fix(managed-agent): use CLI credentials for directory projects

Make project init fully offline, stop generating project-local credential files, bind Publish to the reviewed plan fingerprint, remove the unsafe Apply refresh-only mode, and document Agent-owned File mounts.

Author: chenanran555

packages/commands/src/commands/managed-agent/_engine/config-loader.ts

@@ -33,6 +33,7 @@ interface AgentConfigOptions {
   projectName?: string;
   statePath?: string;
   credentials?: CredentialScope;
+  overrideBailianBaseUrl?: boolean;
 }
 
 /**
@@ -56,7 +57,9 @@ export async function resolveAgentProjectConfig(
   prepareProviderEnv();
   const resolved = await resolveProjectConfig(filePath, options);
   normalizeInterpolatedProviderBlocks(resolved.config.providers);
-  injectProviderCredentials(resolved.config.providers, host);
+  injectProviderCredentials(resolved.config.providers, host, {
+    overrideBaseUrl: options.overrideBailianBaseUrl,
+  });
   scrubCredentialEnv();
   assertBailianOnlyProviders(resolved.config.providers);
   if ((options.credentials ?? "all") !== "none") {

packages/commands/src/commands/managed-agent/_engine/credentials.ts

@@ -99,9 +99,10 @@ export function prepareProviderEnv(): void {
  * Override the bailian provider block with bl's authStage-resolved credential, so
  * the bailian API key is authoritatively the CLI auth chain's — never a config
  * file bare-read or a stale env value. `api_key` is replaced unconditionally
- * when a credential resolved; `base_url` / `workspace_id` are filled only when
- * the block references them and the interpolated value is empty (a literal in
- * agents.yaml is respected).
+ * when a credential resolved. `base_url` is normally filled only when empty so
+ * a literal in agents.yaml remains supported; directory projects pass
+ * `overrideBaseUrl` so their connection always follows the Bailian CLI auth
+ * chain. `workspace_id` is filled only when empty.
  *
  * `base_url` carries {@link AGENTSTUDIO_API_PATH} because the SDK appends resource
  * paths onto it verbatim; a value already ending in the suffix is left as-is.
@@ -114,14 +115,15 @@ export function prepareProviderEnv(): void {
 export function injectProviderCredentials(
   providers: Record<string, unknown>,
   host: CredentialHost,
+  options: { overrideBaseUrl?: boolean } = {},
 ): void {
   const bailian = providers.bailian;
   if (!bailian || typeof bailian !== "object") return;
   const block = bailian as Record<string, unknown>;
 
   const cred = host.client.exportApiCredential();
   if (cred) block.api_key = cred.token;
-  if ("base_url" in block && !block.base_url) {
+  if ("base_url" in block && (options.overrideBaseUrl || !block.base_url)) {
     // Defensive normalization: the auth chain already normalizes base_url to
     // an origin, but never let a trailing slash produce "//api/v1/agentstudio".
     const origin = host.client.baseUrl.replace(/\/+$/, "");

packages/commands/src/commands/managed-agent/apply.ts

@@ -29,13 +29,6 @@ const APPLY_FLAGS = {
       "zh-CN": "规划前跳过从远端刷新状态",
     },
   },
-  refreshOnly: {
-    type: "switch",
-    description: {
-      "en-US": "Refresh state without mutating remote resources",
-      "zh-CN": "仅刷新 State，不修改远端资源",
-    },
-  },
   concurrency: {
     type: "number",
     valueHint: "<n>",
@@ -76,7 +69,6 @@ export default defineCommand({
             provider: "bailian",
             refresh: !flags.noRefresh,
             concurrency: flags.concurrency,
-            refresh_only: flags.refreshOnly,
           },
           config_file: file,
           hint: "Run `managed-agent plan` to preview the exact resource changes.",

