feat(managed-agent): add scoped agent create command

Add `bl managed-agent agent create` with automatic YAML key generation,
atomic config updates, preview-by-default behavior, and create-only scoped
apply that ignores unrelated resource drift.

Author: chenanran555

packages/cli/src/commands.ts

@@ -152,6 +152,7 @@ import {
   managedAgentSessionEvents,
   managedAgentSkillList,
   managedAgentCapabilities,
+  managedAgentAgentCreate,
   managedAgentAgentList,
   managedAgentAgentGet,
   managedAgentAgentSearch,
@@ -350,6 +351,7 @@ export const commands: Record<string, AnyCommand> = {
   "managed-agent session events": managedAgentSessionEvents,
   "managed-agent skill-list": managedAgentSkillList,
   "managed-agent capabilities": managedAgentCapabilities,
+  "managed-agent agent create": managedAgentAgentCreate,
   "managed-agent agent list": managedAgentAgentList,
   "managed-agent agent get": managedAgentAgentGet,
   "managed-agent agent search": managedAgentAgentSearch,

packages/commands/src/commands/managed-agent/_engine/credentials.ts

@@ -170,11 +170,16 @@ export function normalizeInterpolatedProviderBlocks(providers: Record<string, un
  * provider's `api_key` resolved empty (missing env var, or no bl login for
  * bailian). Replaces the SDK's raw `Environment variable '...' is not set` /
  * zod config error with a clean message plus a provider-specific hint. Validates
- * every declared provider, so a project is only runnable once all its providers'
- * keys are available; offline commands skip the check entirely.
+ * every declared provider by default. A scoped operation may pass its exact
+ * provider list so unrelated credentials cannot block it; offline commands skip
+ * the check entirely.
  */
-export function assertProviderCredentials(providers: Record<string, unknown>): void {
+export function assertProviderCredentials(
+  providers: Record<string, unknown>,
+  targetProviders?: readonly string[],
+): void {
   for (const [name, raw] of Object.entries(providers)) {
+    if (targetProviders && !targetProviders.includes(name)) continue;
     if (!raw || typeof raw !== "object") continue;
     const block = raw as Record<string, unknown>;
     if (!("api_key" in block)) continue;

packages/commands/src/commands/managed-agent/_engine/file-state-manager.ts

@@ -6,7 +6,7 @@ import {
   type StateScope,
 } from "@openagentpack/sdk";
 
-function createStateScope(configPath: string, projectName?: string): StateScope {
+export function createFileStateScope(configPath: string, projectName?: string): StateScope {
   const resolved = resolve(configPath);
   return { projectId: projectName ?? basename(dirname(resolved)) };
 }
@@ -19,6 +19,6 @@ export async function loadFileState(
 ): Promise<IStateManager> {
   const resolved = resolve(configPath);
   const backend = new LocalFileStateBackend({ configPath: resolved, statePath });
-  const path = backend.getStatePath(createStateScope(resolved, projectName));
+  const path = backend.getStatePath(createFileStateScope(resolved, projectName));
   return StateManager.load(path);
 }