@@ -175,3 +175,4 @@ pnpm -F bailian-cli exec tsx src/main.ts usage stats --dry-run --output json --w
 - ✗ token mask 显示完整 token,日志泄漏
 - ✗ `auth: "console"` 命令误用 `apiKey` 域,config 只有 API key 时会把 `sk-...` 发到网关
 - ✗ 新增 core resolver hint 时写死产品命令,导致 `kscli` 等入口提示错误
+- ✗ Windows 上用 `cmd /c start` 打开带 `&` 的 URL 时没把整段目标括起来。`auth login --console` 的 `needapikey=true` 会被 cmd 当成下一条命令,浏览器只拿到控制台会话。打开参数走 `packages/commands/src/commands/shared/local-server.ts` 的 `buildOpenInvocation`（dsh 插件里有一份同步实现）
@@ -160,16 +160,53 @@ async function extractCredentials(
   return pickCallbackCredentials(Object.fromEntries(url.searchParams), body);
 }
 
-/** Open a URL with the OS default handler; never routed through a shell. */
+/**
+ * Quote a value for `cmd.exe`. `%` is doubled because cmd expands variables even
+ * inside quotes; embedded `"` becomes `""`.
+ * Keep in sync with `buildOpenInvocation` in
+ * `packages/commands/src/commands/shared/local-server.ts`.
+ */
+function quoteForCmd(value: string): string {
+  return `"${value.replaceAll("%", "%%").replaceAll('"', '""')}"`;
+}
+
+/**
+ * Command that opens `target` with the OS default handler.
+ * On Windows, `cmd.exe` splits an unquoted `&`, so `needapikey=true` never
+ * reaches the browser. See `buildOpenInvocation` in the commands package.
+ */
+export function buildOpenInvocation(
+  target: string,
+  platform = process.platform,
+): { command: string; args: string[]; windowsVerbatimArguments?: boolean } {
+  if (platform === "win32") {
+    const inner = `start "" ${quoteForCmd(target)}`;
+    return {
+      command: "cmd",
+      args: ["/d", "/v:off", "/s", "/c", `"${inner}"`],
+      windowsVerbatimArguments: true,
+    };
+  }
+  if (platform === "darwin") return { command: "open", args: [target] };
+  return { command: "xdg-open", args: [target] };
+}
+
+/** Open a URL with the OS default handler. */
 function openInBrowser(url: string): Promise<void> {
-  const cmd =
-    process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
-  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  const invocation = buildOpenInvocation(url);
   return new Promise((resolve, reject) => {
-    execFile(cmd, args, { windowsHide: true }, (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
+    execFile(
+      invocation.command,
+      invocation.args,
+      {
+        windowsHide: true,
+        windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+      },
+      (err) => {
+        if (err) reject(err);
+        else resolve();
+      },
+    );
   });
 }
 
 
@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vite-plus/test";
 import {
+  buildOpenInvocation,
   consoleLoginState,
   parseCallbackBody,
   pickCallbackCredentials,
@@ -68,3 +69,14 @@ describe("consoleLoginState", () => {
     expect(consoleLoginState()).toEqual({ phase: "idle" });
   });
 });
+
+describe("buildOpenInvocation", () => {
+  it("quotes a Windows start target so & stays inside the URL", () => {
+    const url =
+      "https://bailian.console.aliyun.com/console-login?notice=127.0.0.1:1?state=abc&needapikey=true";
+    const invocation = buildOpenInvocation(url, "win32");
+    const command = invocation.args.at(-1) ?? "";
+    expect(invocation.windowsVerbatimArguments).toBe(true);
+    expect(command.slice(1, -1)).toBe(`start "" "${url}"`);
+  });
+});
@@ -1,4 +1,10 @@
-import { maskToken, type AuthStore, type Identity, type Settings } from "bailian-cli-core";
+import {
+  maskToken,
+  type AuthStore,
+  type Identity,
+  type LocalizedText,
+  type Settings,
+} from "bailian-cli-core";
 import { runConsoleLogin, resolveConsoleOrigin } from "./login-console.ts";
 
 /** Read-only auth snapshot the config UI account widget renders. bl stores no
@@ -32,8 +38,9 @@ export function makeAuthUiBridge(ctx: {
   identity: Identity;
   settings: Settings;
   authStore: AuthStore;
+  localize?: (text: LocalizedText) => string;
 }): AuthUiBridge {
-  const { identity, settings, authStore } = ctx;
+  const { identity, settings, authStore, localize } = ctx;
   return {
     status() {
       const a = authStore.describe();
@@ -63,7 +70,7 @@ export function makeAuthUiBridge(ctx: {
       // endpoint to detect completion. Errors are logged, not surfaced.
       void runConsoleLogin(
         origin,
-        { identity, settings, authStore },
+        { identity, settings, authStore, localize },
         {
           needApiKey: !hasApiKey,
         },
 
