bailian-cli 1.14.0 → 1.14.1

package/README.md

@@ -26,7 +26,7 @@ Equip your AI Agent out-of-the-box with these capabilities, composable across co
 
 - **Text chat** — Qwen3.8-max: major gains in agentic coding, frontend coding, and vibe coding
 - **Multimodal (Omni)** — Full omni-modal support across text + image + audio + video
-- **Image generation & editing** — Qwen-Image 2.0: pro text rendering, photorealism, strong semantic adherence, multi-image composition
+- **Image generation & editing** — Qwen-Image 3.0: pro text rendering, photorealism, strong semantic adherence, multi-image composition
 - **Video generation & editing** — happyhorse-1.1 series: text-/image-/reference-to-video and natural-language video editing (up to 9-image reference)
 - **Speech synthesis & recognition** — CosyVoice streaming TTS, voice cloning from 5–20s samples; FunAudio-ASR covers 30 languages including 7 Chinese dialects and 20+ Mandarin accents
 - **Image & video understanding** — Qwen-VL: long-form video analysis, chart/document parsing, visual reasoning, multilingual OCR
@@ -85,6 +85,9 @@ irm https://bailian.aliyun.com/cli/install.ps1 | iex
 
 # Node users / developers (Node.js >= 18.17)
 npm install -g bailian-cli
+
+# Agent skills
+npx skills add modelstudioai/cli --all -g
 ```
 
 > Binary install does not require Node.js. `npm install -g` remains fully supported.

package/README.zh.md

@@ -26,7 +26,7 @@ _专为 AI Agent 打造，每个命令均可作为结构化工具调用。_
 
 - **文本对话** — Qwen3.8-max：Agentic coding、前端编程、Vibe coding 等能力显著增强
 - **全模态对话** — 文本 + 图像 + 音频 + 视频全模态支持
-- **图像生成与编辑** — Qwen-Image 2.0：专业文字渲染、真实质感、强语义遵循、多图合成
+- **图像生成与编辑** — Qwen-Image 3.0：专业文字渲染、真实质感、强语义遵循、多图合成
 - **视频生成与编辑** — happyhorse-1.1 系列，支持文生 / 图生 / 参考生（最多 9 张图参考）/ 自然语言视频编辑
 - **语音合成与识别** — CosyVoice 实时流式合成，5-20s 样本即可克隆；FunAudio-ASR 覆盖 30 种语种，含汉语七大方言与 20+ 口音官话
 - **图像与视频理解** — Qwen-VL：长视频解析、复杂图表与文档识别、视觉推理、多语种 OCR
@@ -83,6 +83,9 @@ irm https://bailian.aliyun.com/cli/install.ps1 | iex
 
 # Node 用户 / 开发者（需要 Node.js >= 18.17）
 npm install -g bailian-cli
+
+# Agent skills
+npx skills add modelstudioai/cli --all -g
 ```
 