packages/commands/src/commands/managed-agent/project.ts

@@ -49,15 +49,14 @@ export const managedAgentProjectInit = defineCommand({
   async run(ctx) {
     if (ctx.settings.dryRun) {
       emitResult(
-        { would_initialize_project: ctx.flags.project ?? "." },
+        {
+          would_initialize_project: ctx.flags.project ?? ".",
+        },
         detectOutputFormat(ctx.settings.output),
       );
       return;
     }
-    const result = await initializeDirectoryProject({
-      projectRoot: ctx.flags.project ?? ".",
-      provider: "bailian",
-    });
+    const result = await initializeDirectoryProject({ projectRoot: ctx.flags.project ?? "." });
     emitResult(result, detectOutputFormat(ctx.settings.output));
   },
 });
@@ -163,9 +162,9 @@ export const managedAgentProjectPublish = defineCommand({
     installSdkTransport(ctx);
     const root = ctx.flags.project ?? ".";
     const resolveBuild: ProjectBuildResolver = async (buildPath) =>
-      (await resolveAgentProjectConfig(ctx, buildPath)) as unknown as Awaited<
-        ReturnType<ProjectBuildResolver>
-      >;
+      (await resolveAgentProjectConfig(ctx, buildPath, {
+        overrideBailianBaseUrl: true,
+      })) as unknown as Awaited<ReturnType<ProjectBuildResolver>>;
     const planned = await withAgentErrors(() =>
       withStdoutProtected(() =>
         planProjectPublish(root, {
@@ -199,6 +198,7 @@ export const managedAgentProjectPublish = defineCommand({
           projectRoot: planned.project_root,
           expectedProjectRevision: planned.project_revision,
           expectedYamlHash: planned.build_manifest.yaml_hash,
+          expectedPlanFingerprint: planned.plan_fingerprint,
           provider: "bailian",
           refresh: !ctx.flags.noRefresh,
           concurrency: ctx.flags.concurrency,

packages/commands/tests/credentials-bridge.test.ts

@@ -104,6 +104,20 @@ test("inject:base_url 已带后缀不重复拼;非空字面量 base_url 保留",
   expect(literal.bailian.base_url).toBe("https://custom.example.com/api/v1/agentstudio");
 });
 
+test("inject:目录项目可强制使用 Bailian CLI 解析出的 base_url", () => {
+  const providers = {
+    bailian: {
+      api_key: "from-project-env",
+      base_url: "https://project-env.example.com/api/v1/agentstudio",
+    },
+  };
+  injectProviderCredentials(providers, makeHost({ apiCred: bailianCred() }), {
+    overrideBaseUrl: true,
+  });
+  expect(providers.bailian.api_key).toBe("sk-auth-chain");
+  expect(providers.bailian.base_url).toBe("https://dashscope.aliyuncs.com/api/v1/agentstudio");
+});
+
 test("inject:base_url 尾斜杠被规范化,不产生双斜杠", () => {
   const providers = { bailian: { api_key: "", base_url: "" } };
   injectProviderCredentials(

packages/commands/tests/e2e/managed-agent.e2e.test.ts

@@ -105,8 +105,8 @@ async function seedTrackedResources(
 /**
  * managed-agent：help / 缺参不依赖密钥；所有 mutation 命令的 --dry-run
  * 必须在构建 SDK runtime（凭证注入 / 联网 / 写盘）之前短路，因此同样不需要密钥。
- * 鉴权分层：离线命令（init/validate/state list|show|rm）auth: "none"；联网命令
- * 统一 auth: "apiKey" 硬门禁（见 managed-agent-auth-chain e2e）。
+ * 鉴权分层：离线命令（init/project init/validate/state list|show|rm）auth: "none"；
+ * 联网命令统一 auth: "apiKey" 硬门禁（见 managed-agent-auth-chain e2e）。
  * 真实集成（apply/destroy/session 流程）依赖工作区内的 agents.yaml 与远端资源，
  * 属批量场景，暂仅覆盖 dry-run 契约。
  */
@@ -234,6 +234,18 @@ describe("e2e: managed-agent", () => {
     expect(stderr).toMatch(/--file|--yes/i);
     expect(stderr).not.toContain("--provider");
     expect(stderr).not.toContain("--ci");
+    expect(stderr).not.toContain("--refresh-only");
+  });
+
+  test("managed-agent apply 不再接受 --refresh-only", async () => {
+    const { stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [
+      "managed-agent",
+      "apply",
+      "--dry-run",
+      "--refresh-only",
+    ]);
+    expect(exitCode).toBe(2);
+    expect(stderr).toMatch(/Unknown flag.*--refresh-only/i);
   });
 
