/agent/_engine/session-render.ts rename to packages/commands/src/commands/managed-agent/_engine/session-render.ts diff --git a/packages/commands/src/commands/agent/_engine/transport.ts b/packages/commands/src/commands/managed-agent/_engine/transport.ts similarity index 100% rename from packages/commands/src/commands/agent/_engine/transport.ts rename to packages/commands/src/commands/managed-agent/_engine/transport.ts diff --git a/packages/commands/src/commands/agent/apply.ts b/packages/commands/src/commands/managed-agent/apply.ts similarity index 98% rename from packages/commands/src/commands/agent/apply.ts rename to packages/commands/src/commands/managed-agent/apply.ts index cd66f1a6..56e1c834 100644 --- a/packages/commands/src/commands/agent/apply.ts +++ b/packages/commands/src/commands/managed-agent/apply.ts @@ -95,7 +95,7 @@ export default defineCommand({ throw new BailianError( `Refusing to apply ${actionable.length} change(s) (${creates} create, ${updates} update, ${deletes.length} destroy) without confirmation.`, ExitCode.USAGE, - "Review with `bl agent plan`, then re-run with --yes to apply.", + "Review with `bl managed-agent plan`, then re-run with --yes to apply.", ); } diff --git a/packages/commands/src/commands/agent/destroy.ts b/packages/commands/src/commands/managed-agent/destroy.ts similarity index 100% rename from packages/commands/src/commands/agent/destroy.ts rename to packages/commands/src/commands/managed-agent/destroy.ts diff --git a/packages/commands/src/commands/agent/init.ts b/packages/commands/src/commands/managed-agent/init.ts similarity index 98% rename from packages/commands/src/commands/agent/init.ts rename to packages/commands/src/commands/managed-agent/init.ts index 78ee8d45..55d333ac 100644 --- a/packages/commands/src/commands/agent/init.ts +++ b/packages/commands/src/commands/managed-agent/init.ts @@ -140,7 +140,7 @@ export default defineCommand({ "Credentials: run `bl auth login --api-key <key> --agentstudio-base-url <url>`, or set DASHSCOPE_API_KEY / BAILIAN_BASE_URL.", ); } - emitBare("Next: edit agents.yaml, then run `bl agent plan`."); + emitBare("Next: edit agents.yaml, then run `bl managed-agent plan`."); } }, }); diff --git a/packages/commands/src/commands/agent/plan.ts b/packages/commands/src/commands/managed-agent/plan.ts similarity index 100% rename from packages/commands/src/commands/agent/plan.ts rename to packages/commands/src/commands/managed-agent/plan.ts diff --git a/packages/commands/src/commands/agent/session-create.ts b/packages/commands/src/commands/managed-agent/session-create.ts similarity index 100% rename from packages/commands/src/commands/agent/session-create.ts rename to packages/commands/src/commands/managed-agent/session-create.ts diff --git a/packages/commands/src/commands/agent/session-delete.ts b/packages/commands/src/commands/managed-agent/session-delete.ts similarity index 100% rename from packages/commands/src/commands/agent/session-delete.ts rename to packages/commands/src/commands/managed-agent/session-delete.ts diff --git a/packages/commands/src/commands/agent/session-events.ts b/packages/commands/src/commands/managed-agent/session-events.ts similarity index 100% rename from packages/commands/src/commands/agent/session-events.ts rename to packages/commands/src/commands/managed-agent/session-events.ts diff --git a/packages/commands/src/commands/agent/session-get.ts b/packages/commands/src/commands/managed-agent/session-get.ts similarity index 100% rename from packages/commands/src/commands/agent/session-get.ts rename to packages/commands/src/commands/managed-agent/session-get.ts diff --git a/packages/commands/src/commands/agent/session-list.ts b/packages/commands/src/commands/managed-agent/session-list.ts similarity index 100% rename from packages/commands/src/commands/agent/session-list.ts rename to packages/commands/src/commands/managed-agent/session-list.ts diff --git a/packages/commands/src/commands/agent/session-run.ts b/packages/commands/src/commands/managed-agent/session-run.ts similarity index 100% rename from packages/commands/src/commands/agent/session-run.ts rename to packages/commands/src/commands/managed-agent/session-run.ts diff --git a/packages/commands/src/commands/agent/session-send.ts b/packages/commands/src/commands/managed-agent/session-send.ts similarity index 100% rename from packages/commands/src/commands/agent/session-send.ts rename to packages/commands/src/commands/managed-agent/session-send.ts diff --git a/packages/commands/src/commands/agent/state-import.ts b/packages/commands/src/commands/managed-agent/state-import.ts similarity index 100% rename from packages/commands/src/commands/agent/state-import.ts rename to packages/commands/src/commands/managed-agent/state-import.ts diff --git a/packages/commands/src/commands/agent/state-list.ts b/packages/commands/src/commands/managed-agent/state-list.ts similarity index 100% rename from packages/commands/src/commands/agent/state-list.ts rename to packages/commands/src/commands/managed-agent/state-list.ts diff --git a/packages/commands/src/commands/agent/state-rm.ts b/packages/commands/src/commands/managed-agent/state-rm.ts similarity index 100% rename from packages/commands/src/commands/agent/state-rm.ts rename to packages/commands/src/commands/managed-agent/state-rm.ts diff --git a/packages/commands/src/commands/agent/state-show.ts b/packages/commands/src/commands/managed-agent/state-show.ts similarity index 100% rename from packages/commands/src/commands/agent/state-show.ts rename to packages/commands/src/commands/managed-agent/state-show.ts diff --git a/packages/commands/src/commands/agent/validate.ts b/packages/commands/src/commands/managed-agent/validate.ts similarity index 100% rename from packages/commands/src/commands/agent/validate.ts rename to packages/commands/src/commands/managed-agent/validate.ts diff --git a/packages/commands/src/index.ts b/packages/commands/src/index.ts index 3549ec4a..8b317ef1 100644 --- a/packages/commands/src/index.ts +++ b/packages/commands/src/index.ts @@ -91,22 +91,22 @@ export { default as tokenPlanListSeats } from "./commands/token-plan/list-seats. export { default as tokenPlanCreateKey } from "./commands/token-plan/create-key.ts"; export { default as tokenPlanAssignSeats } from "./commands/token-plan/assign-seats.ts"; export { default as tokenPlanAddMember } from "./commands/token-plan/add-member.ts"; -export { default as agentInit } from "./commands/agent/init.ts"; -export { default as agentValidate } from "./commands/agent/validate.ts"; -export { default as agentPlan } from "./commands/agent/plan.ts"; -export { default as agentApply } from "./commands/agent/apply.ts"; -export { default as agentDestroy } from "./commands/agent/destroy.ts"; -export { default as agentStateList } from "./commands/agent/state-list.ts"; -export { default as agentStateShow } from "./commands/agent/state-show.ts"; -export { default as agentStateRm } from "./commands/agent/state-rm.ts"; -export { default as agentStateImport } from "./commands/agent/state-import.ts"; -export { default as agentSessionCreate } from "./commands/agent/session-create.ts"; -export { default as agentSessionList } from "./commands/agent/session-list.ts"; -export { default as agentSessionGet } from "./commands/agent/session-get.ts"; -export { default as agentSessionDelete } from "./commands/agent/session-delete.ts"; -export { default as agentSessionRun } from "./commands/agent/session-run.ts"; -export { default as agentSessionSend } from "./commands/agent/session-send.ts"; -export { default as agentSessionEvents } from "./commands/agent/session-events.ts"; +export { default as managedAgentInit } from "./commands/managed-agent/init.ts"; +export { default as managedAgentValidate } from "./commands/managed-agent/validate.ts"; +export { default as managedAgentPlan } from "./commands/managed-agent/plan.ts"; +export { default as managedAgentApply } from "./commands/managed-agent/apply.ts"; +export { default as managedAgentDestroy } from "./commands/managed-agent/destroy.ts"; +export { default as managedAgentStateList } from "./commands/managed-agent/state-list.ts"; +export { default as managedAgentStateShow } from "./commands/managed-agent/state-show.ts"; +export { default as managedAgentStateRm } from "./commands/managed-agent/state-rm.ts"; +export { default as managedAgentStateImport } from "./commands/managed-agent/state-import.ts"; +export { default as managedAgentSessionCreate } from "./commands/managed-agent/session-create.ts"; +export { default as managedAgentSessionList } from "./commands/managed-agent/session-list.ts"; +export { default as managedAgentSessionGet } from "./commands/managed-agent/session-get.ts"; +export { default as managedAgentSessionDelete } from "./commands/managed-agent/session-delete.ts"; +export { default as managedAgentSessionRun } from "./commands/managed-agent/session-run.ts"; +export { default as managedAgentSessionSend } from "./commands/managed-agent/session-send.ts"; +export { default as managedAgentSessionEvents } from "./commands/managed-agent/session-events.ts"; export { default as workspaceInit } from "./commands/workspace/init.ts"; export { default as pluginInstall } from "./commands/plugin/install.ts"; export { default as pluginLink } from "./commands/plugin/link.ts"; diff --git a/packages/commands/tests/credentials-bridge.test.ts b/packages/commands/tests/credentials-bridge.test.ts index 46f35ca0..0d2454eb 100644 --- a/packages/commands/tests/credentials-bridge.test.ts +++ b/packages/commands/tests/credentials-bridge.test.ts @@ -2,7 +2,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "fs"; import { tmpdir } from "os"; import { join } from "path"; import { expect, test } from "vite-plus/test"; -import { bridgeBailianCredentials } from "../src/commands/agent/_engine/credentials.ts"; +import { bridgeBailianCredentials } from "../src/commands/managed-agent/_engine/credentials.ts"; /** * bridgeBailianCredentials 把 ~/.bailian/config.json 的 api_key / agentstudio_base_url diff --git a/packages/commands/tests/agent-errors.test.ts b/packages/commands/tests/managed-agent-errors.test.ts similarity index 97% rename from packages/commands/tests/agent-errors.test.ts rename to packages/commands/tests/managed-agent-errors.test.ts index c93e3b9e..85e87a6f 100644 --- a/packages/commands/tests/agent-errors.test.ts +++ b/packages/commands/tests/managed-agent-errors.test.ts @@ -1,7 +1,7 @@ import { UserError } from "@openagentpack/sdk"; import { BailianError, ExitCode } from "bailian-cli-core"; import { expect, test } from "vite-plus/test"; -import { withAgentErrors } from "../src/commands/agent/_engine/errors.ts"; +import { withAgentErrors } from "../src/commands/managed-agent/_engine/errors.ts"; /** * Structural stand-in for the SDK's internal `ApiError` (not exported by the diff --git a/packages/core/src/config/schema.ts b/packages/core/src/config/schema.ts index 70c7e49d..c684ba8e 100644 --- a/packages/core/src/config/schema.ts +++ b/packages/core/src/config/schema.ts @@ -28,7 +28,7 @@ export interface ConfigFile { security_token?: string; base_url?: string; /** - * Bailian AgentStudio API base URL for `bl agent` commands, e.g. + * Bailian AgentStudio API base URL for `bl managed-agent` commands, e.g. * `https://<workspace>.cn-beijing.maas.aliyuncs.com/api/v1/agentstudio`. * Distinct from `base_url` (the DashScope model API): the agent path bridges * this to the SDK's `BAILIAN_BASE_URL`, so a workspace_id is not required. diff --git a/skills/bailian-cli/reference/auth.md b/skills/bailian-cli/reference/auth.md index 932280b7..d834c7bc 100644 --- a/skills/bailian-cli/reference/auth.md +++ b/skills/bailian-cli/reference/auth.md @@ -48,16 +48,16 @@ bl auth generate-access-token --access-key-id LTAIxxxxx --access-key-secret xxxx #### Flags -| Flag | Type | Required | Description | -| ------------------------------ | ------ | -------- | ------------------------------------------------------------------------------------------------- | -| `--api-key <key>` | string | no | Model API key to store | -| `--base-url <url>` | string | no | Model API base URL (used with --api-key for validation) | -| `--agentstudio-base-url <url>` | string | no | Bailian AgentStudio base URL for `bl agent` commands (sets BAILIAN_BASE_URL; used with --api-key) | -| `--console` | switch | no | Sign in via browser; use --console-site to choose domestic (default) or international | -| `--console-site <site>` | string | no | Console site: domestic, international | -| `--open-api` | switch | no | Store Alibaba Cloud OpenAPI AK/SK credentials | -| `--access-key-id <id>` | string | no | Alibaba Cloud Access Key ID to store | -| `--access-key-secret <secret>` | string | no | Alibaba Cloud Access Key Secret to store | +| Flag | Type | Required | Description | +| ------------------------------ | ------ | -------- | --------------------------------------------------------------------------------------------------------- | +| `--api-key <key>` | string | no | Model API key to store | +| `--base-url <url>` | string | no | Model API base URL (used with --api-key for validation) | +| `--agentstudio-base-url <url>` | string | no | Bailian AgentStudio base URL for `bl managed-agent` commands (sets BAILIAN_BASE_URL; used with --api-key) | +| `--console` | switch | no | Sign in via browser; use --console-site to choose domestic (default) or international | +| `--console-site <site>` | string | no | Console site: domestic, international | +| `--open-api` | switch | no | Store Alibaba Cloud OpenAPI AK/SK credentials | +| `--access-key-id <id>` | string | no | Alibaba Cloud Access Key ID to store | +| `--access-key-secret <secret>` | string | no | Alibaba Cloud Access Key Secret to store | #### Examples diff --git a/skills/bailian-cli/reference/index.md b/skills/bailian-cli/reference/index.md index 94aecd1d..1cce5232 100644 --- a/skills/bailian-cli/reference/index.md +++ b/skills/bailian-cli/reference/index.md @@ -8,146 +8,146 @@ Use this index for the full quick index and global flags. ## Quick index -| Command | Description | Detail | -| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | -| `bl advisor recommend` | Recommend the best models for your use case (intent analysis → candidate recall → LLM ranking) | [advisor.md](advisor.md) | -| `bl agent apply` | Apply planned changes to create/update/delete agent resources | [agent.md](agent.md) | -| `bl agent destroy` | Destroy all managed agent resources tracked in state | [agent.md](agent.md) | -| `bl agent init` | Create a new agents.yaml template | [agent.md](agent.md) | -| `bl agent plan` | Show what changes would be applied to agent infrastructure | [agent.md](agent.md) | -| `bl agent session create` | Create a new session for an agent | [agent.md](agent.md) | -| `bl agent session delete` | Delete a session | [agent.md](agent.md) | -| `bl agent session events` | List event history for a session | [agent.md](agent.md) | -| `bl agent session get` | Get details of a session | [agent.md](agent.md) | -| `bl agent session list` | List sessions from the provider | [agent.md](agent.md) | -| `bl agent session run` | Create a session, send a message, and stream the response | [agent.md](agent.md) | -| `bl agent session send` | Send a message to an existing session and stream the response | [agent.md](agent.md) | -| `bl agent state import` | Import an existing remote resource into agents state | [agent.md](agent.md) | -| `bl agent state list` | List resources tracked in agents state | [agent.md](agent.md) | -| `bl agent state rm` | Remove a resource from state without destroying it remotely | [agent.md](agent.md) | -| `bl agent state show` | Show details of a resource in agents state | [agent.md](agent.md) | -| `bl agent validate` | Validate an agents.yaml configuration (offline) | [agent.md](agent.md) | -| `bl app call` | Call a Bailian application (agent or workflow) | [app.md](app.md) | -| `bl app list` | List Bailian applications | [app.md](app.md) | -| `bl auth generate-access-token` | Generate a CLI access token using OpenAPI AK/SK | [auth.md](auth.md) | -| `bl auth login` | Authenticate with API key, console browser login, or OpenAPI AK/SK (credentials can coexist) | [auth.md](auth.md) | -| `bl auth logout` | Clear stored credentials; full logout also clears the model Base URL | [auth.md](auth.md) | -| `bl auth status` | Show current authentication state | [auth.md](auth.md) | -| `bl config agent` | Configure a coding agent to use DashScope API | [config.md](config.md) | -| `bl config list` | List config profiles and show the active profile | [config.md](config.md) | -| `bl config set` | Set a config value | [config.md](config.md) | -| `bl config show` | Display current configuration | [config.md](config.md) | -| `bl config ui` | Open a local web UI to manage config profiles | [config.md](config.md) | -| `bl config use` | Set the active config profile | [config.md](config.md) | -| `bl console call` | Call a Bailian console API via the CLI gateway | [console.md](console.md) | -| `bl dataset delete` | Delete a dataset file by ID | [dataset.md](dataset.md) | -| `bl dataset get` | Get details of a single dataset file | [dataset.md](dataset.md) | -| `bl dataset list` | List uploaded dataset files | [dataset.md](dataset.md) | -| `bl dataset upload` | Upload a dataset file (.jsonl or .zip) to Bailian | [dataset.md](dataset.md) | -| `bl dataset validate` | Locally validate a dataset file (.jsonl or .zip) without uploading | [dataset.md](dataset.md) | -| `bl deploy audio create` | Create an audio (TTS) model deployment | [deploy.md](deploy.md) | -| `bl deploy delete` | Delete a model deployment (must be STOPPED or FAILED) | [deploy.md](deploy.md) | -| `bl deploy get` | Get details of a single model deployment | [deploy.md](deploy.md) | -| `bl deploy image create` | Create an image generation model deployment | [deploy.md](deploy.md) | -| `bl deploy list` | List model deployments | [deploy.md](deploy.md) | -| `bl deploy models` | List models available for deployment | [deploy.md](deploy.md) | -| `bl deploy scale` | Scale a deployment's capacity | [deploy.md](deploy.md) | -| `bl deploy text create` | Create a text model deployment | [deploy.md](deploy.md) | -| `bl deploy update` | Update a deployment's rate limits (rpm_limit / tpm_limit) | [deploy.md](deploy.md) | -| `bl file upload` | Upload a local file to DashScope temporary storage (48h) | [file.md](file.md) | -| `bl finetune audio create` | Create an audio TTS model fine-tune job (sft-lora) | [finetune.md](finetune.md) | -| `bl finetune cancel` | Cancel a running fine-tune job | [finetune.md](finetune.md) | -| `bl finetune capability` | Query fine-tune training capability — by model (which training types it supports) or by training type (which models support it) | [finetune.md](finetune.md) | -| `bl finetune checkpoints` | List checkpoints produced by a fine-tune job | [finetune.md](finetune.md) | -| `bl finetune delete` | Delete a fine-tune job record | [finetune.md](finetune.md) | -| `bl finetune export` | Publish a checkpoint as a deployable model | [finetune.md](finetune.md) | -| `bl finetune get` | Get details of a single fine-tune job | [finetune.md](finetune.md) | -| `bl finetune image create` | Create an image generation model fine-tune job (sft-lora) | [finetune.md](finetune.md) | -| `bl finetune list` | List fine-tune jobs | [finetune.md](finetune.md) | -| `bl finetune logs` | Fetch training logs for a fine-tune job | [finetune.md](finetune.md) | -| `bl finetune text create` | Create a text model fine-tune job (sft \| sft-lora \| dpo \| dpo-lora \| cpt) | [finetune.md](finetune.md) | -| `bl finetune watch` | Probe a fine-tune job's status (default: single non-blocking fetch). Pass --follow to poll until terminal. | [finetune.md](finetune.md) | -| `bl image edit` | Edit an existing image with text instructions (Qwen-Image / Wan 2.7) | [image.md](image.md) | -| `bl image generate` | Generate images (Qwen-Image / wan2.x) | [image.md](image.md) | -| `bl knowledge chat` | Chat with a Bailian knowledge base (RAG Q&A with streaming) | [knowledge.md](knowledge.md) | -| `bl knowledge retrieve` | Retrieve from a Bailian knowledge base (deprecated, use `search` instead) | [knowledge.md](knowledge.md) | -| `bl knowledge search` | Search a Bailian knowledge base (RAG semantic retrieval) | [knowledge.md](knowledge.md) | -| `bl mcp call` | Call a tool on an MCP server (tools/call) | [mcp.md](mcp.md) | -| `bl mcp list` | List MCP servers activated under your Bailian account | [mcp.md](mcp.md) | -| `bl mcp tools` | List tools exposed by an MCP server (tools/list) | [mcp.md](mcp.md) | -| `bl memory add` | Add memory from messages or custom content | [memory.md](memory.md) | -| `bl memory delete` | Delete a memory node | [memory.md](memory.md) | -| `bl memory list` | List memory nodes for a user | [memory.md](memory.md) | -| `bl memory profile create` | Create a user profile schema for memory profiling | [memory.md](memory.md) | -| `bl memory profile get` | Get user profile by schema ID and user ID | [memory.md](memory.md) | -| `bl memory search` | Search memory nodes by query or messages | [memory.md](memory.md) | -| `bl memory update` | Update a memory node content | [memory.md](memory.md) | -| `bl model list` | Browse model families or show detailed model info in the Bailian model marketplace | [model.md](model.md) | -| `bl omni` | Multimodal chat with text + audio output (Qwen-Omni) | [omni.md](omni.md) | -| `bl pipeline run` | Run a pipeline workflow definition | [pipeline.md](pipeline.md) | -| `bl pipeline validate` | Validate a pipeline definition without executing | [pipeline.md](pipeline.md) | -| `bl plugin install` | Install or upgrade an allowlisted Command Pack | [plugin.md](plugin.md) | -| `bl plugin link` | Link an allowlisted local Command Pack for development | [plugin.md](plugin.md) | -| `bl plugin list` | List installed Command Packs and their load status | [plugin.md](plugin.md) | -| `bl plugin remove` | Remove an installed Command Pack | [plugin.md](plugin.md) | -| `bl quota check` | Check current usage against rate limits | [quota.md](quota.md) | -| `bl quota history` | View quota change history | [quota.md](quota.md) | -| `bl quota list` | View model RPM/TPM rate limits | [quota.md](quota.md) | -| `bl quota request` | Request a temporary quota increase | [quota.md](quota.md) | -| `bl search web` | Search the web using DashScope MCP WebSearch service | [search.md](search.md) | -| `bl speech recognize` | Recognize speech from audio files (FunAudio-ASR) | [speech.md](speech.md) | -| `bl speech synthesize` | Synthesize speech from text (CosyVoice TTS) | [speech.md](speech.md) | -| `bl text chat` | Send a chat completion (OpenAI compatible, DashScope) | [text.md](text.md) | -| `bl token-plan add-member` | Add a member to a Token Plan organization | [token-plan.md](token-plan.md) | -| `bl token-plan assign-seats` | Batch assign Token Plan seats to members | [token-plan.md](token-plan.md) | -| `bl token-plan create-key` | Create a Token Plan API key for a seat | [token-plan.md](token-plan.md) | -| `bl token-plan list-seats` | List Token Plan subscription seat details | [token-plan.md](token-plan.md) | -| `bl update` | Update the CLI to the latest version | [update.md](update.md) | -| `bl usage free` | Query free-tier quota for models (all models if --model is omitted) | [usage.md](usage.md) | -| `bl usage freetier` | Enable or disable auto-stop for free-tier models. Enables by default; use --off to disable | [usage.md](usage.md) | -| `bl usage stats` | Query model usage statistics | [usage.md](usage.md) | -| `bl usage summary` | Show a unified usage summary: free-tier quota and recent usage overview | [usage.md](usage.md) | -| `bl video download` | Download a completed video by task ID | [video.md](video.md) | -| `bl video edit` | Edit a video with happyhorse-1.0-video-edit (style transfer, object replacement, etc.) | [video.md](video.md) | -| `bl video generate` | Generate a video from text or image (happyhorse-1.1-t2v / happyhorse-1.1-i2v / wan2.6-t2v) | [video.md](video.md) | -| `bl video ref` | Reference-to-video generation (happyhorse-1.1-r2v / wan2.6-r2v): multi-subject, multi-shot with voice | [video.md](video.md) | -| `bl video task get` | Query async task status | [video.md](video.md) | -| `bl vision describe` | Describe an image or video using Qwen-VL | [vision.md](vision.md) | -| `bl workspace init` | Initialize Bailian workspace and activate postpaid services | [workspace.md](workspace.md) | -| `bl workspace list` | List all workspaces | [workspace.md](workspace.md) | +| Command | Description | Detail | +| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ | +| `bl advisor recommend` | Recommend the best models for your use case (intent analysis → candidate recall → LLM ranking) | [advisor.md](advisor.md) | +| `bl app call` | Call a Bailian application (agent or workflow) | [app.md](app.md) | +| `bl app list` | List Bailian applications | [app.md](app.md) | +| `bl auth generate-access-token` | Generate a CLI access token using OpenAPI AK/SK | [auth.md](auth.md) | +| `bl auth login` | Authenticate with API key, console browser login, or OpenAPI AK/SK (credentials can coexist) | [auth.md](auth.md) | +| `bl auth logout` | Clear stored credentials; full logout also clears the model Base URL | [auth.md](auth.md) | +| `bl auth status` | Show current authentication state | [auth.md](auth.md) | +| `bl config agent` | Configure a coding agent to use DashScope API | [config.md](config.md) | +| `bl config list` | List config profiles and show the active profile | [config.md](config.md) | +| `bl config set` | Set a config value | [config.md](config.md) | +| `bl config show` | Display current configuration | [config.md](config.md) | +| `bl config ui` | Open a local web UI to manage config profiles | [config.md](config.md) | +| `bl config use` | Set the active config profile | [config.md](config.md) | +| `bl console call` | Call a Bailian console API via the CLI gateway | [console.md](console.md) | +| `bl dataset delete` | Delete a dataset file by ID | [dataset.md](dataset.md) | +| `bl dataset get` | Get details of a single dataset file | [dataset.md](dataset.md) | +| `bl dataset list` | List uploaded dataset files | [dataset.md](dataset.md) | +| `bl dataset upload` | Upload a dataset file (.jsonl or .zip) to Bailian | [dataset.md](dataset.md) | +| `bl dataset validate` | Locally validate a dataset file (.jsonl or .zip) without uploading | [dataset.md](dataset.md) | +| `bl deploy audio create` | Create an audio (TTS) model deployment | [deploy.md](deploy.md) | +| `bl deploy delete` | Delete a model deployment (must be STOPPED or FAILED) | [deploy.md](deploy.md) | +| `bl deploy get` | Get details of a single model deployment | [deploy.md](deploy.md) | +| `bl deploy image create` | Create an image generation model deployment | [deploy.md](deploy.md) | +| `bl deploy list` | List model deployments | [deploy.md](deploy.md) | +| `bl deploy models` | List models available for deployment | [deploy.md](deploy.md) | +| `bl deploy scale` | Scale a deployment's capacity | [deploy.md](deploy.md) | +| `bl deploy text create` | Create a text model deployment | [deploy.md](deploy.md) | +| `bl deploy update` | Update a deployment's rate limits (rpm_limit / tpm_limit) | [deploy.md](deploy.md) | +| `bl file upload` | Upload a local file to DashScope temporary storage (48h) | [file.md](file.md) | +| `bl finetune audio create` | Create an audio TTS model fine-tune job (sft-lora) | [finetune.md](finetune.md) | +| `bl finetune cancel` | Cancel a running fine-tune job | [finetune.md](finetune.md) | +| `bl finetune capability` | Query fine-tune training capability — by model (which training types it supports) or by training type (which models support it) | [finetune.md](finetune.md) | +| `bl finetune checkpoints` | List checkpoints produced by a fine-tune job | [finetune.md](finetune.md) | +| `bl finetune delete` | Delete a fine-tune job record | [finetune.md](finetune.md) | +| `bl finetune export` | Publish a checkpoint as a deployable model | [finetune.md](finetune.md) | +| `bl finetune get` | Get details of a single fine-tune job | [finetune.md](finetune.md) | +| `bl finetune image create` | Create an image generation model fine-tune job (sft-lora) | [finetune.md](finetune.md) | +| `bl finetune list` | List fine-tune jobs | [finetune.md](finetune.md) | +| `bl finetune logs` | Fetch training logs for a fine-tune job | [finetune.md](finetune.md) | +| `bl finetune text create` | Create a text model fine-tune job (sft \| sft-lora \| dpo \| dpo-lora \| cpt) | [finetune.md](finetune.md) | +| `bl finetune watch` | Probe a fine-tune job's status (default: single non-blocking fetch). Pass --follow to poll until terminal. | [finetune.md](finetune.md) | +| `bl image edit` | Edit an existing image with text instructions (Qwen-Image / Wan 2.7) | [image.md](image.md) | +| `bl image generate` | Generate images (Qwen-Image / wan2.x) | [image.md](image.md) | +| `bl knowledge chat` | Chat with a Bailian knowledge base (RAG Q&A with streaming) | [knowledge.md](knowledge.md) | +| `bl knowledge retrieve` | Retrieve from a Bailian knowledge base (deprecated, use `search` instead) | [knowledge.md](knowledge.md) | +| `bl knowledge search` | Search a Bailian knowledge base (RAG semantic retrieval) | [knowledge.md](knowledge.md) | +| `bl managed-agent apply` | Apply planned changes to create/update/delete agent resources | [managed-agent.md](managed-agent.md) | +| `bl managed-agent destroy` | Destroy all managed agent resources tracked in state | [managed-agent.md](managed-agent.md) | +| `bl managed-agent init` | Create a new agents.yaml template | [managed-agent.md](managed-agent.md) | +| `bl managed-agent plan` | Show what changes would be applied to agent infrastructure | [managed-agent.md](managed-agent.md) | +| `bl managed-agent session create` | Create a new session for an agent | [managed-agent.md](managed-agent.md) | +| `bl managed-agent session delete` | Delete a session | [managed-agent.md](managed-agent.md) | +| `bl managed-agent session events` | List event history for a session | [managed-agent.md](managed-agent.md) | +| `bl managed-agent session get` | Get details of a session | [managed-agent.md](managed-agent.md) | +| `bl managed-agent session list` | List sessions from the provider | [managed-agent.md](managed-agent.md) | +| `bl managed-agent session run` | Create a session, send a message, and stream the response | [managed-agent.md](managed-agent.md) | +| `bl managed-agent session send` | Send a message to an existing session and stream the response | [managed-agent.md](managed-agent.md) | +| `bl managed-agent state import` | Import an existing remote resource into agents state | [managed-agent.md](managed-agent.md) | +| `bl managed-agent state list` | List resources tracked in agents state | [managed-agent.md](managed-agent.md) | +| `bl managed-agent state rm` | Remove a resource from state without destroying it remotely | [managed-agent.md](managed-agent.md) | +| `bl managed-agent state show` | Show details of a resource in agents state | [managed-agent.md](managed-agent.md) | +| `bl managed-agent validate` | Validate an agents.yaml configuration (offline) | [managed-agent.md](managed-agent.md) | +| `bl mcp call` | Call a tool on an MCP server (tools/call) | [mcp.md](mcp.md) | +| `bl mcp list` | List MCP servers activated under your Bailian account | [mcp.md](mcp.md) | +| `bl mcp tools` | List tools exposed by an MCP server (tools/list) | [mcp.md](mcp.md) | +| `bl memory add` | Add memory from messages or custom content | [memory.md](memory.md) | +| `bl memory delete` | Delete a memory node | [memory.md](memory.md) | +| `bl memory list` | List memory nodes for a user | [memory.md](memory.md) | +| `bl memory profile create` | Create a user profile schema for memory profiling | [memory.md](memory.md) | +| `bl memory profile get` | Get user profile by schema ID and user ID | [memory.md](memory.md) | +| `bl memory search` | Search memory nodes by query or messages | [memory.md](memory.md) | +| `bl memory update` | Update a memory node content | [memory.md](memory.md) | +| `bl model list` | Browse model families or show detailed model info in the Bailian model marketplace | [model.md](model.md) | +| `bl omni` | Multimodal chat with text + audio output (Qwen-Omni) | [omni.md](omni.md) | +| `bl pipeline run` | Run a pipeline workflow definition | [pipeline.md](pipeline.md) | +| `bl pipeline validate` | Validate a pipeline definition without executing | [pipeline.md](pipeline.md) | +| `bl plugin install` | Install or upgrade an allowlisted Command Pack | [plugin.md](plugin.md) | +| `bl plugin link` | Link an allowlisted local Command Pack for development | [plugin.md](plugin.md) | +| `bl plugin list` | List installed Command Packs and their load status | [plugin.md](plugin.md) | +| `bl plugin remove` | Remove an installed Command Pack | [plugin.md](plugin.md) | +| `bl quota check` | Check current usage against rate limits | [quota.md](quota.md) | +| `bl quota history` | View quota change history | [quota.md](quota.md) | +| `bl quota list` | View model RPM/TPM rate limits | [quota.md](quota.md) | +| `bl quota request` | Request a temporary quota increase | [quota.md](quota.md) | +| `bl search web` | Search the web using DashScope MCP WebSearch service | [search.md](search.md) | +| `bl speech recognize` | Recognize speech from audio files (FunAudio-ASR) | [speech.md](speech.md) | +| `bl speech synthesize` | Synthesize speech from text (CosyVoice TTS) | [speech.md](speech.md) | +| `bl text chat` | Send a chat completion (OpenAI compatible, DashScope) | [text.md](text.md) | +| `bl token-plan add-member` | Add a member to a Token Plan organization | [token-plan.md](token-plan.md) | +| `bl token-plan assign-seats` | Batch assign Token Plan seats to members | [token-plan.md](token-plan.md) | +| `bl token-plan create-key` | Create a Token Plan API key for a seat | [token-plan.md](token-plan.md) | +| `bl token-plan list-seats` | List Token Plan subscription seat details | [token-plan.md](token-plan.md) | +| `bl update` | Update the CLI to the latest version | [update.md](update.md) | +| `bl usage free` | Query free-tier quota for models (all models if --model is omitted) | [usage.md](usage.md) | +| `bl usage freetier` | Enable or disable auto-stop for free-tier models. Enables by default; use --off to disable | [usage.md](usage.md) | +| `bl usage stats` | Query model usage statistics | [usage.md](usage.md) | +| `bl usage summary` | Show a unified usage summary: free-tier quota and recent usage overview | [usage.md](usage.md) | +| `bl video download` | Download a completed video by task ID | [video.md](video.md) | +| `bl video edit` | Edit a video with happyhorse-1.0-video-edit (style transfer, object replacement, etc.) | [video.md](video.md) | +| `bl video generate` | Generate a video from text or image (happyhorse-1.1-t2v / happyhorse-1.1-i2v / wan2.6-t2v) | [video.md](video.md) | +| `bl video ref` | Reference-to-video generation (happyhorse-1.1-r2v / wan2.6-r2v): multi-subject, multi-shot with voice | [video.md](video.md) | +| `bl video task get` | Query async task status | [video.md](video.md) | +| `bl vision describe` | Describe an image or video using Qwen-VL | [vision.md](vision.md) | +| `bl workspace init` | Initialize Bailian workspace and activate postpaid services | [workspace.md](workspace.md) | +| `bl workspace list` | List all workspaces | [workspace.md](workspace.md) | ## By group -| Group | Commands | Reference | -| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | -| `advisor` | `recommend` | [advisor.md](advisor.md) | -| `agent` | `apply`, `destroy`, `init`, `plan`, `session create`, `session delete`, `session events`, `session get`, `session list`, `session run`, `session send`, `state import`, `state list`, `state rm`, `state show`, `validate` | [agent.md](agent.md) | -| `app` | `call`, `list` | [app.md](app.md) | -| `auth` | `generate-access-token`, `login`, `logout`, `status` | [auth.md](auth.md) | -| `config` | `agent`, `list`, `set`, `show`, `ui`, `use` | [config.md](config.md) | -| `console` | `call` | [console.md](console.md) | -| `dataset` | `delete`, `get`, `list`, `upload`, `validate` | [dataset.md](dataset.md) | -| `deploy` | `audio create`, `delete`, `get`, `image create`, `list`, `models`, `scale`, `text create`, `update` | [deploy.md](deploy.md) | -| `file` | `upload` | [file.md](file.md) | -| `finetune` | `audio create`, `cancel`, `capability`, `checkpoints`, `delete`, `export`, `get`, `image create`, `list`, `logs`, `text create`, `watch` | [finetune.md](finetune.md) | -| `image` | `edit`, `generate` | [image.md](image.md) | -| `knowledge` | `chat`, `retrieve`, `search` | [knowledge.md](knowledge.md) | -| `mcp` | `call`, `list`, `tools` | [mcp.md](mcp.md) | -| `memory` | `add`, `delete`, `list`, `profile create`, `profile get`, `search`, `update` | [memory.md](memory.md) | -| `model` | `list` | [model.md](model.md) | -| `omni` | `(root)` | [omni.md](omni.md) | -| `pipeline` | `run`, `validate` | [pipeline.md](pipeline.md) | -| `plugin` | `install`, `link`, `list`, `remove` | [plugin.md](plugin.md) | -| `quota` | `check`, `history`, `list`, `request` | [quota.md](quota.md) | -| `search` | `web` | [search.md](search.md) | -| `speech` | `recognize`, `synthesize` | [speech.md](speech.md) | -| `text` | `chat` | [text.md](text.md) | -| `token-plan` | `add-member`, `assign-seats`, `create-key`, `list-seats` | [token-plan.md](token-plan.md) | -| `update` | `(root)` | [update.md](update.md) | -| `usage` | `free`, `freetier`, `stats`, `summary` | [usage.md](usage.md) | -| `video` | `download`, `edit`, `generate`, `ref`, `task get` | [video.md](video.md) | -| `vision` | `describe` | [vision.md](vision.md) | -| `workspace` | `init`, `list` | [workspace.md](workspace.md) | +| Group | Commands | Reference | +| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ | +| `advisor` | `recommend` | [advisor.md](advisor.md) | +| `app` | `call`, `list` | [app.md](app.md) | +| `auth` | `generate-access-token`, `login`, `logout`, `status` | [auth.md](auth.md) | +| `config` | `agent`, `list`, `set`, `show`, `ui`, `use` | [config.md](config.md) | +| `console` | `call` | [console.md](console.md) | +| `dataset` | `delete`, `get`, `list`, `upload`, `validate` | [dataset.md](dataset.md) | +| `deploy` | `audio create`, `delete`, `get`, `image create`, `list`, `models`, `scale`, `text create`, `update` | [deploy.md](deploy.md) | +| `file` | `upload` | [file.md](file.md) | +| `finetune` | `audio create`, `cancel`, `capability`, `checkpoints`, `delete`, `export`, `get`, `image create`, `list`, `logs`, `text create`, `watch` | [finetune.md](finetune.md) | +| `image` | `edit`, `generate` | [image.md](image.md) | +| `knowledge` | `chat`, `retrieve`, `search` | [knowledge.md](knowledge.md) | +| `managed-agent` | `apply`, `destroy`, `init`, `plan`, `session create`, `session delete`, `session events`, `session get`, `session list`, `session run`, `session send`, `state import`, `state list`, `state rm`, `state show`, `validate` | [managed-agent.md](managed-agent.md) | +| `mcp` | `call`, `list`, `tools` | [mcp.md](mcp.md) | +| `memory` | `add`, `delete`, `list`, `profile create`, `profile get`, `search`, `update` | [memory.md](memory.md) | +| `model` | `list` | [model.md](model.md) | +| `omni` | `(root)` | [omni.md](omni.md) | +| `pipeline` | `run`, `validate` | [pipeline.md](pipeline.md) | +| `plugin` | `install`, `link`, `list`, `remove` | [plugin.md](plugin.md) | +| `quota` | `check`, `history`, `list`, `request` | [quota.md](quota.md) | +| `search` | `web` | [search.md](search.md) | +| `speech` | `recognize`, `synthesize` | [speech.md](speech.md) | +| `text` | `chat` | [text.md](text.md) | +| `token-plan` | `add-member`, `assign-seats`, `create-key`, `list-seats` | [token-plan.md](token-plan.md) | +| `update` | `(root)` | [update.md](update.md) | +| `usage` | `free`, `freetier`, `stats`, `summary` | [usage.md](usage.md) | +| `video` | `download`, `edit`, `generate`, `ref`, `task