 > 二进制安装不依赖 Node.js。`npm install -g` 长期保留。

package/dist/bailian.mjs

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
 
-import{createCli as e}from"bailian-cli-runtime";import{advisorRecommend as t,appCall as n,appList as r,authGenerateAccessToken as i,authLogin as a,authLogout as o,authStatus as s,configAgent as c,configList as l,configSet as u,configShow as d,configUi as f,configUse as p,consoleCall as m,datasetDelete as h,datasetGet as g,datasetList as _,datasetUpload as v,datasetValidate as y,deployAudioCreate as b,deployDelete as x,deployGet as S,deployImageCreate as C,deployList as w,deployModels as T,deployScale as E,deployTextCreate as D,deployUpdate as O,fileUpload as k,finetuneAudioCreate as A,finetuneCancel as j,finetuneCapability as M,finetuneCheckpoints as N,finetuneDelete as P,finetuneExport as F,finetuneGet as I,finetuneImageCreate as L,finetuneList as R,finetuneLogs as z,finetuneTextCreate as B,finetuneWatch as V,imageEdit as H,imageGenerate as U,knowledgeChat as W,knowledgeRetrieve as G,knowledgeSearch as K,managedAgentApply as q,managedAgentDestroy as J,managedAgentInit as Y,managedAgentPlan as X,managedAgentSessionCreate as Z,managedAgentSessionDelete as Q,managedAgentSessionEvents as $,managedAgentSessionGet as ee,managedAgentSessionList as te,managedAgentSessionRun as ne,managedAgentSessionSend as re,managedAgentSkillList as ie,managedAgentStateImport as ae,managedAgentStateList as oe,managedAgentStateRm as se,managedAgentStateShow as ce,managedAgentValidate as le,mcpCall as ue,mcpList as de,mcpTools as fe,memoryAdd as pe,memoryDelete as me,memoryList as he,memoryProfileCreate as ge,memoryProfileGet as _e,memorySearch as ve,memoryUpdate as ye,modelList as be,pipelineRun as xe,pipelineValidate as Se,pluginInstall as Ce,pluginLink as we,pluginList as Te,pluginRemove as Ee,quotaCheck as De,quotaHistory as Oe,quotaList as ke,quotaRequest as Ae,searchWeb as je,skillAdd as Me,skillList as Ne,skillRemove as Pe,skillUpdate as Fe,speechRecognize as Ie,speechSynthesize as Le,textChat as Re,textOmni as ze,tokenPlanAddMember as Be,tokenPlanAssignSeats as Ve,tokenPlanCreateKey as He,tokenPlanListSeats as Ue,update as We,usageFree as Ge,usageFreetier as Ke,usageStats as qe,usageSummary as Je,videoDownload as Ye,videoEdit as Xe,videoGenerate as Ze,videoRef as Qe,videoTaskGet as $e,visionDescribe as et,workspaceInit as tt,workspaceList as nt}from"bailian-cli-commands";e({"auth login":a,"auth status":s,"auth logout":o,"auth generate-access-token":i,"text chat":Re,omni:ze,"image generate":U,"image edit":H,"video generate":Ze,"video edit":Xe,"video ref":Qe,"video task get":$e,"video download":Ye,"vision describe":et,"config show":d,"config set":u,"config list":l,"config use":p,"config ui":f,"config agent":c,update:We,"app call":n,"app list":r,"memory add":pe,"memory search":ve,"memory list":he,"memory update":ye,"memory delete":me,"memory profile create":ge,"memory profile get":_e,"knowledge retrieve":G,"knowledge search":K,"knowledge chat":W,"mcp call":ue,"mcp list":de,"mcp tools":fe,"search web":je,"speech synthesize":Le,"speech recognize":Ie,"file upload":k,"console call":m,"usage free":Ge,"usage freetier":Ke,"usage stats":qe,"usage summary":Je,"pipeline run":xe,"pipeline validate":Se,"advisor recommend":t,"model list":be,"workspace list":nt,"quota list":ke,"quota request":Ae,"quota history":Oe,"quota check":De,"dataset upload":v,"dataset list":_,"dataset get":g,"dataset delete":h,"dataset validate":y,"finetune text create":B,"finetune audio create":A,"finetune image create":L,"finetune list":R,"finetune get":I,"finetune cancel":j,"finetune delete":P,"finetune logs":z,"finetune checkpoints":N,"finetune export":F,"finetune watch":V,"finetune capability":M,"deploy text create":D,"deploy audio create":b,"deploy image create":C,"deploy list":w,"deploy get":S,"deploy models":T,"deploy scale":E,"deploy