feat(config-ui): MCP management, skill zip install, and UI polish

- MCP: editable JSON config in the detail drawer with secret masking and
  mask-preserving writes; create/update/delete across claude-code, qwen-code,
  opencode, cursor, windsurf, gemini, qoderwork, openclaw and Claude Desktop
- Skills: upload a .zip and install into any agent's skills root (self-contained
  ZIP reader, zip-slip safe); scan more roots (openclaw workspace, qoderwork,
  windsurf/codeium, gemini antigravity, workbuddy)
- Markdown: GFM table rendering in the skill detail drawer
- Layout: collapsible grouped sidebar with icons + persistent state, responsive
  breakpoint, wider main, single-line tile titles, 2-line description clamp,
  round icon run buttons, custom file picker, modal spacing
- Server: /api/mcp POST/DELETE, /api/skill/install, binary upload reader,
  constant-time token compare, CSP/no-store headers, error logging

Author: inhai

packages/commands/src/commands/auth/console-ui.ts

@@ -0,0 +1,79 @@
+import { maskToken, type AuthStore, type Identity, type Settings } from "bailian-cli-core";
+import { runConsoleLogin, resolveConsoleOrigin } from "./login-console.ts";
+
+/** Read-only auth snapshot the config UI account widget renders. bl stores no
+ * user profile (name/avatar), so this exposes only which credential domains
+ * resolve, the console region/site, and a masked token. */
+export interface AuthUiStatus {
+  authenticated: boolean;
+  methods: { apiKey: boolean; console: boolean; openapi: boolean };
+  primary: "console" | "apiKey" | "openapi" | null;
+  region?: string;
+  site?: "domestic" | "international";
+  masked?: string;
+}
+
+/**
+ * The auth capability surface the config UI is allowed to use. All `authStore`
+ * access is kept inside this module (commands/auth/**), which the lint boundary
+ * permits; commands/config/** consumes only this opaque bridge and never
+ * touches `authStore` directly.
+ */
+export interface AuthUiBridge {
+  status(): AuthUiStatus;
+  /** Start browser-based console login (fire-and-forget; UI polls status). */
+  startConsoleLogin(): void;
+  /** Clear all stored credentials. Returns whether anything changed. */
+  logout(): Promise<boolean>;
+}
+
+/** Build the bridge from a command context (identity/settings/authStore). */
+export function makeAuthUiBridge(ctx: {
+  identity: Identity;
+  settings: Settings;
+  authStore: AuthStore;
+}): AuthUiBridge {
+  const { identity, settings, authStore } = ctx;
+  return {
+    status() {
+      const a = authStore.describe();
+      const methods = { apiKey: !!a.apiKey, console: !!a.console, openapi: !!a.openapi };
+      let masked: string | undefined;
+      if (a.console) masked = maskToken(a.console.token);
+      else if (a.apiKey) masked = maskToken(a.apiKey.token);
+      else if (a.openapi) masked = maskToken(a.openapi.accessKeyId);
+      const primary = a.console ? "console" : a.apiKey ? "apiKey" : a.openapi ? "openapi" : null;
+      return {
+        authenticated: methods.apiKey || methods.console || methods.openapi,
+        methods,
+        primary,
+        region: a.console?.region,
+        site: a.console?.site,
+        masked,
+      };
+    },
+    startConsoleLogin() {
+      const origin = resolveConsoleOrigin(authStore.describe().console?.site);
+      // Mirror the CLI (`bl auth login --console`): request an api_key from the
+      // console only when one isn't already stored, so a first console login in
+      // the config UI also provisions the model api_key (not just access_token).
+      const hasApiKey = !!authStore.stored().apiKey;
+      // runConsoleLogin opens the browser and runs its own callback server
+      // (up to 15 min). We don't await it — the config UI polls the status
+      // endpoint to detect completion. Errors are logged, not surfaced.
+      void runConsoleLogin(
+        origin,
+        { identity, settings, authStore },
+        {
+          needApiKey: !hasApiKey,
+        },
+      ).catch((err: unknown) => {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`console login failed: ${msg}\n`);
+      });
+    },
+    logout() {
+      return authStore.logout("all");
+    },
+  };
+}

packages/commands/src/commands/config/agent-launch.ts

@@ -22,6 +22,25 @@ export function agentCommand(id: string): string | undefined {
   return Object.prototype.hasOwnProperty.call(AGENT_COMMANDS, id) ? AGENT_COMMANDS[id] : undefined;
 }
 
+/**
+ * Per-agent argv that passes an initial task prompt while keeping the agent
+ * interactive in the terminal. Only verified contracts are listed; an agent
+ * absent here cannot be dispatched a prompt (its bare launch still works).
+ *   - qwen-code:   `qwen -i "<prompt>"`   (execute prompt, stay interactive)
+ *   - claude-code: `claude "<prompt>"`    (positional initial prompt)
+ *   - codex:       `codex "<prompt>"`     (positional initial prompt)
+ */
+const AGENT_PROMPT_ARGV: Record<string, (prompt: string) => string[]> = {
+  "qwen-code": (p) => ["-i", p],
+  "claude-code": (p) => [p],
+  codex: (p) => [p],
+};
+
+/** Whether a known agent supports being dispatched an initial task prompt. */
+export function agentSupportsPrompt(id: string): boolean {
+  return Object.prototype.hasOwnProperty.call(AGENT_PROMPT_ARGV, id);
+}
+
 /** Resolve whether a binary is reachable on PATH (via `which`/`where`). */
 function onPath(bin: string): Promise<boolean> {
   const cmd = process.platform === "win32" ? "where" : "which";
@@ -82,16 +101,31 @@ export interface LaunchResult {
 }
 