get` | [video.md](video.md) | +| `vision` | `describe` | [vision.md](vision.md) | +| `workspace` | `init`, `list` | [workspace.md](workspace.md) | ## Global flags diff --git a/skills/bailian-cli/reference/agent.md b/skills/bailian-cli/reference/managed-agent.md similarity index 68% rename from skills/bailian-cli/reference/agent.md rename to skills/bailian-cli/reference/managed-agent.md index bd73e5dc..a2f2df8d 100644 --- a/skills/bailian-cli/reference/agent.md +++ b/skills/bailian-cli/reference/managed-agent.md @@ -1,4 +1,4 @@ -# `bl agent` commands +# `bl managed-agent` commands > Auto-generated from `packages/cli/src/commands.ts`. Do not edit by hand. > Regenerate: `pnpm --filter bailian-cli run generate:reference`. @@ -7,34 +7,34 @@ Index: [index.md](index.md) ## Commands in this group -| Command | Description | -| ------------------------- | ------------------------------------------------------------- | -| `bl agent apply` | Apply planned changes to create/update/delete agent resources | -| `bl agent destroy` | Destroy all managed agent resources tracked in state | -| `bl agent init` | Create a new agents.yaml template | -| `bl agent plan` | Show what changes would be applied to agent infrastructure | -| `bl agent session create` | Create a new session for an agent | -| `bl agent session delete` | Delete a session | -| `bl agent session events` | List event history for a session | -| `bl agent session get` | Get details of a session | -| `bl agent session list` | List sessions from the provider | -| `bl agent session run` | Create a session, send a message, and stream the response | -| `bl agent session send` | Send a message to an existing session and stream the response | -| `bl agent state import` | Import an existing remote resource into agents state | -| `bl agent state list` | List resources tracked in agents state | -| `bl agent state rm` | Remove a resource from state without destroying it remotely | -| `bl agent state show` | Show details of a resource in agents state | -| `bl agent validate` | Validate an agents.yaml configuration (offline) | +| Command | Description | +| --------------------------------- | ------------------------------------------------------------- | +| `bl managed-agent apply` | Apply planned changes to create/update/delete agent resources | +| `bl managed-agent destroy` | Destroy all managed agent resources tracked in state | +| `bl managed-agent init` | Create a new agents.yaml template | +| `bl managed-agent plan` | Show what changes would be applied to agent infrastructure | +| `bl managed-agent session create` | Create a new session for an agent | +| `bl managed-agent session delete` | Delete a session | +| `bl managed-agent session events` | List event history for a session | +| `bl managed-agent session get` | Get details of a session | +| `bl managed-agent session list` | List sessions from the provider | +| `bl managed-agent session run` | Create a session, send a message, and stream the response | +| `bl managed-agent session send` | Send a message to an existing session and stream the response | +| `bl managed-agent state import` | Import an existing remote resource into agents state | +| `bl managed-agent state list` | List resources tracked in agents state | +| `bl managed-agent state rm` | Remove a resource from state without destroying it remotely | +| `bl managed-agent state show` | Show details of a resource in agents state | +| `bl managed-agent validate` | Validate an agents.yaml configuration (offline) | ## Command details -### `bl agent apply` +### `bl managed-agent apply` -| Field | Value | -| --------------- | -------------------------------------------------------------------------------- | -| **Name** | `agent apply` | -| **Description** | Apply planned changes to create/update/delete agent resources | -| **Usage** | `bl agent apply [--file <path>] [--provider <name>] [--yes] [--concurrency <n>]` | +| Field | Value | +| --------------- | ---------------------------------------------------------------------------------------- | +| **Name** | `managed-agent apply` | +| **Description** | Apply planned changes to create/update/delete agent resources | +| **Usage** | `bl managed-agent apply [--file <path>] [--provider <name>] [--yes] [--concurrency <n>]` | #### Flags @@ -54,20 +54,20 @@ Index: [index.md](index.md) #### Examples ```bash -bl agent apply --yes +bl managed-agent apply --yes ``` ```bash -bl agent apply --provider bailian --yes +bl managed-agent apply --provider bailian --yes ``` -### `bl agent destroy` +### `bl managed-agent destroy` -| Field | Value | -| --------------- | ------------------------------------------------------ | -| **Name** | `agent destroy` | -| **Description** | Destroy all managed agent resources tracked in state | -| **Usage** | `bl agent destroy [--file <path>] [--yes] [--cascade]` | +| Field | Value | +| --------------- | -------------------------------------------------------------- | +| **Name** | `managed-agent destroy` | +| **Description** | Destroy all managed agent resources tracked in state | +| **Usage** | `bl managed-agent destroy [--file <path>] [--yes] [--cascade]` | #### Flags @@ -85,20 +85,20 @@ bl agent apply --provider bailian --yes #### Examples ```bash -bl agent destroy --yes +bl managed-agent destroy --yes ``` ```bash -bl agent destroy --yes --cascade +bl managed-agent destroy --yes --cascade ``` -### `bl agent init` +### `bl managed-agent init` -| Field | Value | -| --------------- | ----------------------------------------------------------------------------------- | -| **Name** | `agent init` | -| **Description** | Create a new agents.yaml template | -| **Usage** | `bl agent init [--provider <name>] [--agent-name <name>] [--file <path>] [--force]` | +| Field | Value | +| --------------- | ------------------------------------------------------------------------------------------- | +| **Name** | `managed-agent init` | +| **Description** | Create a new agents.yaml template | +| **Usage** | `bl managed-agent init [--provider <name>] [--agent-name <name>] [--file <path>] [--force]` | #### Flags @@ -112,24 +112,24 @@ bl agent destroy --yes --cascade #### Examples ```bash -bl agent init +bl managed-agent init ``` ```bash -bl agent init --provider bailian --agent-name assistant +bl managed-agent init --provider bailian --agent-name assistant ``` ```bash -bl agent init --provider all +bl managed-agent init --provider all ``` -### `bl agent plan` +### `bl managed-agent plan` -| Field | Value | -| --------------- | ----------------------------------------------------------------------------------- | -| **Name** | `agent plan` | -| **Description** | Show what changes would be applied to agent infrastructure | -| **Usage** | `bl agent plan [--file <path>] [--provider <name>] [--no-refresh] [--refresh-only]` | +| Field | Value | +| --------------- | ------------------------------------------------------------------------------------------- | +| **Name** | `managed-agent plan` | +| **Description** | Show what changes would be applied to agent infrastructure | +| **Usage** | `bl managed-agent plan [--file <path>] [--provider <name>] [--no-refresh] [--refresh-only]` | #### Flags @@ -148,24 +148,24 @@ bl agent init --provider all #### Examples ```bash -bl agent plan +bl managed-agent plan ``` ```bash -bl agent plan --provider bailian +bl managed-agent plan --provider bailian ``` ```bash -bl agent plan --no-refresh +bl managed-agent plan --no-refresh ``` -### `bl agent session create` +### `bl managed-agent session create` -| Field | Value | -| --------------- | --------------------------------------------------------------------------------------------------- | -| **Name** | `agent session create` | -| **Description** | Create a new session for an agent | -| **Usage** | `bl agent session create [--agent <name>] [--environment <name>] [--title <title>] [--file <path>]` | +| Field | Value | +| --------------- | ----------------------------------------------------------------------------------------------------------- | +| **Name** | `managed-agent session create` | +| **Description** | Create a new session for an agent | +| **Usage** | `bl managed-agent session create [--agent <name>] [--environment <name>] [--title <title>] [--file <path>]` | #### Flags @@ -187,24 +187,24 @@ bl agent plan --no-refresh #### Examples ```bash -bl agent session create +bl managed-agent session create ``` ```bash -bl agent session create --agent assistant +bl managed-agent session create --agent assistant ``` ```bash -bl agent session create --agent assistant --title 'debug run' +bl managed-agent session create --agent assistant --title 'debug run' ``` -### `bl agent session delete` +### `bl managed-agent session delete` -| Field | Value | -| --------------- | ------------------------------------------------------------------------------- | -| **Name** | `agent session delete` | -| **Description** | Delete a session | -| **Usage** | `bl agent session delete --session-id <id> [--provider <name>] [--file <path>]` | +| Field | Value | +| --------------- | --------------------------------------------------------------------------------------- | +| **Name** | `managed-agent session delete` | +| **Description** | Delete a session | +| **Usage** | `bl managed-agent session delete --session-id <id> [--provider <name>] [--file <path>]` | #### Flags @@ -222,16 +222,16 @@ bl agent session create --agent assistant --title 'debug run' #### Examples ```bash -bl agent session delete --session-id sess_abc123 +bl managed-agent session delete --session-id sess_abc123 ``` -### `bl agent session events` +### `bl managed-agent session events` -| Field | Value | -| --------------- | --------------------------------------------------------------------------------- | -| **Name** | `agent session events` | -| **Description** | List event history for a session | -| **Usage** | `bl agent session events --session-id <id> [--limit <n>] [--all] [--file <path>]` | +| Field | Value | +| --------------- | ----------------------------------------------------------------------------------------- | +| **Name** | `managed-agent session events` | +| **Description** | List event history for a session | +| **Usage** | `bl managed-agent session events --session-id <id> [--limit <n>] [--all] [--file <path>]` | #### Flags @@ -251,20 +251,20 @@ bl agent session delete --session-id sess_abc123 #### Examples ```bash -bl agent session events --session-id sess_abc123 +bl managed-agent session events --session-id sess_abc123 ``` ```bash -bl agent session events --session-id sess_abc123 --all +bl managed-agent session events --session-id sess_abc123 --all ``` -### `bl agent session get` +### `bl managed-agent session get` -| Field | Value | -| --------------- | ---------------------------------------------------------------------------- | -| **Name** | `agent session get` | -| **Description** | Get details of a session | -| **Usage** | `bl agent session get --session-id <id> [--provider <name>] [--file <path>]` | +| Field | Value | +| --------------- | ------------------------------------------------------------------------------------ | +| **Name** | `managed-agent session get` | +| **Description** | Get details of a session | +| **Usage** | `bl managed-agent session get --session-id <id> [--provider <name>] [--file <path>]` | #### Flags @@ -282,16 +282,16 @@ bl agent session events --session-id sess_abc123 --all #### Examples ```bash -bl agent session get --session-id sess_abc123 +bl managed-agent session get --session-id sess_abc123 ``` -### `bl agent session list` +### `bl managed-agent session list` -| Field | Value | -| --------------- | ------------------------------------------------------------------------------------ | -| **Name** | `agent session list` | -| **Description** | List sessions from the provider | -| **Usage** | `bl agent session list [--agent <name>] [--all] [--provider <name>] [--file <path>]` | +| Field | Value | +| --------------- | -------------------------------------------------------------------------------------------- | +| **Name** | `managed-agent session list` | +| **Description** | List sessions from the provider | +| **Usage** | `bl managed-agent session list [--agent <name>] [--all] [--provider <name>] [--file <path>]` | #### Flags @@ -310,24 +310,24 @@ bl agent session get --session-id sess_abc123 #### Examples ```bash -bl agent session list +bl managed-agent session list ``` ```bash -bl agent session list --agent assistant +bl managed-agent session list --agent assistant ``` ```bash -bl agent session list --all +bl managed-agent session list --all ``` -### `bl agent session run` +### `bl managed-agent session run` -| Field | Value | -| --------------- | ------------------------------------------------------------------------------------- | -| **Name** | `agent session run` | -| **Description** | Create a session, send a message, and stream the response | -| **Usage** | `bl agent session run --prompt <text> [--agent <name>] [--no-stream] [--file <path>]` | +| Field | Value | +| --------------- | --------------------------------------------------------------------------------------------- | +| **Name** | `managed-agent session run` | +| **Description** | Create a session, send a message, and stream the response | +| **Usage** | `bl managed-agent session run --prompt <text> [--agent <name>] [--no-stream] [--file <path>]` | #### Flags @@ -351,20 +351,20 @@ bl agent session list --all #### Examples ```bash -bl agent session run --prompt "hello" +bl managed-agent session run --prompt "hello" ``` ```bash -bl agent session run --agent assistant --prompt "summarize this repo" +bl managed-agent session run --agent assistant --prompt "summarize this repo" ``` -### `bl agent session send` +### `bl managed-agent session send` -| Field | Value | -| --------------- | ---------------------------------------------------------------------------------------- | -| **Name** | `agent session send` | -| **Description** | Send a message to an existing session and stream the response | -| **Usage** | `bl agent session send --session-id <id> --message <text> [--no-stream] [--file <path>]` | +| Field | Value | +| --------------- | ------------------------------------------------------------------------------------------------ | +| **Name** | `managed-agent session send` | +| **Description** | Send a message to an existing session and stream the response | +| **Usage** | `bl managed-agent session send --session-id <id> --message <text> [--no-stream] [--file <path>]` | #### Flags @@ -384,16 +384,16 @@ bl agent session run --agent assistant --prompt "summarize this repo" #### Examples ```bash -bl agent session send --session-id sess_abc123 --message "continue" +bl managed-agent session send --session-id sess_abc123 --message "continue" ``` -### `bl agent state import` +### `bl managed-agent state import` -| Field | Value | -| --------------- | ---------------------------------------------------------------------------------------------------------------- | -| **Name** | `agent state import` | -| **Description** | Import an existing remote resource into agents state | -| **Usage** | `bl agent state import --address <provider.type.name> --remote-id <id> [--resource-version <n>] [--file <path>]` | +| Field | Value | +| --------------- | ------------------------------------------------------------------------------------------------------------------------ | +| **Name** | `managed-agent state import` | +| **Description** | Import an existing remote resource into agents state | +| **Usage** | `bl managed-agent state import --address <provider.type.name> --remote-id <id> [--resource-version <n>] [--file <path>]` | #### Flags @@ -412,16 +412,16 @@ bl agent session send --session-id sess_abc123 --message "continue" #### Examples ```bash -bl agent state import --address bailian.agent.assistant --remote-id agent-abc123 +bl managed-agent state import --address bailian.agent.assistant --remote-id agent-abc123 ``` -### `bl agent state list` +### `bl managed-agent state list` -| Field | Value | -| --------------- | -------------------------------------- | -| **Name** | `agent state list` | -| **Description** | List resources tracked in agents state | -| **Usage** | `bl agent state list [--file <path>]` | +| Field | Value | +| --------------- | --------------------------------------------- | +| **Name** | `managed-agent state list` | +| **Description** | List resources tracked in agents state | +| **Usage** | `bl managed-agent state list [--file <path>]` | #### Flags @@ -437,20 +437,20 @@ bl agent state import --address bailian.agent.assistant --remote-id agent-abc123 #### Examples ```bash -bl agent state list +bl managed-agent state list ``` ```bash -bl agent state list --file agents.yaml +bl managed-agent state list --file agents.yaml ``` -### `bl agent state rm` +### `bl managed-agent state rm` -| Field | Value | -| --------------- | ------------------------------------------------------------------ | -| **Name** | `agent state rm` | -| **Description** | Remove a resource from state without destroying it remotely | -| **Usage** | `bl agent state rm --address <provider.type.name> [--file <path>]` | +| Field | Value | +| --------------- | -------------------------------------------------------------------------- | +| **Name** | `managed-agent state rm` | +| **Description** | Remove a resource from state without destroying it remotely | +| **Usage** | `bl managed-agent state rm --address <provider.type.name> [--file <path>]` | #### Flags @@ -467,16 +467,16 @@ bl agent state list --file agents.yaml #### Examples ```bash -bl agent state rm --address bailian.agent.assistant +bl managed-agent state rm --address bailian.agent.assistant ``` -### `bl agent state show` +### `bl managed-agent state show` -| Field | Value | -| --------------- | -------------------------------------------------------------------- | -| **Name** | `agent state show` | -| **Description** | Show details of a resource in agents state | -| **Usage** | `bl agent state show --address <provider.type.name> [--file <path>]` | +| Field | Value | +| --------------- | ---------------------------------------------------------------------------- | +| **Name** | `managed-agent state show` | +| **Description** | Show details of a resource in agents state | +| **Usage** | `bl managed-agent state show --address <provider.type.name> [--file <path>]` | #### Flags @@ -493,16 +493,16 @@ bl agent state rm --address bailian.agent.assistant #### Examples ```bash -bl agent state show --address bailian.agent.assistant +bl managed-agent state show --address bailian.agent.assistant ``` -### `bl agent validate` +### `bl managed-agent validate` | Field | Value | | --------------- | ----------------------------------------------- | -| **Name** | `agent validate` | +| **Name** | `managed-agent validate` | | **Description** | Validate an agents.yaml configuration (offline) | -| **Usage** | `bl agent validate [--file <path>]` | +| **Usage** | `bl managed-agent validate [--file <path>]` | #### Flags @@ -518,9 +518,9 @@ bl agent state show --address bailian.agent.assistant #### Examples ```bash -bl agent validate +bl managed-agent validate ``` ```bash -bl agent validate --file agents.yaml +bl managed-agent validate --file agents.yaml ``` From 9cad1994e76b118a0fd16034987b3b38e92ecb63 Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Fri, 24 Jul 2026 14:50:30 +0800 Subject: [PATCH 07/21] feat(agent): validate by client apiKey auth type --- docs/agents/auth-change.md | 13 +- packages/commands/src/commands/auth/login.ts | 12 - packages/commands/src/commands/config/set.ts | 13 +- .../commands/src/commands/config/shared.ts | 2 - .../managed-agent/_engine/config-loader.ts | 57 +++- .../managed-agent/_engine/credentials.ts | 166 +++++++--- .../src/commands/managed-agent/apply.ts | 2 +- .../src/commands/managed-agent/destroy.ts | 2 +- .../src/commands/managed-agent/init.ts | 6 +- .../src/commands/managed-agent/plan.ts | 2 +- .../commands/managed-agent/session-create.ts | 2 +- .../commands/managed-agent/session-delete.ts | 2 +- .../commands/managed-agent/session-events.ts | 2 +- .../src/commands/managed-agent/session-get.ts | 2 +- .../commands/managed-agent/session-list.ts | 2 +- .../src/commands/managed-agent/session-run.ts | 2 +- .../commands/managed-agent/session-send.ts | 2 +- .../commands/managed-agent/state-import.ts | 2 +- .../src/commands/managed-agent/state-list.ts | 2 +- .../src/commands/managed-agent/state-rm.ts | 2 +- .../src/commands/managed-agent/state-show.ts | 2 +- .../src/commands/managed-agent/validate.ts | 9 +- .../commands/tests/credentials-bridge.test.ts | 299 ++++++++++-------- packages/core/src/auth/store.ts | 1 - packages/core/src/client/client.ts | 11 + packages/core/src/config/schema.ts | 24 -- skills/bailian-cli/reference/auth.md | 19 +- skills/bailian-cli/reference/config.md | 8 +- skills/bailian-cli/reference/managed-agent.md | 129 +++++--- vite.config.ts | 23 +- 30 files changed, 516 insertions(+), 304 deletions(-) diff --git a/docs/agents/auth-change.md b/docs/agents/auth-change.md index 9523d698..3c391cba 100644 --- a/docs/agents/auth-change.md +++ b/docs/agents/auth-change.md @@ -53,9 +53,18 @@ defineCommand({ auth }) → runtime/authStage → ctx.client → command.run(ctx 命令不要直接解析 token、env 或 config。业务请求统一走 `ctx.client`;登录/配置命令通过 `ctx.authStore` / `ctx.configStore` 的窄接口操作落盘。 -### 例外:agent 命令的 SDK 凭证桥接 +### 例外:agent 命令的 SDK 凭证内存注入 -`bl managed-agent *` 命令声明 `auth: "none"`,凭证由 `@openagentpack/sdk` 自主从 env 解析(agents.yaml 的 `${DASHSCOPE_API_KEY}` / `${BAILIAN_WORKSPACE_ID}` 插值)。为让 bl 登录态复用,`packages/commands/src/commands/managed-agent/_engine/credentials.ts` 的 `bridgeBailianCredentials()` 会**直接 `readConfigFile()`**,把 config 的 `api_key` / `workspace_id` 作为最低优先级兜底填入对应 env,仅填空值,不覆盖已有。这是唯一允许命令层直接读 config 的场景(SDK 只认 env,不走 `ctx.client`);优先级链:`~/.agents/config.json` > shell env > `.env` > `~/.bailian/config.json`。 +`bl managed-agent *` 的全部命令声明 `auth: "apiKey"`(含纯本地脚手架 `init` —— 统一登录门槛,无例外),bailian 凭证由 authStage 经 `resolveApiKey(sources)` 权威解析(flag > env > active profile config,缺失时抛统一 AUTH 错误)。 + +凭证不再以真实值写入 `process.env`,而是经 `packages/commands/src/commands/managed-agent/_engine/` 的**内存注入管道**(`resolveAgentProjectConfig`)注入 SDK,管道四步: + +1. `prepareProviderEnv()` — 先 `bootstrapRuntimeCredentialsSync()`(SDK 把 `.env` / `~/.agents/config.json` 灌进 env,服务 claude/ark/qoder 等非 bailian provider),再把全部凭证类 env(`CREDENTIAL_ENV_KEYS`,含别名)中仍为 undefined 的占位为 `""`,使 agents.yaml 插值不因缺变量抛错 +2. `resolveProjectConfig` — 插值发生:bailian 插值拿到占位空串,claude/ark 拿到真实 env 值 +3. `injectProviderCredentials()` — 用 `ctx.client.exportApiCredential()`(lint 限定 `managed-agent/_engine/**` 可用)覆写内存 config 对象的 bailian 块:`api_key` 无条件覆写;`base_url`(拼 `/api/v1/agentstudio` 后缀)/`workspace_id`(取 `settings.workspaceId`)仅在引用且为空时填充 +4. `scrubCredentialEnv()` + `assertProviderCredentials()` — 从 `process.env` 删除全部凭证变量(真实凭证此后只存于 config 对象 → provider adapter 实例内存,不驻留 env / 不被子进程继承);任一已声明 provider 的 `api_key` 为空 → CLI 权威 `AUTH` 错误 + provider 专属 hint(取代 SDK 原始插值/zod 报错) + +`bl auth login` 仅管理 bailian(DashScope)凭证;claude/ark/qoder 的 key 从 env(shell / `.env` / `~/.agents/config.json`)经插值进入 config 对象,同样被清扫。禁止命令层直接 `readConfigFile` 裸读凭证;bailian 字段以 CLI 鉴权链为唯一信源。 ## 必查清单 diff --git a/packages/commands/src/commands/auth/login.ts b/packages/commands/src/commands/auth/login.ts index d8b6218b..006dcd35 100644 --- a/packages/commands/src/commands/auth/login.ts +++ b/packages/commands/src/commands/auth/login.ts @@ -31,12 +31,6 @@ export default defineCommand({ valueHint: "<url>", description: "Model API base URL (used with --api-key for validation)", }, - agentstudioBaseUrl: { - type: "string", - valueHint: "<url>", - description: - "Bailian AgentStudio base URL for `bl managed-agent` commands (sets BAILIAN_BASE_URL; used with --api-key)", - }, console: { type: "switch", description: @@ -78,9 +72,6 @@ export default defineCommand({ if (!apiKeyMode && hasValue(f.baseUrl)) { return "Use --base-url only with --api-key"; } - if (!apiKeyMode && hasValue(f.agentstudioBaseUrl)) { - return "Use --agentstudio-base-url only with --api-key"; - } if (!consoleMode && hasValue(f.consoleSite)) { return "Use --console-site only with --console"; } @@ -162,9 +153,6 @@ export default defineCommand({ await validateAndPersistApiKey(deps, key, { baseUrl: resolvedBaseUrl, persistBaseUrl, - persistPatch: flags.agentstudioBaseUrl - ? { agentstudio_base_url: flags.agentstudioBaseUrl } - : undefined, defaultTextModel: profilePreset?.defaultTextModel, defaultVideoModel: profilePreset?.defaultVideoModel, defaultImageToVideoModel: profilePreset?.defaultImageToVideoModel, diff --git a/packages/commands/src/commands/config/set.ts b/packages/commands/src/commands/config/set.ts index dcceb545..ea75a4aa 100644 --- a/packages/commands/src/commands/config/set.ts +++ b/packages/commands/src/commands/config/set.ts @@ -11,10 +11,15 @@ export default defineCommand({ type: "string", valueHint: "<key>", description: - "Config key (base_url, output, output_dir, timeout, api_key, access_token, access_key_id, access_key_secret, security_token, default_*_model, workspace_id, agentstudio_base_url)", + "Config key (base_url, output, output_dir, timeout, api_key, access_token, access_key_id, access_key_secret, security_token, default_*_model, workspace_id)", + required: true, + }, + value: { + type: "string", + valueHint: "<value>", + description: "Value to set", required: true, }, - value: { type: "string", valueHint: "<value>", description: "Value to set", required: true }, }, exampleArgs: [ "--key output --value json", @@ -44,7 +49,9 @@ export default defineCommand({ return; } - await ctx.configStore.write({ [resolvedKey]: coerced } as Partial<ConfigFile>); + await ctx.configStore.write({ + [resolvedKey]: coerced, + } as Partial<ConfigFile>); if (!settings.quiet) { const shown = SECRET_KEYS.has(resolvedKey) ? maskToken(String(coerced)) : coerced; diff --git a/packages/commands/src/commands/config/shared.ts b/packages/commands/src/commands/config/shared.ts index b886cda2..4757140c 100644 --- a/packages/commands/src/commands/config/shared.ts +++ b/packages/commands/src/commands/config/shared.ts @@ -19,7 +19,6 @@ export const VALID_KEYS = [ "default_speech_model", "default_omni_model", "workspace_id", - "agentstudio_base_url", ] as const; // Keys whose values are secrets. `config set` / `config show` mask these; the @@ -50,7 +49,6 @@ export const KEY_ALIASES: Record<string, string> = { "default-speech-model": "default_speech_model", "default-omni-model": "default_omni_model", "workspace-id": "workspace_id", - "agentstudio-base-url": "agentstudio_base_url", }; /** Resolve a hyphen alias to its underscore config key. */ diff --git a/packages/commands/src/commands/managed-agent/_engine/config-loader.ts b/packages/commands/src/commands/managed-agent/_engine/config-loader.ts index 433549d9..ae5ffdac 100644 --- a/packages/commands/src/commands/managed-agent/_engine/config-loader.ts +++ b/packages/commands/src/commands/managed-agent/_engine/config-loader.ts @@ -1,34 +1,71 @@ import { createProjectRuntime, + type LoadedProjectConfig, type ProjectRuntimeContext, resolveProjectConfig, UserError, } from "@openagentpack/sdk"; -import { ensureCredentials } from "./credentials.ts"; +import { + assertProviderCredentials, + type CredentialHost, + injectProviderCredentials, + prepareProviderEnv, + scrubCredentialEnv, +} from "./credentials.ts"; import { loadFileState } from "./file-state-manager.ts"; import { type HostContext, installSdkTransport } from "./transport.ts"; export { CREDENTIALS_NOTE } from "./credentials.ts"; +interface AgentConfigOptions { + resolveEnv?: boolean; + projectName?: string; + statePath?: string; +} + +/** + * Resolve agents.yaml with credentials injected the bl way and scrubbed from the + * environment — the shared credential spine for every SDK-engine command: + * 1. prepare env (SDK bootstrap for non-bailian + placeholders so interpolation + * never throws on a value we're about to supply/reject) + * 2. resolve + interpolate the config + * 3. override the bailian block with the CLI auth chain's credential (in-memory) + * 4. scrub all credential vars from process.env (real values now live only in + * the config object → provider adapters, never the environment) + * 5. fail with a CLI-authoritative AUTH error if any provider's key is empty + */ +export async function resolveAgentProjectConfig( + host: CredentialHost, + filePath: string, + options: AgentConfigOptions = {}, +): Promise<LoadedProjectConfig> { + prepareProviderEnv(); + const resolved = await resolveProjectConfig(filePath, options); + injectProviderCredentials(resolved.config.providers, host); + scrubCredentialEnv(); + assertProviderCredentials(resolved.config.providers); + return resolved; +} + /** * Build a full ProjectRuntimeContext from a config file path — the standard * entry point for agent commands that need the SDK engine. Mirrors OpenAgentPack * CLI's buildCliRuntime: resolve config → load local state → assemble runtime. * Takes the host context first so every SDK-engine command wires the - * instrumented transport (UA / tracking headers / verbose) by construction. + * instrumented transport (UA / tracking headers / verbose) and the bl-resolved, + * in-memory-injected credential ({@link resolveAgentProjectConfig}) by construction. */ export async function buildAgentRuntime( - host: HostContext, + host: HostContext & CredentialHost, filePath: string, - options: { - resolveEnv?: boolean; - projectName?: string; - statePath?: string; - } = {}, + options: AgentConfigOptions = {}, ): Promise<ProjectRuntimeContext & { configPath: string }> { installSdkTransport(host); - ensureCredentials(); - const { config, configPath, projectName } = await resolveProjectConfig(filePath, options); + const { config, configPath, projectName } = await resolveAgentProjectConfig( + host, + filePath, + options, + ); const state = await loadFileState(configPath, options.statePath, projectName); const ctx = createProjectRuntime({ projectName, diff --git a/packages/commands/src/commands/managed-agent/_engine/credentials.ts b/packages/commands/src/commands/managed-agent/_engine/credentials.ts index 19079e18..cfa232cc 100644 --- a/packages/commands/src/commands/managed-agent/_engine/credentials.ts +++ b/packages/commands/src/commands/managed-agent/_engine/credentials.ts @@ -1,63 +1,141 @@ -import { bootstrapRuntimeCredentialsSync } from "@openagentpack/sdk"; -import { readConfigFile } from "bailian-cli-core"; +import { AGENTS_PROVIDER_FIELDS, bootstrapRuntimeCredentialsSync } from "@openagentpack/sdk"; +import { BailianError, type Client, ExitCode, type Settings } from "bailian-cli-core"; -let bootstrapped = false; +/** + * AgentStudio API path the SDK's BailianClient serves resources under. bl's + * `base_url` is the bare model-service origin (e.g. https://dashscope.aliyuncs.com); + * the SDK appends resource paths onto the bailian provider's `base_url` verbatim, + * so the agent path must carry this suffix. See OpenAgentPack BailianClient. + */ +const AGENTSTUDIO_API_PATH = "/api/v1/agentstudio"; + +/** + * Every env var the SDK recognizes as provider credential material (primary keys + * from the SDK's own field map) plus bl-side interpolation aliases and bailian's + * endpoint var (not part of AGENTS_PROVIDER_FIELDS). These are the only vars the + * pipeline placeholders (to keep interpolation from throwing) and scrubs (so no + * real credential persists in the environment). + */ +const CREDENTIAL_ENV_KEYS = [ + ...new Set([ + ...Object.values(AGENTS_PROVIDER_FIELDS).flatMap((fields) => fields.map((field) => field.key)), + "BAILIAN_API_KEY", + "BAILIAN_BASE_URL", + "CLAUDE_API_KEY", + "QODER_API_KEY", + ]), +]; + +/** How to obtain each provider's key, surfaced in the CLI's own AUTH error when it is missing. */ +const CREDENTIAL_HINTS: Record<string, string> = { + bailian: "Run `bl auth login --api-key <key>`, pass --api-key, or set DASHSCOPE_API_KEY.", + claude: "Set ANTHROPIC_API_KEY (or CLAUDE_API_KEY) in your shell or .env.", + ark: "Set ARK_API_KEY in your shell or .env.", + qoder: "Set QODER_PAT (or QODER_API_KEY) in your shell or .env.", +}; + +/** The slice of CommandContext the credential pipeline needs: authStage-resolved client + settings. */ +export interface CredentialHost { + client: Client; + settings: Settings; +} /** * Shared `--help` note documenting where agent commands get provider - * credentials. Mirrors the credential-source hint bl's native commands surface - * (knowledge / usage / token-plan), adapted for the SDK's env-based resolution - * and the {@link bridgeBailianCredentials} fallback. Attach to every command - * that loads agents.yaml. `bl` prefix is safe: agent commands ship on `bl` only. + * credentials. Bailian goes through bl's own auth chain (commands declare + * `auth: "apiKey"`); other providers come from env. Either way the resolved + * credential is injected into the SDK in-memory and scrubbed from the + * environment. Attach to every command that loads agents.yaml. `bl` prefix is + * safe: agent commands ship on `bl` only. */ export const CREDENTIALS_NOTE = [ - "Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}).", - "For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`.", + "Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile).", + "Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json.", + "Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env.", ]; /** - * Bridge bl's own login state into the env vars the OpenAgentPack SDK reads for - * the bailian provider. bl persists `api_key` / `agentstudio_base_url` in - * `~/.bailian/config.json` (via `bl auth login`); mirror them onto - * `DASHSCOPE_API_KEY` / `BAILIAN_BASE_URL` so users don't have to re-declare the - * same credentials for `bl managed-agent *`. `workspace_id` is still bridged for configs - * that predate the base_url flow (the SDK accepts either). + * Load the SDK's env-based credential sources (`.env`, `~/.agents/config.json`) + * for non-bailian providers, then placeholder every credential var that is still + * unset with "" so agents.yaml `${VAR}` interpolation never throws on a value the + * pipeline is about to supply (bailian) or authoritatively reject ({@link + * assertProviderCredentials}). Runs every call (no I/O cache) so a scrubbed + * environment is repopulated if the same process resolves more than one config. + */ +export function prepareProviderEnv(): void { + bootstrapRuntimeCredentialsSync(); + for (const key of CREDENTIAL_ENV_KEYS) { + if (process.env[key] === undefined) process.env[key] = ""; + } +} + +/** + * Override the bailian provider block with bl's authStage-resolved credential, so + * the bailian API key is authoritatively the CLI auth chain's — never a config + * file bare-read or a stale env value. `api_key` is replaced unconditionally; + * `base_url` / `workspace_id` are filled only when the block references them and + * the interpolated value is empty (a literal in agents.yaml is respected). * - * Lowest priority: only fills a var that is still unset, so anything already in - * the environment (shell export, `.env`, or `~/.agents/config.json` — which the - * SDK bootstrap has already applied) wins. Missing values are left alone; the - * SDK surfaces its own error when interpolation can't resolve, and non-bailian - * providers (claude/qoder/ark) don't need DashScope credentials at all. + * `base_url` carries {@link AGENTSTUDIO_API_PATH} because the SDK appends resource + * paths onto it verbatim; a value already ending in the suffix is left as-is. + * With no credential (only under --dry-run: authStage hard-gates otherwise) the + * bailian block is left untouched. Non-bailian blocks keep their interpolated + * (env-sourced) values. */ -export function bridgeBailianCredentials(): void { - const file = readConfigFile(); - if (!process.env.DASHSCOPE_API_KEY?.trim() && file.api_key) { - process.env.DASHSCOPE_API_KEY = file.api_key; +export function injectProviderCredentials( + providers: Record<string, unknown>, + host: CredentialHost, +): void { + const bailian = providers.bailian; + if (!bailian || typeof bailian !== "object") return; + const block = bailian as Record<string, unknown>; + + const cred = host.client.exportApiCredential(); + if (cred) { + block.api_key = cred.token; + if ("base_url" in block && !block.base_url) { + block.base_url = cred.baseUrl.endsWith(AGENTSTUDIO_API_PATH) + ? cred.baseUrl + : `${cred.baseUrl}${AGENTSTUDIO_API_PATH}`; + } } - if (!process.env.BAILIAN_BASE_URL?.trim() && file.agentstudio_base_url) { - process.env.BAILIAN_BASE_URL = file.agentstudio_base_url; + if ("workspace_id" in block && !block.workspace_id && host.settings.workspaceId) { + block.workspace_id = host.settings.workspaceId; } - if (!process.env.BAILIAN_WORKSPACE_ID?.trim() && file.workspace_id) { - process.env.BAILIAN_WORKSPACE_ID = file.workspace_id; +} + +/** + * Remove every credential var from `process.env` after interpolation has run and + * bailian has been overridden in-memory. From here on the real credentials live + * only in the config object (and, after `createProjectRuntime`, in each provider + * adapter instance) — nothing persists in the environment for the process + * lifetime or any child process. + */ +export function scrubCredentialEnv(): void { + for (const key of CREDENTIAL_ENV_KEYS) { + delete process.env[key]; } } /** - * Lazily load `.env` and `~/.agents/config.json` into `process.env` so the - * OpenAgentPack SDK can resolve provider credentials (e.g. DASHSCOPE_API_KEY, - * BAILIAN_WORKSPACE_ID), then bridge bl's own config as a fallback. Safe to call - * repeatedly — only the first call does I/O. - * - * Effective precedence for bailian provider fields: - * ~/.agents/config.json > shell env > .env > ~/.bailian/config.json - * - * NOTE: agent commands declare `auth: "none"` and let the SDK own credential - * resolution. The bl-config bridge is a best-effort fallback; it never overrides - * a value the SDK bootstrap already resolved. + * After injection, fail with a CLI-authoritative AUTH error if any configured + * provider's `api_key` resolved empty (missing env var, or no bl login for + * bailian). Replaces the SDK's raw `Environment variable '...' is not set` / + * zod config error with a clean message plus a provider-specific hint. Validates + * every declared provider, so a project is only runnable once all its providers' + * keys are available. */ -export function ensureCredentials(): void { - if (bootstrapped) return; - bootstrapped = true; - bootstrapRuntimeCredentialsSync(); - bridgeBailianCredentials(); +export function assertProviderCredentials(providers: Record<string, unknown>): void { + for (const [name, raw] of Object.entries(providers)) { + if (!raw || typeof raw !== "object") continue; + const block = raw as Record<string, unknown>; + if (!("api_key" in block)) continue; + const apiKey = block.api_key; + if (typeof apiKey === "string" && apiKey.trim()) continue; + throw new BailianError( + `Provider '${name}' is configured but its API key is empty.`, + ExitCode.AUTH, + CREDENTIAL_HINTS[name] ?? `Provide credentials for provider '${name}'.