refactor(auth): remove deprecated AK/SK auth for knowledge retrieve

AK/SK signing was used only by `knowledge retrieve`'s deprecated fallback,
which the api-key auth gate now makes unreachable. Drop it; the command is
pure api-key.

- knowledge/retrieve: remove the AK/SK path + --access-key-id/secret/workspace-id
  flags; api-key only
- delete client/ak-sign.ts and its signRequest/AkSignConfig exports
- drop access_key_id/access_key_secret from config schema, loader, and
  `config show` / `config set`
- remove the now-unused PascalCase KnowledgeRetrieve request/response types

Author: XXPermanentXX

README.md

@@ -156,18 +156,6 @@ Required for console capability commands (`app list`, `usage free`, `usage stats
 bl auth login --console
 ```
 
-### Alibaba Cloud AK/SK (Knowledge Base only)
-
-Required for `knowledge retrieve`. Get your AccessKey from [RAM Console](https://ram.console.aliyun.com/manage/ak).
-
-> Recommended: create a RAM sub-account with minimum privileges instead of using the root account's AK/SK.
-
-```bash
-export ALIBABA_CLOUD_ACCESS_KEY_ID=LTAI5t...
-export ALIBABA_CLOUD_ACCESS_KEY_SECRET=...
-export BAILIAN_WORKSPACE_ID=ws-...
-```
-
 ## Configuration
 
 ```bash

README.zh.md

@@ -151,18 +151,6 @@ bl text chat --api-key sk-xxxxx --message "你好"
 bl auth login --console
 ```
 
-### 阿里云 AK/SK（仅知识库检索）
-
-`knowledge retrieve` 命令需要阿里云 AccessKey。前往 [RAM 控制台](https://ram.console.aliyun.com/manage/ak) 获取。
-
-> 建议：创建 RAM 子账号并授予最小权限，避免使用主账号 AK/SK。
-
-```bash
-export ALIBABA_CLOUD_ACCESS_KEY_ID=LTAI5t...
-export ALIBABA_CLOUD_ACCESS_KEY_SECRET=...
-export BAILIAN_WORKSPACE_ID=ws-...
-```
-
 ## 配置
 
 ```bash

packages/cli/README.md

@@ -156,18 +156,6 @@ Required for console capability commands (`app list`, `usage free`, `usage stats
 bl auth login --console
 ```
 
-### Alibaba Cloud AK/SK (Knowledge Base only)
-
-Required for `knowledge retrieve`. Get your AccessKey from [RAM Console](https://ram.console.aliyun.com/manage/ak).
-
-> Recommended: create a RAM sub-account with minimum privileges instead of using the root account's AK/SK.
-
-```bash
-export ALIBABA_CLOUD_ACCESS_KEY_ID=LTAI5t...
-export ALIBABA_CLOUD_ACCESS_KEY_SECRET=...
-export BAILIAN_WORKSPACE_ID=ws-...
-```
-
 ## Configuration
 
 ```bash

packages/cli/README.zh.md

@@ -151,18 +151,6 @@ bl text chat --api-key sk-xxxxx --message "你好"
 bl auth login --console
 ```
 
-### 阿里云 AK/SK（仅知识库检索）
-
-`knowledge retrieve` 命令需要阿里云 AccessKey。前往 [RAM 控制台](https://ram.console.aliyun.com/manage/ak) 获取。
-
-> 建议：创建 RAM 子账号并授予最小权限，避免使用主账号 AK/SK。
-
-```bash
-export ALIBABA_CLOUD_ACCESS_KEY_ID=LTAI5t...
-export ALIBABA_CLOUD_ACCESS_KEY_SECRET=...
-export BAILIAN_WORKSPACE_ID=ws-...
-```
-
 ## 配置
 
 ```bash

packages/cli/tests/e2e/global-setup.ts

@@ -30,11 +30,6 @@ DASHSCOPE_API_KEY=
 # -------------------------------
 BAILIAN_E2E_VIDEO_TASK_ID=b499a8cb-1fc4-4d43-9495-e23c7f78ae0d
 # -------------------------------
-# 阿里云 AK
-ALIBABA_CLOUD_ACCESS_KEY_ID=
-# 阿里云 SK
-ALIBABA_CLOUD_ACCESS_KEY_SECRET=
-# -------------------------------
 # 知识库 ID
 BAILIAN_WORKSPACE_ID=
 # 索引 ID

packages/cli/tests/e2e/helpers.ts

@@ -117,23 +117,11 @@ export function e2eLabelFromMetaUrl(metaUrl: string): string {
   return basename(fileURLToPath(metaUrl), ".ts").replace(/\.e2e\.test$/, "");
 }
 