 /**
- * Launch a known coding agent's local CLI in a new terminal window.
- * Rejects when the id is unknown, the binary is missing from PATH, or the
- * platform terminal could not be opened.
+ * Launch a known coding agent's local CLI in a new terminal window. When
+ * `prompt` is provided, it is passed as a single quoted argument using the
+ * agent's verified prompt contract so the agent starts with that task.
+ * Rejects when the id is unknown, the binary is missing from PATH, the agent
+ * does not support prompt dispatch, or the platform terminal could not open.
  */
-export async function launchAgent(id: string, cwd: string = process.cwd()): Promise<LaunchResult> {
+export async function launchAgent(
+  id: string,
+  cwd: string = process.cwd(),
+  prompt?: string,
+): Promise<LaunchResult> {
   const command = agentCommand(id);
   if (!command) throw new Error(`Unknown agent: ${id}`);
   if (!(await onPath(command))) {
     throw new Error(`\`${command}\` was not found on your PATH — install ${id} first.`);
   }
-  await spawnTerminal(command, cwd);
-  return { launched: true, command };
+  let fullCommand = command;
+  const task = (prompt ?? "").trim();
+  if (task) {
+    const build = AGENT_PROMPT_ARGV[id];
+    if (!build) throw new Error(`${id} does not support dispatching a task prompt.`);
+    // shQuote keeps the whole prompt as one shell argument (no injection); the
+    // platform terminal layer escapes the resulting command line separately.
+    fullCommand = [command, ...build(task).map(shQuote)].join(" ");
+  }
+  await spawnTerminal(fullCommand, cwd);
+  return { launched: true, command: fullCommand };
 }

packages/commands/src/commands/config/assets.ts

@@ -1,8 +1,10 @@
 // Read/manage the local assets that `bl` writes into the output directory
 // (default ~/bailian-output, overridable via the `output_dir` config key).
-// Generated media is organized into per-type subdirectories: images/, videos/,
-// speech/, omni/. This module discovers those files, classifies them, and
-// provides safe path resolution for serving/deleting individual assets.
+// Generated media may live directly under the base or in any subfolder (bl's
+// own images/, videos/, speech/, omni/, or user-created folders). This module
+// recursively discovers every file under the base, classifies each by type,
+// derives its category from the top-level folder, and provides safe path
+// resolution for serving/deleting individual assets.
 import { readdirSync, statSync, existsSync, type Dirent } from "node:fs";
 import { homedir } from "node:os";
 import { join, extname, relative, resolve, sep } from "node:path";
@@ -23,8 +25,8 @@ export interface AssetInfo {
   ext: string;
 }
 
-/** Category subdirectories that `bl` writes generated media into. */
-const CATEGORY_DIRS = ["images", "videos", "speech", "omni"] as const;
+/** Max directory depth to descend from the output base when scanning. */
+const MAX_SCAN_DEPTH = 8;
 
 const KIND_BY_EXT: Record<string, AssetKind> = {
   ".png": "image",
@@ -101,9 +103,11 @@ function walk(dir: string, depth: number, out: string[]): void {
 }
 
 /**
- * List generated assets under `base`, newest first. Scans each known category
- * subdirectory plus any loose files directly under the base (grouped as
- * "other"). Returns the resolved base so callers can surface it in the UI.
+ * List generated assets under `base`, newest first. Recursively scans every
+ * subfolder under the base (plus loose files at the root), so assets in bl's
+ * own category dirs and any user-created folders are all discovered. Each
+ * file's `category` is its top-level folder name, or "other" for root files.
+ * Returns the resolved base so callers can surface it in the UI.
  */
 export function listAssets(base: string = defaultOutputBase()): {
   base: string;
@@ -112,44 +116,30 @@ export function listAssets(base: string = defaultOutputBase()): {
   const assets: AssetInfo[] = [];
   if (!existsSync(base)) return { base, assets };
 
-  const seen = new Set<string>();
-  const addFile = (full: string, category: string): void => {
-    if (seen.has(full)) return;
-    seen.add(full);
+  const files: string[] = [];
+  walk(base, MAX_SCAN_DEPTH, files);
+
+  for (const full of files) {
     let st;
     try {
       st = statSync(full);
     } catch {
-      return;
+      continue;
     }
-    if (!st.isFile()) return;
+    if (!st.isFile()) continue;
+    const rel = relative(base, full);
+    const segments = rel.split(sep);
+    const category = segments.length > 1 ? segments[0]! : "other";
     const ext = extname(full);
     assets.push({
       name: full.split(sep).pop() ?? full,
       category,
       kind: kindOf(ext),
-      relPath: relative(base, full),
+      relPath: rel,
       size: st.size,
       mtime: st.mtimeMs,
       ext: ext.replace(/^\./, "").toLowerCase(),
     });
-  };
-
-  for (const cat of CATEGORY_DIRS) {
-    const files: string[] = [];
-    walk(join(base, cat), 4, files);
-    for (const f of files) addFile(f, cat);
-  }
-
-  // Loose files placed directly under the base directory.
-  let rootEntries: Dirent[] = [];
-  try {
-    rootEntries = readdirSync(base, { withFileTypes: true });
-  } catch {
-    rootEntries = [];
-  }
-  for (const e of rootEntries) {
-    if (e.isFile() || e.isSymbolicLink()) addFile(join(base, e.name), "other");
   }
 
   assets.sort((a, b) => b.mtime - a.mtime);