update":O,"deploy delete":x,"token-plan list-seats":Ue,"token-plan create-key":He,"token-plan assign-seats":Ve,"token-plan add-member":Be,"workspace init":tt,"plugin install":Ce,"plugin link":we,"plugin list":Te,"plugin remove":Ee,"skill add":Me,"skill update":Fe,"skill remove":Pe,"skill list":Ne,"managed-agent init":Y,"managed-agent validate":le,"managed-agent plan":X,"managed-agent apply":q,"managed-agent destroy":J,"managed-agent state list":oe,"managed-agent state show":ce,"managed-agent state rm":se,"managed-agent state import":ae,"managed-agent session create":Z,"managed-agent session list":te,"managed-agent session get":ee,"managed-agent session delete":Q,"managed-agent session run":ne,"managed-agent session send":re,"managed-agent session events":$,"managed-agent skill-list":ie},{binName:`bl`,version:`1.14.0`,clientName:`bailian-cli`,npmPackage:`bailian-cli`,quickStartTasks:[`Help me generate a set of Amazon e-commerce main images for baseball caps (white background + lifestyle shots + model wear shots)`,`Help me generate a 3-minute humorous crosstalk audio clip`,`Help me generate a Little Red Riding Hood picture-book PDF (with illustrations)`,`Help me analyze this video and write a Xiaohongshu-style post`],commandPacks:{supported:{"@ali/bailian-plugin-agent":{commandPrefixes:[`agent`],credentialAccess:[`apiKey`]},"@ali/bailian-plugin-inner-console-call":{commandPrefixes:[`inner-console`]}}}}).run();export{};
+import{createCli as e}from"bailian-cli-runtime";import{advisorRecommend as t,appCall as n,appList as r,authGenerateAccessToken as i,authLogin as a,authLogout as o,authStatus as s,configAgent as c,configList as l,configSet as u,configShow as d,configUi as f,configUse as p,consoleCall as m,datasetDelete as h,datasetGet as g,datasetList as _,datasetUpload as v,datasetValidate as y,deployAudioCreate as b,deployDelete as x,deployGet as S,deployImageCreate as C,deployList as w,deployModels as T,deployScale as E,deployTextCreate as D,deployUpdate as O,fileUpload as k,finetuneAudioCreate as A,finetuneCancel as j,finetuneCapability as M,finetuneCheckpoints as N,finetuneDelete as P,finetuneExport as F,finetuneGet as I,finetuneImageCreate as L,finetuneList as R,finetuneLogs as z,finetuneTextCreate as B,finetuneWatch as V,imageEdit as H,imageGenerate as U,knowledgeChat as W,knowledgeRetrieve as G,knowledgeSearch as K,managedAgentApply as q,managedAgentDestroy as J,managedAgentInit as Y,managedAgentPlan as X,managedAgentSessionCreate as Z,managedAgentSessionDelete as Q,managedAgentSessionEvents as $,managedAgentSessionGet as ee,managedAgentSessionList as te,managedAgentSessionRun as ne,managedAgentSessionSend as re,managedAgentSkillList as ie,managedAgentStateImport as ae,managedAgentStateList as oe,managedAgentStateRm as se,managedAgentStateShow as ce,managedAgentValidate as le,mcpCall as ue,mcpList as de,mcpTools as fe,memoryAdd as pe,memoryDelete as me,memoryList as he,memoryProfileCreate as ge,memoryProfileGet as _e,memorySearch as ve,memoryUpdate as ye,modelList as be,pipelineRun as xe,pipelineValidate as Se,pluginInstall as Ce,pluginLink as we,pluginList as Te,pluginRemove as Ee,quotaCheck as De,quotaHistory as Oe,quotaList as ke,quotaRequest as Ae,searchWeb as je,skillAdd as Me,skillList as Ne,skillRemove as Pe,skillUpdate as Fe,speechRecognize as Ie,speechSynthesize as Le,textChat as Re,textOmni as ze,tokenPlanAddMember as Be,tokenPlanAssignSeats as Ve,tokenPlanCreateKey as He,tokenPlanListSeats as Ue,update as We,usageFree as Ge,usageFreetier as Ke,usageStats as qe,usageSummary as Je,videoDownload as Ye,videoEdit as Xe,videoGenerate as Ze,videoRef as Qe,videoTaskGet as $e,visionDescribe as et,workspaceInit as tt,workspaceList as nt}from"bailian-cli-commands";e({"auth login":a,"auth status":s,"auth logout":o,"auth generate-access-token":i,"text chat":Re,omni:ze,"image generate":U,"image edit":H,"video