-/** 知识库用例：须显式索引 ID + API-KEY 或 AK/SK */
+/** 知识库用例：须显式索引 ID + API-KEY */
 export function isKnowledgeE2EReady(): boolean {
   if (!isBailianE2EEnabled()) return false;
   if (!process.env.BAILIAN_E2E_INDEX_ID) return false;
-  const hasApiKey = isDashScopeE2EReady();
-  const hasAkSk =
-    !!process.env.ALIBABA_CLOUD_ACCESS_KEY_ID && !!process.env.ALIBABA_CLOUD_ACCESS_KEY_SECRET;
-  return hasApiKey || hasAkSk;
-}
-
-export function isKnowledgeAkSkReady(): boolean {
-  return (
-    isBailianE2EEnabled() &&
-    !!process.env.ALIBABA_CLOUD_ACCESS_KEY_ID &&
-    !!process.env.ALIBABA_CLOUD_ACCESS_KEY_SECRET &&
-    !!process.env.BAILIAN_E2E_INDEX_ID
-  );
+  return isDashScopeE2EReady();
 }
 
 export interface RunCliResult {

packages/cli/tests/e2e/knowledge.e2e.test.ts

@@ -35,7 +35,6 @@ describe("e2e: knowledge retrieve", () => {
     expect(stderr).toMatch(/--query/i);
     expect(stderr).toMatch(/--rerank-top-n/i);
     expect(stderr).toMatch(/deprecated/i);
-    expect(stderr).toMatch(/--workspace-id/i);
   });
 
   test("缺少 --index-id 时打印帮助并退出 (0)", async () => {
@@ -82,8 +81,6 @@ describe("e2e: knowledge retrieve errors", () => {
       {
         DASHSCOPE_API_KEY: undefined,
         DASHSCOPE_ACCESS_TOKEN: undefined,
-        ALIBABA_CLOUD_ACCESS_KEY_ID: undefined,
-        ALIBABA_CLOUD_ACCESS_KEY_SECRET: undefined,
         BAILIAN_CONFIG_DIR: tmpdir(),
       },
     );

packages/commands/src/commands/config/set.ts

@@ -21,15 +21,13 @@ const VALID_KEYS = [
   "default_image_model",
   "default_speech_model",
   "default_omni_model",
-  "access_key_id",
-  "access_key_secret",
   "workspace_id",
 ];
 
 // Keys whose values are secrets. Their stored value must never be echoed back in
 // cleartext (CI logs, pipes, shared terminals); show a masked form instead — the
 // same policy `config show` and `auth status` already follow.
-const SECRET_KEYS = new Set(["api_key", "access_token", "access_key_id", "access_key_secret"]);
+const SECRET_KEYS = new Set(["api_key", "access_token"]);
 
 // Allow hyphen-style keys (e.g. default-text-model → default_text_model)
 const KEY_ALIASES: Record<string, string> = {
@@ -42,8 +40,6 @@ const KEY_ALIASES: Record<string, string> = {
   "default-image-model": "default_image_model",
   "default-speech-model": "default_speech_model",
   "default-omni-model": "default_omni_model",
-  "access-key-id": "access_key_id",
-  "access-key-secret": "access_key_secret",
   "workspace-id": "workspace_id",
 };
 
@@ -56,7 +52,7 @@ export default defineCommand({
       type: "string",
       valueHint: "<key>",
       description:
-        "Config key (base_url, output, output_dir, timeout, api_key, access_token, default_*_model, access_key_id, access_key_secret, workspace_id)",
+        "Config key (base_url, output, output_dir, timeout, api_key, access_token, default_*_model, workspace_id)",
       required: true,
     },
     value: { type: "string", valueHint: "<value>", description: "Value to set", required: true },

packages/commands/src/commands/config/show.ts

@@ -27,11 +27,6 @@ export default defineCommand({
     if (typeof result.api_key === "string") result.api_key = maskToken(result.api_key);
     if (typeof result.access_token === "string")
       result.access_token = maskToken(result.access_token);
-    if (typeof result.access_key_id === "string")
-      result.access_key_id = maskToken(result.access_key_id);
-    if (typeof result.access_key_secret === "string") {
-      result.access_key_secret = maskToken(result.access_key_secret);
-    }
 
     emitResult(result, format);
   },