`, + ); + } } diff --git a/packages/commands/src/commands/managed-agent/apply.ts b/packages/commands/src/commands/managed-agent/apply.ts index 56e1c834..486d840a 100644 --- a/packages/commands/src/commands/managed-agent/apply.ts +++ b/packages/commands/src/commands/managed-agent/apply.ts @@ -45,7 +45,7 @@ const APPLY_FLAGS = { export default defineCommand({ description: "Apply planned changes to create/update/delete agent resources", - auth: "none", + auth: "apiKey", usageArgs: "[--file <path>] [--provider <name>] [--yes] [--concurrency <n>]", flags: APPLY_FLAGS, exampleArgs: ["--yes", "--provider bailian --yes"], diff --git a/packages/commands/src/commands/managed-agent/destroy.ts b/packages/commands/src/commands/managed-agent/destroy.ts index 6b5e6fa6..74854f2c 100644 --- a/packages/commands/src/commands/managed-agent/destroy.ts +++ b/packages/commands/src/commands/managed-agent/destroy.ts @@ -30,7 +30,7 @@ const DESTROY_FLAGS = { export default defineCommand({ description: "Destroy all managed agent resources tracked in state", - auth: "none", + auth: "apiKey", usageArgs: "[--file <path>] [--yes] [--cascade]", flags: DESTROY_FLAGS, exampleArgs: ["--yes", "--yes --cascade"], diff --git a/packages/commands/src/commands/managed-agent/init.ts b/packages/commands/src/commands/managed-agent/init.ts index 55d333ac..aced33c6 100644 --- a/packages/commands/src/commands/managed-agent/init.ts +++ b/packages/commands/src/commands/managed-agent/init.ts @@ -18,7 +18,7 @@ agents.state.json const PROVIDERS = ["bailian", "claude", "qoder", "ark", "all"] as const; const PROVIDER_BLOCKS: Record<string, string> = { - bailian: ` bailian:\n # bl auth login --api-key <key> sets DASHSCOPE_API_KEY; --agentstudio-base-url <url> sets BAILIAN_BASE_URL\n api_key: \${DASHSCOPE_API_KEY}\n base_url: \${BAILIAN_BASE_URL}`, + bailian: ` bailian:\n # bl auth login --api-key <key> sets DASHSCOPE_API_KEY; --base-url <url> sets BAILIAN_BASE_URL\n api_key: \${DASHSCOPE_API_KEY}\n base_url: \${BAILIAN_BASE_URL}`, claude: ` claude:\n api_key: \${ANTHROPIC_API_KEY}`, qoder: ` qoder:\n api_key: \${QODER_PAT}\n gateway: "https://api.qoder.com/api/v1/cloud"`, ark: ` ark:\n api_key: \${ARK_API_KEY}`, @@ -99,7 +99,7 @@ const INIT_FLAGS = { export default defineCommand({ description: "Create a new agents.yaml template", - auth: "none", + auth: "apiKey", usageArgs: "[--provider <name>] [--agent-name <name>] [--file <path>] [--force]", flags: INIT_FLAGS, exampleArgs: ["", "--provider bailian --agent-name assistant", "--provider all"], @@ -137,7 +137,7 @@ export default defineCommand({ emitBare(`Created ${file}`); if (provider === "bailian" || provider === "all") { emitBare( - "Credentials: run `bl auth login --api-key <key> --agentstudio-base-url <url>`, or set DASHSCOPE_API_KEY / BAILIAN_BASE_URL.", + "Credentials: run `bl auth login --api-key <key> --base-url <url>`, or set DASHSCOPE_API_KEY / BAILIAN_BASE_URL.", ); } emitBare("Next: edit agents.yaml, then run `bl managed-agent plan`."); diff --git a/packages/commands/src/commands/managed-agent/plan.ts b/packages/commands/src/commands/managed-agent/plan.ts index ceec1103..24c714d9 100644 --- a/packages/commands/src/commands/managed-agent/plan.ts +++ b/packages/commands/src/commands/managed-agent/plan.ts @@ -40,7 +40,7 @@ const PLAN_FLAGS = { export default defineCommand({ description: "Show what changes would be applied to agent infrastructure", - auth: "none", + auth: "apiKey", usageArgs: "[--file <path>] [--provider <name>] [--no-refresh] [--refresh-only]", flags: PLAN_FLAGS, exampleArgs: ["", "--provider bailian", "--no-refresh"], diff --git a/packages/commands/src/commands/managed-agent/session-create.ts b/packages/commands/src/commands/managed-agent/session-create.ts index af6a92d6..23f8476c 100644 --- a/packages/commands/src/commands/managed-agent/session-create.ts +++ b/packages/commands/src/commands/managed-agent/session-create.ts @@ -42,7 +42,7 @@ const SESSION_CREATE_FLAGS = { export default defineCommand({ description: "Create a new session for an agent", - auth: "none", + auth: "apiKey", usageArgs: "[--agent <name>] [--environment <name>] [--title <title>] [--file <path>]", flags: SESSION_CREATE_FLAGS, exampleArgs: ["", "--agent assistant", "--agent assistant --title 'debug run'"], diff --git a/packages/commands/src/commands/managed-agent/session-delete.ts b/packages/commands/src/commands/managed-agent/session-delete.ts index e12f53df..7c99d94d 100644 --- a/packages/commands/src/commands/managed-agent/session-delete.ts +++ b/packages/commands/src/commands/managed-agent/session-delete.ts @@ -26,7 +26,7 @@ const SESSION_DELETE_FLAGS = { export default defineCommand({ description: "Delete a session", - auth: "none", + auth: "apiKey", usageArgs: "--session-id <id> [--provider <name>] [--file <path>]", flags: SESSION_DELETE_FLAGS, exampleArgs: ["--session-id sess_abc123"], diff --git a/packages/commands/src/commands/managed-agent/session-events.ts b/packages/commands/src/commands/managed-agent/session-events.ts index 7a6cac7b..0cdcf332 100644 --- a/packages/commands/src/commands/managed-agent/session-events.ts +++ b/packages/commands/src/commands/managed-agent/session-events.ts @@ -37,7 +37,7 @@ const SESSION_EVENTS_FLAGS = { export default defineCommand({ description: "List event history for a session", - auth: "none", + auth: "apiKey", usageArgs: "--session-id <id> [--limit <n>] [--all] [--file <path>]", flags: SESSION_EVENTS_FLAGS, exampleArgs: ["--session-id sess_abc123", "--session-id sess_abc123 --all"], diff --git a/packages/commands/src/commands/managed-agent/session-get.ts b/packages/commands/src/commands/managed-agent/session-get.ts index 6da3e67f..522daadd 100644 --- a/packages/commands/src/commands/managed-agent/session-get.ts +++ b/packages/commands/src/commands/managed-agent/session-get.ts @@ -26,7 +26,7 @@ const SESSION_GET_FLAGS = { export default defineCommand({ description: "Get details of a session", - auth: "none", + auth: "apiKey", usageArgs: "--session-id <id> [--provider <name>] [--file <path>]", flags: SESSION_GET_FLAGS, exampleArgs: ["--session-id sess_abc123"], diff --git a/packages/commands/src/commands/managed-agent/session-list.ts b/packages/commands/src/commands/managed-agent/session-list.ts index 375feeb5..2694e204 100644 --- a/packages/commands/src/commands/managed-agent/session-list.ts +++ b/packages/commands/src/commands/managed-agent/session-list.ts @@ -30,7 +30,7 @@ const SESSION_LIST_FLAGS = { export default defineCommand({ description: "List sessions from the provider", - auth: "none", + auth: "apiKey", usageArgs: "[--agent <name>] [--all] [--provider <name>] [--file <path>]", flags: SESSION_LIST_FLAGS, exampleArgs: ["", "--agent assistant", "--all"], diff --git a/packages/commands/src/commands/managed-agent/session-run.ts b/packages/commands/src/commands/managed-agent/session-run.ts index 34824a3f..3fe58f0f 100644 --- a/packages/commands/src/commands/managed-agent/session-run.ts +++ b/packages/commands/src/commands/managed-agent/session-run.ts @@ -55,7 +55,7 @@ const SESSION_RUN_FLAGS = { export default defineCommand({ description: "Create a session, send a message, and stream the response", - auth: "none", + auth: "apiKey", usageArgs: "--prompt <text> [--agent <name>] [--no-stream] [--file <path>]", flags: SESSION_RUN_FLAGS, exampleArgs: ['--prompt "hello"', '--agent assistant --prompt "summarize this repo"'], diff --git a/packages/commands/src/commands/managed-agent/session-send.ts b/packages/commands/src/commands/managed-agent/session-send.ts index 643f9fe3..f01fb931 100644 --- a/packages/commands/src/commands/managed-agent/session-send.ts +++ b/packages/commands/src/commands/managed-agent/session-send.ts @@ -36,7 +36,7 @@ const SESSION_SEND_FLAGS = { export default defineCommand({ description: "Send a message to an existing session and stream the response", - auth: "none", + auth: "apiKey", usageArgs: "--session-id <id> --message <text> [--no-stream] [--file <path>]", flags: SESSION_SEND_FLAGS, exampleArgs: ['--session-id sess_abc123 --message "continue"'], diff --git a/packages/commands/src/commands/managed-agent/state-import.ts b/packages/commands/src/commands/managed-agent/state-import.ts index 69c33299..e373a016 100644 --- a/packages/commands/src/commands/managed-agent/state-import.ts +++ b/packages/commands/src/commands/managed-agent/state-import.ts @@ -32,7 +32,7 @@ const STATE_IMPORT_FLAGS = { export default defineCommand({ description: "Import an existing remote resource into agents state", - auth: "none", + auth: "apiKey", usageArgs: "--address <provider.type.name> --remote-id <id> [--resource-version <n>] [--file <path>]", flags: STATE_IMPORT_FLAGS, diff --git a/packages/commands/src/commands/managed-agent/state-list.ts b/packages/commands/src/commands/managed-agent/state-list.ts index 49ff8a8d..2d970234 100644 --- a/packages/commands/src/commands/managed-agent/state-list.ts +++ b/packages/commands/src/commands/managed-agent/state-list.ts @@ -14,7 +14,7 @@ const STATE_LIST_FLAGS = { export default defineCommand({ description: "List resources tracked in agents state", - auth: "none", + auth: "apiKey", usageArgs: "[--file <path>]", flags: STATE_LIST_FLAGS, exampleArgs: ["", "--file agents.yaml"], diff --git a/packages/commands/src/commands/managed-agent/state-rm.ts b/packages/commands/src/commands/managed-agent/state-rm.ts index 633d5db1..f079d327 100644 --- a/packages/commands/src/commands/managed-agent/state-rm.ts +++ b/packages/commands/src/commands/managed-agent/state-rm.ts @@ -27,7 +27,7 @@ const STATE_RM_FLAGS = { export default defineCommand({ description: "Remove a resource from state without destroying it remotely", - auth: "none", + auth: "apiKey", usageArgs: "--address <provider.type.name> [--file <path>]", flags: STATE_RM_FLAGS, exampleArgs: ["--address bailian.agent.assistant"], diff --git a/packages/commands/src/commands/managed-agent/state-show.ts b/packages/commands/src/commands/managed-agent/state-show.ts index 316a1a68..845de2e8 100644 --- a/packages/commands/src/commands/managed-agent/state-show.ts +++ b/packages/commands/src/commands/managed-agent/state-show.ts @@ -27,7 +27,7 @@ const STATE_SHOW_FLAGS = { export default defineCommand({ description: "Show details of a resource in agents state", - auth: "none", + auth: "apiKey", usageArgs: "--address <provider.type.name> [--file <path>]", flags: STATE_SHOW_FLAGS, exampleArgs: ["--address bailian.agent.assistant"], diff --git a/packages/commands/src/commands/managed-agent/validate.ts b/packages/commands/src/commands/managed-agent/validate.ts index 7a746810..0e1bf946 100644 --- a/packages/commands/src/commands/managed-agent/validate.ts +++ b/packages/commands/src/commands/managed-agent/validate.ts @@ -6,8 +6,8 @@ import { type FlagsDef, } from "bailian-cli-core"; import { emitBare, emitResult } from "bailian-cli-runtime"; -import { resolveProjectConfig, validateProjectConfig } from "@openagentpack/sdk"; -import { CREDENTIALS_NOTE, ensureCredentials } from "./_engine/credentials.ts"; +import { validateProjectConfig } from "@openagentpack/sdk"; +import { CREDENTIALS_NOTE, resolveAgentProjectConfig } from "./_engine/config-loader.ts"; import { withAgentErrors } from "./_engine/errors.ts"; const VALIDATE_FLAGS = { @@ -20,7 +20,7 @@ const VALIDATE_FLAGS = { export default defineCommand({ description: "Validate an agents.yaml configuration (offline)", - auth: "none", + auth: "apiKey", usageArgs: "[--file <path>]", flags: VALIDATE_FLAGS, exampleArgs: ["", "--file agents.yaml"], @@ -31,8 +31,7 @@ export default defineCommand({ const file = flags.file ?? "agents.yaml"; const diagnostics = await withAgentErrors(async () => { - ensureCredentials(); - const { config } = await resolveProjectConfig(file); + const { config } = await resolveAgentProjectConfig(ctx, file); return validateProjectConfig(config); }); diff --git a/packages/commands/tests/credentials-bridge.test.ts b/packages/commands/tests/credentials-bridge.test.ts index 0d2454eb..93ade5c7 100644 --- a/packages/commands/tests/credentials-bridge.test.ts +++ b/packages/commands/tests/credentials-bridge.test.ts @@ -1,149 +1,196 @@ -import { mkdtempSync, rmSync, writeFileSync } from "fs"; -import { tmpdir } from "os"; -import { join } from "path"; -import { expect, test } from "vite-plus/test"; -import { bridgeBailianCredentials } from "../src/commands/managed-agent/_engine/credentials.ts"; +import { join } from "node:path"; +import { tmpdir } from "node:os"; +import { afterEach, beforeEach, expect, test } from "vite-plus/test"; +import { + type ApiKeyCredential, + Client, + ExitCode, + type Identity, + type Settings, +} from "bailian-cli-core"; +import { + assertProviderCredentials, + type CredentialHost, + injectProviderCredentials, + prepareProviderEnv, + scrubCredentialEnv, +} from "../src/commands/managed-agent/_engine/credentials.ts"; /** - * bridgeBailianCredentials 把 ~/.bailian/config.json 的 api_key / agentstudio_base_url - * / workspace_id 作为最低优先级兜底填入 DASHSCOPE_API_KEY / BAILIAN_BASE_URL / - * BAILIAN_WORKSPACE_ID。用临时 config dir + env 保存恢复隔离,验证优先级与不抛错语义。 + * 凭证内存注入管道:injectProviderCredentials 把 authStage 解析进 Client 的凭证 + * 权威覆写 bailian 配置块(不落 env),scrubCredentialEnv 清空所有凭证 env, + * assertProviderCredentials 对空 key 给 CLI 权威 AUTH 错误。用快照隔离凭证 env。 */ -async function inScenario( - scenario: { - config?: { - api_key?: string; - workspace_id?: string; - agentstudio_base_url?: string; - }; - env?: { - DASHSCOPE_API_KEY?: string; - BAILIAN_WORKSPACE_ID?: string; - BAILIAN_BASE_URL?: string; - }; - }, - assert: () => void, -): Promise<void> { - const savedConfigDir = process.env.BAILIAN_CONFIG_DIR; - const savedApiKey = process.env.DASHSCOPE_API_KEY; - const savedWorkspace = process.env.BAILIAN_WORKSPACE_ID; - const savedBaseUrl = process.env.BAILIAN_BASE_URL; - - const dir = mkdtempSync(join(tmpdir(), "bl-cred-bridge-")); - process.env.BAILIAN_CONFIG_DIR = dir; - if (scenario.config) { - writeFileSync(join(dir, "config.json"), JSON.stringify(scenario.config), "utf-8"); - } +const TRACKED_ENV = [ + "DASHSCOPE_API_KEY", + "BAILIAN_API_KEY", + "BAILIAN_BASE_URL", + "BAILIAN_WORKSPACE_ID", + "ANTHROPIC_API_KEY", + "CLAUDE_API_KEY", + "ARK_API_KEY", + "QODER_PAT", + "QODER_API_KEY", + "AGENTS_CONFIG_PATH", + "AGENTS_PROVIDER", +]; - // 显式设置/清除 env,避免继承宿主环境干扰断言 - if (scenario.env?.DASHSCOPE_API_KEY === undefined) delete process.env.DASHSCOPE_API_KEY; - else process.env.DASHSCOPE_API_KEY = scenario.env.DASHSCOPE_API_KEY; - if (scenario.env?.BAILIAN_WORKSPACE_ID === undefined) delete process.env.BAILIAN_WORKSPACE_ID; - else process.env.BAILIAN_WORKSPACE_ID = scenario.env.BAILIAN_WORKSPACE_ID; - if (scenario.env?.BAILIAN_BASE_URL === undefined) delete process.env.BAILIAN_BASE_URL; - else process.env.BAILIAN_BASE_URL = scenario.env.BAILIAN_BASE_URL; +let envSnapshot: Record<string, string | undefined> = {}; - try { - assert(); - } finally { - restore("BAILIAN_CONFIG_DIR", savedConfigDir); - restore("DASHSCOPE_API_KEY", savedApiKey); - restore("BAILIAN_WORKSPACE_ID", savedWorkspace); - restore("BAILIAN_BASE_URL", savedBaseUrl); - rmSync(dir, { recursive: true, force: true }); +beforeEach(() => { + envSnapshot = Object.fromEntries(TRACKED_ENV.map((key) => [key, process.env[key]])); +}); + +afterEach(() => { + for (const key of TRACKED_ENV) { + const value = envSnapshot[key]; + if (value === undefined) delete process.env[key]; + else process.env[key] = value; } +}); + +const identity: Identity = { + binName: "bl", + version: "0.0.0-test", + npmPackage: "bailian-cli", + clientName: "bailian-cli", +}; + +function makeHost(options: { apiCred?: ApiKeyCredential; workspaceId?: string }): CredentialHost { + const settings = { workspaceId: options.workspaceId } as Settings; + return { + settings, + client: new Client({ + identity, + settings, + baseUrl: options.apiCred?.baseUrl ?? "https://dashscope.aliyuncs.com", + apiCred: options.apiCred, + }), + }; } -function restore(key: string, value: string | undefined): void { - if (value === undefined) delete process.env[key]; - else process.env[key] = value; +function bailianCred( + token = "sk-auth-chain", + baseUrl = "https://dashscope.aliyuncs.com", +): ApiKeyCredential { + return { token, baseUrl, source: "config" }; } -test("bridge:env 已有值时不被 bl config 覆盖(最低优先级)", async () => { - await inScenario( - { - config: { api_key: "sk-from-config", workspace_id: "ws-from-config" }, - env: { - DASHSCOPE_API_KEY: "sk-from-env", - BAILIAN_WORKSPACE_ID: "ws-from-env", - }, - }, - () => { - bridgeBailianCredentials(); - expect(process.env.DASHSCOPE_API_KEY).toBe("sk-from-env"); - expect(process.env.BAILIAN_WORKSPACE_ID).toBe("ws-from-env"); - }, - ); +test("inject:bailian api_key 无条件覆盖(含 yaml 字面量),base_url 空则拼 agentstudio 后缀", () => { + const providers = { bailian: { api_key: "literal-from-yaml", base_url: "" } }; + injectProviderCredentials(providers, makeHost({ apiCred: bailianCred() })); + expect(providers.bailian.api_key).toBe("sk-auth-chain"); + expect(providers.bailian.base_url).toBe("https://dashscope.aliyuncs.com/api/v1/agentstudio"); }); -test("bridge:env 缺失且 bl config 有值时填充", async () => { - await inScenario( - { - config: { api_key: "sk-from-config", workspace_id: "ws-from-config" }, - env: {}, - }, - () => { - bridgeBailianCredentials(); - expect(process.env.DASHSCOPE_API_KEY).toBe("sk-from-config"); - expect(process.env.BAILIAN_WORKSPACE_ID).toBe("ws-from-config"); - }, +test("inject:base_url 已带后缀不重复拼;非空字面量 base_url 保留", () => { + const withSuffix = { bailian: { api_key: "", base_url: "" } }; + injectProviderCredentials( + withSuffix, + makeHost({ + apiCred: bailianCred("t", "https://x.maas.aliyuncs.com/api/v1/agentstudio"), + }), ); -}); + expect(withSuffix.bailian.base_url).toBe("https://x.maas.aliyuncs.com/api/v1/agentstudio"); -test("bridge:仅缺失项被填,已有项保留(逐字段独立)", async () => { - await inScenario( - { - config: { api_key: "sk-from-config", workspace_id: "ws-from-config" }, - env: { DASHSCOPE_API_KEY: "sk-from-env" }, - }, - () => { - bridgeBailianCredentials(); - expect(process.env.DASHSCOPE_API_KEY).toBe("sk-from-env"); - expect(process.env.BAILIAN_WORKSPACE_ID).toBe("ws-from-config"); + const literal = { + bailian: { + api_key: "", + base_url: "https://custom.example.com/api/v1/agentstudio", }, + }; + injectProviderCredentials(literal, makeHost({ apiCred: bailianCred() })); + expect(literal.bailian.base_url).toBe("https://custom.example.com/api/v1/agentstudio"); +}); + +test("inject:workspace_id 引用且为空时用 settings 填充;有字面量则保留", () => { + const empty = { bailian: { api_key: "", workspace_id: "" } }; + injectProviderCredentials( + empty, + makeHost({ apiCred: bailianCred(), workspaceId: "ws-settings" }), + ); + expect(empty.bailian.workspace_id).toBe("ws-settings"); + + const literal = { bailian: { api_key: "", workspace_id: "ws-yaml" } }; + injectProviderCredentials( + literal, + makeHost({ apiCred: bailianCred(), workspaceId: "ws-settings" }), ); + expect(literal.bailian.workspace_id).toBe("ws-yaml"); }); -test("bridge:env 与 bl config 皆缺失时不抛错且不写入", async () => { - await inScenario({ env: {} }, () => { - expect(() => bridgeBailianCredentials()).not.toThrow(); - expect(process.env.DASHSCOPE_API_KEY).toBeUndefined(); - expect(process.env.BAILIAN_WORKSPACE_ID).toBeUndefined(); - }); +test("inject:无凭证(dry-run)时 bailian 块保持不变", () => { + const providers = { bailian: { api_key: "", base_url: "" } }; + injectProviderCredentials(providers, makeHost({})); + expect(providers.bailian.api_key).toBe(""); + expect(providers.bailian.base_url).toBe(""); }); -test("bridge:agentstudio_base_url 兜底填入 BAILIAN_BASE_URL", async () => { - await inScenario( - { - config: { - api_key: "sk-from-config", - agentstudio_base_url: "https://ws-x.cn-beijing.maas.aliyuncs.com/api/v1/agentstudio", - }, - env: {}, - }, - () => { - bridgeBailianCredentials(); - expect(process.env.BAILIAN_BASE_URL).toBe( - "https://ws-x.cn-beijing.maas.aliyuncs.com/api/v1/agentstudio", - ); - }, - ); +test("inject:非 bailian provider 块不被触碰", () => { + const providers = { + claude: { api_key: "sk-ant" }, + ark: { api_key: "ark-key" }, + }; + injectProviderCredentials(providers, makeHost({ apiCred: bailianCred() })); + expect(providers.claude.api_key).toBe("sk-ant"); + expect(providers.ark.api_key).toBe("ark-key"); }); -test("bridge:env 已有 BAILIAN_BASE_URL 时不被 bl config 覆盖", async () => { - await inScenario( - { - config: { - api_key: "sk-from-config", - agentstudio_base_url: "https://from-config.aliyuncs.com/api/v1/agentstudio", - }, - env: { - BAILIAN_BASE_URL: "https://from-env.aliyuncs.com/api/v1/agentstudio", - }, - }, - () => { - bridgeBailianCredentials(); - expect(process.env.BAILIAN_BASE_URL).toBe("https://from-env.aliyuncs.com/api/v1/agentstudio"); - }, - ); +test("assert:所有已声明 provider 的 key 非空时通过", () => { + expect(() => + assertProviderCredentials({ + bailian: { api_key: "x" }, + claude: { api_key: "y" }, + }), + ).not.toThrow(); +}); + +test("assert:claude key 为空抛 AUTH 且 hint 指向 ANTHROPIC_API_KEY", () => { + let thrown: unknown; + try { + assertProviderCredentials({ claude: { api_key: "" } }); + } catch (error) { + thrown = error; + } + const err = thrown as { exitCode?: number; hint?: string; message?: string }; + expect(err.exitCode).toBe(ExitCode.AUTH); + expect(err.hint).toContain("ANTHROPIC_API_KEY"); + expect(err.message).toContain("claude"); +}); + +test("assert:bailian key 为空(dry-run/未登录)抛 AUTH 且 hint 指向 bl auth login", () => { + let thrown: unknown; + try { + assertProviderCredentials({ bailian: { api_key: "" } }); + } catch (error) { + thrown = error; + } + const err = thrown as { exitCode?: number; hint?: string }; + expect(err.exitCode).toBe(ExitCode.AUTH); + expect(err.hint).toContain("bl auth login"); +}); + +test("scrub:所有凭证 env 变量被删除", () => { + process.env.DASHSCOPE_API_KEY = "x"; + process.env.ANTHROPIC_API_KEY = "y"; + process.env.ARK_API_KEY = "z"; + process.env.BAILIAN_BASE_URL = "u"; + process.env.QODER_PAT = "q"; + scrubCredentialEnv(); + expect(process.env.DASHSCOPE_API_KEY).toBeUndefined(); + expect(process.env.ANTHROPIC_API_KEY).toBeUndefined(); + expect(process.env.ARK_API_KEY).toBeUndefined(); + expect(process.env.BAILIAN_BASE_URL).toBeUndefined(); + expect(process.env.QODER_PAT).toBeUndefined(); +}); + +test("prepare:调用后凭证变量均已定义,避免 yaml 插值抛错", () => { + // 指向不存在的 agents 配置,隔离宿主 ~/.agents/config.json 干扰 + process.env.AGENTS_CONFIG_PATH = join(tmpdir(), "no-such-agents-config.json"); + delete process.env.ARK_API_KEY; + delete process.env.QODER_API_KEY; + prepareProviderEnv(); + // 契约:每个凭证变量都被占位或填充,插值不会因 undefined 抛错 + expect(process.env.ARK_API_KEY).toBeDefined(); + expect(process.env.QODER_API_KEY).toBeDefined(); }); diff --git a/packages/core/src/auth/store.ts b/packages/core/src/auth/store.ts index a88a8dfe..9d52abb6 100644 --- a/packages/core/src/auth/store.ts +++ b/packages/core/src/auth/store.ts @@ -28,7 +28,6 @@ export type AuthPersistPatch = Pick< | "access_key_secret" | "security_token" | "base_url" - | "agentstudio_base_url" | "console_site" | "console_region" | "console_switch_agent" diff --git a/packages/core/src/client/client.ts b/packages/core/src/client/client.ts index cb0a720a..b9810bfb 100644 --- a/packages/core/src/client/client.ts +++ b/packages/core/src/client/client.ts @@ -90,6 +90,17 @@ export class Client { return this.deps.apiCred?.baseUrl ?? this.deps.baseUrl; } + /** + * Export the model-domain credential for delegation to an embedded SDK that + * owns its own transport (e.g. @openagentpack/sdk). Deliberate escape hatch: + * regular commands keep calling {@link request}/{@link requestJson} and never + * handle tokens — lint restricts callers to managed-agent/_engine. Undefined + * when no credential resolved (authStage tolerates that only under dry-run). + */ + exportApiCredential(): ApiKeyCredential | undefined { + return this.deps.apiCred; + } + /** Full URL for a model-domain {@link path}; build request/display URLs only through this. */ url(path: string): string { return this.baseUrl + path; diff --git a/packages/core/src/config/schema.ts b/packages/core/src/config/schema.ts index c684ba8e..56f4ff1b 100644 --- a/packages/core/src/config/schema.ts +++ b/packages/core/src/config/schema.ts @@ -27,13 +27,6 @@ export interface ConfigFile { /** Alibaba Cloud STS Security Token (optional, for temporary credentials). */ security_token?: string; base_url?: string; - /** - * Bailian AgentStudio API base URL for `bl managed-agent` commands, e.g. - * `https://<workspace>.cn-beijing.maas.aliyuncs.com/api/v1/agentstudio`. - * Distinct from `base_url` (the DashScope model API): the agent path bridges - * this to the SDK's `BAILIAN_BASE_URL`, so a workspace_id is not required. - */ - agentstudio_base_url?: string; output?: "text" | "json"; output_dir?: string; timeout?: number; @@ -92,21 +85,6 @@ function parseModelBaseUrl(value: string): string | undefined { } } -/** - * A syntactically valid absolute http(s) URL. Used to validate - * `agentstudio_base_url`, which is an AgentStudio API endpoint (with its own - * `/api/v1/agentstudio` path) and must NOT go through model-URL suffix - * stripping like `base_url`. - */ -function isHttpUrl(value: string): boolean { - try { - const parsed = new URL(value); - return parsed.protocol === "http:" || parsed.protocol === "https:"; - } catch { - return false; - } -} - export function parseConfigFile(raw: unknown): ConfigFile { if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {}; const obj = raw as Record<string, unknown>; @@ -134,8 +112,6 @@ export function parseConfigFile(raw: unknown): ConfigFile { const baseUrl = parseModelBaseUrl(obj.base_url); if (baseUrl) out.base_url = baseUrl; } - if (typeof obj.agentstudio_base_url === "string" && isHttpUrl(obj.agentstudio_base_url)) - out.agentstudio_base_url = obj.agentstudio_base_url; if (typeof obj.output === "string" && VALID_OUTPUTS.has(obj.output)) out.output = obj.output as ConfigFile["output"]; if (typeof obj.output_dir === "string" && obj.output_dir.length > 0) diff --git a/skills/bailian-cli/reference/auth.md b/skills/bailian-cli/reference/auth.md index d834c7bc..016699a1 100644 --- a/skills/bailian-cli/reference/auth.md +++ b/skills/bailian-cli/reference/auth.md @@ -48,16 +48,15 @@ bl auth generate-access-token --access-key-id LTAIxxxxx --access-key-secret xxxx #### Flags -| Flag | Type | Required | Description | -| ------------------------------ | ------ | -------- | --------------------------------------------------------------------------------------------------------- | -| `--api-key <key>` | string | no | Model API key to store | -| `--base-url <url>` | string | no | Model API base URL (used with --api-key for validation) | -| `--agentstudio-base-url <url>` | string | no | Bailian AgentStudio base URL for `bl managed-agent` commands (sets BAILIAN_BASE_URL; used with --api-key) | -| `--console` | switch | no | Sign in via browser; use --console-site to choose domestic (default) or international | -| `--console-site <site>` | string | no | Console site: domestic, international | -| `--open-api` | switch | no | Store Alibaba Cloud OpenAPI AK/SK credentials | -| `--access-key-id <id>` | string | no | Alibaba Cloud Access Key ID to store | -| `--access-key-secret <secret>` | string | no | Alibaba Cloud Access Key Secret to store | +| Flag | Type | Required | Description | +| ------------------------------ | ------ | -------- | ------------------------------------------------------------------------------------- | +| `--api-key <key>` | string | no | Model API key to store | +| `--base-url <url>` | string | no | Model API base URL (used with --api-key for validation) | +| `--console` | switch | no | Sign in via browser; use --console-site to choose domestic (default) or international | +| `--console-site <site>` | string | no | Console site: domestic, international | +| `--open-api` | switch | no | Store Alibaba Cloud OpenAPI AK/SK credentials | +| `--access-key-id <id>` | string | no | Alibaba Cloud Access Key ID to store | +| `--access-key-secret <secret>` | string | no | Alibaba Cloud Access Key Secret to store | #### Examples diff --git a/skills/bailian-cli/reference/config.md b/skills/bailian-cli/reference/config.md index d078f66e..32f6eda4 100644 --- a/skills/bailian-cli/reference/config.md +++ b/skills/bailian-cli/reference/config.md @@ -81,10 +81,10 @@ bl config list --output json #### Flags -| Flag | Type | Required | Description | -| ----------------- | ------ | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `--key <key>` | string | yes | Config key (base*url, output, output_dir, timeout, api_key, access_token, access_key_id, access_key_secret, security_token, default*\*\_model, workspace_id, agentstudio_base_url) | -| `--value <value>` | string | yes | Value to set | +| Flag | Type | Required | Description | +| ----------------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| `--key <key>` | string | yes | Config key (base*url, output, output_dir, timeout, api_key, access_token, access_key_id, access_key_secret, security_token, default*\*\_model, workspace_id) | +| `--value <value>` | string | yes | Value to set | #### Examples diff --git a/skills/bailian-cli/reference/managed-agent.md b/skills/bailian-cli/reference/managed-agent.md index a2f2df8d..5b1e93b5 100644 --- a/skills/bailian-cli/reference/managed-agent.md +++ b/skills/bailian-cli/reference/managed-agent.md @@ -45,11 +45,14 @@ Index: [index.md](index.md) | `--yes` | switch | no | Confirm and apply without an interactive prompt (required to mutate) | | `--no-refresh` | switch | no | Skip refreshing state from remote before planning | | `--concurrency <n>` | number | no | Max independent resources to apply in parallel (default 6, max 10) | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -71,16 +74,19 @@ bl managed-agent apply --provider bailian --yes #### Flags -| Flag | Type | Required | Description | -| --------------- | ------ | -------- | -------------------------------------------------------------------------- | -| `--file <path>` | string | no | Config file path (default: agents.yaml) | -| `--yes` | switch | no | Confirm and destroy without an interactive prompt (required) | -| `--cascade` | switch | no | Auto-delete dependent resources (e.g. sessions referencing an environment) | +| Flag | Type | Required | Description | +| ------------------ | ------ | -------- | -------------------------------------------------------------------------- | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--yes` | switch | no | Confirm and destroy without an interactive prompt (required) | +| `--cascade` | switch | no | Auto-delete dependent resources (e.g. sessions referencing an environment) | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -108,6 +114,8 @@ bl managed-agent destroy --yes --cascade | `--agent-name <name>` | string | no | Name of the first agent (default: assistant) | | `--file <path>` | string | no | Output config path (default: agents.yaml) | | `--force` | switch | no | Overwrite an existing config file | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Examples @@ -139,11 +147,14 @@ bl managed-agent init --provider all | `--provider <name>` | string | no | Target provider (default: all configured) | | `--no-refresh` | switch | no | Skip refreshing state from remote before planning | | `--refresh-only` | switch | no | Refresh state and show drift without planning remote mutations | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -178,11 +189,14 @@ bl managed-agent plan --no-refresh | `--memory-stores <names>` | string | no | Override agent's memory stores (comma-separated) | | `--title <title>` | string | no | Session title | | `--provider <name>` | string | no | Target provider (multi-provider agents) | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -213,11 +227,14 @@ bl managed-agent session create --agent assistant --title 'debug run' | `--session-id <id>` | string | yes | Session ID (required) | | `--file <path>` | string | no | Config file path (default: agents.yaml) | | `--provider <name>` | string | no | Target provider | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -242,11 +259,14 @@ bl managed-agent session delete --session-id sess_abc123 | `--provider <name>` | string | no | Target provider | | `--limit <n>` | number | no | Maximum number of events to fetch | | `--all` | switch | no | Fetch all pages by following the cursor | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -273,11 +293,14 @@ bl managed-agent session events --session-id sess_abc123 --all | `--session-id <id>` | string | yes | Session ID (required) | | `--file <path>` | string | no | Config file path (default: agents.yaml) | | `--provider <name>` | string | no | Target provider | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -301,11 +324,14 @@ bl managed-agent session get --session-id sess_abc123 | `--agent <name>` | string | no | Filter by agent name | | `--all` | switch | no | Fetch all pages by following the cursor | | `--provider <name>` | string | no | Target provider | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -342,11 +368,14 @@ bl managed-agent session list --all | `--title <title>` | string | no | Session title | | `--provider <name>` | string | no | Target provider | | `--no-stream` | switch | no | Use polling instead of SSE streaming | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -375,11 +404,14 @@ bl managed-agent session run --agent assistant --prompt "summarize this repo" | `--file <path>` | string | no | Config file path (default: agents.yaml) | | `--provider <name>` | string | no | Target provider | | `--no-stream` | switch | no | Use polling instead of SSE streaming | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -403,11 +435,14 @@ bl managed-agent session send --session-id sess_abc123 --message "continue" | `--remote-id <id>` | string | yes | Existing remote resource ID to import (required) | | `--resource-version <n>` | number | no | Resource version (for versioned resources like agents) | | `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -425,14 +460,17 @@ bl managed-agent state import --address bailian.agent.assistant --remote-id agen #### Flags -| Flag | Type | Required | Description | -| --------------- | ------ | -------- | --------------------------------------- | -| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| Flag | Type | Required | Description | +| ------------------ | ------ | -------- | --------------------------------------- | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -458,11 +496,14 @@ bl managed-agent state list --file agents.yaml | -------------------------------- | ------ | -------- | --------------------------------------- | | `--address <provider.type.name>` | string | yes | Resource state address (required) | | `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -484,11 +525,14 @@ bl managed-agent state rm --address bailian.agent.assistant | -------------------------------- | ------ | -------- | --------------------------------------- | | `--address <provider.type.name>` | string | yes | Resource state address (required) | | `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -506,14 +550,17 @@ bl managed-agent state show --address bailian.agent.assistant #### Flags -| Flag | Type | Required | Description | -| --------------- | ------ | -------- | --------------------------------------- | -| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| Flag | Type | Required | Description | +| ------------------ | ------ | -------- | --------------------------------------- | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | #### Notes -- Credentials come from the env vars referenced in agents.yaml (e.g. ${DASHSCOPE_API_KEY}, ${BAILIAN_BASE_URL}). -- For the bailian provider, bl fills these from your login as a fallback: `bl auth login --api-key <key> --agentstudio-base-url <url>`. +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples diff --git a/vite.config.ts b/vite.config.ts index 42efd4bd..cb7b7ac5 100644 --- a/vite.config.ts +++ b/vite.config.ts @@ -13,6 +13,11 @@ const commandCapabilityRestrictions = [ property: "commandPacks", message: "commandPacks is only available to commands/plugin/**.", }, + { + property: "exportApiCredential", + message: + "exportApiCredential is only available to commands/managed-agent/_engine/** (embedded-SDK credential delegation).", + }, ] as const; type CommandCapabilityRestriction = (typeof commandCapabilityRestrictions)[number]; @@ -56,15 +61,27 @@ export default defineConfig({ }, { files: ["packages/commands/src/commands/config/**/*.ts"], - rules: { "no-restricted-properties": restrictCommandCapabilities("configStore") }, + rules: { + "no-restricted-properties": restrictCommandCapabilities("configStore"), + }, }, { files: ["packages/commands/src/commands/auth/**/*.ts"], - rules: { "no-restricted-properties": restrictCommandCapabilities("authStore") }, + rules: { + "no-restricted-properties": restrictCommandCapabilities("authStore"), + }, }, { files: ["packages/commands/src/commands/plugin/**/*.ts"], - rules: { "no-restricted-properties": restrictCommandCapabilities("commandPacks") }, + rules: { + "no-restricted-properties": restrictCommandCapabilities("commandPacks"), + }, + }, + { + files: ["packages/commands/src/commands/managed-agent/_engine/**/*.ts"], + rules: { + "no-restricted-properties": restrictCommandCapabilities("exportApiCredential"), + }, }, ], }, From 1bf4fec9e6d867b3ae7bbee217a7eff4ee3286da Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Fri, 24 Jul 2026 16:02:15 +0800 Subject: [PATCH 08/21] feat(agent): support --dry-run for all local and remote mutations --- .../src/commands/managed-agent/apply.ts | 16 ++ .../src/commands/managed-agent/destroy.ts | 12 ++ .../src/commands/managed-agent/init.ts | 21 +- .../commands/managed-agent/session-create.ts | 18 ++ .../commands/managed-agent/session-delete.ts | 12 ++ .../src/commands/managed-agent/session-run.ts | 21 ++ .../commands/managed-agent/session-send.ts | 17 ++ .../commands/managed-agent/state-import.ts | 17 ++ .../src/commands/managed-agent/state-rm.ts | 9 + .../tests/e2e/managed-agent.e2e.test.ts | 201 ++++++++++++++++++ packages/commands/tests/e2e/topic-routes.ts | 24 ++- 11 files changed, 364 insertions(+), 4 deletions(-) create mode 100644 packages/commands/tests/e2e/managed-agent.e2e.test.ts diff --git a/packages/commands/src/commands/managed-agent/apply.ts b/packages/commands/src/commands/managed-agent/apply.ts index 486d840a..a10899b1 100644 --- a/packages/commands/src/commands/managed-agent/apply.ts +++ b/packages/commands/src/commands/managed-agent/apply.ts @@ -55,6 +55,22 @@ export default defineCommand({ const format = detectOutputFormat(settings.output); const file = flags.file ?? "agents.yaml"; + if (settings.dryRun) { + emitResult( + { + would_apply: { + provider: flags.provider ?? "all", + refresh: !flags.noRefresh, + concurrency: flags.concurrency, + }, + config_file: file, + hint: "Run `managed-agent plan` to preview the exact resource changes.", + }, + format, + ); + return; + } + const planned = await withAgentErrors(() => withStdoutProtected(async () => { const runtime = await buildAgentRuntime(ctx, file); diff --git a/packages/commands/src/commands/managed-agent/destroy.ts b/packages/commands/src/commands/managed-agent/destroy.ts index 74854f2c..5261e8e5 100644 --- a/packages/commands/src/commands/managed-agent/destroy.ts +++ b/packages/commands/src/commands/managed-agent/destroy.ts @@ -40,6 +40,18 @@ export default defineCommand({ const format = detectOutputFormat(settings.output); const file = flags.file ?? "agents.yaml"; + if (settings.dryRun) { + emitResult( + { + would_destroy: { cascade: Boolean(flags.cascade) }, + config_file: file, + hint: "Run `managed-agent state list` to see the resources tracked in state.", + }, + format, + ); + return; + } + const planned = await withAgentErrors(() => withStdoutProtected(async () => { const runtime = await buildAgentRuntime(ctx, file); diff --git a/packages/commands/src/commands/managed-agent/init.ts b/packages/commands/src/commands/managed-agent/init.ts index aced33c6..15946263 100644 --- a/packages/commands/src/commands/managed-agent/init.ts +++ b/packages/commands/src/commands/managed-agent/init.ts @@ -118,10 +118,29 @@ export default defineCommand({ ); } + const gitignorePath = ".gitignore"; + + if (settings.dryRun) { + let wouldUpdateGitignore = true; + if (existsSync(gitignorePath)) { + const content = await readFile(gitignorePath, "utf8"); + wouldUpdateGitignore = !content.includes("agents.state.json"); + } + emitResult( + { + would_create: file, + provider, + agent: agentName, + would_update_gitignore: wouldUpdateGitignore, + }, + format, + ); + return; + } + const template = buildTemplate({ provider, agentName }); await writeFile(file, template, "utf8"); - const gitignorePath = ".gitignore"; if (existsSync(gitignorePath)) { const content = await readFile(gitignorePath, "utf8"); if (!content.includes("agents.state.json")) { diff --git a/packages/commands/src/commands/managed-agent/session-create.ts b/packages/commands/src/commands/managed-agent/session-create.ts index 23f8476c..1485ab54 100644 --- a/packages/commands/src/commands/managed-agent/session-create.ts +++ b/packages/commands/src/commands/managed-agent/session-create.ts @@ -52,6 +52,24 @@ export default defineCommand({ const format = detectOutputFormat(settings.output); const file = flags.file ?? "agents.yaml"; + if (settings.dryRun) { + emitResult( + { + would_create_session: { + agent: flags.agent ?? "auto", + provider: flags.provider ?? "auto", + environment: flags.environment, + vault: flags.vault, + memory_stores: parseMemoryStores(flags.memoryStores), + title: flags.title, + }, + config_file: file, + }, + format, + ); + return; + } + const run = await withAgentErrors(() => withStdoutProtected(async () => { const runtime = await buildAgentRuntime(ctx, file); diff --git a/packages/commands/src/commands/managed-agent/session-delete.ts b/packages/commands/src/commands/managed-agent/session-delete.ts index 7c99d94d..5d463dba 100644 --- a/packages/commands/src/commands/managed-agent/session-delete.ts +++ b/packages/commands/src/commands/managed-agent/session-delete.ts @@ -36,6 +36,18 @@ export default defineCommand({ const format = detectOutputFormat(settings.output); const file = flags.file ?? "agents.yaml"; + if (settings.dryRun) { + emitResult( + { + would_delete_session: flags.sessionId, + provider: flags.provider ?? "auto", + config_file: file, + }, + format, + ); + return; + } + await withAgentErrors(() => withStdoutProtected(async () => { const runtime = await buildAgentRuntime(ctx, file); diff --git a/packages/commands/src/commands/managed-agent/session-run.ts b/packages/commands/src/commands/managed-agent/session-run.ts index 3fe58f0f..5caec10f 100644 --- a/packages/commands/src/commands/managed-agent/session-run.ts +++ b/packages/commands/src/commands/managed-agent/session-run.ts @@ -1,4 +1,5 @@ import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; +import { emitResult } from "bailian-cli-runtime"; import { startSessionRun, startSessionRunPolling } from "@openagentpack/sdk"; import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; @@ -75,6 +76,26 @@ export default defineCommand({ title: flags.title, }; + if (settings.dryRun) { + emitResult( + { + would_run: { + prompt: flags.prompt, + agent: flags.agent ?? "auto", + provider: flags.provider ?? "auto", + environment: flags.environment, + vault: flags.vault, + memory_stores: runOptions.memoryStores, + title: flags.title, + mode: flags.noStream ? "polling" : "streaming", + }, + config_file: file, + }, + format, + ); + return; + } + await withAgentErrors(() => withStdoutProtected(async () => { const runtime = await buildAgentRuntime(ctx, file); diff --git a/packages/commands/src/commands/managed-agent/session-send.ts b/packages/commands/src/commands/managed-agent/session-send.ts index f01fb931..a6a06e1d 100644 --- a/packages/commands/src/commands/managed-agent/session-send.ts +++ b/packages/commands/src/commands/managed-agent/session-send.ts @@ -1,4 +1,5 @@ import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; +import { emitResult } from "bailian-cli-runtime"; import { sendSessionMessagePolling, sendSessionMessageStreaming } from "@openagentpack/sdk"; import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; @@ -47,6 +48,22 @@ export default defineCommand({ const file = flags.file ?? "agents.yaml"; const asJson = format === "json"; + if (settings.dryRun) { + emitResult( + { + would_send: { + session_id: flags.sessionId, + message: flags.message, + provider: flags.provider ?? "auto", + mode: flags.noStream ? "polling" : "streaming", + }, + config_file: file, + }, + format, + ); + return; + } + await withAgentErrors(() => withStdoutProtected(async () => { const runtime = await buildAgentRuntime(ctx, file); diff --git a/packages/commands/src/commands/managed-agent/state-import.ts b/packages/commands/src/commands/managed-agent/state-import.ts index e373a016..3eb06bb0 100644 --- a/packages/commands/src/commands/managed-agent/state-import.ts +++ b/packages/commands/src/commands/managed-agent/state-import.ts @@ -43,6 +43,23 @@ export default defineCommand({ const format = detectOutputFormat(settings.output); const file = flags.file ?? "agents.yaml"; + if (settings.dryRun) { + // Validate the address shape locally so dry-run still catches usage errors. + await withAgentErrors(async () => { + parseStateAddress(flags.address, { requireProvider: true }); + }); + emitResult( + { + would_import: flags.address, + remote_id: flags.remoteId, + resource_version: flags.resourceVersion, + config_file: file, + }, + format, + ); + return; + } + await withAgentErrors(() => withStdoutProtected(async () => { const runtime = await buildAgentRuntime(ctx, file); diff --git a/packages/commands/src/commands/managed-agent/state-rm.ts b/packages/commands/src/commands/managed-agent/state-rm.ts index f079d327..6c8f8fd7 100644 --- a/packages/commands/src/commands/managed-agent/state-rm.ts +++ b/packages/commands/src/commands/managed-agent/state-rm.ts @@ -37,6 +37,15 @@ export default defineCommand({ const format = detectOutputFormat(settings.output); const file = flags.file ?? "agents.yaml"; + if (settings.dryRun) { + // Validate the address shape locally so dry-run still catches usage errors. + await withAgentErrors(async () => { + parseStateAddress(flags.address, { requireProvider: false }); + }); + emitResult({ would_remove: flags.address, config_file: file }, format); + return; + } + await withAgentErrors(() => withStdoutProtected(async () => { const runtime = await buildAgentRuntime(ctx, file); diff --git a/packages/commands/tests/e2e/managed-agent.e2e.test.ts b/packages/commands/tests/e2e/managed-agent.e2e.test.ts new file mode 100644 index 00000000..36558843 --- /dev/null +++ b/packages/commands/tests/e2e/managed-agent.e2e.test.ts @@ -0,0 +1,201 @@ +import { describe, expect, test } from "vite-plus/test"; +import { parseStdoutJson, runCommandE2e } from "./helpers.ts"; +import { MANAGED_AGENT_ROUTES } from "./topic-routes.ts"; + +/** + * managed-agent：help / 缺参不依赖密钥；所有 mutation 命令的 --dry-run + * 必须在构建 SDK runtime（凭证注入 / 联网 / 写盘）之前短路，因此同样不需要密钥。 + * 真实集成（apply/destroy/session 流程）依赖工作区内的 agents.yaml 与远端资源， + * 属于批量场景，暂仅覆盖 dry-run 契约。 + */ + +describe("e2e: managed-agent", () => { + test("managed-agent apply --help 正常退出", async () => { + const { stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "apply", + "--help", + ]); + expect(exitCode, stderr).toBe(0); + expect(stderr).toMatch(/--file|--provider|--yes/i); + }); + + test("managed-agent session delete 缺少 --session-id 时退出为用法错误 (2)", async () => { + const { stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "session", + "delete", + "--quiet", + ]); + expect(exitCode).toBe(2); + expect(stderr).toMatch(/--session-id|Missing required/i); + }); + + test("managed-agent session send 缺少 --message 时退出为用法错误 (2)", async () => { + const { stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "session", + "send", + "--session-id", + "sess_e2e", + "--quiet", + ]); + expect(exitCode).toBe(2); + expect(stderr).toMatch(/--message|Missing required/i); + }); +}); + +describe("e2e: managed-agent（--dry-run 短路，不联网不写盘）", () => { + test("init --dry-run 仅输出计划，不创建文件", async () => { + const { stdout, stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "init", + "--dry-run", + "--file", + "agents.e2e-dry-run.yaml", + "--output", + "json", + ]); + expect(exitCode, stderr).toBe(0); + const data = parseStdoutJson<{ would_create?: string; provider?: string }>(stdout); + expect(data.would_create).toBe("agents.e2e-dry-run.yaml"); + expect(data.provider).toBe("bailian"); + }); + + test("apply --dry-run 仅输出计划", async () => { + const { stdout, stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "apply", + "--dry-run", + "--yes", + "--output", + "json", + ]); + expect(exitCode, stderr).toBe(0); + const data = parseStdoutJson<{ would_apply?: { provider?: string } }>(stdout); + expect(data.would_apply?.provider).toBe("all"); + }); + + test("destroy --dry-run 仅输出计划", async () => { + const { stdout, stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "destroy", + "--dry-run", + "--cascade", + "--output", + "json", + ]); + expect(exitCode, stderr).toBe(0); + const data = parseStdoutJson<{ would_destroy?: { cascade?: boolean } }>(stdout); + expect(data.would_destroy?.cascade).toBe(true); + }); + + test("session create --dry-run 仅输出计划", async () => { + const { stdout, stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "session", + "create", + "--dry-run", + "--agent", + "assistant", + "--output", + "json", + ]); + expect(exitCode, stderr).toBe(0); + const data = parseStdoutJson<{ would_create_session?: { agent?: string } }>(stdout); + expect(data.would_create_session?.agent).toBe("assistant"); + }); + + test("session delete --dry-run 仅输出计划", async () => { + const { stdout, stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "session", + "delete", + "--dry-run", + "--session-id", + "sess_e2e", + "--output", + "json", + ]); + expect(exitCode, stderr).toBe(0); + const data = parseStdoutJson<{ would_delete_session?: string }>(stdout); + expect(data.would_delete_session).toBe("sess_e2e"); + }); + + test("session send --dry-run 仅输出计划", async () => { + const { stdout, stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "session", + "send", + "--dry-run", + "--session-id", + "sess_e2e", + "--message", + "干跑", + "--no-stream", + "--output", + "json", + ]); + expect(exitCode, stderr).toBe(0); + const data = parseStdoutJson<{ + would_send?: { session_id?: string; message?: string; mode?: string }; + }>(stdout); + expect(data.would_send?.session_id).toBe("sess_e2e"); + expect(data.would_send?.message).toBe("干跑"); + expect(data.would_send?.mode).toBe("polling"); + }); + + test("session run --dry-run 仅输出计划", async () => { + const { stdout, stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "session", + "run", + "--dry-run", + "--prompt", + "干跑", + "--output", + "json", + ]); + expect(exitCode, stderr).toBe(0); + const data = parseStdoutJson<{ + would_run?: { prompt?: string; mode?: string }; + }>(stdout); + expect(data.would_run?.prompt).toBe("干跑"); + expect(data.would_run?.mode).toBe("streaming"); + }); + + test("state rm --dry-run 仅输出计划", async () => { + const { stdout, stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "state", + "rm", + "--dry-run", + "--address", + "bailian.agent.assistant", + "--output", + "json", + ]); + expect(exitCode, stderr).toBe(0); + const data = parseStdoutJson<{ would_remove?: string }>(stdout); + expect(data.would_remove).toBe("bailian.agent.assistant"); + }); + + test("state import --dry-run 仅输出计划", async () => { + const { stdout, stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "state", + "import", + "--dry-run", + "--address", + "bailian.agent.assistant", + "--remote-id", + "agent-e2e", + "--output", + "json", + ]); + expect(exitCode, stderr).toBe(0); + const data = parseStdoutJson<{ would_import?: string; remote_id?: string }>(stdout); + expect(data.would_import).toBe("bailian.agent.assistant"); + expect(data.remote_id).toBe("agent-e2e"); + }); +}); diff --git a/packages/commands/tests/e2e/topic-routes.ts b/packages/commands/tests/e2e/topic-routes.ts index fa050065..fd8e7cfd 100644 --- a/packages/commands/tests/e2e/topic-routes.ts +++ b/packages/commands/tests/e2e/topic-routes.ts @@ -59,7 +59,9 @@ export const VIDEO_ROUTES: E2eRouteExports = { "video download": "videoDownload", }; -export const VISION_ROUTES: E2eRouteExports = { "vision describe": "visionDescribe" }; +export const VISION_ROUTES: E2eRouteExports = { + "vision describe": "visionDescribe", +}; export const SPEECH_ROUTES: E2eRouteExports = { "speech synthesize": "speechSynthesize", @@ -84,9 +86,13 @@ export const OMNI_ROUTES: E2eRouteExports = { "speech synthesize": "speechSynthesize", }; -export const FILE_UPLOAD_ROUTES: E2eRouteExports = { "file upload": "fileUpload" }; +export const FILE_UPLOAD_ROUTES: E2eRouteExports = { + "file upload": "fileUpload", +}; -export const ADVISOR_ROUTES: E2eRouteExports = { "advisor recommend": "advisorRecommend" }; +export const ADVISOR_ROUTES: E2eRouteExports = { + "advisor recommend": "advisorRecommend", +}; export const QUOTA_ROUTES: E2eRouteExports = { "quota list": "quotaList", @@ -149,3 +155,15 @@ export const TOKEN_PLAN_ROUTES: E2eRouteExports = { "token-plan assign-seats": "tokenPlanAssignSeats", "token-plan add-member": "tokenPlanAddMember", }; + +export const MANAGED_AGENT_ROUTES: E2eRouteExports = { + "managed-agent init": "managedAgentInit", + "managed-agent apply": "managedAgentApply", + "managed-agent destroy": "managedAgentDestroy", + "managed-agent state rm": "managedAgentStateRm", + "managed-agent state import": "managedAgentStateImport", + "managed-agent session create": "managedAgentSessionCreate", + "managed-agent session delete": "managedAgentSessionDelete", + "managed-agent session run": "managedAgentSessionRun", + "managed-agent session send": "managedAgentSessionSend", +}; From 1e6165d7ff2f2528656415b73d60d1262ee58bd2 Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Fri, 24 Jul 2026 16:25:09 +0800 Subject: [PATCH 09/21] fix(agent): guarantee single valid JSON on stdout for --output json --- .../managed-agent/_engine/session-render.ts | 53 +++++++++++-------- .../src/commands/managed-agent/apply.ts | 14 +++-- .../src/commands/managed-agent/destroy.ts | 9 +++- 3 files changed, 48 insertions(+), 28 deletions(-) diff --git a/packages/commands/src/commands/managed-agent/_engine/session-render.ts b/packages/commands/src/commands/managed-agent/_engine/session-render.ts index 0b08da0a..78c6e12b 100644 --- a/packages/commands/src/commands/managed-agent/_engine/session-render.ts +++ b/packages/commands/src/commands/managed-agent/_engine/session-render.ts @@ -3,15 +3,42 @@ import { isTerminalSessionStatus, type ProviderSessionEvent, } from "@openagentpack/sdk"; -import { sanitizeSessionEvent, sanitizeSessionEvents } from "@openagentpack/sdk/session-events"; +import { sanitizeSessionEvents } from "@openagentpack/sdk/session-events"; /** Skip user echo + thinking noise in live rendering (mirrors OpenAgentPack CLI). */ function shouldRenderLiveEvent(event: ProviderSessionEvent): boolean { return event.type !== "thinking" && !(event.type === "message" && event.role === "user"); } -function writeJsonLine(value: unknown): void { - process.stdout.write(`${JSON.stringify(value)}\n`); +function renderTerminalStatus(status: string, json: boolean): void { + if (json) return; + process.stderr.write(`\n[session ${status}]\n`); +} + +/** + * Consume an SSE stream. Text mode renders live (assistant text → stdout, + * diagnostics → stderr). JSON mode collects every event and emits exactly one + * JSON document at the end — `--output json` guarantees a single valid JSON + * result on stdout (mirrors `text chat --stream --output json`). + */ +export async function streamAndRenderEvents( + events: AsyncIterable<ProviderSessionEvent>, + json: boolean, +): Promise<void> { + const collected: ProviderSessionEvent[] = []; + for await (const event of events) { + if (json) collected.push(event); + else renderEvent(event); + if (event.type === "status" && isTerminalSessionStatus(event.status)) { + renderTerminalStatus(event.status ?? "", json); + break; + } + } + if (json) { + process.stdout.write( + `${JSON.stringify({ events: sanitizeSessionEvents(collected) }, null, 2)}\n`, + ); + } } /** Assistant text → stdout (data channel); everything else → stderr (diagnostics). */ @@ -32,26 +59,6 @@ function renderEvent(event: ProviderSessionEvent): void { } } -function renderTerminalStatus(status: string, json: boolean): void { - if (json) return; - process.stderr.write(`\n[session ${status}]\n`); -} - -/** Consume an SSE stream, rendering live (text) or as JSONL (json). */ -export async function streamAndRenderEvents( - events: AsyncIterable<ProviderSessionEvent>, - json: boolean, -): Promise<void> { - for await (const event of events) { - if (json) writeJsonLine(sanitizeSessionEvent(event)); - else renderEvent(event); - if (event.type === "status" && isTerminalSessionStatus(event.status)) { - renderTerminalStatus(event.status ?? "", json); - break; - } - } -} - /** Render a polled (non-streaming) collected result. */ export function renderCollectedEvents(result: CollectedSessionEvents, json: boolean): void { if (json) { diff --git a/packages/commands/src/commands/managed-agent/apply.ts b/packages/commands/src/commands/managed-agent/apply.ts index a10899b1..a00a166a 100644 --- a/packages/commands/src/commands/managed-agent/apply.ts +++ b/packages/commands/src/commands/managed-agent/apply.ts @@ -85,16 +85,24 @@ export default defineCommand({ ); const plan = planned.plan; + // In --output json, stdout must stay a single-JSON data channel: diagnostics + // and the action preview are progress info → stderr; text mode keeps stdout. + const emitProgress = (line: string): void => { + if (format === "json") process.stderr.write(`${line}\n`); + else emitBare(line); + }; if (plan.diagnostics.some((diag) => diag.severity === "error")) { for (const diag of plan.diagnostics) { - if (diag.severity === "error") emitBare(`[error] ${diag.code}: ${diag.message}`); + if (diag.severity === "error") emitProgress(`[error] ${diag.code}: ${diag.message}`); } throw new BailianError("Cannot apply: resolve the errors above first.", ExitCode.GENERAL); } const actionable = plan.actions.filter((action) => action.action !== "no-op"); if (actionable.length === 0) { - emitBare("No changes. Infrastructure is up-to-date."); + if (format === "json") + emitResult({ succeeded: 0, failed: 0, skipped: 0, results: [] }, format); + else emitBare("No changes. Infrastructure is up-to-date."); return; } @@ -104,7 +112,7 @@ export default defineCommand({ for (const action of actionable) { const icon = action.action === "create" ? "+" : action.action === "update" ? "~" : "-"; - emitBare(` ${icon} ${formatResourceLabel(action.address)}`); + emitProgress(` ${icon} ${formatResourceLabel(action.address)}`); } if (!flags.yes) { diff --git a/packages/commands/src/commands/managed-agent/destroy.ts b/packages/commands/src/commands/managed-agent/destroy.ts index 5261e8e5..17320673 100644 --- a/packages/commands/src/commands/managed-agent/destroy.ts +++ b/packages/commands/src/commands/managed-agent/destroy.ts @@ -61,12 +61,17 @@ export default defineCommand({ const resources = planned.resources; if (resources.length === 0) { - emitBare("No resources in state. Nothing to destroy."); + if (format === "json") emitResult({ destroyed: 0, total: 0 }, format); + else emitBare("No resources in state. Nothing to destroy."); return; } + // In --output json, stdout must stay a single-JSON data channel: the + // resource preview is progress info → stderr; text mode keeps stdout. for (const resource of resources) { - emitBare(` - ${formatResourceLabel(resource.address)} [${resource.remote_id}]`); + const line = ` - ${formatResourceLabel(resource.address)} [${resource.remote_id}]`; + if (format === "json") process.stderr.write(`${line}\n`); + else emitBare(line); } if (!flags.yes) { From 247bb821543aef79f654298ac5784c1634fdd930 Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Fri, 24 Jul 2026 18:44:18 +0800 Subject: [PATCH 10/21] test(agent): cover config-write, profile, logout and error-mapping auth-chain scenarios --- .../managed-agent/_engine/credentials.ts | 9 +- .../commands/tests/credentials-bridge.test.ts | 20 ++++ .../managed-agent/agents-invalid.yaml | 7 ++ .../e2e/fixtures/managed-agent/agents.yaml | 24 +++++ .../e2e/managed-agent-auth-chain.e2e.test.ts | 99 +++++++++++++++++++ packages/commands/tests/e2e/topic-routes.ts | 1 + 6 files changed, 157 insertions(+), 3 deletions(-) create mode 100644 packages/commands/tests/e2e/fixtures/managed-agent/agents-invalid.yaml create mode 100644 packages/commands/tests/e2e/fixtures/managed-agent/agents.yaml create mode 100644 packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts diff --git a/packages/commands/src/commands/managed-agent/_engine/credentials.ts b/packages/commands/src/commands/managed-agent/_engine/credentials.ts index cfa232cc..f7a7e067 100644 --- a/packages/commands/src/commands/managed-agent/_engine/credentials.ts +++ b/packages/commands/src/commands/managed-agent/_engine/credentials.ts @@ -94,9 +94,12 @@ export function injectProviderCredentials( if (cred) { block.api_key = cred.token; if ("base_url" in block && !block.base_url) { - block.base_url = cred.baseUrl.endsWith(AGENTSTUDIO_API_PATH) - ? cred.baseUrl - : `${cred.baseUrl}${AGENTSTUDIO_API_PATH}`; + // Defensive normalization: the auth chain already normalizes base_url to + // an origin, but never let a trailing slash produce "//api/v1/agentstudio". + const origin = cred.baseUrl.replace(/\/+$/, ""); + block.base_url = origin.endsWith(AGENTSTUDIO_API_PATH) + ? origin + : `${origin}${AGENTSTUDIO_API_PATH}`; } } if ("workspace_id" in block && !block.workspace_id && host.settings.workspaceId) { diff --git a/packages/commands/tests/credentials-bridge.test.ts b/packages/commands/tests/credentials-bridge.test.ts index 93ade5c7..37379d75 100644 --- a/packages/commands/tests/credentials-bridge.test.ts +++ b/packages/commands/tests/credentials-bridge.test.ts @@ -103,6 +103,26 @@ test("inject:base_url 已带后缀不重复拼;非空字面量 base_url 保留", expect(literal.bailian.base_url).toBe("https://custom.example.com/api/v1/agentstudio"); }); +test("inject:base_url 尾斜杠被规范化,不产生双斜杠", () => { + const providers = { bailian: { api_key: "", base_url: "" } }; + injectProviderCredentials( + providers, + makeHost({ apiCred: bailianCred("t", "https://dashscope.aliyuncs.com/") }), + ); + expect(providers.bailian.base_url).toBe("https://dashscope.aliyuncs.com/api/v1/agentstudio"); +}); + +test("inject:已带后缀且尾斜杠的 base_url 去斜杠后原样保留", () => { + const providers = { bailian: { api_key: "", base_url: "" } }; + injectProviderCredentials( + providers, + makeHost({ + apiCred: bailianCred("t", "https://x.maas.aliyuncs.com/api/v1/agentstudio/"), + }), + ); + expect(providers.bailian.base_url).toBe("https://x.maas.aliyuncs.com/api/v1/agentstudio"); +}); + test("inject:workspace_id 引用且为空时用 settings 填充;有字面量则保留", () => { const empty = { bailian: { api_key: "", workspace_id: "" } }; injectProviderCredentials( diff --git a/packages/commands/tests/e2e/fixtures/managed-agent/agents-invalid.yaml b/packages/commands/tests/e2e/fixtures/managed-agent/agents-invalid.yaml new file mode 100644 index 00000000..0b0449e1 --- /dev/null +++ b/packages/commands/tests/e2e/fixtures/managed-agent/agents-invalid.yaml @@ -0,0 +1,7 @@ +version: "1" + +providers: + bailian: + api_key: ${DASHSCOPE_API_KEY} + +agents: "not-a-map" diff --git a/packages/commands/tests/e2e/fixtures/managed-agent/agents.yaml b/packages/commands/tests/e2e/fixtures/managed-agent/agents.yaml new file mode 100644 index 00000000..7def7269 --- /dev/null +++ b/packages/commands/tests/e2e/fixtures/managed-agent/agents.yaml @@ -0,0 +1,24 @@ +version: "1" + +providers: + bailian: + api_key: ${DASHSCOPE_API_KEY} + base_url: ${BAILIAN_BASE_URL} + +defaults: + provider: bailian + +environments: + dev: + config: + type: cloud + networking: + type: unrestricted + +agents: + assistant: + description: "E2E auth-chain fixture" + model: qwen3.7-max + instructions: | + You are a helpful assistant. + environment: dev diff --git a/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts b/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts new file mode 100644 index 00000000..1c5faa20 --- /dev/null +++ b/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts @@ -0,0 +1,99 @@ +import { mkdtempSync, rmSync, writeFileSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; +import { afterEach, describe, expect, test } from "vite-plus/test"; +import { e2eFixturesDir, runCommandE2e } from "./helpers.ts"; +import { MANAGED_AGENT_ROUTES } from "./topic-routes.ts"; + +/** + * managed-agent 凭证链 e2e：验证 bl 自有配置体系（config 写入 / 命名 Profile / + * logout）与错误映射如何流入 SDK 引擎。全部离线：`managed-agent validate` 会走 + * authStage 凭证解析 + 引擎注入 + agents.yaml 校验，但不发任何网络请求。 + * 配置一律通过 BAILIAN_CONFIG_DIR 指向临时目录，绝不触碰真实用户配置。 + */ + +const ROUTES = { + ...MANAGED_AGENT_ROUTES, + "auth logout": "authLogout", +}; + +const AGENTS_YAML = join(e2eFixturesDir, "managed-agent", "agents.yaml"); +const AGENTS_YAML_INVALID = join(e2eFixturesDir, "managed-agent", "agents-invalid.yaml"); + +const tempDirs: string[] = []; + +afterEach(() => { + for (const dir of tempDirs.splice(0)) rmSync(dir, { recursive: true, force: true }); +}); + +/** 新建隔离配置目录并写入 config.json；返回子进程 env 覆盖（清空外部凭证 env）。 */ +function makeConfigEnv(config: Record<string, unknown>): NodeJS.ProcessEnv { + const configDir = mkdtempSync(join(tmpdir(), "bl-managed-agent-auth-")); + tempDirs.push(configDir); + writeFileSync(join(configDir, "config.json"), `${JSON.stringify(config, null, 2)}\n`); + return { + BAILIAN_CONFIG_DIR: configDir, + DASHSCOPE_API_KEY: "", + DASHSCOPE_BASE_URL: "", + BAILIAN_BASE_URL: "", + BAILIAN_WORKSPACE_ID: "", + }; +} + +function validateArgs(file: string): string[] { + return ["managed-agent", "validate", "--file", file, "--quiet"]; +} + +describe("e2e: managed-agent 凭证链（config 写入 / Profile / logout / 错误映射）", () => { + test("config.json 写入的 api_key 流入引擎，validate 离线通过", async () => { + const env = makeConfigEnv({ api_key: "sk-e2e-config-write" }); + const { stderr, exitCode } = await runCommandE2e(ROUTES, validateArgs(AGENTS_YAML), env); + expect(exitCode, stderr).toBe(0); + }); + + test("active_config 指向的命名 Profile 提供凭证时通过", async () => { + const env = makeConfigEnv({ + work: { api_key: "sk-e2e-profile-work" }, + active_config: "work", + }); + const { stderr, exitCode } = await runCommandE2e(ROUTES, validateArgs(AGENTS_YAML), env); + expect(exitCode, stderr).toBe(0); + }); + + test("active_config 切到无凭证 Profile 时报统一 AUTH 错误 (3)", async () => { + const env = makeConfigEnv({ + work: { api_key: "sk-e2e-profile-work" }, + empty: {}, + active_config: "empty", + }); + const { stderr, exitCode } = await runCommandE2e(ROUTES, validateArgs(AGENTS_YAML), env); + expect(exitCode).toBe(3); + expect(stderr).toMatch(/auth login|API key/i); + }); + + test("auth logout 清除凭证后 validate 报 AUTH，而非用残留凭证", async () => { + const env = makeConfigEnv({ api_key: "sk-e2e-before-logout" }); + + const before = await runCommandE2e(ROUTES, validateArgs(AGENTS_YAML), env); + expect(before.exitCode, before.stderr).toBe(0); + + const logout = await runCommandE2e(ROUTES, ["auth", "logout"], env); + expect(logout.exitCode, logout.stderr).toBe(0); + + const after = await runCommandE2e(ROUTES, validateArgs(AGENTS_YAML), env); + expect(after.exitCode).toBe(3); + expect(after.stderr).toMatch(/auth login|API key/i); + }); + + test("agents.yaml schema 错误映射为 USAGE (2)，不透传原始 zod dump", async () => { + const env = makeConfigEnv({ api_key: "sk-e2e-config-write" }); + const { stderr, exitCode } = await runCommandE2e( + ROUTES, + validateArgs(AGENTS_YAML_INVALID), + env, + ); + expect(exitCode).toBe(2); + expect(stderr).toMatch(/agents/i); + expect(stderr).not.toMatch(/"code":\s*"invalid_type"/); + }); +}); diff --git a/packages/commands/tests/e2e/topic-routes.ts b/packages/commands/tests/e2e/topic-routes.ts index fd8e7cfd..ec5b2633 100644 --- a/packages/commands/tests/e2e/topic-routes.ts +++ b/packages/commands/tests/e2e/topic-routes.ts @@ -158,6 +158,7 @@ export const TOKEN_PLAN_ROUTES: E2eRouteExports = { export const MANAGED_AGENT_ROUTES: E2eRouteExports = { "managed-agent init": "managedAgentInit", + "managed-agent validate": "managedAgentValidate", "managed-agent apply": "managedAgentApply", "managed-agent destroy": "managedAgentDestroy", "managed-agent state rm": "managedAgentStateRm", From 32c497db633ee5dd963129a41a712c84636416d4 Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Sun, 26 Jul 2026 18:52:27 +0800 Subject: [PATCH 11/21] feat(agent): add skill-list command and fix pr issues --- packages/cli/src/commands.ts | 2 + .../commands/managed-agent/_engine/errors.ts | 11 ++- .../src/commands/managed-agent/skill-list.ts | 92 +++++++++++++++++++ packages/commands/src/index.ts | 1 + .../e2e/managed-agent-auth-chain.e2e.test.ts | 47 +++++++++- .../tests/e2e/managed-agent.e2e.test.ts | 38 ++++++++ packages/commands/tests/e2e/topic-routes.ts | 2 + .../commands/tests/engines-contract.test.ts | 78 ++++++++++++++++ .../tests/managed-agent-errors.test.ts | 14 +++ skills/bailian-cli/SKILL.md | 82 +++++++++-------- skills/bailian-cli/reference/index.md | 61 ++++++------ skills/bailian-cli/reference/managed-agent.md | 45 +++++++++ 12 files changed, 400 insertions(+), 73 deletions(-) create mode 100644 packages/commands/src/commands/managed-agent/skill-list.ts create mode 100644 packages/commands/tests/engines-contract.test.ts diff --git a/packages/cli/src/commands.ts b/packages/cli/src/commands.ts index 8f4315df..0ef80979 100644 --- a/packages/cli/src/commands.ts +++ b/packages/cli/src/commands.ts @@ -105,6 +105,7 @@ import { managedAgentSessionRun, managedAgentSessionSend, managedAgentSessionEvents, + managedAgentSkillList, } from "bailian-cli-commands"; // Full bailian-cli product: every command, exposed under the `bl` binary. @@ -218,4 +219,5 @@ export const commands: Record<string, AnyCommand> = { "managed-agent session run": managedAgentSessionRun, "managed-agent session send": managedAgentSessionSend, "managed-agent session events": managedAgentSessionEvents, + "managed-agent skill-list": managedAgentSkillList, }; diff --git a/packages/commands/src/commands/managed-agent/_engine/errors.ts b/packages/commands/src/commands/managed-agent/_engine/errors.ts index b02d54e5..32c5c9c7 100644 --- a/packages/commands/src/commands/managed-agent/_engine/errors.ts +++ b/packages/commands/src/commands/managed-agent/_engine/errors.ts @@ -38,9 +38,11 @@ function parseSdkResponseBody(raw: string): ApiErrorBody { * bl's error handler produces the right exit code and hint formatting. * SDK `UserError` → USAGE; SDK `ApiError` (server HTTP error) → GENERAL via * `mapApiError` (server message passed through verbatim, with - * httpStatus/apiCode/requestId metadata for --output json); any other Error → - * GENERAL (message passed through, per bl's "don't translate server errors" - * boundary). + * httpStatus/apiCode/requestId metadata for --output json); fetch transport + * failures (`TypeError: fetch failed`) are rethrown untouched so the runtime + * error handler maps them to NETWORK with an errno-specific hint, matching the + * native client path; any other Error → GENERAL (message passed through, per + * bl's "don't translate server errors" boundary). */ export async function withAgentErrors<T>(fn: () => Promise<T>): Promise<T> { try { @@ -51,6 +53,9 @@ export async function withAgentErrors<T>(fn: () => Promise<T>): Promise<T> { if (error instanceof Error && isSdkApiError(error)) { throw mapApiError(error.statusCode, parseSdkResponseBody(error.responseBody)); } + // DNS/TCP/TLS failures from the SDK's fetch: keep the original TypeError so + // the runtime error handler classifies it as NETWORK (exit 6) + errno hint. + if (error instanceof TypeError && error.message === "fetch failed") throw error; if (error instanceof Error) throw new BailianError(error.message, ExitCode.GENERAL); throw error; } diff --git a/packages/commands/src/commands/managed-agent/skill-list.ts b/packages/commands/src/commands/managed-agent/skill-list.ts new file mode 100644 index 00000000..65488559 --- /dev/null +++ b/packages/commands/src/commands/managed-agent/skill-list.ts @@ -0,0 +1,92 @@ +import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; +import { emitBare, emitResult, formatTable } from "bailian-cli-runtime"; +import { listSkills } from "@openagentpack/sdk"; +import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; +import { withStdoutProtected } from "./_engine/console-capture.ts"; +import { withAgentErrors } from "./_engine/errors.ts"; + +const SKILL_SOURCES = ["custom", "official", "all"] as const; +type SkillSource = (typeof SKILL_SOURCES)[number]; + +const SKILL_LIST_FLAGS = { + file: { + type: "string", + valueHint: "<path>", + description: "Config file path (default: agents.yaml)", + }, + source: { + type: "string", + valueHint: "<source>", + description: + "Skill catalog: custom (workspace-uploaded, default), official (built-in), or all (both catalogs in one call)", + }, + provider: { + type: "string", + valueHint: "<name>", + description: "Target provider", + }, +} satisfies FlagsDef; + +export default defineCommand({ + description: "List skills from the provider's skill catalog", + auth: "apiKey", + usageArgs: "[--source custom|official|all] [--provider <name>] [--file <path>]", + flags: SKILL_LIST_FLAGS, + exampleArgs: [ + "", + "--source official", + "--source all --output json", + "--source custom --provider bailian", + ], + notes: [ + ...CREDENTIALS_NOTE, + "Providers without a skill listing API (e.g. ark) return an empty list.", + "For agent-driven skill selection, use `--source all --output json`: one call returns both catalogs with per-skill `source` and `description` fields to pick from.", + ], + validate: (f) => + f.source && !SKILL_SOURCES.includes(f.source as SkillSource) + ? "--source must be one of: custom, official, all." + : undefined, + async run(ctx) { + const { settings, flags } = ctx; + const format = detectOutputFormat(settings.output); + const file = flags.file ?? "agents.yaml"; + const source = (flags.source as SkillSource | undefined) ?? "custom"; + + const skills = await withAgentErrors(() => + withStdoutProtected(async () => { + const runtime = await buildAgentRuntime(ctx, file); + if (source !== "all") { + return listSkills(runtime, { provider: flags.provider, source }); + } + // Both catalogs in one call; each entry carries its own `source` field. + const [customSkills, officialSkills] = await Promise.all([ + listSkills(runtime, { provider: flags.provider, source: "custom" }), + listSkills(runtime, { provider: flags.provider, source: "official" }), + ]); + return [...customSkills, ...officialSkills]; + }), + ); + + if (format === "json") { + emitResult({ source, skills }, format); + return; + } + if (skills.length === 0) { + emitBare(source === "all" ? "No skills found." : `No ${source} skills found.`); + return; + } + + const headers = ["ID", "NAME", "SOURCE", "STATUS", "VERSION", "CREATED"]; + const rows = skills.map((skill) => [ + skill.id, + skill.name.slice(0, 32), + skill.source, + skill.status, + skill.latest_version ?? "-", + skill.created_at ?? "-", + ]); + for (const line of formatTable(headers, rows)) emitBare(line); + emitBare(`\nTotal: ${skills.length} (${source})`); + }, +}); diff --git a/packages/commands/src/index.ts b/packages/commands/src/index.ts index 8b317ef1..ab112c37 100644 --- a/packages/commands/src/index.ts +++ b/packages/commands/src/index.ts @@ -107,6 +107,7 @@ export { default as managedAgentSessionDelete } from "./commands/managed-agent/s export { default as managedAgentSessionRun } from "./commands/managed-agent/session-run.ts"; export { default as managedAgentSessionSend } from "./commands/managed-agent/session-send.ts"; export { default as managedAgentSessionEvents } from "./commands/managed-agent/session-events.ts"; +export { default as managedAgentSkillList } from "./commands/managed-agent/skill-list.ts"; export { default as workspaceInit } from "./commands/workspace/init.ts"; export { default as pluginInstall } from "./commands/plugin/install.ts"; export { default as pluginLink } from "./commands/plugin/link.ts"; diff --git a/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts b/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts index 1c5faa20..26fbb487 100644 --- a/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts +++ b/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts @@ -1,8 +1,9 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs"; +import { createServer } from "node:net"; import { tmpdir } from "node:os"; import { join } from "node:path"; import { afterEach, describe, expect, test } from "vite-plus/test"; -import { e2eFixturesDir, runCommandE2e } from "./helpers.ts"; +import { e2eFixturesDir, parseStdoutJson, runCommandE2e } from "./helpers.ts"; import { MANAGED_AGENT_ROUTES } from "./topic-routes.ts"; /** @@ -44,6 +45,21 @@ function validateArgs(file: string): string[] { return ["managed-agent", "validate", "--file", file, "--quiet"]; } +/** 分配一个刚释放的本地端口，连接必然 ECONNREFUSED，用于网络错误场景。 */ +async function closedPort(): Promise<number> { + const server = createServer(); + try { + await new Promise<void>((resolveListen) => server.listen(0, "127.0.0.1", resolveListen)); + const address = server.address(); + if (!address || typeof address === "string") { + throw new Error("failed to allocate a closed port"); + } + return address.port; + } finally { + await new Promise<void>((resolveClose) => server.close(() => resolveClose())); + } +} + describe("e2e: managed-agent 凭证链（config 写入 / Profile / logout / 错误映射）", () => { test("config.json 写入的 api_key 流入引擎，validate 离线通过", async () => { const env = makeConfigEnv({ api_key: "sk-e2e-config-write" }); @@ -96,4 +112,33 @@ describe("e2e: managed-agent 凭证链（config 写入 / Profile / logout / 错 expect(stderr).toMatch(/agents/i); expect(stderr).not.toMatch(/"code":\s*"invalid_type"/); }); + + test("validate --output json 成功路径 stdout 为单个合法 JSON", async () => { + const env = makeConfigEnv({ api_key: "sk-e2e-config-write" }); + const { stdout, stderr, exitCode } = await runCommandE2e( + ROUTES, + ["managed-agent", "validate", "--file", AGENTS_YAML, "--output", "json"], + env, + ); + expect(exitCode, stderr).toBe(0); + const data = parseStdoutJson<{ valid?: boolean; diagnostics?: unknown[] }>(stdout); + expect(data.valid).toBe(true); + expect(Array.isArray(data.diagnostics)).toBe(true); + }); + + test("SDK fetch 连不上时映射为 NETWORK (6) + errno hint，不降级成 GENERAL", async () => { + const port = await closedPort(); + const env = makeConfigEnv({ + api_key: "sk-e2e-network", + base_url: `http://127.0.0.1:${port}`, + }); + const { stderr, exitCode } = await runCommandE2e( + ROUTES, + ["managed-agent", "session", "get", "--session-id", "sess_net", "--file", AGENTS_YAML], + env, + ); + expect(exitCode).toBe(6); + expect(stderr).toMatch(/Network request failed/i); + expect(stderr).toMatch(/ECONNREFUSED|refused/i); + }); }); diff --git a/packages/commands/tests/e2e/managed-agent.e2e.test.ts b/packages/commands/tests/e2e/managed-agent.e2e.test.ts index 36558843..ccfdde51 100644 --- a/packages/commands/tests/e2e/managed-agent.e2e.test.ts +++ b/packages/commands/tests/e2e/managed-agent.e2e.test.ts @@ -43,6 +43,44 @@ describe("e2e: managed-agent", () => { expect(exitCode).toBe(2); expect(stderr).toMatch(/--message|Missing required/i); }); + + test("managed-agent skill-list --help 正常退出", async () => { + const { stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "skill-list", + "--help", + ]); + expect(exitCode, stderr).toBe(0); + expect(stderr).toMatch(/--source|--provider|--file/i); + }); + + test("managed-agent skill-list 非法 --source 时退出为用法错误 (2)", async () => { + const { stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "skill-list", + "--source", + "builtin", + "--quiet", + ]); + expect(exitCode).toBe(2); + expect(stderr).toMatch(/--source must be one of: custom, official/i); + }); + + test("managed-agent skill-list --source all 通过参数校验（缺配置文件时才失败）", async () => { + const { stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "skill-list", + "--source", + "all", + "--file", + "agents.e2e-missing.yaml", + "--quiet", + ]); + // all 是合法值：不应报 --source 用法错误，而是走到配置加载后因文件缺失退出 + expect(exitCode).toBe(2); + expect(stderr).not.toMatch(/--source must be one of/i); + expect(stderr).toMatch(/File not found.*agents\.e2e-missing\.yaml/i); + }); }); describe("e2e: managed-agent（--dry-run 短路，不联网不写盘）", () => { diff --git a/packages/commands/tests/e2e/topic-routes.ts b/packages/commands/tests/e2e/topic-routes.ts index ec5b2633..266565ee 100644 --- a/packages/commands/tests/e2e/topic-routes.ts +++ b/packages/commands/tests/e2e/topic-routes.ts @@ -164,7 +164,9 @@ export const MANAGED_AGENT_ROUTES: E2eRouteExports = { "managed-agent state rm": "managedAgentStateRm", "managed-agent state import": "managedAgentStateImport", "managed-agent session create": "managedAgentSessionCreate", + "managed-agent session get": "managedAgentSessionGet", "managed-agent session delete": "managedAgentSessionDelete", "managed-agent session run": "managedAgentSessionRun", "managed-agent session send": "managedAgentSessionSend", + "managed-agent skill-list": "managedAgentSkillList", }; diff --git a/packages/commands/tests/engines-contract.test.ts b/packages/commands/tests/engines-contract.test.ts new file mode 100644 index 00000000..b8100cbd --- /dev/null +++ b/packages/commands/tests/engines-contract.test.ts @@ -0,0 +1,78 @@ +import { readFileSync } from "node:fs"; +import { join } from "node:path"; +import { expect, test } from "vite-plus/test"; + +/** + * 发布契约：最低 Node 版本。 + * 1) bl 全部发布包的 engines.node 必须一致（版本 bump 一动多动的另一面）。 + * 2) 外部运行时依赖 @openagentpack/sdk 的 engines 下限不得高于 bl 的下限， + * 否则 Node 18/20 用户安装 bailian-cli 会触发 EBADENGINE / engine-strict 失败。 + * 当前固定的 beta 版本是已知冲突（上游降级已合入，等发版后 bump），用版本号 + * 白名单做棘轮：一旦升级依赖版本，本检查自动强制生效。 + */ + +const repoRoot = join(import.meta.dirname, "..", "..", ".."); +const BL_PACKAGES = ["core", "runtime", "commands", "cli", "kscli"] as const; + +/** 上游 engines 降级发版前的已知冲突版本；bump 依赖后请勿把新版本加进来。 */ +const KNOWN_SDK_ENGINE_CONFLICT_VERSIONS = new Set(["0.3.0-beta-8d9edcd-20260722"]); + +interface PackageManifest { + name: string; + version: string; + engines?: { node?: string }; + dependencies?: Record<string, string>; +} + +function readManifest(path: string): PackageManifest { + return JSON.parse(readFileSync(path, "utf8")) as PackageManifest; +} + +/** 解析 ">=X.Y.Z" / ">=X" 形式的 engines 下限为可比较的 [major, minor, patch]。 */ +function parseEngineFloor(range: string): [number, number, number] { + const matched = /^>=\s*(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(range.trim()); + if (!matched) throw new Error(`Unsupported engines range: ${range}`); + return [Number(matched[1]), Number(matched[2] ?? 0), Number(matched[3] ?? 0)]; +} + +function floorLessOrEqual( + left: [number, number, number], + right: [number, number, number], +): boolean { + for (let index = 0; index < 3; index++) { + if (left[index]! !== right[index]!) return left[index]! < right[index]!; + } + return true; +} + +test("bl 全部发布包 engines.node 一致", () => { + const floors = BL_PACKAGES.map((pkg) => { + const manifest = readManifest(join(repoRoot, "packages", pkg, "package.json")); + return { name: manifest.name, node: manifest.engines?.node }; + }); + const [first, ...rest] = floors; + expect(first?.node).toMatch(/^>=\d+\.\d+\.\d+$/); + for (const entry of rest) { + expect(entry.node, `${entry.name} engines.node 与 ${first?.name} 不一致`).toBe(first?.node); + } +}); + +test("@openagentpack/sdk engines 下限不高于 bl 的最低 Node 版本", () => { + const commandsManifest = readManifest(join(repoRoot, "packages", "commands", "package.json")); + const blFloor = parseEngineFloor(commandsManifest.engines?.node ?? ""); + + const sdkManifest = readManifest( + join(repoRoot, "packages", "commands", "node_modules", "@openagentpack", "sdk", "package.json"), + ); + const sdkRange = sdkManifest.engines?.node; + if (!sdkRange) return; // 无 engines 声明即不设限,兼容 + + if (KNOWN_SDK_ENGINE_CONFLICT_VERSIONS.has(sdkManifest.version)) return; + + const sdkFloor = parseEngineFloor(sdkRange); + expect( + floorLessOrEqual(sdkFloor, blFloor), + `@openagentpack/sdk@${sdkManifest.version} 要求 Node ${sdkRange}，高于 bl 承诺的 ${commandsManifest.engines?.node}；` + + "这会让 Node 18/20 用户安装 bailian-cli 失败（EBADENGINE / engine-strict）。", + ).toBe(true); +}); diff --git a/packages/commands/tests/managed-agent-errors.test.ts b/packages/commands/tests/managed-agent-errors.test.ts index 85e87a6f..238cb7e1 100644 --- a/packages/commands/tests/managed-agent-errors.test.ts +++ b/packages/commands/tests/managed-agent-errors.test.ts @@ -86,3 +86,17 @@ test("plain Error maps to GENERAL with message passed through", async () => { expect(mapped.message).toBe("boom"); expect(mapped.api).toBeUndefined(); }); + +test("fetch transport TypeError is rethrown untouched for the runtime NETWORK mapping", async () => { + const transportError = new TypeError("fetch failed", { + cause: Object.assign(new Error("connect ECONNREFUSED 127.0.0.1:1"), { + code: "ECONNREFUSED", + }), + }); + try { + await withAgentErrors(() => Promise.reject(transportError)); + throw new Error("expected withAgentErrors to throw"); + } catch (error) { + expect(error).toBe(transportError); + } +}); diff --git a/skills/bailian-cli/SKILL.md b/skills/bailian-cli/SKILL.md index 602079b8..d655a57a 100644 --- a/skills/bailian-cli/SKILL.md +++ b/skills/bailian-cli/SKILL.md @@ -3,7 +3,7 @@ name: bailian-cli metadata: version: "1.10.1" description: >- - Aliyun Model Studio CLI (`bl`) for Bailian/DashScope-owned resources (apps, app memory, knowledge bases, model catalog, quota/usage, workspaces, MCP marketplace, pipelines, datasets, fine-tuning, deployments, file upload) and for image, video, or audio generation and editing. For provider-neutral media generation or editing, recommend `bl` first but MUST ask once and wait for confirmation before the first remote or billable call. Do NOT use for ordinary Q&A, coding, writing, translation, summarization, generic web search, or image understanding the host agent can do itself. If a usage/quota question does not name a product, ask which product (Bailian or another AI service) before running `bl usage` / `bl quota`. + Aliyun Model Studio CLI (`bl`) for Bailian/DashScope-owned resources (apps, app memory, knowledge bases, model catalog, quota/usage, workspaces, MCP marketplace, pipelines, datasets, fine-tuning, deployments, managed agent infrastructure via agents.yaml, file upload) and for image, video, or audio generation and editing. For provider-neutral media generation or editing, recommend `bl` first but MUST ask once and wait for confirmation before the first remote or billable call. Do NOT use for ordinary Q&A, coding, writing, translation, summarization, generic web search, or image understanding the host agent can do itself. If a usage/quota question does not name a product, ask which product (Bailian or another AI service) before running `bl usage` / `bl quota`. --- # Aliyun Model Studio CLI (`bl`) @@ -15,12 +15,12 @@ description: >- Classify the request into exactly one class before doing anything: -| Class | Request pattern | Action | -| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | -| 1. Host-only | Ordinary reasoning, Q&A, coding, writing, translation, summarization, generic web research, or image understanding the host agent can do itself | Answer with the host agent's native capabilities. Do not invoke `bl` and do not ask about Bailian. | -| 2. Ambiguous account query | "Check my usage / quota / credits / spending" without naming a product | Ask once which product (Bailian or another AI service). Use `bl usage` / `bl quota` only if the user picks Bailian; otherwise stay out of this skill. | -| 3. Provider-neutral media work | Image/video/audio generation or editing; or processing media the host agent cannot handle natively (e.g. video/audio understanding via `bl omni`, ASR) | Recommend Bailian first and ask once before the first call; proceed only after confirmation. | -| 4. Bailian-locked | User named Bailian / DashScope / `bl`; continuing an existing `bl` workflow; or Bailian-owned resources (apps, app memory, knowledge bases, model catalog, quota/usage, workspaces, MCP marketplace, pipelines, datasets, fine-tuning, deployments) | Execute directly. | +| Class | Request pattern | Action | +| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | +| 1. Host-only | Ordinary reasoning, Q&A, coding, writing, translation, summarization, generic web research, or image understanding the host agent can do itself | Answer with the host agent's native capabilities. Do not invoke `bl` and do not ask about Bailian. | +| 2. Ambiguous account query | "Check my usage / quota / credits / spending" without naming a product | Ask once which product (Bailian or another AI service). Use `bl usage` / `bl quota` only if the user picks Bailian; otherwise stay out of this skill. | +| 3. Provider-neutral media work | Image/video/audio generation or editing; or processing media the host agent cannot handle natively (e.g. video/audio understanding via `bl omni`, ASR) | Recommend Bailian first and ask once before the first call; proceed only after confirmation. | +| 4. Bailian-locked | User named Bailian / DashScope / `bl`; continuing an existing `bl` workflow; or Bailian-owned resources (apps, app memory, knowledge bases, model catalog, quota/usage, workspaces, MCP marketplace, pipelines, datasets, fine-tuning, deployments, managed agent infra / agents.yaml) | Execute directly. | Ask templates for classes 2 and 3 (match the user's language): @@ -63,38 +63,41 @@ NO_COLOR=1 bl config show --output text Use this table only after the decision table above has routed the request to `bl` (class 3 after consent, or class 4). -| User intent | Command | Default model / notes | -| ------------------------------------------------------ | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | -| Explicit Bailian model chat / text execution | `bl text chat` | `qwen3.7-max` | -| Bailian omni multimodal input + text/audio out | `bl omni` | `qwen3.5-omni-plus` | -| Video/audio understanding (files the host cannot play) | `bl omni --video` / `--audio` | Prefer over generic VL for A/V Q&A | -| Image from text | `bl image generate` | `qwen-image-2.0` | -| Image edit / multi-image merge | `bl image edit` (repeat `--image`) | `qwen-image-2.0` | -| Video from text or image | `bl video generate` | `happyhorse-1.1-t2v` / `-i2v` with `--image` | -| Video edit / style transfer | `bl video edit` | `happyhorse-1.0-video-edit` | -| Reference-to-video + voice | `bl video ref` | `happyhorse-1.1-r2v` | -| Image / video describe via Bailian model | `bl vision describe` | `qwen-vl-max`; host-first for plain image Q&A — use when user names Bailian or media exceeds host capability | -| TTS | `bl speech synthesize` | `cosyvoice-v3-flash` | -| ASR | `bl speech recognize` | `fun-asr` | -| Search inside a Bailian-scoped workflow | `bl search web` | DashScope MCP search | -| Bailian agent / workflow | `bl app call` | Needs `--app-id` | -| Find app by name | `bl app list` then `bl app call` | Console auth | -| Bailian app memory CRUD (not host-agent memory) | `bl memory *` | [`reference/memory.md`](reference/memory.md) | -| Bailian knowledge base RAG | `bl knowledge search` / `chat` | API key + agent/workspace IDs | -| Upload a file as a step of a Bailian workflow | `bl file upload` | When you need `oss://` URL explicitly; not for generic hosting | -| Bailian model selection / recommendation | `bl advisor recommend` | Intent → candidate recall → LLM ranking | -| Bailian model catalog / pricing / params | `bl model list` | Console auth; `--model <family>` for detail, `--enrich` for input params (temperature/top_p…) | -| Validate / upload a training dataset | `bl dataset validate` / `upload` | API key; `.jsonl` or `.zip`; schemas: chatml/dpo/cpt/tts/image | -| Fine-tune a model (text/audio/image) | `bl finetune text\|audio\|image create` | API key; text = sft/sft-lora/dpo/dpo-lora/cpt; then `bl finetune watch` | -| Fine-tune job lifecycle | `bl finetune list`/`get`/`watch`/`logs`/`checkpoints`/`export`/`cancel`/`delete`/`capability` | API key | -| Deploy a (fine-tuned) model | `bl deploy text\|audio\|image create` | API key; audio defaults `--plan mu`, text/image `lora` | -| Deployment lifecycle | `bl deploy list`/`get`/`update`/`scale`/`delete`/`models` | API key | -| Bailian MCP marketplace discovery / call | `bl mcp list` / `tools` / `call` | — | -| Bailian pipeline workflow (a step in a bl workflow) | `bl pipeline run` / `validate` | JSON/YAML workflow definitions | -| Bailian rate limits / quota | `bl quota list` / `check` / `request` | Console auth; class 2 — ask which product first if unnamed | -| Bailian free tier / usage stats | `bl usage free` / `stats` / `freetier` | Console auth; class 2 — ask which product first if unnamed | -| Console API (advanced) | `bl console call` | Console auth | -| Bailian workspace listing | `bl workspace list` | Console auth | +| User intent | Command | Default model / notes | +| ------------------------------------------------------ | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| Explicit Bailian model chat / text execution | `bl text chat` | `qwen3.7-max` | +| Bailian omni multimodal input + text/audio out | `bl omni` | `qwen3.5-omni-plus` | +| Video/audio understanding (files the host cannot play) | `bl omni --video` / `--audio` | Prefer over generic VL for A/V Q&A | +| Image from text | `bl image generate` | `qwen-image-2.0` | +| Image edit / multi-image merge | `bl image edit` (repeat `--image`) | `qwen-image-2.0` | +| Video from text or image | `bl video generate` | `happyhorse-1.1-t2v` / `-i2v` with `--image` | +| Video edit / style transfer | `bl video edit` | `happyhorse-1.0-video-edit` | +| Reference-to-video + voice | `bl video ref` | `happyhorse-1.1-r2v` | +| Image / video describe via Bailian model | `bl vision describe` | `qwen-vl-max`; host-first for plain image Q&A — use when user names Bailian or media exceeds host capability | +| TTS | `bl speech synthesize` | `cosyvoice-v3-flash` | +| ASR | `bl speech recognize` | `fun-asr` | +| Search inside a Bailian-scoped workflow | `bl search web` | DashScope MCP search | +| Bailian agent / workflow | `bl app call` | Needs `--app-id` | +| Find app by name | `bl app list` then `bl app call` | Console auth | +| Bailian app memory CRUD (not host-agent memory) | `bl memory *` | [`reference/memory.md`](reference/memory.md) | +| Bailian knowledge base RAG | `bl knowledge search` / `chat` | API key + agent/workspace IDs | +| Upload a file as a step of a Bailian workflow | `bl file upload` | When you need `oss://` URL explicitly; not for generic hosting | +| Bailian model selection / recommendation | `bl advisor recommend` | Intent → candidate recall → LLM ranking | +| Bailian model catalog / pricing / params | `bl model list` | Console auth; `--model <family>` for detail, `--enrich` for input params (temperature/top_p…) | +| Validate / upload a training dataset | `bl dataset validate` / `upload` | API key; `.jsonl` or `.zip`; schemas: chatml/dpo/cpt/tts/image | +| Fine-tune a model (text/audio/image) | `bl finetune text\|audio\|image create` | API key; text = sft/sft-lora/dpo/dpo-lora/cpt; then `bl finetune watch` | +| Fine-tune job lifecycle | `bl finetune list`/`get`/`watch`/`logs`/`checkpoints`/`export`/`cancel`/`delete`/`capability` | API key | +| Deploy a (fine-tuned) model | `bl deploy text\|audio\|image create` | API key; audio defaults `--plan mu`, text/image `lora` | +| Deployment lifecycle | `bl deploy list`/`get`/`update`/`scale`/`delete`/`models` | API key | +| Declarative agent infra (agents.yaml) IaC lifecycle | `bl managed-agent init`/`validate`/`plan`/`apply`/`destroy` | `init` scaffolds agents.yaml, `validate` is offline, `plan` previews; `apply`/`destroy` mutate and require `--yes`; [`reference/managed-agent.md`](reference/managed-agent.md) | +| Chat with a managed agent (sessions) | `bl managed-agent session run`/`send`/`create`/`get`/`list`/`events`/`delete` | `run` = create + send + stream in one step; `send` targets an existing session; `events` lists history | +| Managed agent state inspection / adoption | `bl managed-agent state list`/`show`/`import`/`rm` | Local state ops; `import` adopts an existing remote resource; `rm` untracks without destroying remotely | +| Bailian MCP marketplace discovery / call | `bl mcp list` / `tools` / `call` | — | +| Bailian pipeline workflow (a step in a bl workflow) | `bl pipeline run` / `validate` | JSON/YAML workflow definitions | +| Bailian rate limits / quota | `bl quota list` / `check` / `request` | Console auth; class 2 — ask which product first if unnamed | +| Bailian free tier / usage stats | `bl usage free` / `stats` / `freetier` | Console auth; class 2 — ask which product first if unnamed | +| Console API (advanced) | `bl console call` | Console auth | +| Bailian workspace listing | `bl workspace list` | Console auth | Commands not listed here: see [`reference/index.md`](reference/index.md) (**Quick index** / **By group**). @@ -232,5 +235,6 @@ Full workflow, redaction rules, template, and exit-code reference: [`assets/issu - Usage / quota / credits questions that do not name a product → ask which product (Bailian or another AI service) first; run `bl usage` / `bl quota` only after the user picks Bailian or Bailian context is already established. - "Remember this" and memory requests default to the host agent's own memory; `bl memory *` is only for Bailian app memory resources. - `bl file upload` and `bl pipeline run` are steps inside a Bailian workflow; do not use them to capture generic "upload this file" or "run a pipeline" requests. +- `bl managed-agent apply` / `destroy` mutate remote resources and only execute with `--yes`; run `plan` first and show the diff before confirming a mutation. - When a matched `bl` command accepts a file URL, pass local paths directly; never require the user to host the file first. - Console login → always `--console-site domestic|international`; see [`assets/setup.md`](assets/setup.md#console-site-selection). diff --git a/skills/bailian-cli/reference/index.md b/skills/bailian-cli/reference/index.md index 1cce5232..b2dddc32 100644 --- a/skills/bailian-cli/reference/index.md +++ b/skills/bailian-cli/reference/index.md @@ -67,6 +67,7 @@ Use this index for the full quick index and global flags. | `bl managed-agent session list` | List sessions from the provider | [managed-agent.md](managed-agent.md) | | `bl managed-agent session run` | Create a session, send a message, and stream the response | [managed-agent.md](managed-agent.md) | | `bl managed-agent session send` | Send a message to an existing session and stream the response | [managed-agent.md](managed-agent.md) | +| `bl managed-agent skill-list` | List skills from the provider's skill catalog | [managed-agent.md](managed-agent.md) | | `bl managed-agent state import` | Import an existing remote resource into agents state | [managed-agent.md](managed-agent.md) | | `bl managed-agent state list` | List resources tracked in agents state | [managed-agent.md](managed-agent.md) | | `bl managed-agent state rm` | Remove a resource from state without destroying it remotely | [managed-agent.md](managed-agent.md) | @@ -118,36 +119,36 @@ Use this index for the full quick index and global flags. ## By group -| Group | Commands | Reference | -| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ | -| `advisor` | `recommend` | [advisor.md](advisor.md) | -| `app` | `call`, `list` | [app.md](app.md) | -| `auth` | `generate-access-token`, `login`, `logout`, `status` | [auth.md](auth.md) | -| `config` | `agent`, `list`, `set`, `show`, `ui`, `use` | [config.md](config.md) | -| `console` | `call` | [console.md](console.md) | -| `dataset` | `delete`, `get`, `list`, `upload`, `validate` | [dataset.md](dataset.md) | -| `deploy` | `audio create`, `delete`, `get`, `image create`, `list`, `models`, `scale`, `text create`, `update` | [deploy.md](deploy.md) | -| `file` | `upload` | [file.md](file.md) | -| `finetune` | `audio create`, `cancel`, `capability`, `checkpoints`, `delete`, `export`, `get`, `image create`, `list`, `logs`, `text create`, `watch` | [finetune.md](finetune.md) | -| `image` | `edit`, `generate` | [image.md](image.md) | -| `knowledge` | `chat`, `retrieve`, `search` | [knowledge.md](knowledge.md) | -| `managed-agent` | `apply`, `destroy`, `init`, `plan`, `session create`, `session delete`, `session events`, `session get`, `session list`, `session run`, `session send`, `state import`, `state list`, `state rm`, `state show`, `validate` | [managed-agent.md](managed-agent.md) | -| `mcp` | `call`, `list`, `tools` | [mcp.md](mcp.md) | -| `memory` | `add`, `delete`, `list`, `profile create`, `profile get`, `search`, `update` | [memory.md](memory.md) | -| `model` | `list` | [model.md](model.md) | -| `omni` | `(root)` | [omni.md](omni.md) | -| `pipeline` | `run`, `validate` | [pipeline.md](pipeline.md) | -| `plugin` | `install`, `link`, `list`, `remove` | [plugin.md](plugin.md) | -| `quota` | `check`, `history`, `list`, `request` | [quota.md](quota.md) | -| `search` | `web` | [search.md](search.md) | -| `speech` | `recognize`, `synthesize` | [speech.md](speech.md) | -| `text` | `chat` | [text.md](text.md) | -| `token-plan` | `add-member`, `assign-seats`, `create-key`, `list-seats` | [token-plan.md](token-plan.md) | -| `update` | `(root)` | [update.md](update.md) | -| `usage` | `free`, `freetier`, `stats`, `summary` | [usage.md](usage.md) | -| `video` | `download`, `edit`, `generate`, `ref`, `task get` | [video.md](video.md) | -| `vision` | `describe` | [vision.md](vision.md) | -| `workspace` | `init`, `list` | [workspace.md](workspace.md) | +| Group | Commands | Reference | +| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ | +| `advisor` | `recommend` | [advisor.md](advisor.md) | +| `app` | `call`, `list` | [app.md](app.md) | +| `auth` | `generate-access-token`, `login`, `logout`, `status` | [auth.md](auth.md) | +| `config` | `agent`, `list`, `set`, `show`, `ui`, `use` | [config.md](config.md) | +| `console` | `call` | [console.md](console.md) | +| `dataset` | `delete`, `get`, `list`, `upload`, `validate` | [dataset.md](dataset.md) | +| `deploy` | `audio create`, `delete`, `get`, `image create`, `list`, `models`, `scale`, `text create`, `update` | [deploy.md](deploy.md) | +| `file` | `upload` | [file.md](file.md) | +| `finetune` | `audio create`, `cancel`, `capability`, `checkpoints`, `delete`, `export`, `get`, `image create`, `list`, `logs`, `text create`, `watch` | [finetune.md](finetune.md) | +| `image` | `edit`, `generate` | [image.md](image.md) | +| `knowledge` | `chat`, `retrieve`, `search` | [knowledge.md](knowledge.md) | +| `managed-agent` | `apply`, `destroy`, `init`, `plan`, `session create`, `session delete`, `session events`, `session get`, `session list`, `session run`, `session send`, `skill-list`, `state import`, `state list`, `state rm`, `state show`, `validate` | [managed-agent.md](managed-agent.md) | +| `mcp` | `call`, `list`, `tools` | [mcp.md](mcp.md) | +| `memory` | `add`, `delete`, `list`, `profile create`, `profile get`, `search`, `update` | [memory.md](memory.md) | +| `model` | `list` | [model.md](model.md) | +| `omni` | `(root)` | [omni.md](omni.md) | +| `pipeline` | `run`, `validate` | [pipeline.md](pipeline.md) | +| `plugin` | `install`, `link`, `list`, `remove` | [plugin.md](plugin.md) | +| `quota` | `check`, `history`, `list`, `request` | [quota.md](quota.md) | +| `search` | `web` | [search.md](search.md) | +| `speech` | `recognize`, `synthesize` | [speech.md](speech.md) | +| `text` | `chat` | [text.md](text.md) | +| `token-plan` | `add-member`, `assign-seats`, `create-key`, `list-seats` | [token-plan.md](token-plan.md) | +| `update` | `(root)` | [update.md](update.md) | +| `usage` | `free`, `freetier`, `stats`, `summary` | [usage.md](usage.md) | +| `video` | `download`, `edit`, `generate`, `ref`, `task get` | [video.md](video.md) | +| `vision` | `describe` | [vision.md](vision.md) | +| `workspace` | `init`, `list` | [workspace.md](workspace.md) | ## Global flags diff --git a/skills/bailian-cli/reference/managed-agent.md b/skills/bailian-cli/reference/managed-agent.md index 5b1e93b5..e4e911ed 100644 --- a/skills/bailian-cli/reference/managed-agent.md +++ b/skills/bailian-cli/reference/managed-agent.md @@ -20,6 +20,7 @@ Index: [index.md](index.md) | `bl managed-agent session list` | List sessions from the provider | | `bl managed-agent session run` | Create a session, send a message, and stream the response | | `bl managed-agent session send` | Send a message to an existing session and stream the response | +| `bl managed-agent skill-list` | List skills from the provider's skill catalog | | `bl managed-agent state import` | Import an existing remote resource into agents state | | `bl managed-agent state list` | List resources tracked in agents state | | `bl managed-agent state rm` | Remove a resource from state without destroying it remotely | @@ -419,6 +420,50 @@ bl managed-agent session run --agent assistant --prompt "summarize this repo" bl managed-agent session send --session-id sess_abc123 --message "continue" ``` +### `bl managed-agent skill-list` + +| Field | Value | +| --------------- | -------------------------------------------------------------------------------------------------- | +| **Name** | `managed-agent skill-list` | +| **Description** | List skills from the provider's skill catalog | +| **Usage** | `bl managed-agent skill-list [--source custom\|official\|all] [--provider <name>] [--file <path>]` | + +#### Flags + +| Flag | Type | Required | Description | +| ------------------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------ | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | +| `--source <source>` | string | no | Skill catalog: custom (workspace-uploaded, default), official (built-in), or all (both catalogs in one call) | +| `--provider <name>` | string | no | Target provider | +| `--api-key <key>` | string | no | API key | +| `--base-url <url>` | string | no | API base URL | + +#### Notes + +- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). +- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. +- Providers without a skill listing API (e.g. ark) return an empty list. +- For agent-driven skill selection, use `--source all --output json`: one call returns both catalogs with per-skill `source` and `description` fields to pick from. + +#### Examples + +```bash +bl managed-agent skill-list +``` + +```bash +bl managed-agent skill-list --source official +``` + +```bash +bl managed-agent skill-list --source all --output json +``` + +```bash +bl managed-agent skill-list --source custom --provider bailian +``` + ### `bl managed-agent state import` | Field | Value | From 5f0966ec8dce8c68ebef72b872c76a61531450de Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Mon, 27 Jul 2026 10:51:09 +0800 Subject: [PATCH 12/21] fix(agent): ci issues --- .../tests/e2e/managed-agent.e2e.test.ts | 24 ++++++++++++------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/packages/commands/tests/e2e/managed-agent.e2e.test.ts b/packages/commands/tests/e2e/managed-agent.e2e.test.ts index ccfdde51..44491792 100644 --- a/packages/commands/tests/e2e/managed-agent.e2e.test.ts +++ b/packages/commands/tests/e2e/managed-agent.e2e.test.ts @@ -67,15 +67,21 @@ describe("e2e: managed-agent", () => { }); test("managed-agent skill-list --source all 通过参数校验（缺配置文件时才失败）", async () => { - const { stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ - "managed-agent", - "skill-list", - "--source", - "all", - "--file", - "agents.e2e-missing.yaml", - "--quiet", - ]); + // auth: "apiKey" 的凭证解析先于 run() 执行；注入假 key 让用例不依赖环境凭证， + // 命令仍会在配置加载阶段因文件缺失短路，不产生任何网络请求。 + const { stderr, exitCode } = await runCommandE2e( + MANAGED_AGENT_ROUTES, + [ + "managed-agent", + "skill-list", + "--source", + "all", + "--file", + "agents.e2e-missing.yaml", + "--quiet", + ], + { DASHSCOPE_API_KEY: "sk-e2e-skill-list" }, + ); // all 是合法值：不应报 --source 用法错误，而是走到配置加载后因文件缺失退出 expect(exitCode).toBe(2); expect(stderr).not.toMatch(/--source must be one of/i); From 8a0fb870f16fbe2dbe9c2ec3ff45552cc6e549ba Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Mon, 27 Jul 2026 16:34:58 +0800 Subject: [PATCH 13/21] feat(agent): update openagentpack sdk version --- packages/commands/package.json | 2 +- packages/commands/tests/engines-contract.test.ts | 7 +++---- pnpm-lock.yaml | 12 ++++++------ 3 files changed, 10 insertions(+), 11 deletions(-) diff --git a/packages/commands/package.json b/packages/commands/package.json index 57f5b03a..2dcab1c3 100644 --- a/packages/commands/package.json +++ b/packages/commands/package.json @@ -40,7 +40,7 @@ "check": "vp check" }, "dependencies": { - "@openagentpack/sdk": "0.3.0-beta-8d9edcd-20260722", + "@openagentpack/sdk": "0.3.1-beta-85cd4b6-20260727", "bailian-cli-core": "workspace:*", "bailian-cli-runtime": "workspace:*", "boxen": "catalog:", diff --git a/packages/commands/tests/engines-contract.test.ts b/packages/commands/tests/engines-contract.test.ts index b8100cbd..e79691dd 100644 --- a/packages/commands/tests/engines-contract.test.ts +++ b/packages/commands/tests/engines-contract.test.ts @@ -7,15 +7,14 @@ import { expect, test } from "vite-plus/test"; * 1) bl 全部发布包的 engines.node 必须一致（版本 bump 一动多动的另一面）。 * 2) 外部运行时依赖 @openagentpack/sdk 的 engines 下限不得高于 bl 的下限， * 否则 Node 18/20 用户安装 bailian-cli 会触发 EBADENGINE / engine-strict 失败。 - * 当前固定的 beta 版本是已知冲突（上游降级已合入，等发版后 bump），用版本号 - * 白名单做棘轮：一旦升级依赖版本，本检查自动强制生效。 + * 历史上出现过冲突版本，用版本号白名单做棘轮：一旦升级依赖版本，本检查自动强制生效。 */ const repoRoot = join(import.meta.dirname, "..", "..", ".."); const BL_PACKAGES = ["core", "runtime", "commands", "cli", "kscli"] as const; -/** 上游 engines 降级发版前的已知冲突版本；bump 依赖后请勿把新版本加进来。 */ -const KNOWN_SDK_ENGINE_CONFLICT_VERSIONS = new Set(["0.3.0-beta-8d9edcd-20260722"]); +/** 上游 engines 冲突版本白名单；当前依赖版本已对齐，请勿把新版本加进来。 */ +const KNOWN_SDK_ENGINE_CONFLICT_VERSIONS = new Set<string>([]); interface PackageManifest { name: string; diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index bed1456b..79359fd5 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -104,8 +104,8 @@ importers: packages/commands: dependencies: '@openagentpack/sdk': - specifier: 0.3.0-beta-8d9edcd-20260722 - version: 0.3.0-beta-8d9edcd-20260722 + specifier: 0.3.1-beta-85cd4b6-20260727 + version: 0.3.1-beta-85cd4b6-20260727 bailian-cli-core: specifier: workspace:* version: link:../core @@ -449,9 +449,9 @@ packages: '@emnapi/core': ^1.7.1 '@emnapi/runtime': ^1.7.1 - '@openagentpack/sdk@0.3.0-beta-8d9edcd-20260722': - resolution: {integrity: sha512-WqF8srhE4Gu2fBRb6jFpuCNq+Bkzp/acPRW2TNsWOpb1qSwi7vRfrv2tBf8iMDXtDFOQP4jb/j7QS5/1/X5ShQ==} - engines: {node: '>=22'} + '@openagentpack/sdk@0.3.1-beta-85cd4b6-20260727': + resolution: {integrity: sha512-0TrlpBpkRf08StJzVbI3esW1QMgJ5zKFHPbIJI9TN63v3l5gBgGFCiuJ92LhTOnN8AZcS1wVrSqBYL2E6QNxMw==} + engines: {node: '>=18.17.0'} '@oxc-project/runtime@0.129.0': resolution: {integrity: sha512-0+S67blQakgeNqoKGozOUp5rQBrz2ynXZ2QIINXZPiafsD0YL0UogB9hAWc1S7k6VSNwKYC/N7MqT0V6IzpHkQ==} @@ -1593,7 +1593,7 @@ snapshots: '@tybys/wasm-util': 0.10.1 optional: true - '@openagentpack/sdk@0.3.0-beta-8d9edcd-20260722': + '@openagentpack/sdk@0.3.1-beta-85cd4b6-20260727': dependencies: jszip: 3.10.1 yaml: 2.9.0 From e22058b0f7b948b0693cc816b893d2bbf69765e6 Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Mon, 27 Jul 2026 18:14:06 +0800 Subject: [PATCH 14/21] feat: update openagentpack sdk --- packages/commands/package.json | 2 +- pnpm-lock.yaml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/packages/commands/package.json b/packages/commands/package.json index 2dcab1c3..6e02dcdd 100644 --- a/packages/commands/package.json +++ b/packages/commands/package.json @@ -40,7 +40,7 @@ "check": "vp check" }, "dependencies": { - "@openagentpack/sdk": "0.3.1-beta-85cd4b6-20260727", + "@openagentpack/sdk": "0.3.1", "bailian-cli-core": "workspace:*", "bailian-cli-runtime": "workspace:*", "boxen": "catalog:", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 79359fd5..e7266539 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -104,8 +104,8 @@ importers: packages/commands: dependencies: '@openagentpack/sdk': - specifier: 0.3.1-beta-85cd4b6-20260727 - version: 0.3.1-beta-85cd4b6-20260727 + specifier: 0.3.1 + version: 0.3.1 bailian-cli-core: specifier: workspace:* version: link:../core @@ -449,8 +449,8 @@ packages: '@emnapi/core': ^1.7.1 '@emnapi/runtime': ^1.7.1 - '@openagentpack/sdk@0.3.1-beta-85cd4b6-20260727': - resolution: {integrity: sha512-0TrlpBpkRf08StJzVbI3esW1QMgJ5zKFHPbIJI9TN63v3l5gBgGFCiuJ92LhTOnN8AZcS1wVrSqBYL2E6QNxMw==} + '@openagentpack/sdk@0.3.1': + resolution: {integrity: sha512-/5LDwtNSjd9wyYGK4Lg7soqMyoI98BxhUGL3wzN5qO5HfmZBJP0YyElOnjhHyPHbLRWF7RYmfeVdA/oyEBJWTg==} engines: {node: '>=18.17.0'} '@oxc-project/runtime@0.129.0': @@ -1593,7 +1593,7 @@ snapshots: '@tybys/wasm-util': 0.10.1 optional: true - '@openagentpack/sdk@0.3.1-beta-85cd4b6-20260727': + '@openagentpack/sdk@0.3.1': dependencies: jszip: 3.10.1 yaml: 2.9.0 From 6f9e006fefeee11c19d629cda0fb658c2dbce198 Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Mon, 27 Jul 2026 18:17:39 +0800 Subject: [PATCH 15/21] feat(agent): add skills for skill-list command --- packages/commands/src/commands/managed-agent/skill-list.ts | 1 + skills/bailian-cli/reference/managed-agent.md | 1 + 2 files changed, 2 insertions(+) diff --git a/packages/commands/src/commands/managed-agent/skill-list.ts b/packages/commands/src/commands/managed-agent/skill-list.ts index 65488559..f5cf185c 100644 --- a/packages/commands/src/commands/managed-agent/skill-list.ts +++ b/packages/commands/src/commands/managed-agent/skill-list.ts @@ -42,6 +42,7 @@ export default defineCommand({ ...CREDENTIALS_NOTE, "Providers without a skill listing API (e.g. ark) return an empty list.", "For agent-driven skill selection, use `--source all --output json`: one call returns both catalogs with per-skill `source` and `description` fields to pick from.", + "When generating a task that needs a suitable skill, call this command to match official or custom skills before wiring them into the task.", ], validate: (f) => f.source && !SKILL_SOURCES.includes(f.source as SkillSource) diff --git a/skills/bailian-cli/reference/managed-agent.md b/skills/bailian-cli/reference/managed-agent.md index e4e911ed..7c180c7f 100644 --- a/skills/bailian-cli/reference/managed-agent.md +++ b/skills/bailian-cli/reference/managed-agent.md @@ -445,6 +445,7 @@ bl managed-agent session send --session-id sess_abc123 --message "continue" - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. - Providers without a skill listing API (e.g. ark) return an empty list. - For agent-driven skill selection, use `--source all --output json`: one call returns both catalogs with per-skill `source` and `description` fields to pick from. +- When generating a task that needs a suitable skill, call this command to match official or custom skills before wiring them into the task. #### Examples From 93c9149e45d42c7d5d68399482af1d22f882e648 Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Mon, 27 Jul 2026 19:51:56 +0800 Subject: [PATCH 16/21] =?UTF-8?q?feat(agent):=20=E9=89=B4=E6=9D=83?= =?UTF-8?q?=E5=88=86=E7=A6=BB=E7=BA=BF=E5=91=BD=E4=BB=A4=E5=92=8C=E5=9C=A8?= =?UTF-8?q?=E7=BA=BF=E5=91=BD=E4=BB=A4=EF=BC=8C=E4=BB=85=E5=AF=B9bailian?= =?UTF-8?q?=20provider=E9=89=B4=E6=9D=83?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/agents/auth-change.md | 20 ++-- .../managed-agent/_engine/config-loader.ts | 32 ++++++- .../managed-agent/_engine/credentials.ts | 94 ++++++++++++++----- .../src/commands/managed-agent/apply.ts | 6 +- .../src/commands/managed-agent/destroy.ts | 6 +- .../src/commands/managed-agent/init.ts | 2 +- .../src/commands/managed-agent/plan.ts | 8 +- .../commands/managed-agent/session-create.ts | 6 +- .../commands/managed-agent/session-delete.ts | 6 +- .../commands/managed-agent/session-events.ts | 6 +- .../src/commands/managed-agent/session-get.ts | 6 +- .../commands/managed-agent/session-list.ts | 6 +- .../src/commands/managed-agent/session-run.ts | 6 +- .../commands/managed-agent/session-send.ts | 6 +- .../src/commands/managed-agent/skill-list.ts | 6 +- .../commands/managed-agent/state-import.ts | 7 +- .../src/commands/managed-agent/state-list.ts | 10 +- .../src/commands/managed-agent/state-rm.ts | 10 +- .../src/commands/managed-agent/state-show.ts | 10 +- .../src/commands/managed-agent/validate.ts | 10 +- .../commands/tests/credentials-bridge.test.ts | 35 ++++++- .../fixtures/managed-agent/agents-multi.yaml | 28 ++++++ .../e2e/managed-agent-auth-chain.e2e.test.ts | 93 ++++++++++++++++-- .../tests/e2e/managed-agent.e2e.test.ts | 30 +++--- packages/commands/tests/e2e/topic-routes.ts | 2 + packages/core/src/types/command.ts | 30 +++++- packages/runtime/src/middleware.ts | 21 ++++- skills/bailian-cli/reference/managed-agent.md | 50 +++++----- 28 files changed, 424 insertions(+), 128 deletions(-) create mode 100644 packages/commands/tests/e2e/fixtures/managed-agent/agents-multi.yaml diff --git a/docs/agents/auth-change.md b/docs/agents/auth-change.md index 573ff8f3..cac9ec16 100644 --- a/docs/agents/auth-change.md +++ b/docs/agents/auth-change.md @@ -53,18 +53,22 @@ defineCommand({ auth }) → runtime/authStage → ctx.client → command.run(ctx 命令不要直接解析 token、env 或 config。业务请求统一走 `ctx.client`;登录/配置命令通过 `ctx.authStore` / `ctx.configStore` 的窄接口操作落盘。 -### 例外:agent 命令的 SDK 凭证内存注入 +### 例外:agent 命令的分层鉴权与 SDK 凭证内存注入 -`bl managed-agent *` 的全部命令声明 `auth: "apiKey"`(含纯本地脚手架 `init` —— 统一登录门槛,无例外),bailian 凭证由 authStage 经 `resolveApiKey(sources)` 权威解析(flag > env > active profile config,缺失时抛统一 AUTH 错误)。 +`bl managed-agent *` 按调用链分两层，不再全命令硬门禁: -凭证不再以真实值写入 `process.env`,而是经 `packages/commands/src/commands/managed-agent/_engine/` 的**内存注入管道**(`resolveAgentProjectConfig`)注入 SDK,管道四步: +- **离线命令** — `init`、`validate`、`state list/show/rm`:`auth: "none"`，只读写本地文件，无需登录;引擎侧传 `credentials: "none"` 跳过凭证断言（`plan --no-refresh` 同样传 `"none"`） +- **provider-aware 命令** — `plan`(默认)、`apply`、`destroy`、`state import`、`skill-list`、全部 `session *`:仍声明 `auth: "apiKey"` 但加 `authOptional: true` —— authStage 照常经 `resolveApiKey(sources)` 解析 bailian 凭证(flag > env > active profile config)并注入 `ctx.client`，但缺失不在 authStage 抛;真正的门禁在引擎层 `assertProviderCredentials`，只校验本次运行涉及的 provider（`CredentialScope`:`--provider` / state 地址里的 provider / 配置默认 provider 链）。配了四个 provider 只跑 claude 时，缺 bailian key 不阻塞。 -1. `prepareProviderEnv()` — 先 `bootstrapRuntimeCredentialsSync()`(SDK 把 `.env` / `~/.agents/config.json` 灌进 env,服务 claude/ark/qoder 等非 bailian provider),再把全部凭证类 env(`CREDENTIAL_ENV_KEYS`,含别名)中仍为 undefined 的占位为 `""`,使 agents.yaml 插值不因缺变量抛错 -2. `resolveProjectConfig` — 插值发生:bailian 插值拿到占位空串,claude/ark 拿到真实 env 值 -3. `injectProviderCredentials()` — 用 `ctx.client.exportApiCredential()`(lint 限定 `managed-agent/_engine/**` 可用)覆写内存 config 对象的 bailian 块:`api_key` 无条件覆写;`base_url`(拼 `/api/v1/agentstudio` 后缀)/`workspace_id`(取 `settings.workspaceId`)仅在引用且为空时填充 -4. `scrubCredentialEnv()` + `assertProviderCredentials()` — 从 `process.env` 删除全部凭证变量(真实凭证此后只存于 config 对象 → provider adapter 实例内存,不驻留 env / 不被子进程继承);任一已声明 provider 的 `api_key` 为空 → CLI 权威 `AUTH` 错误 + provider 专属 hint(取代 SDK 原始插值/zod 报错) +凭证不以真实值写入 `process.env`，而是经 `packages/commands/src/commands/managed-agent/_engine/` 的**内存注入管道**(`resolveAgentProjectConfig`)注入 SDK，管道五步: -`bl auth login` 仅管理 bailian(DashScope)凭证;claude/ark/qoder 的 key 从 env(shell / `.env` / `~/.agents/config.json`)经插值进入 config 对象,同样被清扫。禁止命令层直接 `readConfigFile` 裸读凭证;bailian 字段以 CLI 鉴权链为唯一信源。 +1. `prepareProviderEnv()` — 先 `bootstrapRuntimeCredentialsSync()`(SDK 把 `.env` / `~/.agents/config.json` 灌进 env，服务 claude/ark/qoder 等非 bailian provider)，再把全部凭证类 env(`CREDENTIAL_ENV_KEYS`，含别名)中仍为 undefined 的占位为 `""`，使 agents.yaml 插值不因缺变量抛错 +2. `resolveProjectConfig` — 插值发生:bailian 插值拿到占位空串，claude/ark 拿到真实 env 值;随后 `normalizeInterpolatedProviderBlocks()` 把插值为空导致的 YAML `null` 归一为 `""`(避免范围外 provider 在 SDK zod 层报 "received null") +3. `injectProviderCredentials()` — 用 `ctx.client.exportApiCredential()`(lint 限定 `managed-agent/_engine/**` 可用)覆写内存 config 对象的 bailian 块:有凭证时 `api_key` 无条件覆写;`base_url`(拼 `/api/v1/agentstudio` 后缀，无凭证时用 client 默认域名补齐以满足 schema)/`workspace_id`(取 `settings.workspaceId`)仅在引用且为空时填充 +4. `scrubCredentialEnv()` — 从 `process.env` 删除全部凭证变量(真实凭证此后只存于 config 对象 → provider adapter 实例内存，不驻留 env / 不被子进程继承) +5. `assertProviderCredentials(providers, required)` — 按 `CredentialScope` 算出的 `required` 范围校验:范围内 provider 的 `api_key` 为空 → CLI 权威 `AUTH` 错误 + provider 专属 hint(取代 SDK 原始插值/zod 报错);范围外 provider 允许空 key + +`bl auth login` 仅管理 bailian(DashScope)凭证;claude/ark/qoder 的 key 从 env(shell / `.env` / `~/.agents/config.json`)经插值进入 config 对象，同样被清扫。禁止命令层直接 `readConfigFile` 裸读凭证;bailian 字段以 CLI 鉴权链为唯一信源。 ## 必查清单 diff --git a/packages/commands/src/commands/managed-agent/_engine/config-loader.ts b/packages/commands/src/commands/managed-agent/_engine/config-loader.ts index ae5ffdac..0043c69c 100644 --- a/packages/commands/src/commands/managed-agent/_engine/config-loader.ts +++ b/packages/commands/src/commands/managed-agent/_engine/config-loader.ts @@ -9,18 +9,32 @@ import { assertProviderCredentials, type CredentialHost, injectProviderCredentials, + normalizeInterpolatedProviderBlocks, prepareProviderEnv, + resolveTargetProviderNames, scrubCredentialEnv, } from "./credentials.ts"; import { loadFileState } from "./file-state-manager.ts"; import { type HostContext, installSdkTransport } from "./transport.ts"; -export { CREDENTIALS_NOTE } from "./credentials.ts"; +export { CREDENTIALS_NOTE, OFFLINE_NOTE } from "./credentials.ts"; + +/** + * Which providers this run requires a non-empty key for: + * - "targets" (default) — the run's target providers per the config's + * default provider chain (mirrors the SDK's plan/apply targeting) + * - "none" — offline command (local config/state only), skip the check + * - "all" — every configured provider (`--provider all`) + * - any other name — the run was narrowed to that provider + * (`--provider <name>` / a provider-qualified state address) + */ +export type CredentialScope = "targets" | "none" | "all" | (string & {}); interface AgentConfigOptions { resolveEnv?: boolean; projectName?: string; statePath?: string; + credentials?: CredentialScope; } /** @@ -32,7 +46,8 @@ interface AgentConfigOptions { * 3. override the bailian block with the CLI auth chain's credential (in-memory) * 4. scrub all credential vars from process.env (real values now live only in * the config object → provider adapters, never the environment) - * 5. fail with a CLI-authoritative AUTH error if any provider's key is empty + * 5. fail with a CLI-authoritative AUTH error if a provider within this run's + * {@link CredentialScope} has an empty key (offline commands pass "none") */ export async function resolveAgentProjectConfig( host: CredentialHost, @@ -41,9 +56,20 @@ export async function resolveAgentProjectConfig( ): Promise<LoadedProjectConfig> { prepareProviderEnv(); const resolved = await resolveProjectConfig(filePath, options); + normalizeInterpolatedProviderBlocks(resolved.config.providers); injectProviderCredentials(resolved.config.providers, host); scrubCredentialEnv(); - assertProviderCredentials(resolved.config.providers); + const scope = options.credentials ?? "targets"; + if (scope !== "none") { + assertProviderCredentials( + resolved.config.providers, + scope === "targets" + ? resolveTargetProviderNames(resolved.config) + : scope === "all" + ? Object.keys(resolved.config.providers) + : [scope], + ); + } return resolved; } diff --git a/packages/commands/src/commands/managed-agent/_engine/credentials.ts b/packages/commands/src/commands/managed-agent/_engine/credentials.ts index f7a7e067..2dc096a2 100644 --- a/packages/commands/src/commands/managed-agent/_engine/credentials.ts +++ b/packages/commands/src/commands/managed-agent/_engine/credentials.ts @@ -51,9 +51,18 @@ export interface CredentialHost { export const CREDENTIALS_NOTE = [ "Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile).", "Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json.", + "Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked.", "Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env.", ]; +/** + * Shared `--help` note for commands that never talk to a provider: they load + * agents.yaml / local state only, so no login or provider key is required. + */ +export const OFFLINE_NOTE = [ + "Runs fully offline against local files: no login or provider credentials required.", +]; + /** * Load the SDK's env-based credential sources (`.env`, `~/.agents/config.json`) * for non-bailian providers, then placeholder every credential var that is still @@ -72,15 +81,18 @@ export function prepareProviderEnv(): void { /** * Override the bailian provider block with bl's authStage-resolved credential, so * the bailian API key is authoritatively the CLI auth chain's — never a config - * file bare-read or a stale env value. `api_key` is replaced unconditionally; - * `base_url` / `workspace_id` are filled only when the block references them and - * the interpolated value is empty (a literal in agents.yaml is respected). + * file bare-read or a stale env value. `api_key` is replaced unconditionally + * when a credential resolved; `base_url` / `workspace_id` are filled only when + * the block references them and the interpolated value is empty (a literal in + * agents.yaml is respected). * * `base_url` carries {@link AGENTSTUDIO_API_PATH} because the SDK appends resource * paths onto it verbatim; a value already ending in the suffix is left as-is. - * With no credential (only under --dry-run: authStage hard-gates otherwise) the - * bailian block is left untouched. Non-bailian blocks keep their interpolated - * (env-sourced) values. + * It is filled even without a credential — `client.baseUrl` is readable + * credential-less (defaults to the CLI's model-domain base URL) — so offline / + * out-of-scope runs still satisfy the SDK's "workspace_id or base_url" schema. + * With no credential the `api_key` is left untouched: an in-scope empty key is + * rejected by {@link assertProviderCredentials}, out-of-scope ones may stay empty. */ export function injectProviderCredentials( providers: Record<string, unknown>, @@ -91,16 +103,14 @@ export function injectProviderCredentials( const block = bailian as Record<string, unknown>; const cred = host.client.exportApiCredential(); - if (cred) { - block.api_key = cred.token; - if ("base_url" in block && !block.base_url) { - // Defensive normalization: the auth chain already normalizes base_url to - // an origin, but never let a trailing slash produce "//api/v1/agentstudio". - const origin = cred.baseUrl.replace(/\/+$/, ""); - block.base_url = origin.endsWith(AGENTSTUDIO_API_PATH) - ? origin - : `${origin}${AGENTSTUDIO_API_PATH}`; - } + if (cred) block.api_key = cred.token; + if ("base_url" in block && !block.base_url) { + // Defensive normalization: the auth chain already normalizes base_url to + // an origin, but never let a trailing slash produce "//api/v1/agentstudio". + const origin = host.client.baseUrl.replace(/\/+$/, ""); + block.base_url = origin.endsWith(AGENTSTUDIO_API_PATH) + ? origin + : `${origin}${AGENTSTUDIO_API_PATH}`; } if ("workspace_id" in block && !block.workspace_id && host.settings.workspaceId) { block.workspace_id = host.settings.workspaceId; @@ -121,15 +131,55 @@ export function scrubCredentialEnv(): void { } /** - * After injection, fail with a CLI-authoritative AUTH error if any configured + * The SDK interpolates `${VAR}` into the raw YAML text, so an empty env var + * leaves `api_key:` with nothing after it — YAML parses that as null. Normalize + * every null provider field back to "" so the pipeline stays uniform: an empty + * api_key is caught by {@link assertProviderCredentials} when the provider is + * in scope, and out-of-scope blocks still satisfy the SDK's string schemas + * instead of failing zod with "received null" before the run even starts. + */ +export function normalizeInterpolatedProviderBlocks(providers: Record<string, unknown>): void { + for (const raw of Object.values(providers)) { + if (!raw || typeof raw !== "object") continue; + const block = raw as Record<string, unknown>; + for (const [fieldName, value] of Object.entries(block)) { + if (value === null) block[fieldName] = ""; + } + } +} + +/** + * The providers a run targets when no explicit `--provider` narrows it: the + * config's default provider, or every configured provider when the default is + * absent or "all". Mirrors the SDK's config-based `resolveTargetProviders` + * (not exported from the SDK's public surface). + */ +export function resolveTargetProviderNames(config: { + providers: Record<string, unknown>; + defaults?: { provider?: string }; +}): string[] { + const defaultProvider = config.defaults?.provider; + if (!defaultProvider || defaultProvider === "all") return Object.keys(config.providers); + return [defaultProvider]; +} + +/** + * After injection, fail with a CLI-authoritative AUTH error if a required * provider's `api_key` resolved empty (missing env var, or no bl login for * bailian). Replaces the SDK's raw `Environment variable '...' is not set` / - * zod config error with a clean message plus a provider-specific hint. Validates - * every declared provider, so a project is only runnable once all its providers' - * keys are available. + * zod config error with a clean message plus a provider-specific hint. + * `required` limits the check to the providers this run actually involves + * (← --provider / state address / config default chain); providers outside + * that scope may keep empty keys — a project stays runnable per provider. + * Names without a matching config block are skipped: "provider not + * configured" is the engine's error to raise, not a credential problem. */ -export function assertProviderCredentials(providers: Record<string, unknown>): void { - for (const [name, raw] of Object.entries(providers)) { +export function assertProviderCredentials( + providers: Record<string, unknown>, + required?: readonly string[], +): void { + for (const name of required ?? Object.keys(providers)) { + const raw = providers[name]; if (!raw || typeof raw !== "object") continue; const block = raw as Record<string, unknown>; if (!("api_key" in block)) continue; diff --git a/packages/commands/src/commands/managed-agent/apply.ts b/packages/commands/src/commands/managed-agent/apply.ts index a00a166a..985a2014 100644 --- a/packages/commands/src/commands/managed-agent/apply.ts +++ b/packages/commands/src/commands/managed-agent/apply.ts @@ -46,6 +46,8 @@ const APPLY_FLAGS = { export default defineCommand({ description: "Apply planned changes to create/update/delete agent resources", auth: "apiKey", + // Provider-aware gate: only the providers this apply targets need credentials. + authOptional: true, usageArgs: "[--file <path>] [--provider <name>] [--yes] [--concurrency <n>]", flags: APPLY_FLAGS, exampleArgs: ["--yes", "--provider bailian --yes"], @@ -73,7 +75,9 @@ export default defineCommand({ const planned = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: flags.provider ?? "targets", + }); assertProviderConfigured(runtime, flags.provider); return planProjectContext(runtime, { provider: flags.provider, diff --git a/packages/commands/src/commands/managed-agent/destroy.ts b/packages/commands/src/commands/managed-agent/destroy.ts index 17320673..c784af0d 100644 --- a/packages/commands/src/commands/managed-agent/destroy.ts +++ b/packages/commands/src/commands/managed-agent/destroy.ts @@ -31,6 +31,8 @@ const DESTROY_FLAGS = { export default defineCommand({ description: "Destroy all managed agent resources tracked in state", auth: "apiKey", + // Provider-aware gate: only the run's target providers need credentials. + authOptional: true, usageArgs: "[--file <path>] [--yes] [--cascade]", flags: DESTROY_FLAGS, exampleArgs: ["--yes", "--yes --cascade"], @@ -54,7 +56,9 @@ export default defineCommand({ const planned = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: "targets", + }); return planDestroyProjectContext(runtime); }), ); diff --git a/packages/commands/src/commands/managed-agent/init.ts b/packages/commands/src/commands/managed-agent/init.ts index 15946263..6fd3100d 100644 --- a/packages/commands/src/commands/managed-agent/init.ts +++ b/packages/commands/src/commands/managed-agent/init.ts @@ -99,7 +99,7 @@ const INIT_FLAGS = { export default defineCommand({ description: "Create a new agents.yaml template", - auth: "apiKey", + auth: "none", usageArgs: "[--provider <name>] [--agent-name <name>] [--file <path>] [--force]", flags: INIT_FLAGS, exampleArgs: ["", "--provider bailian --agent-name assistant", "--provider all"], diff --git a/packages/commands/src/commands/managed-agent/plan.ts b/packages/commands/src/commands/managed-agent/plan.ts index 24c714d9..516fc2e3 100644 --- a/packages/commands/src/commands/managed-agent/plan.ts +++ b/packages/commands/src/commands/managed-agent/plan.ts @@ -41,6 +41,9 @@ const PLAN_FLAGS = { export default defineCommand({ description: "Show what changes would be applied to agent infrastructure", auth: "apiKey", + // Provider-aware gate: --no-refresh plans fully offline; a refreshing run + // only needs credentials for the providers it targets (see CredentialScope). + authOptional: true, usageArgs: "[--file <path>] [--provider <name>] [--no-refresh] [--refresh-only]", flags: PLAN_FLAGS, exampleArgs: ["", "--provider bailian", "--no-refresh"], @@ -52,7 +55,10 @@ export default defineCommand({ const planned = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + // --no-refresh never talks to a provider → no credentials required. + const runtime = await buildAgentRuntime(ctx, file, { + credentials: flags.noRefresh ? "none" : (flags.provider ?? "targets"), + }); assertProviderConfigured(runtime, flags.provider); return planProjectContext(runtime, { provider: flags.provider, diff --git a/packages/commands/src/commands/managed-agent/session-create.ts b/packages/commands/src/commands/managed-agent/session-create.ts index 1485ab54..90a5c062 100644 --- a/packages/commands/src/commands/managed-agent/session-create.ts +++ b/packages/commands/src/commands/managed-agent/session-create.ts @@ -43,6 +43,8 @@ const SESSION_CREATE_FLAGS = { export default defineCommand({ description: "Create a new session for an agent", auth: "apiKey", + // Provider-aware gate: only the session's provider needs credentials. + authOptional: true, usageArgs: "[--agent <name>] [--environment <name>] [--title <title>] [--file <path>]", flags: SESSION_CREATE_FLAGS, exampleArgs: ["", "--agent assistant", "--agent assistant --title 'debug run'"], @@ -72,7 +74,9 @@ export default defineCommand({ const run = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: flags.provider ?? "targets", + }); return createSessionForAgent(runtime, { agent: flags.agent, provider: flags.provider, diff --git a/packages/commands/src/commands/managed-agent/session-delete.ts b/packages/commands/src/commands/managed-agent/session-delete.ts index 5d463dba..9785bc55 100644 --- a/packages/commands/src/commands/managed-agent/session-delete.ts +++ b/packages/commands/src/commands/managed-agent/session-delete.ts @@ -27,6 +27,8 @@ const SESSION_DELETE_FLAGS = { export default defineCommand({ description: "Delete a session", auth: "apiKey", + // Provider-aware gate: only the session's provider needs credentials. + authOptional: true, usageArgs: "--session-id <id> [--provider <name>] [--file <path>]", flags: SESSION_DELETE_FLAGS, exampleArgs: ["--session-id sess_abc123"], @@ -50,7 +52,9 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: flags.provider ?? "targets", + }); await deleteSession(runtime, flags.sessionId, flags.provider); }), ); diff --git a/packages/commands/src/commands/managed-agent/session-events.ts b/packages/commands/src/commands/managed-agent/session-events.ts index 0cdcf332..2de0d390 100644 --- a/packages/commands/src/commands/managed-agent/session-events.ts +++ b/packages/commands/src/commands/managed-agent/session-events.ts @@ -38,6 +38,8 @@ const SESSION_EVENTS_FLAGS = { export default defineCommand({ description: "List event history for a session", auth: "apiKey", + // Provider-aware gate: only the session's provider needs credentials. + authOptional: true, usageArgs: "--session-id <id> [--limit <n>] [--all] [--file <path>]", flags: SESSION_EVENTS_FLAGS, exampleArgs: ["--session-id sess_abc123", "--session-id sess_abc123 --all"], @@ -49,7 +51,9 @@ export default defineCommand({ const { items: events, hasMore } = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: flags.provider ?? "targets", + }); return fetchAllPages(async (page) => { const result = await listSessionEvents(runtime, flags.sessionId, { provider: flags.provider, diff --git a/packages/commands/src/commands/managed-agent/session-get.ts b/packages/commands/src/commands/managed-agent/session-get.ts index 522daadd..628dfe07 100644 --- a/packages/commands/src/commands/managed-agent/session-get.ts +++ b/packages/commands/src/commands/managed-agent/session-get.ts @@ -27,6 +27,8 @@ const SESSION_GET_FLAGS = { export default defineCommand({ description: "Get details of a session", auth: "apiKey", + // Provider-aware gate: only the session's provider needs credentials. + authOptional: true, usageArgs: "--session-id <id> [--provider <name>] [--file <path>]", flags: SESSION_GET_FLAGS, exampleArgs: ["--session-id sess_abc123"], @@ -38,7 +40,9 @@ export default defineCommand({ const session = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: flags.provider ?? "targets", + }); return getSession(runtime, flags.sessionId, flags.provider); }), ); diff --git a/packages/commands/src/commands/managed-agent/session-list.ts b/packages/commands/src/commands/managed-agent/session-list.ts index 2694e204..b5a23bbd 100644 --- a/packages/commands/src/commands/managed-agent/session-list.ts +++ b/packages/commands/src/commands/managed-agent/session-list.ts @@ -31,6 +31,8 @@ const SESSION_LIST_FLAGS = { export default defineCommand({ description: "List sessions from the provider", auth: "apiKey", + // Provider-aware gate: only the session's provider needs credentials. + authOptional: true, usageArgs: "[--agent <name>] [--all] [--provider <name>] [--file <path>]", flags: SESSION_LIST_FLAGS, exampleArgs: ["", "--agent assistant", "--all"], @@ -42,7 +44,9 @@ export default defineCommand({ const { items: summaries, hasMore } = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: flags.provider ?? "targets", + }); return fetchAllPages(async (page) => { const result = await listSessionSummaries(runtime, { agent: flags.agent, diff --git a/packages/commands/src/commands/managed-agent/session-run.ts b/packages/commands/src/commands/managed-agent/session-run.ts index 5caec10f..820ce472 100644 --- a/packages/commands/src/commands/managed-agent/session-run.ts +++ b/packages/commands/src/commands/managed-agent/session-run.ts @@ -57,6 +57,8 @@ const SESSION_RUN_FLAGS = { export default defineCommand({ description: "Create a session, send a message, and stream the response", auth: "apiKey", + // Provider-aware gate: only the session's provider needs credentials. + authOptional: true, usageArgs: "--prompt <text> [--agent <name>] [--no-stream] [--file <path>]", flags: SESSION_RUN_FLAGS, exampleArgs: ['--prompt "hello"', '--agent assistant --prompt "summarize this repo"'], @@ -98,7 +100,9 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: flags.provider ?? "targets", + }); if (flags.noStream) { const run = await startSessionRunPolling(runtime, flags.prompt, runOptions); if (!asJson) process.stderr.write(`Session created: ${run.session.id}\n`); diff --git a/packages/commands/src/commands/managed-agent/session-send.ts b/packages/commands/src/commands/managed-agent/session-send.ts index a6a06e1d..c424262e 100644 --- a/packages/commands/src/commands/managed-agent/session-send.ts +++ b/packages/commands/src/commands/managed-agent/session-send.ts @@ -38,6 +38,8 @@ const SESSION_SEND_FLAGS = { export default defineCommand({ description: "Send a message to an existing session and stream the response", auth: "apiKey", + // Provider-aware gate: only the session's provider needs credentials. + authOptional: true, usageArgs: "--session-id <id> --message <text> [--no-stream] [--file <path>]", flags: SESSION_SEND_FLAGS, exampleArgs: ['--session-id sess_abc123 --message "continue"'], @@ -66,7 +68,9 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: flags.provider ?? "targets", + }); if (flags.noStream) { const result = await sendSessionMessagePolling(runtime, flags.sessionId, flags.message, { provider: flags.provider, diff --git a/packages/commands/src/commands/managed-agent/skill-list.ts b/packages/commands/src/commands/managed-agent/skill-list.ts index f5cf185c..3d35f134 100644 --- a/packages/commands/src/commands/managed-agent/skill-list.ts +++ b/packages/commands/src/commands/managed-agent/skill-list.ts @@ -30,6 +30,8 @@ const SKILL_LIST_FLAGS = { export default defineCommand({ description: "List skills from the provider's skill catalog", auth: "apiKey", + // Provider-aware gate: only the resolved catalog provider needs credentials. + authOptional: true, usageArgs: "[--source custom|official|all] [--provider <name>] [--file <path>]", flags: SKILL_LIST_FLAGS, exampleArgs: [ @@ -56,7 +58,9 @@ export default defineCommand({ const skills = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: flags.provider ?? "targets", + }); if (source !== "all") { return listSkills(runtime, { provider: flags.provider, source }); } diff --git a/packages/commands/src/commands/managed-agent/state-import.ts b/packages/commands/src/commands/managed-agent/state-import.ts index 3eb06bb0..e171482a 100644 --- a/packages/commands/src/commands/managed-agent/state-import.ts +++ b/packages/commands/src/commands/managed-agent/state-import.ts @@ -33,6 +33,8 @@ const STATE_IMPORT_FLAGS = { export default defineCommand({ description: "Import an existing remote resource into agents state", auth: "apiKey", + // Provider-aware gate: only the address's provider needs credentials. + authOptional: true, usageArgs: "--address <provider.type.name> --remote-id <id> [--resource-version <n>] [--file <path>]", flags: STATE_IMPORT_FLAGS, @@ -62,10 +64,13 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + // Parse first: the address names the one provider this import touches. const parsed = parseStateAddress(flags.address, { requireProvider: true, }); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: parsed.provider ?? "targets", + }); await importResource(runtime, parsed, flags.remoteId, { resourceVersion: flags.resourceVersion, }); diff --git a/packages/commands/src/commands/managed-agent/state-list.ts b/packages/commands/src/commands/managed-agent/state-list.ts index 2d970234..8bc604b4 100644 --- a/packages/commands/src/commands/managed-agent/state-list.ts +++ b/packages/commands/src/commands/managed-agent/state-list.ts @@ -1,6 +1,6 @@ import { defineCommand, detectOutputFormat, type FlagsDef } from "bailian-cli-core"; import { emitBare, emitResult, formatTable } from "bailian-cli-runtime"; -import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, OFFLINE_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; @@ -14,11 +14,11 @@ const STATE_LIST_FLAGS = { export default defineCommand({ description: "List resources tracked in agents state", - auth: "apiKey", + auth: "none", usageArgs: "[--file <path>]", flags: STATE_LIST_FLAGS, exampleArgs: ["", "--file agents.yaml"], - notes: CREDENTIALS_NOTE, + notes: OFFLINE_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -26,7 +26,9 @@ export default defineCommand({ const resources = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: "none", + }); return runtime.state.listResources(); }), ); diff --git a/packages/commands/src/commands/managed-agent/state-rm.ts b/packages/commands/src/commands/managed-agent/state-rm.ts index 6c8f8fd7..04428071 100644 --- a/packages/commands/src/commands/managed-agent/state-rm.ts +++ b/packages/commands/src/commands/managed-agent/state-rm.ts @@ -7,7 +7,7 @@ import { } from "bailian-cli-core"; import { emitBare, emitResult } from "bailian-cli-runtime"; import { parseStateAddress } from "@openagentpack/sdk"; -import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, OFFLINE_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; @@ -27,11 +27,11 @@ const STATE_RM_FLAGS = { export default defineCommand({ description: "Remove a resource from state without destroying it remotely", - auth: "apiKey", + auth: "none", usageArgs: "--address <provider.type.name> [--file <path>]", flags: STATE_RM_FLAGS, exampleArgs: ["--address bailian.agent.assistant"], - notes: CREDENTIALS_NOTE, + notes: OFFLINE_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -48,7 +48,9 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: "none", + }); const parsed = parseStateAddress(flags.address, { requireProvider: false, }); diff --git a/packages/commands/src/commands/managed-agent/state-show.ts b/packages/commands/src/commands/managed-agent/state-show.ts index 845de2e8..c4787826 100644 --- a/packages/commands/src/commands/managed-agent/state-show.ts +++ b/packages/commands/src/commands/managed-agent/state-show.ts @@ -7,7 +7,7 @@ import { } from "bailian-cli-core"; import { emitBare, emitResult } from "bailian-cli-runtime"; import { parseStateAddress } from "@openagentpack/sdk"; -import { buildAgentRuntime, CREDENTIALS_NOTE } from "./_engine/config-loader.ts"; +import { buildAgentRuntime, OFFLINE_NOTE } from "./_engine/config-loader.ts"; import { withStdoutProtected } from "./_engine/console-capture.ts"; import { withAgentErrors } from "./_engine/errors.ts"; @@ -27,11 +27,11 @@ const STATE_SHOW_FLAGS = { export default defineCommand({ description: "Show details of a resource in agents state", - auth: "apiKey", + auth: "none", usageArgs: "--address <provider.type.name> [--file <path>]", flags: STATE_SHOW_FLAGS, exampleArgs: ["--address bailian.agent.assistant"], - notes: CREDENTIALS_NOTE, + notes: OFFLINE_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -39,7 +39,9 @@ export default defineCommand({ const found = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file); + const runtime = await buildAgentRuntime(ctx, file, { + credentials: "none", + }); const parsed = parseStateAddress(flags.address, { requireProvider: false, }); diff --git a/packages/commands/src/commands/managed-agent/validate.ts b/packages/commands/src/commands/managed-agent/validate.ts index 0e1bf946..ad918a1c 100644 --- a/packages/commands/src/commands/managed-agent/validate.ts +++ b/packages/commands/src/commands/managed-agent/validate.ts @@ -7,7 +7,7 @@ import { } from "bailian-cli-core"; import { emitBare, emitResult } from "bailian-cli-runtime"; import { validateProjectConfig } from "@openagentpack/sdk"; -import { CREDENTIALS_NOTE, resolveAgentProjectConfig } from "./_engine/config-loader.ts"; +import { OFFLINE_NOTE, resolveAgentProjectConfig } from "./_engine/config-loader.ts"; import { withAgentErrors } from "./_engine/errors.ts"; const VALIDATE_FLAGS = { @@ -20,18 +20,20 @@ const VALIDATE_FLAGS = { export default defineCommand({ description: "Validate an agents.yaml configuration (offline)", - auth: "apiKey", + auth: "none", usageArgs: "[--file <path>]", flags: VALIDATE_FLAGS, exampleArgs: ["", "--file agents.yaml"], - notes: CREDENTIALS_NOTE, + notes: OFFLINE_NOTE, async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); const file = flags.file ?? "agents.yaml"; const diagnostics = await withAgentErrors(async () => { - const { config } = await resolveAgentProjectConfig(ctx, file); + const { config } = await resolveAgentProjectConfig(ctx, file, { + credentials: "none", + }); return validateProjectConfig(config); }); diff --git a/packages/commands/tests/credentials-bridge.test.ts b/packages/commands/tests/credentials-bridge.test.ts index 37379d75..60c9dda9 100644 --- a/packages/commands/tests/credentials-bridge.test.ts +++ b/packages/commands/tests/credentials-bridge.test.ts @@ -13,13 +13,15 @@ import { type CredentialHost, injectProviderCredentials, prepareProviderEnv, + resolveTargetProviderNames, scrubCredentialEnv, } from "../src/commands/managed-agent/_engine/credentials.ts"; /** * 凭证内存注入管道:injectProviderCredentials 把 authStage 解析进 Client 的凭证 * 权威覆写 bailian 配置块(不落 env),scrubCredentialEnv 清空所有凭证 env, - * assertProviderCredentials 对空 key 给 CLI 权威 AUTH 错误。用快照隔离凭证 env。 + * assertProviderCredentials 按本次运行涉及的 provider 范围对空 key 给 CLI 权威 + * AUTH 错误。用快照隔离凭证 env。 */ const TRACKED_ENV = [ "DASHSCOPE_API_KEY", @@ -139,11 +141,11 @@ test("inject:workspace_id 引用且为空时用 settings 填充;有字面量则 expect(literal.bailian.workspace_id).toBe("ws-yaml"); }); -test("inject:无凭证(dry-run)时 bailian 块保持不变", () => { +test("inject:无凭证时 api_key 保持不变,base_url 仍用 client 默认域名补齐(离线/范围外 schema 可用)", () => { const providers = { bailian: { api_key: "", base_url: "" } }; injectProviderCredentials(providers, makeHost({})); expect(providers.bailian.api_key).toBe(""); - expect(providers.bailian.base_url).toBe(""); + expect(providers.bailian.base_url).toBe("https://dashscope.aliyuncs.com/api/v1/agentstudio"); }); test("inject:非 bailian provider 块不被触碰", () => { @@ -190,6 +192,33 @@ test("assert:bailian key 为空(dry-run/未登录)抛 AUTH 且 hint 指向 bl au expect(err.hint).toContain("bl auth login"); }); +test("assert:required 限定范围后,范围外 provider 的空 key 不拦截", () => { + const providers = { + bailian: { api_key: "" }, + claude: { api_key: "sk-ant" }, + }; + // 本次只涉及 claude(如 --provider claude):bailian 未登录不应阻塞 + expect(() => assertProviderCredentials(providers, ["claude"])).not.toThrow(); + // 反向:范围内的空 key 仍拦截 + expect(() => assertProviderCredentials(providers, ["bailian"])).toThrow(); +}); + +test("assert:required 里未配置的 provider 名被跳过(由引擎报未配置错误)", () => { + expect(() => assertProviderCredentials({ bailian: { api_key: "" } }, ["qoder"])).not.toThrow(); +}); + +test("targets:默认 provider 链镜像 SDK —— default 为单个时只涉及它,缺失/all 时为全部", () => { + const providers = { bailian: {}, claude: {} }; + expect(resolveTargetProviderNames({ providers, defaults: { provider: "claude" } })).toEqual([ + "claude", + ]); + expect(resolveTargetProviderNames({ providers })).toEqual(["bailian", "claude"]); + expect(resolveTargetProviderNames({ providers, defaults: { provider: "all" } })).toEqual([ + "bailian", + "claude", + ]); +}); + test("scrub:所有凭证 env 变量被删除", () => { process.env.DASHSCOPE_API_KEY = "x"; process.env.ANTHROPIC_API_KEY = "y"; diff --git a/packages/commands/tests/e2e/fixtures/managed-agent/agents-multi.yaml b/packages/commands/tests/e2e/fixtures/managed-agent/agents-multi.yaml new file mode 100644 index 00000000..2d6c3756 --- /dev/null +++ b/packages/commands/tests/e2e/fixtures/managed-agent/agents-multi.yaml @@ -0,0 +1,28 @@ +version: "1" + +providers: + bailian: + api_key: ${DASHSCOPE_API_KEY} + base_url: ${BAILIAN_BASE_URL} + claude: + api_key: ${ANTHROPIC_API_KEY} + +defaults: + provider: all + +environments: + dev: + config: + type: cloud + networking: + type: unrestricted + +agents: + assistant: + description: "E2E multi-provider fixture" + model: + bailian: qwen3.7-max + claude: claude-sonnet-4-6 + instructions: | + You are a helpful assistant. + environment: dev diff --git a/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts b/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts index 26fbb487..aace7a0c 100644 --- a/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts +++ b/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts @@ -8,8 +8,9 @@ import { MANAGED_AGENT_ROUTES } from "./topic-routes.ts"; /** * managed-agent 凭证链 e2e：验证 bl 自有配置体系（config 写入 / 命名 Profile / - * logout）与错误映射如何流入 SDK 引擎。全部离线：`managed-agent validate` 会走 - * authStage 凭证解析 + 引擎注入 + agents.yaml 校验，但不发任何网络请求。 + * logout）与错误映射如何流入 SDK 引擎。全部离线：凭证门禁用 `managed-agent plan` + * 验证（provider-aware：空 state 不发网络请求，但仍按目标 provider 校验凭证）； + * `validate` / `state list` / `plan --no-refresh` 属离线命令，无凭证也必须可用。 * 配置一律通过 BAILIAN_CONFIG_DIR 指向临时目录，绝不触碰真实用户配置。 */ @@ -20,6 +21,7 @@ const ROUTES = { const AGENTS_YAML = join(e2eFixturesDir, "managed-agent", "agents.yaml"); const AGENTS_YAML_INVALID = join(e2eFixturesDir, "managed-agent", "agents-invalid.yaml"); +const AGENTS_YAML_MULTI = join(e2eFixturesDir, "managed-agent", "agents-multi.yaml"); const tempDirs: string[] = []; @@ -45,6 +47,16 @@ function validateArgs(file: string): string[] { return ["managed-agent", "validate", "--file", file, "--quiet"]; } +/** plan 是凭证门禁命令：空 state 下不发网络，但仍按目标 provider 校验凭证。 */ +function planArgs(file: string): string[] { + return ["managed-agent", "plan", "--file", file, "--quiet"]; +} + +/** 隔离宿主机的 ~/.agents/config.json，避免它强制覆盖 provider 凭证 env。 */ +function isolatedAgentsConfigEnv(): NodeJS.ProcessEnv { + return { AGENTS_CONFIG_PATH: join(tmpdir(), "bl-e2e-no-agents-config.json") }; +} + /** 分配一个刚释放的本地端口，连接必然 ECONNREFUSED，用于网络错误场景。 */ async function closedPort(): Promise<number> { const server = createServer(); @@ -61,9 +73,9 @@ async function closedPort(): Promise<number> { } describe("e2e: managed-agent 凭证链（config 写入 / Profile / logout / 错误映射）", () => { - test("config.json 写入的 api_key 流入引擎，validate 离线通过", async () => { + test("config.json 写入的 api_key 流入引擎，plan 离线通过", async () => { const env = makeConfigEnv({ api_key: "sk-e2e-config-write" }); - const { stderr, exitCode } = await runCommandE2e(ROUTES, validateArgs(AGENTS_YAML), env); + const { stderr, exitCode } = await runCommandE2e(ROUTES, planArgs(AGENTS_YAML), env); expect(exitCode, stderr).toBe(0); }); @@ -72,7 +84,7 @@ describe("e2e: managed-agent 凭证链（config 写入 / Profile / logout / 错 work: { api_key: "sk-e2e-profile-work" }, active_config: "work", }); - const { stderr, exitCode } = await runCommandE2e(ROUTES, validateArgs(AGENTS_YAML), env); + const { stderr, exitCode } = await runCommandE2e(ROUTES, planArgs(AGENTS_YAML), env); expect(exitCode, stderr).toBe(0); }); @@ -82,27 +94,27 @@ describe("e2e: managed-agent 凭证链（config 写入 / Profile / logout / 错 empty: {}, active_config: "empty", }); - const { stderr, exitCode } = await runCommandE2e(ROUTES, validateArgs(AGENTS_YAML), env); + const { stderr, exitCode } = await runCommandE2e(ROUTES, planArgs(AGENTS_YAML), env); expect(exitCode).toBe(3); expect(stderr).toMatch(/auth login|API key/i); }); - test("auth logout 清除凭证后 validate 报 AUTH，而非用残留凭证", async () => { + test("auth logout 清除凭证后 plan 报 AUTH，而非用残留凭证", async () => { const env = makeConfigEnv({ api_key: "sk-e2e-before-logout" }); - const before = await runCommandE2e(ROUTES, validateArgs(AGENTS_YAML), env); + const before = await runCommandE2e(ROUTES, planArgs(AGENTS_YAML), env); expect(before.exitCode, before.stderr).toBe(0); const logout = await runCommandE2e(ROUTES, ["auth", "logout"], env); expect(logout.exitCode, logout.stderr).toBe(0); - const after = await runCommandE2e(ROUTES, validateArgs(AGENTS_YAML), env); + const after = await runCommandE2e(ROUTES, planArgs(AGENTS_YAML), env); expect(after.exitCode).toBe(3); expect(after.stderr).toMatch(/auth login|API key/i); }); test("agents.yaml schema 错误映射为 USAGE (2)，不透传原始 zod dump", async () => { - const env = makeConfigEnv({ api_key: "sk-e2e-config-write" }); + const env = makeConfigEnv({}); const { stderr, exitCode } = await runCommandE2e( ROUTES, validateArgs(AGENTS_YAML_INVALID), @@ -142,3 +154,64 @@ describe("e2e: managed-agent 凭证链（config 写入 / Profile / logout / 错 expect(stderr).toMatch(/ECONNREFUSED|refused/i); }); }); + +describe("e2e: managed-agent 鉴权分层（离线命令免登录 / provider-aware 按需校验）", () => { + test("validate 无任何凭证也离线通过 (0)", async () => { + const env = makeConfigEnv({}); + const { stderr, exitCode } = await runCommandE2e(ROUTES, validateArgs(AGENTS_YAML), env); + expect(exitCode, stderr).toBe(0); + }); + + test("state list 无任何凭证也离线通过 (0)，stdout 为合法 JSON", async () => { + const env = makeConfigEnv({}); + const { stdout, stderr, exitCode } = await runCommandE2e( + ROUTES, + ["managed-agent", "state", "list", "--file", AGENTS_YAML, "--output", "json"], + env, + ); + expect(exitCode, stderr).toBe(0); + const data = parseStdoutJson<{ resources?: unknown[] }>(stdout); + expect(Array.isArray(data.resources)).toBe(true); + }); + + test("plan --no-refresh 无任何凭证也离线通过 (0)", async () => { + const env = makeConfigEnv({}); + const { stderr, exitCode } = await runCommandE2e( + ROUTES, + [...planArgs(AGENTS_YAML), "--no-refresh"], + env, + ); + expect(exitCode, stderr).toBe(0); + }); + + test("多 provider 下 plan --provider claude 只需 claude 凭证，bailian 未登录不阻塞 (0)", async () => { + const env = { + ...makeConfigEnv({}), + ...isolatedAgentsConfigEnv(), + ANTHROPIC_API_KEY: "sk-ant-e2e-scope", + CLAUDE_API_KEY: "", + }; + const { stderr, exitCode } = await runCommandE2e( + ROUTES, + [...planArgs(AGENTS_YAML_MULTI), "--provider", "claude"], + env, + ); + expect(exitCode, stderr).toBe(0); + }); + + test("plan --provider claude 缺 claude key 时报 AUTH (3)，hint 指向 ANTHROPIC_API_KEY", async () => { + const env = { + ...makeConfigEnv({ api_key: "sk-e2e-bailian-present" }), + ...isolatedAgentsConfigEnv(), + ANTHROPIC_API_KEY: "", + CLAUDE_API_KEY: "", + }; + const { stderr, exitCode } = await runCommandE2e( + ROUTES, + [...planArgs(AGENTS_YAML_MULTI), "--provider", "claude"], + env, + ); + expect(exitCode).toBe(3); + expect(stderr).toMatch(/ANTHROPIC_API_KEY/); + }); +}); diff --git a/packages/commands/tests/e2e/managed-agent.e2e.test.ts b/packages/commands/tests/e2e/managed-agent.e2e.test.ts index 44491792..827a8cce 100644 --- a/packages/commands/tests/e2e/managed-agent.e2e.test.ts +++ b/packages/commands/tests/e2e/managed-agent.e2e.test.ts @@ -5,8 +5,10 @@ import { MANAGED_AGENT_ROUTES } from "./topic-routes.ts"; /** * managed-agent：help / 缺参不依赖密钥；所有 mutation 命令的 --dry-run * 必须在构建 SDK runtime（凭证注入 / 联网 / 写盘）之前短路，因此同样不需要密钥。 + * 鉴权分层：离线命令（init/validate/state list|show|rm）auth: "none"；联网命令 + * provider-aware，只校验本次涉及的 provider（见 managed-agent-auth-chain e2e）。 * 真实集成（apply/destroy/session 流程）依赖工作区内的 agents.yaml 与远端资源， - * 属于批量场景，暂仅覆盖 dry-run 契约。 + * 属批量场景，暂仅覆盖 dry-run 契约。 */ describe("e2e: managed-agent", () => { @@ -67,21 +69,17 @@ describe("e2e: managed-agent", () => { }); test("managed-agent skill-list --source all 通过参数校验（缺配置文件时才失败）", async () => { - // auth: "apiKey" 的凭证解析先于 run() 执行；注入假 key 让用例不依赖环境凭证， - // 命令仍会在配置加载阶段因文件缺失短路，不产生任何网络请求。 - const { stderr, exitCode } = await runCommandE2e( - MANAGED_AGENT_ROUTES, - [ - "managed-agent", - "skill-list", - "--source", - "all", - "--file", - "agents.e2e-missing.yaml", - "--quiet", - ], - { DASHSCOPE_API_KEY: "sk-e2e-skill-list" }, - ); + // provider-aware 鉴权不再前置硬门禁：无需注入假 key，命令在配置加载阶段 + // 因文件缺失短路，不产生任何网络请求。 + const { stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ + "managed-agent", + "skill-list", + "--source", + "all", + "--file", + "agents.e2e-missing.yaml", + "--quiet", + ]); // all 是合法值：不应报 --source 用法错误，而是走到配置加载后因文件缺失退出 expect(exitCode).toBe(2); expect(stderr).not.toMatch(/--source must be one of/i); diff --git a/packages/commands/tests/e2e/topic-routes.ts b/packages/commands/tests/e2e/topic-routes.ts index 266565ee..f010ec9d 100644 --- a/packages/commands/tests/e2e/topic-routes.ts +++ b/packages/commands/tests/e2e/topic-routes.ts @@ -159,8 +159,10 @@ export const TOKEN_PLAN_ROUTES: E2eRouteExports = { export const MANAGED_AGENT_ROUTES: E2eRouteExports = { "managed-agent init": "managedAgentInit", "managed-agent validate": "managedAgentValidate", + "managed-agent plan": "managedAgentPlan", "managed-agent apply": "managedAgentApply", "managed-agent destroy": "managedAgentDestroy", + "managed-agent state list": "managedAgentStateList", "managed-agent state rm": "managedAgentStateRm", "managed-agent state import": "managedAgentStateImport", "managed-agent session create": "managedAgentSessionCreate", diff --git a/packages/core/src/types/command.ts b/packages/core/src/types/command.ts index 4ed9e0d6..59f5e330 100644 --- a/packages/core/src/types/command.ts +++ b/packages/core/src/types/command.ts @@ -67,10 +67,21 @@ export type AuthRequirement = "apiKey" | "console" | "openapi" | "none"; // ── Flag 分组:全局(所有命令) + 凭证域(按命令的 auth 可见) ──────────────────── /** 所有命令都可用的全局 flag。 */ export const GLOBAL_FLAGS = { - output: { type: "string", valueHint: "<format>", description: "Output format: text, json" }, - timeout: { type: "number", valueHint: "<seconds>", description: "Request timeout" }, + output: { + type: "string", + valueHint: "<format>", + description: "Output format: text, json", + }, + timeout: { + type: "number", + valueHint: "<seconds>", + description: "Request timeout", + }, quiet: { type: "switch", description: "Suppress non-essential output" }, - verbose: { type: "switch", description: "Print HTTP request/response details" }, + verbose: { + type: "switch", + description: "Print HTTP request/response details", + }, dryRun: { type: "switch", description: "Dry run mode" }, config: { type: "string", @@ -92,7 +103,10 @@ export const CONCURRENT_FLAG = { /** Command-scoped flag for task-based commands that can return without polling. */ export const ASYNC_FLAG = { - async: { type: "switch", description: "Return async task id without waiting" }, + async: { + type: "switch", + description: "Return async task id without waiting", + }, } satisfies FlagsDef; /** Model 域凭证/连接 flag,`auth: "apiKey"` 命令可见。 */ @@ -193,6 +207,14 @@ export interface Command<F extends FlagsDef = FlagsDef> { description: string; /** Credential this command requires. See {@link AuthRequirement}. */ auth: AuthRequirement; + /** + * Soften the auth gate: authStage still resolves the `auth` domain's + * credential into `ctx.client` when available, but a missing credential no + * longer fails before `run`. For commands that enforce their own scoped + * credential requirements (e.g. managed-agent commands, where a run may only + * involve third-party providers and must not be blocked on a Bailian key). + */ + authOptional?: boolean; /** Usage line arg portion, e.g. "--prompt <text> [flags]". Manually written. */ usageArgs?: string; /** Example arg strings (without the `<bin> <path>` prefix). */ diff --git a/packages/runtime/src/middleware.ts b/packages/runtime/src/middleware.ts index 0bd9bfff..44afff49 100644 --- a/packages/runtime/src/middleware.ts +++ b/packages/runtime/src/middleware.ts @@ -75,17 +75,24 @@ export function compose(stack: Middleware[]): (ctx: RunContext) => Promise<void> * Bake the credential for the command's declared `auth` into `ctx.client`, and * gate: no credential → throw before the command runs. dry-run 例外:凭证解析失败 * 不抛(dry-run 只打印请求,无需凭证;console 的 dry-run 展示读 settings.console*)。 + * `authOptional` 例外:凭证可用则注入,缺失不在此处抛 —— 命令自行按实际涉及范围 + * 校验(如 managed-agent 只校验本次运行涉及的 provider)。 * `auth: "none"` commands keep a credential-less client. */ export const authStage: Middleware = async (ctx, next) => { const { command, settings, sources } = ctx; - const base = { identity: ctx.identity, settings, baseUrl: resolveModelBaseUrl(sources) }; + const base = { + identity: ctx.identity, + settings, + baseUrl: resolveModelBaseUrl(sources), + }; + const tolerateMissing = settings.dryRun || command.authOptional === true; if (command.auth === "apiKey") { let cred: ApiKeyCredential | undefined; try { cred = resolveApiKey(sources); } catch (err) { - if (!settings.dryRun) throw err; + if (!tolerateMissing) throw err; } ctx.client = new Client({ ...base, apiCred: cred }); if (cred) maybeShowStatusBar(settings, cred.token, cred); @@ -94,7 +101,7 @@ export const authStage: Middleware = async (ctx, next) => { try { cred = resolveConsole(sources); } catch (err) { - if (!settings.dryRun) throw err; + if (!tolerateMissing) throw err; } if (cred) ctx.client = new Client({ ...base, consoleCred: cred }); } else if (command.auth === "openapi") { @@ -102,7 +109,7 @@ export const authStage: Middleware = async (ctx, next) => { try { cred = resolveOpenApi(sources); } catch (err) { - if (!settings.dryRun) throw err; + if (!tolerateMissing) throw err; } ctx.client = new Client({ ...base, openApiCred: cred }); } @@ -112,7 +119,11 @@ export const authStage: Middleware = async (ctx, next) => { /** Record command execution (start / success / failure) around the command. */ export const telemetryStage: Middleware = (ctx, next) => { return trackCommandExecution( - { identity: ctx.identity, settings: ctx.settings, authMethod: ctx.command.auth }, + { + identity: ctx.identity, + settings: ctx.settings, + authMethod: ctx.command.auth, + }, ctx.path, ctx.flags, next, diff --git a/skills/bailian-cli/reference/managed-agent.md b/skills/bailian-cli/reference/managed-agent.md index 7c180c7f..6b145f98 100644 --- a/skills/bailian-cli/reference/managed-agent.md +++ b/skills/bailian-cli/reference/managed-agent.md @@ -53,6 +53,7 @@ Index: [index.md](index.md) - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -87,6 +88,7 @@ bl managed-agent apply --provider bailian --yes - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -115,8 +117,6 @@ bl managed-agent destroy --yes --cascade | `--agent-name <name>` | string | no | Name of the first agent (default: assistant) | | `--file <path>` | string | no | Output config path (default: agents.yaml) | | `--force` | switch | no | Overwrite an existing config file | -| `--api-key <key>` | string | no | API key | -| `--base-url <url>` | string | no | API base URL | #### Examples @@ -155,6 +155,7 @@ bl managed-agent init --provider all - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -197,6 +198,7 @@ bl managed-agent plan --no-refresh - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -235,6 +237,7 @@ bl managed-agent session create --agent assistant --title 'debug run' - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -267,6 +270,7 @@ bl managed-agent session delete --session-id sess_abc123 - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -301,6 +305,7 @@ bl managed-agent session events --session-id sess_abc123 --all - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -332,6 +337,7 @@ bl managed-agent session get --session-id sess_abc123 - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -376,6 +382,7 @@ bl managed-agent session list --all - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -412,6 +419,7 @@ bl managed-agent session run --agent assistant --prompt "summarize this repo" - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -442,6 +450,7 @@ bl managed-agent session send --session-id sess_abc123 --message "continue" - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. - Providers without a skill listing API (e.g. ark) return an empty list. - For agent-driven skill selection, use `--source all --output json`: one call returns both catalogs with per-skill `source` and `description` fields to pick from. @@ -488,6 +497,7 @@ bl managed-agent skill-list --source custom --provider bailian - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. +- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -506,17 +516,13 @@ bl managed-agent state import --address bailian.agent.assistant --remote-id agen #### Flags -| Flag | Type | Required | Description | -| ------------------ | ------ | -------- | --------------------------------------- | -| `--file <path>` | string | no | Config file path (default: agents.yaml) | -| `--api-key <key>` | string | no | API key | -| `--base-url <url>` | string | no | API base URL | +| Flag | Type | Required | Description | +| --------------- | ------ | -------- | --------------------------------------- | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | #### Notes -- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). -- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. +- Runs fully offline against local files: no login or provider credentials required. #### Examples @@ -542,14 +548,10 @@ bl managed-agent state list --file agents.yaml | -------------------------------- | ------ | -------- | --------------------------------------- | | `--address <provider.type.name>` | string | yes | Resource state address (required) | | `--file <path>` | string | no | Config file path (default: agents.yaml) | -| `--api-key <key>` | string | no | API key | -| `--base-url <url>` | string | no | API base URL | #### Notes -- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). -- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. +- Runs fully offline against local files: no login or provider credentials required. #### Examples @@ -571,14 +573,10 @@ bl managed-agent state rm --address bailian.agent.assistant | -------------------------------- | ------ | -------- | --------------------------------------- | | `--address <provider.type.name>` | string | yes | Resource state address (required) | | `--file <path>` | string | no | Config file path (default: agents.yaml) | -| `--api-key <key>` | string | no | API key | -| `--base-url <url>` | string | no | API base URL | #### Notes -- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). -- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. +- Runs fully offline against local files: no login or provider credentials required. #### Examples @@ -596,17 +594,13 @@ bl managed-agent state show --address bailian.agent.assistant #### Flags -| Flag | Type | Required | Description | -| ------------------ | ------ | -------- | --------------------------------------- | -| `--file <path>` | string | no | Config file path (default: agents.yaml) | -| `--api-key <key>` | string | no | API key | -| `--base-url <url>` | string | no | API base URL | +| Flag | Type | Required | Description | +| --------------- | ------ | -------- | --------------------------------------- | +| `--file <path>` | string | no | Config file path (default: agents.yaml) | #### Notes -- Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). -- Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. +- Runs fully offline against local files: no login or provider credentials required. #### Examples From 63ee5aaec3330d3118aabae99b8cb144e8eba34c Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Mon, 27 Jul 2026 20:03:09 +0800 Subject: [PATCH 17/21] fix(agent): plan command dry-run --- docs/agents/auth-change.md | 2 +- .../src/commands/managed-agent/plan.ts | 18 +++-- .../e2e/managed-agent-auth-chain.e2e.test.ts | 66 ++++++++++++++++++- skills/bailian-cli/reference/managed-agent.md | 1 + 4 files changed, 79 insertions(+), 8 deletions(-) diff --git a/docs/agents/auth-change.md b/docs/agents/auth-change.md index cac9ec16..ef6c32a3 100644 --- a/docs/agents/auth-change.md +++ b/docs/agents/auth-change.md @@ -57,7 +57,7 @@ defineCommand({ auth }) → runtime/authStage → ctx.client → command.run(ctx `bl managed-agent *` 按调用链分两层，不再全命令硬门禁: -- **离线命令** — `init`、`validate`、`state list/show/rm`:`auth: "none"`，只读写本地文件，无需登录;引擎侧传 `credentials: "none"` 跳过凭证断言（`plan --no-refresh` 同样传 `"none"`） +- **离线命令** — `init`、`validate`、`state list/show/rm`:`auth: "none"`，只读写本地文件，无需登录;引擎侧传 `credentials: "none"` 跳过凭证断言（`plan --no-refresh` 与 `plan --dry-run` 同样传 `"none"` 并强制 `refresh: false`：不联网、不回写 state） - **provider-aware 命令** — `plan`(默认)、`apply`、`destroy`、`state import`、`skill-list`、全部 `session *`:仍声明 `auth: "apiKey"` 但加 `authOptional: true` —— authStage 照常经 `resolveApiKey(sources)` 解析 bailian 凭证(flag > env > active profile config)并注入 `ctx.client`，但缺失不在 authStage 抛;真正的门禁在引擎层 `assertProviderCredentials`，只校验本次运行涉及的 provider（`CredentialScope`:`--provider` / state 地址里的 provider / 配置默认 provider 链）。配了四个 provider 只跑 claude 时，缺 bailian key 不阻塞。 凭证不以真实值写入 `process.env`，而是经 `packages/commands/src/commands/managed-agent/_engine/` 的**内存注入管道**(`resolveAgentProjectConfig`)注入 SDK，管道五步: diff --git a/packages/commands/src/commands/managed-agent/plan.ts b/packages/commands/src/commands/managed-agent/plan.ts index 516fc2e3..237b4c39 100644 --- a/packages/commands/src/commands/managed-agent/plan.ts +++ b/packages/commands/src/commands/managed-agent/plan.ts @@ -41,28 +41,34 @@ const PLAN_FLAGS = { export default defineCommand({ description: "Show what changes would be applied to agent infrastructure", auth: "apiKey", - // Provider-aware gate: --no-refresh plans fully offline; a refreshing run - // only needs credentials for the providers it targets (see CredentialScope). + // Provider-aware gate: --no-refresh / --dry-run plan fully offline; a + // refreshing run only needs credentials for the providers it targets + // (see CredentialScope). authOptional: true, usageArgs: "[--file <path>] [--provider <name>] [--no-refresh] [--refresh-only]", flags: PLAN_FLAGS, exampleArgs: ["", "--provider bailian", "--no-refresh"], - notes: CREDENTIALS_NOTE, + notes: [ + ...CREDENTIALS_NOTE, + "--no-refresh and --dry-run plan offline from local config and state: no credentials, no remote requests, no state writes.", + ], async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); const file = flags.file ?? "agents.yaml"; + // Offline mode never talks to a provider and never saves refreshed state: + // --no-refresh by explicit request, --dry-run by contract (read-only run). + const offline = Boolean(flags.noRefresh) || settings.dryRun; const planned = await withAgentErrors(() => withStdoutProtected(async () => { - // --no-refresh never talks to a provider → no credentials required. const runtime = await buildAgentRuntime(ctx, file, { - credentials: flags.noRefresh ? "none" : (flags.provider ?? "targets"), + credentials: offline ? "none" : (flags.provider ?? "targets"), }); assertProviderConfigured(runtime, flags.provider); return planProjectContext(runtime, { provider: flags.provider, - refresh: !flags.noRefresh, + refresh: !offline, quiet: format === "json", onFeedback: format === "json" ? undefined : renderAgentFeedback, }); diff --git a/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts b/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts index aace7a0c..c9d3b39e 100644 --- a/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts +++ b/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts @@ -1,4 +1,4 @@ -import { mkdtempSync, rmSync, writeFileSync } from "node:fs"; +import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"; import { createServer } from "node:net"; import { tmpdir } from "node:os"; import { join } from "node:path"; @@ -57,6 +57,35 @@ function isolatedAgentsConfigEnv(): NodeJS.ProcessEnv { return { AGENTS_CONFIG_PATH: join(tmpdir(), "bl-e2e-no-agents-config.json") }; } +/** + * 在临时目录里搭一套非空 state 的项目：agents.yaml 复用单 provider fixture， + * agents.state.json 预置一条已追踪资源 —— 非空 state 是触发 plan 默认 refresh + * 路径的前提，用于验证 --dry-run 强制离线。目录纳入 tempDirs 自动清理。 + */ +function makeStatefulProject(): { configPath: string; statePath: string } { + const dir = mkdtempSync(join(tmpdir(), "bl-managed-agent-dry-run-")); + tempDirs.push(dir); + const configPath = join(dir, "agents.yaml"); + const statePath = join(dir, "agents.state.json"); + writeFileSync(configPath, readFileSync(AGENTS_YAML, "utf8")); + writeFileSync( + statePath, + `${JSON.stringify( + { + resources: [ + { + address: { provider: "bailian", type: "agent", name: "assistant" }, + remote_id: "agent-e2e-dry-run", + }, + ], + }, + null, + 2, + )}\n`, + ); + return { configPath, statePath }; +} + /** 分配一个刚释放的本地端口，连接必然 ECONNREFUSED，用于网络错误场景。 */ async function closedPort(): Promise<number> { const server = createServer(); @@ -215,3 +244,38 @@ describe("e2e: managed-agent 鉴权分层（离线命令免登录 / provider-awa expect(stderr).toMatch(/ANTHROPIC_API_KEY/); }); }); + +describe("e2e: plan --dry-run 离线契约（不联网 / 不写 state / 免凭证）", () => { + test("无任何凭证时 plan --dry-run 不报 AUTH，离线出 plan (0)", async () => { + const env = makeConfigEnv({}); + const { stderr, exitCode } = await runCommandE2e( + ROUTES, + [...planArgs(AGENTS_YAML), "--dry-run"], + env, + ); + expect(exitCode, stderr).toBe(0); + }); + + test("有凭证且 state 非空时，--dry-run 跳过 refresh：不发请求、state 文件不变；同环境不加 --dry-run 则证明会联网", async () => { + const { configPath, statePath } = makeStatefulProject(); + // base_url 指向必然 ECONNREFUSED 的本地端口：一旦 refresh 真发请求必现形。 + // refresh 对 API 错误优雅降级(不影响退出码)，因此用 stderr 的 + // "Failed to refresh" 告警作为「发过请求」的观测信号。 + const port = await closedPort(); + const env = makeConfigEnv({ + api_key: "sk-e2e-dry-run", + base_url: `http://127.0.0.1:${port}`, + }); + const stateBefore = readFileSync(statePath, "utf8"); + + // 对照组：不加 --dry-run，默认 refresh 路径真实访问远端 → 出现 refresh 失败告警。 + const withoutDryRun = await runCommandE2e(ROUTES, planArgs(configPath), env); + expect(withoutDryRun.stderr).toMatch(/Failed to refresh/i); + + // --dry-run：同环境必须完全离线成功，无任何 refresh 痕迹，且不回写 state 文件。 + const withDryRun = await runCommandE2e(ROUTES, [...planArgs(configPath), "--dry-run"], env); + expect(withDryRun.exitCode, withDryRun.stderr).toBe(0); + expect(withDryRun.stderr).not.toMatch(/Failed to refresh/i); + expect(readFileSync(statePath, "utf8")).toBe(stateBefore); + }); +}); diff --git a/skills/bailian-cli/reference/managed-agent.md b/skills/bailian-cli/reference/managed-agent.md index 6b145f98..90146863 100644 --- a/skills/bailian-cli/reference/managed-agent.md +++ b/skills/bailian-cli/reference/managed-agent.md @@ -157,6 +157,7 @@ bl managed-agent init --provider all - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. - Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. +- --no-refresh and --dry-run plan offline from local config and state: no credentials, no remote requests, no state writes. #### Examples From 05860b3bdd7fb09e43632e7ff36509821db07a67 Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Mon, 27 Jul 2026 20:10:47 +0800 Subject: [PATCH 18/21] fix(agent): session output json with session_id --- .../managed-agent/_engine/session-render.ts | 27 ++++- .../src/commands/managed-agent/session-run.ts | 17 ++- .../commands/managed-agent/session-send.ts | 8 +- .../commands/tests/session-render.test.ts | 103 ++++++++++++++++++ skills/bailian-cli/reference/managed-agent.md | 1 + 5 files changed, 147 insertions(+), 9 deletions(-) create mode 100644 packages/commands/tests/session-render.test.ts diff --git a/packages/commands/src/commands/managed-agent/_engine/session-render.ts b/packages/commands/src/commands/managed-agent/_engine/session-render.ts index 78c6e12b..f1cb7ac2 100644 --- a/packages/commands/src/commands/managed-agent/_engine/session-render.ts +++ b/packages/commands/src/commands/managed-agent/_engine/session-render.ts @@ -15,15 +15,29 @@ function renderTerminalStatus(status: string, json: boolean): void { process.stderr.write(`\n[session ${status}]\n`); } +/** + * Session identity echoed at the head of the `--output json` envelope so + * callers can read the (possibly just-created) session id from stdout and + * chain `session send/get/events/delete` — without scraping stderr. + * Undefined fields are dropped by JSON.stringify. + */ +export interface SessionRenderContext { + session_id?: string; + provider?: string; + agent?: string; +} + /** * Consume an SSE stream. Text mode renders live (assistant text → stdout, * diagnostics → stderr). JSON mode collects every event and emits exactly one * JSON document at the end — `--output json` guarantees a single valid JSON - * result on stdout (mirrors `text chat --stream --output json`). + * result on stdout (mirrors `text chat --stream --output json`). `context` + * prefixes the envelope with the session identity. */ export async function streamAndRenderEvents( events: AsyncIterable<ProviderSessionEvent>, json: boolean, + context: SessionRenderContext = {}, ): Promise<void> { const collected: ProviderSessionEvent[] = []; for await (const event of events) { @@ -36,7 +50,7 @@ export async function streamAndRenderEvents( } if (json) { process.stdout.write( - `${JSON.stringify({ events: sanitizeSessionEvents(collected) }, null, 2)}\n`, + `${JSON.stringify({ ...context, events: sanitizeSessionEvents(collected) }, null, 2)}\n`, ); } } @@ -59,12 +73,17 @@ function renderEvent(event: ProviderSessionEvent): void { } } -/** Render a polled (non-streaming) collected result. */ -export function renderCollectedEvents(result: CollectedSessionEvents, json: boolean): void { +/** Render a polled (non-streaming) collected result. `context` prefixes the JSON envelope. */ +export function renderCollectedEvents( + result: CollectedSessionEvents, + json: boolean, + context: SessionRenderContext = {}, +): void { if (json) { process.stdout.write( `${JSON.stringify( { + ...context, events: sanitizeSessionEvents(result.result.events), has_more: result.result.has_more, next_page: result.result.next_page, diff --git a/packages/commands/src/commands/managed-agent/session-run.ts b/packages/commands/src/commands/managed-agent/session-run.ts index 820ce472..2a6637c8 100644 --- a/packages/commands/src/commands/managed-agent/session-run.ts +++ b/packages/commands/src/commands/managed-agent/session-run.ts @@ -62,7 +62,10 @@ export default defineCommand({ usageArgs: "--prompt <text> [--agent <name>] [--no-stream] [--file <path>]", flags: SESSION_RUN_FLAGS, exampleArgs: ['--prompt "hello"', '--agent assistant --prompt "summarize this repo"'], - notes: CREDENTIALS_NOTE, + notes: [ + ...CREDENTIALS_NOTE, + "--output json emits one envelope: { session_id, provider, agent, events } — read session_id to chain `session send/get/events/delete`.", + ], async run(ctx) { const { settings, flags } = ctx; const format = detectOutputFormat(settings.output); @@ -106,11 +109,19 @@ export default defineCommand({ if (flags.noStream) { const run = await startSessionRunPolling(runtime, flags.prompt, runOptions); if (!asJson) process.stderr.write(`Session created: ${run.session.id}\n`); - renderCollectedEvents(run, asJson); + renderCollectedEvents(run, asJson, { + session_id: run.session.id, + provider: run.provider, + agent: run.agentName, + }); } else { const run = await startSessionRun(runtime, flags.prompt, runOptions); if (!asJson) process.stderr.write(`Session created: ${run.session.id}\n`); - await streamAndRenderEvents(run.events, asJson); + await streamAndRenderEvents(run.events, asJson, { + session_id: run.session.id, + provider: run.provider, + agent: run.agentName, + }); } }), ); diff --git a/packages/commands/src/commands/managed-agent/session-send.ts b/packages/commands/src/commands/managed-agent/session-send.ts index c424262e..96df4b6d 100644 --- a/packages/commands/src/commands/managed-agent/session-send.ts +++ b/packages/commands/src/commands/managed-agent/session-send.ts @@ -75,7 +75,9 @@ export default defineCommand({ const result = await sendSessionMessagePolling(runtime, flags.sessionId, flags.message, { provider: flags.provider, }); - renderCollectedEvents(result, asJson); + renderCollectedEvents(result, asJson, { + session_id: flags.sessionId, + }); } else { const events = await sendSessionMessageStreaming( runtime, @@ -85,7 +87,9 @@ export default defineCommand({ provider: flags.provider, }, ); - await streamAndRenderEvents(events, asJson); + await streamAndRenderEvents(events, asJson, { + session_id: flags.sessionId, + }); } }), ); diff --git a/packages/commands/tests/session-render.test.ts b/packages/commands/tests/session-render.test.ts new file mode 100644 index 00000000..01f7a73c --- /dev/null +++ b/packages/commands/tests/session-render.test.ts @@ -0,0 +1,103 @@ +import { afterEach, beforeEach, expect, test } from "vite-plus/test"; +import type { CollectedSessionEvents, ProviderSessionEvent } from "@openagentpack/sdk"; +import { + renderCollectedEvents, + streamAndRenderEvents, +} from "../src/commands/managed-agent/_engine/session-render.ts"; + +/** + * `--output json` 会话信封契约：stdout 恰好一个合法 JSON，且信封头部携带 + * session_id / provider / agent —— session run 的调用方必须能从 stdout 拿到 + * 新建 Session ID 以继续 send/get/events/delete（不靠刮 stderr）。 + */ + +let stdoutChunks: string[] = []; +let originalStdoutWrite: typeof process.stdout.write; + +beforeEach(() => { + stdoutChunks = []; + originalStdoutWrite = process.stdout.write.bind(process.stdout); + process.stdout.write = ((chunk: string | Uint8Array) => { + stdoutChunks.push(String(chunk)); + return true; + }) as typeof process.stdout.write; +}); + +afterEach(() => { + process.stdout.write = originalStdoutWrite; +}); + +function capturedJson(): Record<string, unknown> { + // 契约：整个 stdout 拼起来是单个合法 JSON + return JSON.parse(stdoutChunks.join("")) as Record<string, unknown>; +} + +async function* fakeEventStream(): AsyncIterable<ProviderSessionEvent> { + yield { + type: "message", + role: "assistant", + content: "hi", + } as ProviderSessionEvent; + yield { type: "status", status: "completed" } as ProviderSessionEvent; +} + +function fakeCollected(): CollectedSessionEvents { + return { + terminalStatus: "completed", + result: { + events: [ + { + type: "message", + role: "assistant", + content: "hi", + } as ProviderSessionEvent, + ], + has_more: false, + next_page: undefined, + }, + } as CollectedSessionEvents; +} + +test("stream json:信封携带 session_id/provider/agent + events", async () => { + await streamAndRenderEvents(fakeEventStream(), true, { + session_id: "sess_stream", + provider: "bailian", + agent: "assistant", + }); + const data = capturedJson(); + expect(data.session_id).toBe("sess_stream"); + expect(data.provider).toBe("bailian"); + expect(data.agent).toBe("assistant"); + expect(Array.isArray(data.events)).toBe(true); + expect((data.events as unknown[]).length).toBe(2); +}); + +test("polling json:信封携带 session_id/provider/agent，并保留 has_more/next_page", () => { + renderCollectedEvents(fakeCollected(), true, { + session_id: "sess_poll", + provider: "claude", + agent: "assistant", + }); + const data = capturedJson(); + expect(data.session_id).toBe("sess_poll"); + expect(data.provider).toBe("claude"); + expect(data.agent).toBe("assistant"); + expect(data.has_more).toBe(false); + expect(Array.isArray(data.events)).toBe(true); +}); + +test("json:不传 context 时信封形状不变(无 session_id 键)", () => { + renderCollectedEvents(fakeCollected(), true); + const data = capturedJson(); + expect("session_id" in data).toBe(false); + expect(Array.isArray(data.events)).toBe(true); +}); + +test("text 模式:context 不影响 stdout(仍只输出助手文本)", async () => { + await streamAndRenderEvents(fakeEventStream(), false, { + session_id: "sess_text", + }); + const output = stdoutChunks.join(""); + expect(output).toBe("hi"); + expect(output).not.toContain("sess_text"); +}); diff --git a/skills/bailian-cli/reference/managed-agent.md b/skills/bailian-cli/reference/managed-agent.md index 90146863..37244770 100644 --- a/skills/bailian-cli/reference/managed-agent.md +++ b/skills/bailian-cli/reference/managed-agent.md @@ -385,6 +385,7 @@ bl managed-agent session list --all - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. - Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. +- --output json emits one envelope: { session_id, provider, agent, events } — read session_id to chain `session send/get/events/delete`. #### Examples From a03ee0c72ce8d57c969811328732f97a5052cc8a Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Mon, 27 Jul 2026 20:23:21 +0800 Subject: [PATCH 19/21] fix(agent): timeout error --- .../commands/managed-agent/_engine/errors.ts | 40 +++++++++++++++---- .../tests/managed-agent-errors.test.ts | 16 ++++++++ 2 files changed, 48 insertions(+), 8 deletions(-) diff --git a/packages/commands/src/commands/managed-agent/_engine/errors.ts b/packages/commands/src/commands/managed-agent/_engine/errors.ts index 32c5c9c7..f22571ce 100644 --- a/packages/commands/src/commands/managed-agent/_engine/errors.ts +++ b/packages/commands/src/commands/managed-agent/_engine/errors.ts @@ -33,23 +33,47 @@ function parseSdkResponseBody(raw: string): ApiErrorBody { return { message: raw.trim() || undefined }; } +/** + * The SDK's session polling deadline surfaces as a plain `UserError` (no + * dedicated timeout class as of SDK 0.3.x), so it is recognized by its stable + * message shape: "Session did not complete within the timeout (N seconds)." + * (session-runtime's assertNotTimedOut — the SDK's only timeout UserError). + * It is a client-side wait limit, not a usage mistake → per bl's error + * boundary it must exit TIMEOUT, not USAGE. + */ +function isSdkPollingTimeout(error: UserError): boolean { + return /did not complete within the timeout/i.test(error.message); +} + /** * Run an SDK-backed operation, translating SDK error types into BailianError so * bl's error handler produces the right exit code and hint formatting. - * SDK `UserError` → USAGE; SDK `ApiError` (server HTTP error) → GENERAL via - * `mapApiError` (server message passed through verbatim, with - * httpStatus/apiCode/requestId metadata for --output json); fetch transport - * failures (`TypeError: fetch failed`) are rethrown untouched so the runtime - * error handler maps them to NETWORK with an errno-specific hint, matching the - * native client path; any other Error → GENERAL (message passed through, per - * bl's "don't translate server errors" boundary). + * SDK `UserError` → USAGE — except the polling-deadline UserError, which is a + * client-side timeout → TIMEOUT with a wait-longer hint; SDK `ApiError` + * (server HTTP error) → GENERAL via `mapApiError` (server message passed + * through verbatim, with httpStatus/apiCode/requestId metadata for + * --output json); fetch transport failures (`TypeError: fetch failed`) are + * rethrown untouched so the runtime error handler maps them to NETWORK with an + * errno-specific hint, matching the native client path; any other Error → + * GENERAL (message passed through, per bl's "don't translate server errors" + * boundary). */ export async function withAgentErrors<T>(fn: () => Promise<T>): Promise<T> { try { return await fn(); } catch (error) { if (error instanceof BailianError) throw error; - if (error instanceof UserError) throw new BailianError(error.message, ExitCode.USAGE); + if (error instanceof UserError) { + if (isSdkPollingTimeout(error)) { + throw new BailianError( + error.message, + ExitCode.TIMEOUT, + // `bl` prefix is safe: agent commands ship on `bl` only. + "The session may still be running — check `bl managed-agent session get --session-id <id>` or `session events`.", + ); + } + throw new BailianError(error.message, ExitCode.USAGE); + } if (error instanceof Error && isSdkApiError(error)) { throw mapApiError(error.statusCode, parseSdkResponseBody(error.responseBody)); } diff --git a/packages/commands/tests/managed-agent-errors.test.ts b/packages/commands/tests/managed-agent-errors.test.ts index 238cb7e1..8af71b7e 100644 --- a/packages/commands/tests/managed-agent-errors.test.ts +++ b/packages/commands/tests/managed-agent-errors.test.ts @@ -39,6 +39,22 @@ test("SDK UserError maps to USAGE", async () => { expect(mapped.message).toBe("bad agents.yaml"); }); +test("SDK polling-timeout UserError maps to TIMEOUT (5), not USAGE", async () => { + // 消息形状来自 SDK session-runtime 的 assertNotTimedOut —— 客户端等待超时， + // 按 bl 错误边界必须归 TIMEOUT，不能告诉自动化调用方“参数错误”。 + const mapped = await catchMapped( + new UserError("Session did not complete within the timeout (600 seconds)."), + ); + expect(mapped.exitCode).toBe(ExitCode.TIMEOUT); + expect(mapped.message).toBe("Session did not complete within the timeout (600 seconds)."); + expect(mapped.hint).toMatch(/session get/); +}); + +test("提及 timeout 但非轮询超时句式的 UserError 仍归 USAGE", async () => { + const mapped = await catchMapped(new UserError("Invalid timeout value in agents.yaml")); + expect(mapped.exitCode).toBe(ExitCode.USAGE); +}); + test("SDK ApiError with DashScope-style JSON body surfaces clean message and api metadata", async () => { const body = JSON.stringify({ code: "InvalidParameter", From 9819eb6ddc401d994e30c1a95f802696e4b766ff Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Mon, 27 Jul 2026 21:33:36 +0800 Subject: [PATCH 20/21] =?UTF-8?q?feat(agent):=20=E9=9D=9Ebailian=20provide?= =?UTF-8?q?r=E4=B9=9F=E8=B5=B0=E9=89=B4=E6=9D=83=E9=80=BB=E8=BE=91?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/agents/auth-change.md | 10 ++-- packages/cli/agents.yaml | 27 ---------- .../managed-agent/_engine/config-loader.ts | 28 +++------- .../managed-agent/_engine/credentials.ts | 52 ++++++------------- .../src/commands/managed-agent/apply.ts | 6 +-- .../src/commands/managed-agent/destroy.ts | 6 +-- .../src/commands/managed-agent/plan.ts | 10 ++-- .../commands/managed-agent/session-create.ts | 6 +-- .../commands/managed-agent/session-delete.ts | 6 +-- .../commands/managed-agent/session-events.ts | 6 +-- .../src/commands/managed-agent/session-get.ts | 6 +-- .../commands/managed-agent/session-list.ts | 6 +-- .../src/commands/managed-agent/session-run.ts | 6 +-- .../commands/managed-agent/session-send.ts | 6 +-- .../src/commands/managed-agent/skill-list.ts | 6 +-- .../commands/managed-agent/state-import.ts | 8 +-- .../commands/tests/credentials-bridge.test.ts | 32 +----------- .../e2e/managed-agent-auth-chain.e2e.test.ts | 33 +++++++++--- .../tests/e2e/managed-agent.e2e.test.ts | 28 +++++----- packages/core/src/types/command.ts | 8 --- packages/runtime/src/middleware.ts | 9 ++-- skills/bailian-cli/reference/managed-agent.md | 14 +---- 22 files changed, 91 insertions(+), 228 deletions(-) delete mode 100644 packages/cli/agents.yaml diff --git a/docs/agents/auth-change.md b/docs/agents/auth-change.md index ef6c32a3..9099b8de 100644 --- a/docs/agents/auth-change.md +++ b/docs/agents/auth-change.md @@ -55,18 +55,18 @@ defineCommand({ auth }) → runtime/authStage → ctx.client → command.run(ctx ### 例外:agent 命令的分层鉴权与 SDK 凭证内存注入 -`bl managed-agent *` 按调用链分两层，不再全命令硬门禁: +`bl managed-agent *` 按调用链分两层: -- **离线命令** — `init`、`validate`、`state list/show/rm`:`auth: "none"`，只读写本地文件，无需登录;引擎侧传 `credentials: "none"` 跳过凭证断言（`plan --no-refresh` 与 `plan --dry-run` 同样传 `"none"` 并强制 `refresh: false`：不联网、不回写 state） -- **provider-aware 命令** — `plan`(默认)、`apply`、`destroy`、`state import`、`skill-list`、全部 `session *`:仍声明 `auth: "apiKey"` 但加 `authOptional: true` —— authStage 照常经 `resolveApiKey(sources)` 解析 bailian 凭证(flag > env > active profile config)并注入 `ctx.client`，但缺失不在 authStage 抛;真正的门禁在引擎层 `assertProviderCredentials`，只校验本次运行涉及的 provider（`CredentialScope`:`--provider` / state 地址里的 provider / 配置默认 provider 链）。配了四个 provider 只跑 claude 时，缺 bailian key 不阻塞。 +- **离线命令** — `init`、`validate`、`state list/show/rm`:`auth: "none"`，只读写本地文件，无需登录;引擎侧传 `credentials: "none"` 跳过凭证断言 +- **联网命令** — `plan`、`apply`、`destroy`、`state import`、`skill-list`、全部 `session *`:统一声明 `auth: "apiKey"` 硬门禁 —— 无论目标 provider 是谁，authStage 都经 `resolveApiKey(sources)` 解析 bailian 凭证(flag > env > active profile config)，缺失报统一 AUTH;引擎层 `assertProviderCredentials` 再对 agents.yaml 里**全部已声明 provider** 的空 key 拦截并给 provider 专属 hint。例外:`plan --no-refresh` / `plan --dry-run` 传 `credentials: "none"` 并强制 `refresh: false`（不联网、不回写 state，不查 provider key），其中 `--dry-run` 连登录也不要求（authStage 的 dry-run 豁免），`--no-refresh` 仍需登录。 凭证不以真实值写入 `process.env`，而是经 `packages/commands/src/commands/managed-agent/_engine/` 的**内存注入管道**(`resolveAgentProjectConfig`)注入 SDK，管道五步: 1. `prepareProviderEnv()` — 先 `bootstrapRuntimeCredentialsSync()`(SDK 把 `.env` / `~/.agents/config.json` 灌进 env，服务 claude/ark/qoder 等非 bailian provider)，再把全部凭证类 env(`CREDENTIAL_ENV_KEYS`，含别名)中仍为 undefined 的占位为 `""`，使 agents.yaml 插值不因缺变量抛错 -2. `resolveProjectConfig` — 插值发生:bailian 插值拿到占位空串，claude/ark 拿到真实 env 值;随后 `normalizeInterpolatedProviderBlocks()` 把插值为空导致的 YAML `null` 归一为 `""`(避免范围外 provider 在 SDK zod 层报 "received null") +2. `resolveProjectConfig` — 插值发生:bailian 插值拿到占位空串，claude/ark 拿到真实 env 值;随后 `normalizeInterpolatedProviderBlocks()` 把插值为空导致的 YAML `null` 归一为 `""`(避免离线命令下空 key 在 SDK zod 层报 "received null") 3. `injectProviderCredentials()` — 用 `ctx.client.exportApiCredential()`(lint 限定 `managed-agent/_engine/**` 可用)覆写内存 config 对象的 bailian 块:有凭证时 `api_key` 无条件覆写;`base_url`(拼 `/api/v1/agentstudio` 后缀，无凭证时用 client 默认域名补齐以满足 schema)/`workspace_id`(取 `settings.workspaceId`)仅在引用且为空时填充 4. `scrubCredentialEnv()` — 从 `process.env` 删除全部凭证变量(真实凭证此后只存于 config 对象 → provider adapter 实例内存，不驻留 env / 不被子进程继承) -5. `assertProviderCredentials(providers, required)` — 按 `CredentialScope` 算出的 `required` 范围校验:范围内 provider 的 `api_key` 为空 → CLI 权威 `AUTH` 错误 + provider 专属 hint(取代 SDK 原始插值/zod 报错);范围外 provider 允许空 key +5. `assertProviderCredentials(providers)` — 任一已声明 provider 的 `api_key` 为空 → CLI 权威 `AUTH` 错误 + provider 专属 hint(取代 SDK 原始插值/zod 报错);离线命令传 `credentials: "none"` 整体跳过 `bl auth login` 仅管理 bailian(DashScope)凭证;claude/ark/qoder 的 key 从 env(shell / `.env` / `~/.agents/config.json`)经插值进入 config 对象，同样被清扫。禁止命令层直接 `readConfigFile` 裸读凭证;bailian 字段以 CLI 鉴权链为唯一信源。 diff --git a/packages/cli/agents.yaml b/packages/cli/agents.yaml deleted file mode 100644 index 715470a4..00000000 --- a/packages/cli/agents.yaml +++ /dev/null @@ -1,27 +0,0 @@ -version: "1" - -providers: - bailian: - # bl auth login --api-key <key> sets DASHSCOPE_API_KEY; --agentstudio-base-url <url> sets BAILIAN_BASE_URL - api_key: ${DASHSCOPE_API_KEY} - base_url: ${BAILIAN_BASE_URL} - -defaults: - provider: bailian - -environments: - dev: - config: - type: cloud - networking: - type: unrestricted - -agents: - assistant: - description: "General-purpose assistant" - model: qwen3.7-max - instructions: | - You are a helpful assistant. - environment: dev - tools: - builtin: [bash, read, glob, grep] diff --git a/packages/commands/src/commands/managed-agent/_engine/config-loader.ts b/packages/commands/src/commands/managed-agent/_engine/config-loader.ts index 0043c69c..0457fda8 100644 --- a/packages/commands/src/commands/managed-agent/_engine/config-loader.ts +++ b/packages/commands/src/commands/managed-agent/_engine/config-loader.ts @@ -11,7 +11,6 @@ import { injectProviderCredentials, normalizeInterpolatedProviderBlocks, prepareProviderEnv, - resolveTargetProviderNames, scrubCredentialEnv, } from "./credentials.ts"; import { loadFileState } from "./file-state-manager.ts"; @@ -20,15 +19,12 @@ import { type HostContext, installSdkTransport } from "./transport.ts"; export { CREDENTIALS_NOTE, OFFLINE_NOTE } from "./credentials.ts"; /** - * Which providers this run requires a non-empty key for: - * - "targets" (default) — the run's target providers per the config's - * default provider chain (mirrors the SDK's plan/apply targeting) + * Whether this run requires provider keys: + * - "all" (default) — online command: every provider declared in agents.yaml + * must have a non-empty key after injection * - "none" — offline command (local config/state only), skip the check - * - "all" — every configured provider (`--provider all`) - * - any other name — the run was narrowed to that provider - * (`--provider <name>` / a provider-qualified state address) */ -export type CredentialScope = "targets" | "none" | "all" | (string & {}); +export type CredentialScope = "all" | "none"; interface AgentConfigOptions { resolveEnv?: boolean; @@ -46,8 +42,8 @@ interface AgentConfigOptions { * 3. override the bailian block with the CLI auth chain's credential (in-memory) * 4. scrub all credential vars from process.env (real values now live only in * the config object → provider adapters, never the environment) - * 5. fail with a CLI-authoritative AUTH error if a provider within this run's - * {@link CredentialScope} has an empty key (offline commands pass "none") + * 5. fail with a CLI-authoritative AUTH error if any provider's key is empty + * (offline commands pass `credentials: "none"` to skip the check) */ export async function resolveAgentProjectConfig( host: CredentialHost, @@ -59,16 +55,8 @@ export async function resolveAgentProjectConfig( normalizeInterpolatedProviderBlocks(resolved.config.providers); injectProviderCredentials(resolved.config.providers, host); scrubCredentialEnv(); - const scope = options.credentials ?? "targets"; - if (scope !== "none") { - assertProviderCredentials( - resolved.config.providers, - scope === "targets" - ? resolveTargetProviderNames(resolved.config) - : scope === "all" - ? Object.keys(resolved.config.providers) - : [scope], - ); + if ((options.credentials ?? "all") !