generate":Ze,"video edit":Xe,"video ref":Qe,"video task get":$e,"video download":Ye,"vision describe":et,"config show":d,"config set":u,"config list":l,"config use":p,"config ui":f,"config agent":c,update:We,"app call":n,"app list":r,"memory add":pe,"memory search":ve,"memory list":he,"memory update":ye,"memory delete":me,"memory profile create":ge,"memory profile get":_e,"knowledge retrieve":G,"knowledge search":K,"knowledge chat":W,"mcp call":ue,"mcp list":de,"mcp tools":fe,"search web":je,"speech synthesize":Le,"speech recognize":Ie,"file upload":k,"console call":m,"usage free":Ge,"usage freetier":Ke,"usage stats":qe,"usage summary":Je,"pipeline run":xe,"pipeline validate":Se,"advisor recommend":t,"model list":be,"workspace list":nt,"quota list":ke,"quota request":Ae,"quota history":Oe,"quota check":De,"dataset upload":v,"dataset list":_,"dataset get":g,"dataset delete":h,"dataset validate":y,"finetune text create":B,"finetune audio create":A,"finetune image create":L,"finetune list":R,"finetune get":I,"finetune cancel":j,"finetune delete":P,"finetune logs":z,"finetune checkpoints":N,"finetune export":F,"finetune watch":V,"finetune capability":M,"deploy text create":D,"deploy audio create":b,"deploy image create":C,"deploy list":w,"deploy get":S,"deploy models":T,"deploy scale":E,"deploy update":O,"deploy delete":x,"token-plan list-seats":Ue,"token-plan create-key":He,"token-plan assign-seats":Ve,"token-plan add-member":Be,"workspace init":tt,"plugin install":Ce,"plugin link":we,"plugin list":Te,"plugin remove":Ee,"skill add":Me,"skill update":Fe,"skill remove":Pe,"skill list":Ne,"managed-agent init":Y,"managed-agent validate":le,"managed-agent plan":X,"managed-agent apply":q,"managed-agent destroy":J,"managed-agent state list":oe,"managed-agent state show":ce,"managed-agent state rm":se,"managed-agent state import":ae,"managed-agent session create":Z,"managed-agent session list":te,"managed-agent session get":ee,"managed-agent session delete":Q,"managed-agent session run":ne,"managed-agent session send":re,"managed-agent session events":$,"managed-agent skill-list":ie},{binName:`bl`,version:`1.14.1`,clientName:`bailian-cli`,npmPackage:`bailian-cli`,quickStartTasks:[`Help me generate a set of Amazon e-commerce main images for baseball caps (white background + lifestyle shots + model wear shots)`,`Help me generate a 3-minute humorous crosstalk audio clip`,`Help me generate a Little Red Riding Hood picture-book PDF (with illustrations)`,`Help me analyze this video and write a Xiaohongshu-style post`],commandPacks:{supported:{"@ali/bailian-plugin-agent":{commandPrefixes:[`agent`],credentialAccess:[`apiKey`]},"@ali/bailian-plugin-inner-console-call":{commandPrefixes:[`inner-console`]}}}}).run();export{};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bailian-cli",
-  "version": "1.14.0",
+  "version": "1.14.1",
   "description": "CLI for Aliyun Model Studio (DashScope) AI Platform.",
   "keywords": [
     "agent",
@@ -38,9 +38,9 @@
   },
   "dependencies": {
     "tar-stream": "^3.2.0",
-    "bailian-cli-commands": "1.14.0",
-    "bailian-cli-runtime": "1.14.0",
-    "bailian-cli-core": "1.14.0"
+    "bailian-cli-commands": "1.14.1",
+    "bailian-cli-core": "1.14.1",
+    "bailian-cli-runtime": "1.14.1"
   },
   "devDependencies": {
     "@clack/prompts": "^0.7.0",
@@ -59,7 +59,7 @@
     "node": ">=18.17.0"
   },
   "scripts": {
-    "generate:reference": "tsx ../../tools/generate-reference.ts && sh -c 'cd ../.. && vp check --fix skills/bailian-cli/reference'",
+    "generate:reference": "tsx ../../tools/generate-reference.ts && sh -c 'cd ../.. && vp check --fix skills/bailian-cli/reference skills/bailian-gen/reference skills/bailian-finetune/reference skills/bailian-managed-agent/reference'",
     "sync:skill-version": "tsx ../../tools/sync-skill-metadata.ts",
     "build": "vp pack",
     "dev": "tsx src/main.ts",