   test("managed-agent init 不再暴露 Git 仓库脚手架", async () => {
@@ -272,6 +284,11 @@ describe("e2e: managed-agent", () => {
     expect(
       parseStdoutJson<{ baseline_version?: string }>(initialized.stdout).baseline_version,
     ).toMatch(/^[a-f0-9]{64}$/);
+    expect(JSON.parse(await readFile(join(projectRoot, "project.json"), "utf8"))).toEqual({
+      version: "1",
+    });
+    expect(await stat(join(projectRoot, ".env")).catch(() => null)).toBeNull();
+    expect(await stat(join(projectRoot, ".gitignore")).catch(() => null)).toBeNull();
 
     const validated = await runCommandE2e(MANAGED_AGENT_ROUTES, [
       "managed-agent",
@@ -301,6 +318,9 @@ describe("e2e: managed-agent", () => {
     expect(await readFile(join(projectRoot, ".openagentpack/build/agents.yaml"), "utf8")).toContain(
       "assistant",
     );
+    expect(await readFile(join(projectRoot, ".openagentpack/build/agents.yaml"), "utf8")).toContain(
+      "provider: bailian",
+    );
 
     const status = await runCommandE2e(MANAGED_AGENT_ROUTES, [
       "managed-agent",
@@ -1425,6 +1445,27 @@ describe("e2e: managed-agent（--dry-run 短路，不联网不写盘）", () =>
     expect(stderr).toMatch(/Unknown flag.*--provider/i);
   });
 
+  test("project init --dry-run 不需要密钥且不创建目录", async () => {
+    const parent = await mkdtemp(join(tmpdir(), "bailian-managed-agent-project-dry-run-"));
+    projectDirectories.push(parent);
+    const projectRoot = join(parent, "project");
+    const { stdout, stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [
+      "managed-agent",
+      "project",
+      "init",
+      "--dry-run",
+      "--project",
+      projectRoot,
+      "--output",
+      "json",
+    ]);
+    expect(exitCode, stderr).toBe(0);
+    expect(
+      parseStdoutJson<{ would_initialize_project?: string }>(stdout).would_initialize_project,
+    ).toBe(projectRoot);
+    expect(await stat(projectRoot).catch(() => null)).toBeNull();
+  });
+
   test("apply --dry-run 仅输出计划", async () => {
     const { stdout, stderr, exitCode } = await runCommandE2e(MANAGED_AGENT_ROUTES, [
       "managed-agent",

skills/bailian-managed-agent/SKILL.md

@@ -62,7 +62,10 @@ for explicit confirmation before re-running with `--yes`.
 | Preview or restore project source       | `bl managed-agent project version preview` / `restore` |
 
 - Bailian CLI and Workbench use the same `.openagentpack/versions/project` store and enable switch. Git is not required.
+- Directory projects always use Bailian. `project.json` does not declare a Provider; Build supplies the Bailian Provider configuration automatically.
+- `project init`, `validate`, `build`, and version commands are local-only. Publish and Workbench resolve credentials from Bailian CLI flags, shell environment, or the active Profile; project initialization does not write credentials into the project directory.
 - Build is local-only. Publish never runs Build implicitly and consumes only a current `.openagentpack/build/agents.yaml` plus manifest.
+- Agent-owned Files live under `agents/<agent>/files/<id>/`. Add `{ "file": "<id>", "mount_path": "/mnt/<name>" }` to `agent.json.files`; Publish uploads the File and every later Session mounts it automatically. A File referenced by multiple Agents is promoted to `resources/files/<id>/` during Build.
 - A successful Publish versions the canonical YAML and the complete project source tree, including Skill scripts/assets and binary files. Remote State is never versioned or restored.
 - `project version restore` restores source files to the working directory, invalidates Build, and does not move version history or remote State.
 - `managed-agent playground` remains the standalone `agents.yaml` Session Preview path; directory Workbench is only under `managed-agent project workbench`.

skills/bailian-managed-agent/reference/managed-agent.md

@@ -306,7 +306,6 @@ bl managed-agent agent versions --agent-id agent_abc --all --output json
 | ------------------- | ------ | -------- | ------------------------------------------------------------------ |
 | `--file <path>`     | string | no       | Config file path (default: agents.yaml)                            |
 | `--no-refresh`      | switch | no       | Skip refreshing state from remote before planning                  |
-| `--refresh-only`    | switch | no       | Refresh state without mutating remote resources                    |
 | `--concurrency <n>` | number | no       | Max independent resources to apply in parallel (default 6, max 10) |
 | `--yes`             | switch | no       | Confirm this high-risk operation                                   |
 | `--api-key <key>`   | string | no       | API key                                                            |