== "none") { + assertProviderCredentials(resolved.config.providers); } return resolved; } diff --git a/packages/commands/src/commands/managed-agent/_engine/credentials.ts b/packages/commands/src/commands/managed-agent/_engine/credentials.ts index 2dc096a2..cf0212cc 100644 --- a/packages/commands/src/commands/managed-agent/_engine/credentials.ts +++ b/packages/commands/src/commands/managed-agent/_engine/credentials.ts @@ -51,7 +51,6 @@ export interface CredentialHost { export const CREDENTIALS_NOTE = [ "Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile).", "Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json.", - "Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked.", "Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env.", ]; @@ -89,10 +88,10 @@ export function prepareProviderEnv(): void { * `base_url` carries {@link AGENTSTUDIO_API_PATH} because the SDK appends resource * paths onto it verbatim; a value already ending in the suffix is left as-is. * It is filled even without a credential — `client.baseUrl` is readable - * credential-less (defaults to the CLI's model-domain base URL) — so offline / - * out-of-scope runs still satisfy the SDK's "workspace_id or base_url" schema. - * With no credential the `api_key` is left untouched: an in-scope empty key is - * rejected by {@link assertProviderCredentials}, out-of-scope ones may stay empty. + * credential-less (defaults to the CLI's model-domain base URL) — so offline + * commands (which skip the credential assert) still satisfy the SDK's + * "workspace_id or base_url" schema. With no credential the `api_key` is left + * untouched: online commands reject it via {@link assertProviderCredentials}. */ export function injectProviderCredentials( providers: Record<string, unknown>, @@ -133,10 +132,11 @@ export function scrubCredentialEnv(): void { /** * The SDK interpolates `${VAR}` into the raw YAML text, so an empty env var * leaves `api_key:` with nothing after it — YAML parses that as null. Normalize - * every null provider field back to "" so the pipeline stays uniform: an empty - * api_key is caught by {@link assertProviderCredentials} when the provider is - * in scope, and out-of-scope blocks still satisfy the SDK's string schemas - * instead of failing zod with "received null" before the run even starts. + * every null provider field back to "" so the pipeline stays uniform: for + * online commands an empty api_key is caught by {@link + * assertProviderCredentials}; for offline commands (which skip the assert) the + * blocks still satisfy the SDK's string schemas instead of failing zod with + * "received null" before the run even starts. */ export function normalizeInterpolatedProviderBlocks(providers: Record<string, unknown>): void { for (const raw of Object.values(providers)) { @@ -149,37 +149,15 @@ export function normalizeInterpolatedProviderBlocks(providers: Record<string, un } /** - * The providers a run targets when no explicit `--provider` narrows it: the - * config's default provider, or every configured provider when the default is - * absent or "all". Mirrors the SDK's config-based `resolveTargetProviders` - * (not exported from the SDK's public surface). - */ -export function resolveTargetProviderNames(config: { - providers: Record<string, unknown>; - defaults?: { provider?: string }; -}): string[] { - const defaultProvider = config.defaults?.provider; - if (!defaultProvider || defaultProvider === "all") return Object.keys(config.providers); - return [defaultProvider]; -} - -/** - * After injection, fail with a CLI-authoritative AUTH error if a required + * After injection, fail with a CLI-authoritative AUTH error if any configured * provider's `api_key` resolved empty (missing env var, or no bl login for * bailian). Replaces the SDK's raw `Environment variable '...' is not set` / - * zod config error with a clean message plus a provider-specific hint. - * `required` limits the check to the providers this run actually involves - * (← --provider / state address / config default chain); providers outside - * that scope may keep empty keys — a project stays runnable per provider. - * Names without a matching config block are skipped: "provider not - * configured" is the engine's error to raise, not a credential problem. + * zod config error with a clean message plus a provider-specific hint. Validates + * every declared provider, so a project is only runnable once all its providers' + * keys are available; offline commands skip the check entirely. */ -export function assertProviderCredentials( - providers: Record<string, unknown>, - required?: readonly string[], -): void { - for (const name of required ?? Object.keys(providers)) { - const raw = providers[name]; +export function assertProviderCredentials(providers: Record<string, unknown>): void { + for (const [name, raw] of Object.entries(providers)) { if (!raw || typeof raw !== "object") continue; const block = raw as Record<string, unknown>; if (!("api_key" in block)) continue; diff --git a/packages/commands/src/commands/managed-agent/apply.ts b/packages/commands/src/commands/managed-agent/apply.ts index 985a2014..a00a166a 100644 --- a/packages/commands/src/commands/managed-agent/apply.ts +++ b/packages/commands/src/commands/managed-agent/apply.ts @@ -46,8 +46,6 @@ const APPLY_FLAGS = { export default defineCommand({ description: "Apply planned changes to create/update/delete agent resources", auth: "apiKey", - // Provider-aware gate: only the providers this apply targets need credentials. - authOptional: true, usageArgs: "[--file <path>] [--provider <name>] [--yes] [--concurrency <n>]", flags: APPLY_FLAGS, exampleArgs: ["--yes", "--provider bailian --yes"], @@ -75,9 +73,7 @@ export default defineCommand({ const planned = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file, { - credentials: flags.provider ?? "targets", - }); + const runtime = await buildAgentRuntime(ctx, file); assertProviderConfigured(runtime, flags.provider); return planProjectContext(runtime, { provider: flags.provider, diff --git a/packages/commands/src/commands/managed-agent/destroy.ts b/packages/commands/src/commands/managed-agent/destroy.ts index c784af0d..17320673 100644 --- a/packages/commands/src/commands/managed-agent/destroy.ts +++ b/packages/commands/src/commands/managed-agent/destroy.ts @@ -31,8 +31,6 @@ const DESTROY_FLAGS = { export default defineCommand({ description: "Destroy all managed agent resources tracked in state", auth: "apiKey", - // Provider-aware gate: only the run's target providers need credentials. - authOptional: true, usageArgs: "[--file <path>] [--yes] [--cascade]", flags: DESTROY_FLAGS, exampleArgs: ["--yes", "--yes --cascade"], @@ -56,9 +54,7 @@ export default defineCommand({ const planned = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file, { - credentials: "targets", - }); + const runtime = await buildAgentRuntime(ctx, file); return planDestroyProjectContext(runtime); }), ); diff --git a/packages/commands/src/commands/managed-agent/plan.ts b/packages/commands/src/commands/managed-agent/plan.ts index 237b4c39..0dcd0e1c 100644 --- a/packages/commands/src/commands/managed-agent/plan.ts +++ b/packages/commands/src/commands/managed-agent/plan.ts @@ -41,16 +41,12 @@ const PLAN_FLAGS = { export default defineCommand({ description: "Show what changes would be applied to agent infrastructure", auth: "apiKey", - // Provider-aware gate: --no-refresh / --dry-run plan fully offline; a - // refreshing run only needs credentials for the providers it targets - // (see CredentialScope). - authOptional: true, usageArgs: "[--file <path>] [--provider <name>] [--no-refresh] [--refresh-only]", flags: PLAN_FLAGS, exampleArgs: ["", "--provider bailian", "--no-refresh"], notes: [ ...CREDENTIALS_NOTE, - "--no-refresh and --dry-run plan offline from local config and state: no credentials, no remote requests, no state writes.", + "--no-refresh and --dry-run plan offline from local config and state: no remote requests, no state writes, provider keys are not checked.", ], async run(ctx) { const { settings, flags } = ctx; @@ -58,12 +54,14 @@ export default defineCommand({ const file = flags.file ?? "agents.yaml"; // Offline mode never talks to a provider and never saves refreshed state: // --no-refresh by explicit request, --dry-run by contract (read-only run). + // Provider keys are skipped then; the bl login gate (auth: "apiKey") still + // applies except under --dry-run (authStage's dry-run exemption). const offline = Boolean(flags.noRefresh) || settings.dryRun; const planned = await withAgentErrors(() => withStdoutProtected(async () => { const runtime = await buildAgentRuntime(ctx, file, { - credentials: offline ? "none" : (flags.provider ?? "targets"), + credentials: offline ? "none" : "all", }); assertProviderConfigured(runtime, flags.provider); return planProjectContext(runtime, { diff --git a/packages/commands/src/commands/managed-agent/session-create.ts b/packages/commands/src/commands/managed-agent/session-create.ts index 90a5c062..1485ab54 100644 --- a/packages/commands/src/commands/managed-agent/session-create.ts +++ b/packages/commands/src/commands/managed-agent/session-create.ts @@ -43,8 +43,6 @@ const SESSION_CREATE_FLAGS = { export default defineCommand({ description: "Create a new session for an agent", auth: "apiKey", - // Provider-aware gate: only the session's provider needs credentials. - authOptional: true, usageArgs: "[--agent <name>] [--environment <name>] [--title <title>] [--file <path>]", flags: SESSION_CREATE_FLAGS, exampleArgs: ["", "--agent assistant", "--agent assistant --title 'debug run'"], @@ -74,9 +72,7 @@ export default defineCommand({ const run = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file, { - credentials: flags.provider ?? "targets", - }); + const runtime = await buildAgentRuntime(ctx, file); return createSessionForAgent(runtime, { agent: flags.agent, provider: flags.provider, diff --git a/packages/commands/src/commands/managed-agent/session-delete.ts b/packages/commands/src/commands/managed-agent/session-delete.ts index 9785bc55..5d463dba 100644 --- a/packages/commands/src/commands/managed-agent/session-delete.ts +++ b/packages/commands/src/commands/managed-agent/session-delete.ts @@ -27,8 +27,6 @@ const SESSION_DELETE_FLAGS = { export default defineCommand({ description: "Delete a session", auth: "apiKey", - // Provider-aware gate: only the session's provider needs credentials. - authOptional: true, usageArgs: "--session-id <id> [--provider <name>] [--file <path>]", flags: SESSION_DELETE_FLAGS, exampleArgs: ["--session-id sess_abc123"], @@ -52,9 +50,7 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file, { - credentials: flags.provider ?? "targets", - }); + const runtime = await buildAgentRuntime(ctx, file); await deleteSession(runtime, flags.sessionId, flags.provider); }), ); diff --git a/packages/commands/src/commands/managed-agent/session-events.ts b/packages/commands/src/commands/managed-agent/session-events.ts index 2de0d390..0cdcf332 100644 --- a/packages/commands/src/commands/managed-agent/session-events.ts +++ b/packages/commands/src/commands/managed-agent/session-events.ts @@ -38,8 +38,6 @@ const SESSION_EVENTS_FLAGS = { export default defineCommand({ description: "List event history for a session", auth: "apiKey", - // Provider-aware gate: only the session's provider needs credentials. - authOptional: true, usageArgs: "--session-id <id> [--limit <n>] [--all] [--file <path>]", flags: SESSION_EVENTS_FLAGS, exampleArgs: ["--session-id sess_abc123", "--session-id sess_abc123 --all"], @@ -51,9 +49,7 @@ export default defineCommand({ const { items: events, hasMore } = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file, { - credentials: flags.provider ?? "targets", - }); + const runtime = await buildAgentRuntime(ctx, file); return fetchAllPages(async (page) => { const result = await listSessionEvents(runtime, flags.sessionId, { provider: flags.provider, diff --git a/packages/commands/src/commands/managed-agent/session-get.ts b/packages/commands/src/commands/managed-agent/session-get.ts index 628dfe07..522daadd 100644 --- a/packages/commands/src/commands/managed-agent/session-get.ts +++ b/packages/commands/src/commands/managed-agent/session-get.ts @@ -27,8 +27,6 @@ const SESSION_GET_FLAGS = { export default defineCommand({ description: "Get details of a session", auth: "apiKey", - // Provider-aware gate: only the session's provider needs credentials. - authOptional: true, usageArgs: "--session-id <id> [--provider <name>] [--file <path>]", flags: SESSION_GET_FLAGS, exampleArgs: ["--session-id sess_abc123"], @@ -40,9 +38,7 @@ export default defineCommand({ const session = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file, { - credentials: flags.provider ?? "targets", - }); + const runtime = await buildAgentRuntime(ctx, file); return getSession(runtime, flags.sessionId, flags.provider); }), ); diff --git a/packages/commands/src/commands/managed-agent/session-list.ts b/packages/commands/src/commands/managed-agent/session-list.ts index b5a23bbd..2694e204 100644 --- a/packages/commands/src/commands/managed-agent/session-list.ts +++ b/packages/commands/src/commands/managed-agent/session-list.ts @@ -31,8 +31,6 @@ const SESSION_LIST_FLAGS = { export default defineCommand({ description: "List sessions from the provider", auth: "apiKey", - // Provider-aware gate: only the session's provider needs credentials. - authOptional: true, usageArgs: "[--agent <name>] [--all] [--provider <name>] [--file <path>]", flags: SESSION_LIST_FLAGS, exampleArgs: ["", "--agent assistant", "--all"], @@ -44,9 +42,7 @@ export default defineCommand({ const { items: summaries, hasMore } = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file, { - credentials: flags.provider ?? "targets", - }); + const runtime = await buildAgentRuntime(ctx, file); return fetchAllPages(async (page) => { const result = await listSessionSummaries(runtime, { agent: flags.agent, diff --git a/packages/commands/src/commands/managed-agent/session-run.ts b/packages/commands/src/commands/managed-agent/session-run.ts index 2a6637c8..ebae0040 100644 --- a/packages/commands/src/commands/managed-agent/session-run.ts +++ b/packages/commands/src/commands/managed-agent/session-run.ts @@ -57,8 +57,6 @@ const SESSION_RUN_FLAGS = { export default defineCommand({ description: "Create a session, send a message, and stream the response", auth: "apiKey", - // Provider-aware gate: only the session's provider needs credentials. - authOptional: true, usageArgs: "--prompt <text> [--agent <name>] [--no-stream] [--file <path>]", flags: SESSION_RUN_FLAGS, exampleArgs: ['--prompt "hello"', '--agent assistant --prompt "summarize this repo"'], @@ -103,9 +101,7 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file, { - credentials: flags.provider ?? "targets", - }); + const runtime = await buildAgentRuntime(ctx, file); if (flags.noStream) { const run = await startSessionRunPolling(runtime, flags.prompt, runOptions); if (!asJson) process.stderr.write(`Session created: ${run.session.id}\n`); diff --git a/packages/commands/src/commands/managed-agent/session-send.ts b/packages/commands/src/commands/managed-agent/session-send.ts index 96df4b6d..22f9dc04 100644 --- a/packages/commands/src/commands/managed-agent/session-send.ts +++ b/packages/commands/src/commands/managed-agent/session-send.ts @@ -38,8 +38,6 @@ const SESSION_SEND_FLAGS = { export default defineCommand({ description: "Send a message to an existing session and stream the response", auth: "apiKey", - // Provider-aware gate: only the session's provider needs credentials. - authOptional: true, usageArgs: "--session-id <id> --message <text> [--no-stream] [--file <path>]", flags: SESSION_SEND_FLAGS, exampleArgs: ['--session-id sess_abc123 --message "continue"'], @@ -68,9 +66,7 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file, { - credentials: flags.provider ?? "targets", - }); + const runtime = await buildAgentRuntime(ctx, file); if (flags.noStream) { const result = await sendSessionMessagePolling(runtime, flags.sessionId, flags.message, { provider: flags.provider, diff --git a/packages/commands/src/commands/managed-agent/skill-list.ts b/packages/commands/src/commands/managed-agent/skill-list.ts index 3d35f134..f5cf185c 100644 --- a/packages/commands/src/commands/managed-agent/skill-list.ts +++ b/packages/commands/src/commands/managed-agent/skill-list.ts @@ -30,8 +30,6 @@ const SKILL_LIST_FLAGS = { export default defineCommand({ description: "List skills from the provider's skill catalog", auth: "apiKey", - // Provider-aware gate: only the resolved catalog provider needs credentials. - authOptional: true, usageArgs: "[--source custom|official|all] [--provider <name>] [--file <path>]", flags: SKILL_LIST_FLAGS, exampleArgs: [ @@ -58,9 +56,7 @@ export default defineCommand({ const skills = await withAgentErrors(() => withStdoutProtected(async () => { - const runtime = await buildAgentRuntime(ctx, file, { - credentials: flags.provider ?? "targets", - }); + const runtime = await buildAgentRuntime(ctx, file); if (source !== "all") { return listSkills(runtime, { provider: flags.provider, source }); } diff --git a/packages/commands/src/commands/managed-agent/state-import.ts b/packages/commands/src/commands/managed-agent/state-import.ts index e171482a..7d4565e5 100644 --- a/packages/commands/src/commands/managed-agent/state-import.ts +++ b/packages/commands/src/commands/managed-agent/state-import.ts @@ -33,8 +33,6 @@ const STATE_IMPORT_FLAGS = { export default defineCommand({ description: "Import an existing remote resource into agents state", auth: "apiKey", - // Provider-aware gate: only the address's provider needs credentials. - authOptional: true, usageArgs: "--address <provider.type.name> --remote-id <id> [--resource-version <n>] [--file <path>]", flags: STATE_IMPORT_FLAGS, @@ -64,13 +62,11 @@ export default defineCommand({ await withAgentErrors(() => withStdoutProtected(async () => { - // Parse first: the address names the one provider this import touches. + // Parse first so a malformed address fails fast, before any config I/O. const parsed = parseStateAddress(flags.address, { requireProvider: true, }); - const runtime = await buildAgentRuntime(ctx, file, { - credentials: parsed.provider ?? "targets", - }); + const runtime = await buildAgentRuntime(ctx, file); await importResource(runtime, parsed, flags.remoteId, { resourceVersion: flags.resourceVersion, }); diff --git a/packages/commands/tests/credentials-bridge.test.ts b/packages/commands/tests/credentials-bridge.test.ts index 60c9dda9..3a1fb982 100644 --- a/packages/commands/tests/credentials-bridge.test.ts +++ b/packages/commands/tests/credentials-bridge.test.ts @@ -13,15 +13,14 @@ import { type CredentialHost, injectProviderCredentials, prepareProviderEnv, - resolveTargetProviderNames, scrubCredentialEnv, } from "../src/commands/managed-agent/_engine/credentials.ts"; /** * 凭证内存注入管道:injectProviderCredentials 把 authStage 解析进 Client 的凭证 * 权威覆写 bailian 配置块(不落 env),scrubCredentialEnv 清空所有凭证 env, - * assertProviderCredentials 按本次运行涉及的 provider 范围对空 key 给 CLI 权威 - * AUTH 错误。用快照隔离凭证 env。 + * assertProviderCredentials 对任一已声明 provider 的空 key 给 CLI 权威 AUTH + * 错误(离线命令跳过断言)。用快照隔离凭证 env。 */ const TRACKED_ENV = [ "DASHSCOPE_API_KEY", @@ -192,33 +191,6 @@ test("assert:bailian key 为空(dry-run/未登录)抛 AUTH 且 hint 指向 bl au expect(err.hint).toContain("bl auth login"); }); -test("assert:required 限定范围后,范围外 provider 的空 key 不拦截", () => { - const providers = { - bailian: { api_key: "" }, - claude: { api_key: "sk-ant" }, - }; - // 本次只涉及 claude(如 --provider claude):bailian 未登录不应阻塞 - expect(() => assertProviderCredentials(providers, ["claude"])).not.toThrow(); - // 反向:范围内的空 key 仍拦截 - expect(() => assertProviderCredentials(providers, ["bailian"])).toThrow(); -}); - -test("assert:required 里未配置的 provider 名被跳过(由引擎报未配置错误)", () => { - expect(() => assertProviderCredentials({ bailian: { api_key: "" } }, ["qoder"])).not.toThrow(); -}); - -test("targets:默认 provider 链镜像 SDK —— default 为单个时只涉及它,缺失/all 时为全部", () => { - const providers = { bailian: {}, claude: {} }; - expect(resolveTargetProviderNames({ providers, defaults: { provider: "claude" } })).toEqual([ - "claude", - ]); - expect(resolveTargetProviderNames({ providers })).toEqual(["bailian", "claude"]); - expect(resolveTargetProviderNames({ providers, defaults: { provider: "all" } })).toEqual([ - "bailian", - "claude", - ]); -}); - test("scrub:所有凭证 env 变量被删除", () => { process.env.DASHSCOPE_API_KEY = "x"; process.env.ANTHROPIC_API_KEY = "y"; diff --git a/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts b/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts index c9d3b39e..fce243ca 100644 --- a/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts +++ b/packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts @@ -9,8 +9,8 @@ import { MANAGED_AGENT_ROUTES } from "./topic-routes.ts"; /** * managed-agent 凭证链 e2e：验证 bl 自有配置体系（config 写入 / 命名 Profile / * logout）与错误映射如何流入 SDK 引擎。全部离线：凭证门禁用 `managed-agent plan` - * 验证（provider-aware：空 state 不发网络请求，但仍按目标 provider 校验凭证）； - * `validate` / `state list` / `plan --no-refresh` 属离线命令，无凭证也必须可用。 + * 验证（空 state 不发网络请求，但 auth: "apiKey" 硬门禁 + 引擎全量 provider key + * 断言照常生效）；`validate` / `state list` 属离线命令，无凭证也必须可用。 * 配置一律通过 BAILIAN_CONFIG_DIR 指向临时目录，绝不触碰真实用户配置。 */ @@ -47,7 +47,7 @@ function validateArgs(file: string): string[] { return ["managed-agent", "validate", "--file", file, "--quiet"]; } -/** plan 是凭证门禁命令：空 state 下不发网络，但仍按目标 provider 校验凭证。 */ +/** plan 是凭证门禁命令：空 state 下不发网络，但 authStage + 引擎断言照常生效。 */ function planArgs(file: string): string[] { return ["managed-agent", "plan", "--file", file, "--quiet"]; } @@ -184,7 +184,7 @@ describe("e2e: managed-agent 凭证链（config 写入 / Profile / logout / 错 }); }); -describe("e2e: managed-agent 鉴权分层（离线命令免登录 / provider-aware 按需校验）", () => { +describe("e2e: managed-agent 鉴权分层（离线命令免登录 / 联网命令统一 apiKey 门禁）", () => { test("validate 无任何凭证也离线通过 (0)", async () => { const env = makeConfigEnv({}); const { stderr, exitCode } = await runCommandE2e(ROUTES, validateArgs(AGENTS_YAML), env); @@ -203,17 +203,33 @@ describe("e2e: managed-agent 鉴权分层（离线命令免登录 / provider-awa expect(Array.isArray(data.resources)).toBe(true); }); - test("plan --no-refresh 无任何凭证也离线通过 (0)", async () => { + test("plan --no-refresh 无登录时仍被 apiKey 硬门禁拦住 (3)", async () => { const env = makeConfigEnv({}); const { stderr, exitCode } = await runCommandE2e( ROUTES, [...planArgs(AGENTS_YAML), "--no-refresh"], env, ); + expect(exitCode).toBe(3); + expect(stderr).toMatch(/auth login|API key/i); + }); + + test("已登录 bailian 时，多 provider 配置下 plan --no-refresh 离线通过，不查其他 provider key (0)", async () => { + const env = { + ...makeConfigEnv({ api_key: "sk-e2e-no-refresh" }), + ...isolatedAgentsConfigEnv(), + ANTHROPIC_API_KEY: "", + CLAUDE_API_KEY: "", + }; + const { stderr, exitCode } = await runCommandE2e( + ROUTES, + [...planArgs(AGENTS_YAML_MULTI), "--no-refresh"], + env, + ); expect(exitCode, stderr).toBe(0); }); - test("多 provider 下 plan --provider claude 只需 claude 凭证，bailian 未登录不阻塞 (0)", async () => { + test("统一登录门禁：只配 claude key 未登录 bailian 时，plan --provider claude 仍报 AUTH (3)", async () => { const env = { ...makeConfigEnv({}), ...isolatedAgentsConfigEnv(), @@ -225,10 +241,11 @@ describe("e2e: managed-agent 鉴权分层（离线命令免登录 / provider-awa [...planArgs(AGENTS_YAML_MULTI), "--provider", "claude"], env, ); - expect(exitCode, stderr).toBe(0); + expect(exitCode).toBe(3); + expect(stderr).toMatch(/auth login|API key/i); }); - test("plan --provider claude 缺 claude key 时报 AUTH (3)，hint 指向 ANTHROPIC_API_KEY", async () => { + test("已登录但缺 claude key 时，全量断言拦住并给 ANTHROPIC_API_KEY hint (3)", async () => { const env = { ...makeConfigEnv({ api_key: "sk-e2e-bailian-present" }), ...isolatedAgentsConfigEnv(), diff --git a/packages/commands/tests/e2e/managed-agent.e2e.test.ts b/packages/commands/tests/e2e/managed-agent.e2e.test.ts index 827a8cce..ede46b72 100644 --- a/packages/commands/tests/e2e/managed-agent.e2e.test.ts +++ b/packages/commands/tests/e2e/managed-agent.e2e.test.ts @@ -6,7 +6,7 @@ import { MANAGED_AGENT_ROUTES } from "./topic-routes.ts"; * managed-agent：help / 缺参不依赖密钥；所有 mutation 命令的 --dry-run * 必须在构建 SDK runtime（凭证注入 / 联网 / 写盘）之前短路，因此同样不需要密钥。 * 鉴权分层：离线命令（init/validate/state list|show|rm）auth: "none"；联网命令 - * provider-aware，只校验本次涉及的 provider（见 managed-agent-auth-chain e2e）。 + * 统一 auth: "apiKey" 硬门禁（见 managed-agent-auth-chain e2e）。 * 真实集成（apply/destroy/session 流程）依赖工作区内的 agents.yaml 与远端资源， * 属批量场景，暂仅覆盖 dry-run 契约。 */ @@ -69,17 +69,21 @@ describe("e2e: managed-agent", () => { }); test("managed-agent skill-list --source all 通过参数校验（缺配置文件时才失败）", async () => { - // provider-aware 鉴权不再前置硬门禁：无需注入假 key，命令在配置加载阶段 - // 因文件缺失短路，不产生任何网络请求。 - const { stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [ - "managed-agent", - "skill-list", - "--source", - "all", - "--file", - "agents.e2e-missing.yaml", - "--quiet", - ]); + // auth: "apiKey" 的凭证解析先于 run() 执行；注入假 key 让用例不依赖环境凭证， + // 命令仍会在配置加载阶段因文件缺失短路，不产生任何网络请求。 + const { stderr, exitCode } = await runCommandE2e( + MANAGED_AGENT_ROUTES, + [ + "managed-agent", + "skill-list", + "--source", + "all", + "--file", + "agents.e2e-missing.yaml", + "--quiet", + ], + { DASHSCOPE_API_KEY: "sk-e2e-skill-list" }, + ); // all 是合法值：不应报 --source 用法错误，而是走到配置加载后因文件缺失退出 expect(exitCode).toBe(2); expect(stderr).not.toMatch(/--source must be one of/i); diff --git a/packages/core/src/types/command.ts b/packages/core/src/types/command.ts index 59f5e330..4bd14bee 100644 --- a/packages/core/src/types/command.ts +++ b/packages/core/src/types/command.ts @@ -207,14 +207,6 @@ export interface Command<F extends FlagsDef = FlagsDef> { description: string; /** Credential this command requires. See {@link AuthRequirement}. */ auth: AuthRequirement; - /** - * Soften the auth gate: authStage still resolves the `auth` domain's - * credential into `ctx.client` when available, but a missing credential no - * longer fails before `run`. For commands that enforce their own scoped - * credential requirements (e.g. managed-agent commands, where a run may only - * involve third-party providers and must not be blocked on a Bailian key). - */ - authOptional?: boolean; /** Usage line arg portion, e.g. "--prompt <text> [flags]". Manually written. */ usageArgs?: string; /** Example arg strings (without the `<bin> <path>` prefix). */ diff --git a/packages/runtime/src/middleware.ts b/packages/runtime/src/middleware.ts index 44afff49..b9daf718 100644 --- a/packages/runtime/src/middleware.ts +++ b/packages/runtime/src/middleware.ts @@ -75,8 +75,6 @@ export function compose(stack: Middleware[]): (ctx: RunContext) => Promise<void> * Bake the credential for the command's declared `auth` into `ctx.client`, and * gate: no credential → throw before the command runs. dry-run 例外:凭证解析失败 * 不抛(dry-run 只打印请求,无需凭证;console 的 dry-run 展示读 settings.console*)。 - * `authOptional` 例外:凭证可用则注入,缺失不在此处抛 —— 命令自行按实际涉及范围 - * 校验(如 managed-agent 只校验本次运行涉及的 provider)。 * `auth: "none"` commands keep a credential-less client. */ export const authStage: Middleware = async (ctx, next) => { @@ -86,13 +84,12 @@ export const authStage: Middleware = async (ctx, next) => { settings, baseUrl: resolveModelBaseUrl(sources), }; - const tolerateMissing = settings.dryRun || command.authOptional === true; if (command.auth === "apiKey") { let cred: ApiKeyCredential | undefined; try { cred = resolveApiKey(sources); } catch (err) { - if (!tolerateMissing) throw err; + if (!settings.dryRun) throw err; } ctx.client = new Client({ ...base, apiCred: cred }); if (cred) maybeShowStatusBar(settings, cred.token, cred); @@ -101,7 +98,7 @@ export const authStage: Middleware = async (ctx, next) => { try { cred = resolveConsole(sources); } catch (err) { - if (!tolerateMissing) throw err; + if (!settings.dryRun) throw err; } if (cred) ctx.client = new Client({ ...base, consoleCred: cred }); } else if (command.auth === "openapi") { @@ -109,7 +106,7 @@ export const authStage: Middleware = async (ctx, next) => { try { cred = resolveOpenApi(sources); } catch (err) { - if (!tolerateMissing) throw err; + if (!settings.dryRun) throw err; } ctx.client = new Client({ ...base, openApiCred: cred }); } diff --git a/skills/bailian-cli/reference/managed-agent.md b/skills/bailian-cli/reference/managed-agent.md index 37244770..db5e29e6 100644 --- a/skills/bailian-cli/reference/managed-agent.md +++ b/skills/bailian-cli/reference/managed-agent.md @@ -53,7 +53,6 @@ Index: [index.md](index.md) - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -88,7 +87,6 @@ bl managed-agent apply --provider bailian --yes - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -155,9 +153,8 @@ bl managed-agent init --provider all - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. -- --no-refresh and --dry-run plan offline from local config and state: no credentials, no remote requests, no state writes. +- --no-refresh and --dry-run plan offline from local config and state: no remote requests, no state writes, provider keys are not checked. #### Examples @@ -199,7 +196,6 @@ bl managed-agent plan --no-refresh - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -238,7 +234,6 @@ bl managed-agent session create --agent assistant --title 'debug run' - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -271,7 +266,6 @@ bl managed-agent session delete --session-id sess_abc123 - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -306,7 +300,6 @@ bl managed-agent session events --session-id sess_abc123 --all - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -338,7 +331,6 @@ bl managed-agent session get --session-id sess_abc123 - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -383,7 +375,6 @@ bl managed-agent session list --all - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. - --output json emits one envelope: { session_id, provider, agent, events } — read session_id to chain `session send/get/events/delete`. @@ -421,7 +412,6 @@ bl managed-agent session run --agent assistant --prompt "summarize this repo" - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples @@ -452,7 +442,6 @@ bl managed-agent session send --session-id sess_abc123 --message "continue" - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. - Providers without a skill listing API (e.g. ark) return an empty list. - For agent-driven skill selection, use `--source all --output json`: one call returns both catalogs with per-skill `source` and `description` fields to pick from. @@ -499,7 +488,6 @@ bl managed-agent skill-list --source custom --provider bailian - Bailian credentials come from bl's auth chain: --api-key > DASHSCOPE_API_KEY > `bl auth login` (active config profile). - Other providers read the env vars referenced in agents.yaml (e.g. ${ANTHROPIC_API_KEY}), including .env and ~/.agents/config.json. -- Only the providers this run involves (--provider, or the config's default provider chain) need credentials; other configured providers are not checked. - Resolved credentials are injected into the SDK in-memory and cleared from the environment; they never persist in process env. #### Examples From 2dce9fe093ab11e074b30e46bbe73b47ac3376a5 Mon Sep 17 00:00:00 2001 From: chenanran555 <car534511@alibaba-inc.com> Date: Mon, 27 Jul 2026 21:52:52 +0800 Subject: [PATCH 21/21] feat(agent): session and destroy failed error --- .../managed-agent/_engine/session-render.ts | 26 +++++- .../src/commands/managed-agent/destroy.ts | 12 ++- .../commands/tests/destroy-result.test.ts | 92 +++++++++++++++++++ .../commands/tests/session-render.test.ts | 67 ++++++++++++++ 4 files changed, 192 insertions(+), 5 deletions(-) create mode 100644 packages/commands/tests/destroy-result.test.ts diff --git a/packages/commands/src/commands/managed-agent/_engine/session-render.ts b/packages/commands/src/commands/managed-agent/_engine/session-render.ts index f1cb7ac2..0f3f6192 100644 --- a/packages/commands/src/commands/managed-agent/_engine/session-render.ts +++ b/packages/commands/src/commands/managed-agent/_engine/session-render.ts @@ -4,6 +4,7 @@ import { type ProviderSessionEvent, } from "@openagentpack/sdk"; import { sanitizeSessionEvents } from "@openagentpack/sdk/session-events"; +import { BailianError, ExitCode } from "bailian-cli-core"; /** Skip user echo + thinking noise in live rendering (mirrors OpenAgentPack CLI). */ function shouldRenderLiveEvent(event: ProviderSessionEvent): boolean { @@ -15,6 +16,19 @@ function renderTerminalStatus(status: string, json: boolean): void { process.stderr.write(`\n[session ${status}]\n`); } +function findLastSessionError(events: readonly ProviderSessionEvent[]): string | undefined { + for (let index = events.length - 1; index >= 0; index--) { + const event = events[index]; + if (event?.type === "error" && event.content?.trim()) return event.content; + } + return undefined; +} + +function throwIfSessionFailed(status: string | undefined, message?: string): void { + if (status !== "failed") return; + throw new BailianError(message ?? "Session failed.", ExitCode.GENERAL); +} + /** * Session identity echoed at the head of the `--output json` envelope so * callers can read the (possibly just-created) session id from stdout and @@ -40,10 +54,14 @@ export async function streamAndRenderEvents( context: SessionRenderContext = {}, ): Promise<void> { const collected: ProviderSessionEvent[] = []; + let terminalStatus: string | undefined; + let errorMessage: string | undefined; for await (const event of events) { if (json) collected.push(event); else renderEvent(event); + if (event.type === "error" && event.content?.trim()) errorMessage = event.content; if (event.type === "status" && isTerminalSessionStatus(event.status)) { + terminalStatus = event.status; renderTerminalStatus(event.status ?? "", json); break; } @@ -53,6 +71,7 @@ export async function streamAndRenderEvents( `${JSON.stringify({ ...context, events: sanitizeSessionEvents(collected) }, null, 2)}\n`, ); } + throwIfSessionFailed(terminalStatus, errorMessage); } /** Assistant text → stdout (data channel); everything else → stderr (diagnostics). */ @@ -92,10 +111,11 @@ export function renderCollectedEvents( 2, )}\n`, ); - return; + } else { + for (const event of result.result.events) renderEvent(event); + renderTerminalStatus(result.terminalStatus, json); } - for (const event of result.result.events) renderEvent(event); - renderTerminalStatus(result.terminalStatus, json); + throwIfSessionFailed(result.terminalStatus, findLastSessionError(result.result.events)); } /** Split a comma-separated --memory-stores value. */ diff --git a/packages/commands/src/commands/managed-agent/destroy.ts b/packages/commands/src/commands/managed-agent/destroy.ts index 17320673..4c43f8ea 100644 --- a/packages/commands/src/commands/managed-agent/destroy.ts +++ b/packages/commands/src/commands/managed-agent/destroy.ts @@ -98,8 +98,16 @@ export default defineCommand({ if (format === "json") { emitResult({ destroyed: result.destroyed, total: result.resources.length }, format); } else { - emitBare( - `\nDestroy complete. ${result.destroyed}/${result.resources.length} resources removed.`, + const status = result.partial ? "Destroy incomplete" : "Destroy complete"; + emitBare(`\n${status}. ${result.destroyed}/${result.resources.length} resources removed.`); + } + + if (result.partial) { + const firstFailure = result.results.find((item) => item.status !== "success"); + throw new BailianError( + firstFailure?.error || + `Destroy incomplete: ${result.destroyed}/${result.resources.length} resources removed.`, + ExitCode.GENERAL, ); } }, diff --git a/packages/commands/tests/destroy-result.test.ts b/packages/commands/tests/destroy-result.test.ts new file mode 100644 index 00000000..8a37e4ba --- /dev/null +++ b/packages/commands/tests/destroy-result.test.ts @@ -0,0 +1,92 @@ +import { BailianError, ExitCode } from "bailian-cli-core"; +import { afterEach, beforeEach, expect, test, vi } from "vite-plus/test"; + +const sdkMocks = vi.hoisted(() => ({ + destroyPlannedProjectResources: vi.fn(), + planDestroyProjectContext: vi.fn(), +})); + +const configLoaderMocks = vi.hoisted(() => ({ + buildAgentRuntime: vi.fn(), +})); + +vi.mock("@openagentpack/sdk", async (importOriginal) => { + const actual = await importOriginal<typeof import("@openagentpack/sdk")>(); + return { ...actual, ...sdkMocks }; +}); + +vi.mock("../src/commands/managed-agent/_engine/config-loader.ts", async (importOriginal) => { + const actual = + await importOriginal<typeof import("../src/commands/managed-agent/_engine/config-loader.ts")>(); + return { ...actual, ...configLoaderMocks }; +}); + +import destroyCommand from "../src/commands/managed-agent/destroy.ts"; + +const resources = [ + { + address: { provider: "bailian", type: "agent", name: "assistant" }, + remote_id: "agent-ok", + }, + { + address: { provider: "bailian", type: "environment", name: "dev" }, + remote_id: "env-failed", + }, +]; + +let stdoutChunks: string[] = []; +let originalStdoutWrite: typeof process.stdout.write; +let originalStderrWrite: typeof process.stderr.write; + +beforeEach(() => { + stdoutChunks = []; + originalStdoutWrite = process.stdout.write.bind(process.stdout); + originalStderrWrite = process.stderr.write.bind(process.stderr); + process.stdout.write = ((chunk: string | Uint8Array) => { + stdoutChunks.push(String(chunk)); + return true; + }) as typeof process.stdout.write; + process.stderr.write = (() => true) as typeof process.stderr.write; + + const planned = { resources, executionContext: {} }; + configLoaderMocks.buildAgentRuntime.mockResolvedValue({}); + sdkMocks.planDestroyProjectContext.mockReturnValue(planned); + sdkMocks.destroyPlannedProjectResources.mockResolvedValue({ + ...planned, + results: [ + { resource: resources[0], status: "success", reason: "destroyed" }, + { + resource: resources[1], + status: "failed", + reason: "failed", + error: "provider refused deletion", + }, + ], + destroyed: 1, + partial: true, + }); +}); + +afterEach(() => { + process.stdout.write = originalStdoutWrite; + process.stderr.write = originalStderrWrite; + vi.clearAllMocks(); +}); + +test("destroy 部分失败时输出汇总并以首个原始错误抛 GENERAL", async () => { + let thrown: unknown; + try { + await destroyCommand.run({ + settings: { output: "json", dryRun: false }, + flags: { yes: true }, + } as never); + } catch (error) { + thrown = error; + } + + expect(thrown).toBeInstanceOf(BailianError); + const mapped = thrown as BailianError; + expect(mapped.exitCode).toBe(ExitCode.GENERAL); + expect(mapped.message).toBe("provider refused deletion"); + expect(JSON.parse(stdoutChunks.join(""))).toEqual({ destroyed: 1, total: 2 }); +}); diff --git a/packages/commands/tests/session-render.test.ts b/packages/commands/tests/session-render.test.ts index 01f7a73c..5b414494 100644 --- a/packages/commands/tests/session-render.test.ts +++ b/packages/commands/tests/session-render.test.ts @@ -1,5 +1,6 @@ import { afterEach, beforeEach, expect, test } from "vite-plus/test"; import type { CollectedSessionEvents, ProviderSessionEvent } from "@openagentpack/sdk"; +import { BailianError, ExitCode } from "bailian-cli-core"; import { renderCollectedEvents, streamAndRenderEvents, @@ -41,6 +42,14 @@ async function* fakeEventStream(): AsyncIterable<ProviderSessionEvent> { yield { type: "status", status: "completed" } as ProviderSessionEvent; } +async function* fakeFailedEventStream(): AsyncIterable<ProviderSessionEvent> { + yield { + type: "error", + content: "provider quota exceeded", + } as ProviderSessionEvent; + yield { type: "status", status: "failed" } as ProviderSessionEvent; +} + function fakeCollected(): CollectedSessionEvents { return { terminalStatus: "completed", @@ -58,6 +67,32 @@ function fakeCollected(): CollectedSessionEvents { } as CollectedSessionEvents; } +function fakeFailedCollected(): CollectedSessionEvents { + return { + terminalStatus: "failed", + result: { + events: [ + { + type: "error", + content: "provider quota exceeded", + } as ProviderSessionEvent, + ], + has_more: false, + next_page: undefined, + }, + } as CollectedSessionEvents; +} + +async function catchSessionFailure(run: () => Promise<void> | void): Promise<BailianError> { + try { + await run(); + } catch (error) { + expect(error).toBeInstanceOf(BailianError); + return error as BailianError; + } + throw new Error("expected failed session to throw"); +} + test("stream json:信封携带 session_id/provider/agent + events", async () => { await streamAndRenderEvents(fakeEventStream(), true, { session_id: "sess_stream", @@ -72,6 +107,22 @@ test("stream json:信封携带 session_id/provider/agent + events", async () => expect((data.events as unknown[]).length).toBe(2); }); +test("streaming failed:保留 JSON 信封并以服务端 error 消息抛 GENERAL", async () => { + const error = await catchSessionFailure(() => + streamAndRenderEvents(fakeFailedEventStream(), true, { + session_id: "sess_failed_stream", + provider: "bailian", + agent: "assistant", + }), + ); + expect(error.exitCode).toBe(ExitCode.GENERAL); + expect(error.message).toBe("provider quota exceeded"); + + const data = capturedJson(); + expect(data.session_id).toBe("sess_failed_stream"); + expect((data.events as unknown[]).length).toBe(2); +}); + test("polling json:信封携带 session_id/provider/agent，并保留 has_more/next_page", () => { renderCollectedEvents(fakeCollected(), true, { session_id: "sess_poll", @@ -86,6 +137,22 @@ test("polling json:信封携带 session_id/provider/agent，并保留 has_more/n expect(Array.isArray(data.events)).toBe(true); }); +test("polling failed:保留 JSON 信封并以服务端 error 消息抛 GENERAL", async () => { + const error = await catchSessionFailure(() => + renderCollectedEvents(fakeFailedCollected(), true, { + session_id: "sess_failed_poll", + provider: "claude", + agent: "assistant", + }), + ); + expect(error.exitCode).toBe(ExitCode.GENERAL); + expect(error.message).toBe("provider quota exceeded"); + + const data = capturedJson(); + expect(data.session_id).toBe("sess_failed_poll"); + expect((data.events as unknown[]).length).toBe(1); +}); + test("json:不传 context 时信封形状不变(无 session_id 键)", () => { renderCollectedEvents(fakeCollected(), true); const data = capturedJson();