[bug] Local media upload is pinned to China endpoint; Singapore workspace API key fails getPolicy (401 InvalidApiKey)

Start with packages/core/src/files/upload.ts and trace how the active profile’s base_url or region reaches resolveFileUrl, uploadFile, and getUploadPolicy. Confirm which regions support the temporary upload policy, then add the proposed host selection and unsupported-region handling with tests for China, Singapore, and an unsupported region. Done means local uploads use a supported regional endpoint or explain how to use an HTTPS reference; the issue names no test file.

Summary

Local reference files cannot be uploaded from an international Singapore (ap-southeast-1) Model Studio workspace using bl video ref. The local-file upload path requests an OSS upload policy from the China DashScope endpoint regardless of the active profile's base_url, and that request fails with HTTP 401 InvalidApiKey.

This fails before the video-generation task is submitted. Passing an already-hosted HTTPS reference is a practical workaround because that bypasses local auto-upload.

Environment

• Bailian CLI: 2.3.2
• OS: macOS on Apple Silicon (arm64)
• Active config: default
• Console site: international
• Region: ap-southeast-1 (Singapore)
• API key: configured, redacted (workspace-specific key)
• base_url: https://ws-<workspace-id>.ap-southeast-1.maas.aliyuncs.com (workspace ID redacted)
• Model: wan3.0-video

Sanitized output of bl auth status --output json:

{
  "authenticated": true,
  "config": "default",
  "api_key": {
    "source": "config",
    "masked": "<REDACTED>",
    "base_url": "https://ws-<workspace-id>.ap-southeast-1.maas.aliyuncs.com"
  },
  "console": {
    "source": "config",
    "masked": "<REDACTED>",
    "region": "ap-southeast-1",
    "site": "international"
  }
}

Note: The authenticated: true status indicates that credentials are configured; this alone is not a live validity check.

Steps to reproduce

1. Configure a Model Studio API key and workspace endpoint for ap-southeast-1.
2. Confirm the active profile with bl auth status --output json.
3. Place an existing short MP4 in the current directory (for example, sample.mp4).
4. Run the supported local-reference workflow:

bl video ref \
  --model wan3.0-video \
  --ref-video ./sample.mp4 \
  --prompt "Video 1 continues moving" \
  --duration 5 \
  --resolution 720P \
  --ratio 9:16

The original failure was observed through a small wrapper that delegates reference-video generation to bl, using a 4.97-second MP4 reference and requesting 5 seconds of output at 480P. The error occurs while obtaining the upload policy, before the requested generation resolution is validated or the model task is submitted. The command above uses the CLI-documented 720P to isolate the upload problem.

Actual behavior

Failed to get upload policy (HTTP 401):
{"code":"InvalidApiKey","message":"Invalid API-key provided.","request_id":"3e6e555d-dcd5-9fd6-a05e-502c5a0e48eb"}

No task is submitted.

Root-cause evidence

The current implementation hardcodes the CN API host:

https://github.com/modelstudioai/cli/blob/main/packages/core/src/files/upload.ts

// Pinned to cn region; thread baseUrl through if overseas upload becomes a requirement.
const UPLOAD_API = `${REGIONS.cn}/api/v1/uploads`;

getUploadPolicy() builds its request from this constant. uploadFile() and resolveFileUrl() accept the API key and model, but do not propagate the active profile's base_url or region to the upload-policy request.

As a result, the Singapore workspace key is sent to a different regional endpoint than the configured model API. The mismatch is a strong explanation for this 401. The exact availability of the temporary upload-policy API in Singapore should be confirmed independently; a region-aware implementation should not assume all regions expose the same upload endpoint.

Expected behavior

• The uploader must respect the active profile/region when the corresponding upload service is supported.
• If local-file temporary uploads are unavailable in a given region, fail early with a precise explanation and guidance to use a reachable HTTPS media URL, rather than presenting the response as a generic invalid API key.
• bl video ref --ref-video <local-file> should not silently use a China-only upload endpoint for an international profile.
• The error message should include the effective upload region/host (without exposing credentials).

Suggested fix

1. Thread the effective base_url / region context from the client through resolveFileUrl, uploadFile, and getUploadPolicy.
2. Resolve the upload-policy endpoint by supported region; distinguish an unsupported upload API from an invalid credential.
3. Add unit tests asserting which host receives getPolicy for CN and international profiles, plus a negative test for an unsupported region.
4. Document HTTPS-reference input as an alternative when automatic local upload is not supported.

Workaround

Host the MP4 on an HTTPS endpoint reachable by Model Studio (for example, a temporary signed Cloudflare R2 GET URL) and pass that HTTPS URL to --ref-video instead of the local path. resolveFileUrl() leaves HTTPS inputs unchanged and skips the upload-policy request.

Related issues

• #171 — upload-policy 401 with a China token-plan profile (different credential/region combination).
• #264 — API key/profile precedence mismatch on other requests (may be related, but does not address the hardcoded uploader host).

This report concerns Singapore workspace-key local uploads specifically, not a token-plan key or generic auth-profile selection problem.