[bug] auth login --console on Windows: browser URL is truncated at &, so needapikey=true is dropped and no API key is created

Start with the browser-opening code path that runs cmd /c start on Windows, which builds the console-login URL and is the source of the unquoted &needapikey=true truncation. Then look at the console-login flow that decides whether to request an API key, and at the non-TTY branch of bl auth login --console that exits and closes the callback port. Done when the URL reaches the browser intact with needapikey=true, and a non-TTY login either waits for completion or prints a clear instruction.

Environment

• CLI: bl 2.1.0
• Skill: 2.1.0
• Node: v24.21.0 (npm 11.19.0)
• OS: Windows 11 家庭版 (Chinese), build 26200, PowerShell 7.6.6
• Region: cn-beijing (domestic, bailian.console.aliyun.com)

Reproduce

1. On a Windows machine with no model API key configured (bl auth status → authenticated: false), run:

   bl auth login --console
   

2. The CLI tries to open the browser via cmd /c start <url>; the URL contains &needapikey=true, which cmd treats as a command separator.

Expected

The browser opens the full console-login URL (including needapikey=true) and an ordinary API key is created and stored, so model commands work afterwards.

Actual

stderr:

Could not open the default browser (Command failed: cmd /c start  https://bailian.console.aliyun.com/console-login?notice=127.0.0.1:49309?state=<state>&needapikey=true
'needapikey' 不是内部或外部命令，也不是可运行的程序或批处理文件。
). Open this URL manually:

The console page still reports “CLI 登录成功”, and bl auth status becomes authenticated: true, but only a console-session token is stored — no model API key is written to ~/.bailian/config.json (top-level keys stay access_token / workspace_id / console_site / console_region / console_switch_agent). Model commands keep failing:

bl text chat --message "hello"
Error:       No API key found.

Two separate problems on Windows/agent environments:

1. cmd /c start <url> is not quoted, so the URL is cut at the first & and &needapikey=true never reaches the console page.
2. In a non-TTY environment (agent/CI), bl auth login --console prints the URL, then immediately says “This process keeps the local port open for the console … (or wait for idle timeout)” and exits right away, so the local callback port is gone before the user can finish the login.

Note: the printed URL also reads ...?notice=127.0.0.1:<port>?state=<state>&needapikey=true — notice appears to embed a second ? where & would be expected; combined with (1) this makes the truncation hard to notice.

Full output

Could not open the default browser (Command failed: cmd /c start  https://bailian.console.aliyun.com/console-login?notice=127.0.0.1:54675?state=<state>&needapikey=true
'needapikey' 不是内部或外部命令，也不是可运行的程序或批处理文件。
). Open this URL manually:

https://bailian.console.aliyun.com/console-login?notice=127.0.0.1:54675?state=<state>&needapikey=true

This process keeps the local port open for the console; press Ctrl+C when finished (or wait for idle timeout).
Config saved to C:\Users\<user>\.bailian\config.json

{
  "authenticated": true,
  "config": "default",
  "config_file": "C:\\Users\\<user>\\.bailian\\config.json",
  "console": { "source": "config", "masked": "[REDACTED]", "region": "cn-beijing", "site": "domestic" }
}

Already tried

• bl --version (2.1.0) matches the installed skill version (2.1.0) and the latest npm version — no upgrade pending
• Re-ran bl auth login --console several times (also with --timeout 900); the process still exits immediately in a non-TTY session
• Opening the printed URL manually does complete the console-session handshake, but the stored credential still has no API key
• Workaround that worked: use the console's one-click script (https://bailian.aliyun.com/api-key.ps1, run with KEY/REGION/WORKSPACE env vars), which decodes the o1_… key and runs bl auth login --config default --api-key <plain> --base-url https://<workspace>.<region>.maas.aliyuncs.com

Suggested fixes

1. Quote the URL and pass an explicit title when opening the browser on Windows, e.g. cmd /c start "" "<url>" (or use Start-Process), so & is not treated as a separator.
2. In a non-TTY environment, either keep the callback port open until the login completes / times out, or detect the non-TTY case and print “complete this login in an interactive terminal, or use --api-key”.
3. Make auth status / the success page distinguish “console session only” from “model API key configured”, so users don't believe setup finished while model commands still fail with No API key found.

Notes

• Frequency: always (Windows 11, PowerShell; reproduced 3×)
• Invoked via: coding agent (non-TTY) on Windows; the same command in an interactive terminal still loses needapikey=true because of (1)
• Secrets: API keys and console tokens are redacted as [REDACTED]