Eliminate per-command --region/--site/--switch-agent duplication across 11 console gateway commands.
These values now flow through config (CLI flags → config file → defaults) and are consumed by
callConsoleGateway automatically. Also wire consoleSite into resolveConsoleOrigin so --console-site
selects the correct login URL (domestic vs international).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Field was replaced by region+site gateway resolution but ConfigFile
definition, parseConfigFile logic, and test case were left behind.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Console gateway URL and action are now resolved from a region + site
mapping table instead of a single hardcoded config value. Supports
cn-beijing and ap-southeast-1 with domestic/international site variants.
- Add ConsoleSite type, REGION_GATEWAYS mapping, and resolveGateway()
- Add switchAgent to cornerstoneParam for delegated access
- Add console_site, console_region, console_switch_agent to config
- Remove consoleGatewayUrl from Config (replaced by region+site resolution)
- login-console callback now persists baseUrl, site, region, switchAgent
- bl console call gains --site and --switch-agent flags
- All callers delegate region default to callConsoleGateway (no more hardcoded cn-beijing)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bump bailian-cli / bailian-cli-core to 1.3.2, sync skill version, and
document the omni --audio HTTP 400 fix (#54) in CHANGELOG. Also add the
.ogg extension to the --audio help text and reference doc.
- `bl mcp list` — list MCP servers enabled under the current Bailian
account via console gateway PageList (always activated=1).
- `bl mcp tools <server-code>` — list tools exposed by a server.
- `bl mcp call <server-code>.<tool>` — invoke a tool. Accepts `--json`,
repeatable `--arg k=v` (JSON-parsed when possible) and `--query` sugar;
`--url` overrides the endpoint for non-Bailian MCPs.
- core: export `bailianMcpUrl(baseUrl, code)` building
`/api/v1/mcps/<code>/mcp`; `McpClient` now takes a full URL.
- `bl search web` switches to `mcpWebSearchEndpoint` directly.
- e2e: `mcp.e2e.test.ts` covering help, dry-run, arg-merge semantics,
invalid-input paths, and one live `tools/list` against WebSearch.
The config file accepted any value that merely starts with "http" (so even
"httpfoo://evil" passed) for base_url and console_gateway_url — origins the
client sends the Bearer token to. Validate them with `new URL()` and an
http:/https: protocol check instead, rejecting malformed values. Valid http(s)
URLs (including custom proxies and local http) are unaffected.
https://claude.ai/code/session_017ZGQCjwNQF5Pz96gLUnnG1
- endpoints: encodeURIComponent the id segments (task_id, app_id, node_id,
schema_id) interpolated into request URLs. task_id in particular comes from
the server's async-submit response and is fetched back with the bearer token
attached, so an unencoded value could steer the authenticated follow-up
request to a different path on the host.
- stream (SSE parser): cap the in-memory buffer (16 MiB). A stream that never
emits a newline, or that builds one enormous event from many data: lines,
could otherwise grow the buffer without bound and exhaust process memory.
https://claude.ai/code/session_017ZGQCjwNQF5Pz96gLUnnG1
- config set: mask api_key/access_token/access_key_id/access_key_secret in the
confirmation echo. It previously printed the stored secret verbatim to stdout
(CI logs, pipes, screen shares), unlike `config show` / `auth status` which
already maskToken().
- http / knowledge retrieve: use maskToken() in --verbose request logs instead
of printing the first 8 chars of the bearer token / AccessKey id.
- telemetry: write telemetry.jsonl with mode 0600 (was created world-readable
by default), matching the other credential-area writers.
- ensureConfigDir: chmod 0700 after mkdir, so a pre-existing ~/.bailian created
by an older build/another tool (where mkdir's mode is ignored) holding
cleartext credentials gets locked down too. Best-effort; never fatal.
https://claude.ai/code/session_017ZGQCjwNQF5Pz96gLUnnG1
Documentation-only patch release.
- Add INSTALL.md for AI-Agent-driven installation
- Sync root and packages/cli READMEs (EN + CN)
- Drop unpkg links in favor of canonical sources
- release.mjs: assert README sync before publishing
故璃