package/postinstall.js

@@ -9,7 +9,8 @@
  *   1. Download skills/index.json from public-read OSS, get the bailian-docs-llm-wiki entry
  *   2. Download skills/bailian-docs-llm-wiki/<entry.object> (sha256-<hex>.tar.br, brotli q6, ~2.3MB);
  *      legacy fallback to skill.tar.br when the entry has no valid object field
- *   3. Node built-in brotli decompress + tar-stream extract (per-entry path safety check) to same-volume temp dir
+ *   3. Node built-in brotli decompress + tar-stream extract (per-entry path safety check) to same-volume temp dir,
+ *      then recompute contentHash over the extracted files and reject on mismatch (symmetric with core installer)
  *   4. renameSync atomic swap into ~/.bailian/skills/bailian-docs-llm-wiki/
  *   5. Write ~/.bailian/wiki-sync-state.json
  *   6. Write ~/.bailian/skills/skill-lock.json record (same ledger as bl skill)
@@ -20,10 +21,12 @@
  *   - Standalone implementation: does not import bailian-cli-core, avoiding ESM path issues after bundling
  *   - Depends on Node built-in modules + tar-stream (consistent with sync.ts / publisher skills-publish.mjs)
  */
+import { createHash } from "node:crypto";
 import {
   createWriteStream,
   existsSync,
   mkdirSync,
+  readdirSync,
   readFileSync,
   renameSync,
   rmSync,
@@ -106,6 +109,9 @@ async function downloadBuffer(url) {
 
 /** tar 条目路径必须是相对路径且不含 ..，防止 tar-slip 逃逸解包目录 */
 function isSafeEntryName(name) {
+  // Symmetric with core skills/extract.ts: backslashes can escape the extraction
+  // dir on Windows (path.join expands "\.." segments, leading "\" hits drive root)
+  if (name.includes("\\") || name.includes("\0")) return false;
   if (name.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(name)) return false;
   return !name.split("/").includes("..");
 }
@@ -140,6 +146,30 @@ async function extractTarBr(tarBrBuffer, destDir) {
   await pipeline(Readable.from(tarBrBuffer), createBrotliDecompress(), extract);
 }
 
+/**
+ * Recompute the publisher's deterministic content hash over an extracted directory
+ * (same accumulation as core skills/extract.ts computeDirContentHash): regular files
+ * sorted by "/"-separated relative path, sha256 over relPath + bytes.
+ */
+function computeDirContentHash(dir) {
+  const relPaths = [];
+  const walk = (sub) => {
+    for (const dirent of readdirSync(sub ? join(dir, sub) : dir, { withFileTypes: true })) {
+      const rel = sub ? `${sub}/${dirent.name}` : dirent.name;
+      if (dirent.isDirectory()) walk(rel);
+      else if (dirent.isFile()) relPaths.push(rel);
+    }
+  };
+  walk("");
+  relPaths.sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));
+  const hash = createHash("sha256");
+  for (const rel of relPaths) {
+    hash.update(rel);
+    hash.update(readFileSync(join(dir, rel)));
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+
 /** Atomic swap: tmpDir (same volume) → catalogDir. */
 function atomicSwap(tmpDir, catalogDir) {
   mkdirSync(dirname(catalogDir), { recursive: true });
@@ -166,12 +196,22 @@ async function main() {
     entry.object && OBJECT_FILE_RE.test(entry.object) ? entry.object : LEGACY_ASSET_NAME;
   const tarBuf = await downloadBuffer(`${REGISTRY_BASE_URL}/${WIKI_SKILL_NAME}/${assetName}`);
 
-  // 3. Extract to same-volume temp dir + atomic swap
+  // 3. Extract to same-volume temp dir + integrity check + atomic swap
   const catalogDir = getCatalogDir();
   const tmpDir = `${catalogDir}.tmp-${process.pid}-${Date.now()}`;
   try {
     mkdirSync(tmpDir, { recursive: true });
     await extractTarBr(tarBuf, tmpDir);
+    // Symmetric with layer 2 (core installer): reject archive/index fingerprint mismatch
+    // before touching the canonical dir
+    if (entry.contentHash.startsWith("sha256:")) {
+      const actualContentHash = computeDirContentHash(tmpDir);
+      if (actualContentHash !== entry.contentHash) {
+        throw new Error(
+          `content hash mismatch: index says ${entry.contentHash}, archive is ${actualContentHash}`,
+        );
+      }
+    }
     atomicSwap(tmpDir, catalogDir);
   } catch (err) {
     if (existsSync(tmpDir)) rmSync(tmpDir, { recursive: true, force: true });