@@ -8,6 +8,7 @@ import {
   type AuthStore,
   type ConfigFile,
   type Identity,
+  type LocalizedText,
   type Settings,
 } from "bailian-cli-core";
 import { listenLocalServer, openInBrowser } from "../shared/local-server.ts";
@@ -18,6 +19,13 @@ export interface LoginDeps {
   identity: Identity;
   settings: Settings;
   authStore: AuthStore;
+  /** 缺省时用户可见新文案回退到 en-US。 */
+  localize?: (text: LocalizedText) => string;
+}
+
+function localizeLogin(deps: LoginDeps, text: LocalizedText): string {
+  if (typeof text === "string") return text;
+  return deps.localize ? deps.localize(text) : text["en-US"];
 }
 
 const CONSOLE_LOGIN_TIMEOUT_MS = 15 * 60 * 1000;
@@ -371,6 +379,7 @@ export async function runConsoleLogin(
 ): Promise<void> {
   const state = randomBytes(16).toString("hex");
   let callbackError: unknown;
+  let savedSessionWithoutApiKey = false;
   const server = http.createServer(async (req, res) => {
     try {
       if (req.method === "OPTIONS") {
@@ -423,6 +432,7 @@ export async function runConsoleLogin(
               ...callbackPatch,
               base_url: baseUrl || undefined,
             });
+            savedSessionWithoutApiKey = true;
             process.stderr.write(`Config saved to ${deps.authStore.path}\n`);
           }
         } catch (err: unknown) {
@@ -506,4 +516,14 @@ export async function runConsoleLogin(
   if (callbackError) {
     throw callbackError;
   }
+
+  if (opts?.needApiKey && savedSessionWithoutApiKey) {
+    const binName = deps.identity.binName;
+    process.stderr.write(
+      `${localizeLogin(deps, {
+        "en-US": `Saved the console session only. Model commands still need an API key: ${binName} auth login --console, or ${binName} auth login --api-key <key>`,
+        "zh-CN": `仅保存了控制台会话。模型命令仍需要 API Key：${binName} auth login --console，或 ${binName} auth login --api-key <key>`,
+      })}\n`,
+    );
+  }
 }
@@ -119,7 +119,7 @@ export default defineCommand({
   async run(ctx) {
     const { identity, settings, flags } = ctx;
     const store = ctx.authStore;
-    const deps = { identity, settings, authStore: store };
+    const deps = { identity, settings, authStore: store, localize: ctx.localize };
     const key = flags.apiKey;
     const baseUrl = flags.baseUrl ? normalizeModelBaseUrl(flags.baseUrl) : undefined;
 
 
@@ -10,7 +10,7 @@ export default defineCommand({
   auth: "none",
   exampleArgs: ["", "--output json"],
   async run(ctx) {
-    const { identity, settings } = ctx;
+    const { identity, settings, localize } = ctx;
     const format = detectOutputFormat(settings.output);
     const auth = ctx.authStore.describe();
 
@@ -40,6 +40,12 @@ export default defineCommand({
     const authenticated = !!(apiKey || consoleCred || openapi);
     const configName = settings.configName ?? "default";
     const configFile = ctx.authStore.path;
+    const modelKeyHint = apiKey
+      ? undefined
+      : localize({
+          "en-US": `No model API key is configured. Model commands need: ${identity.binName} auth login --console, or ${identity.binName} auth login --api-key <key>`,
+          "zh-CN": `尚未配置模型 API Key。模型命令需要：${identity.binName} auth login --console，或 ${identity.binName} auth login --api-key <key>`,
+        });
 
     if (!authenticated) {
       emitResult(
@@ -69,6 +75,7 @@ export default defineCommand({
           api_key: apiKey,
           console: consoleCred,
           openapi,
+          ...(modelKeyHint ? { hint: modelKeyHint } : {}),
         },
         format,
       );
@@ -82,6 +89,7 @@ export default defineCommand({
       emitBare(`  API key (model):  ${apiKey.source}  ${apiKey.masked}`);
     } else {
       emitBare("  API key (model):  not configured");
+      if (modelKeyHint) emitBare(`  ${modelKeyHint}`);
     }
     if (consoleCred) {
       emitBare(
 
@@ -22,21 +22,65 @@ export function listenLocalServer(server: http.Server, port = 0): Promise<number
   });
 }
 
+export interface OpenInvocation {
+  command: string;
+  args: string[];
+  /** Windows only: keep the quotes we added for `cmd.exe`. */
+  windowsVerbatimArguments?: boolean;
+}
+
+/**
+ * Quote a value for `cmd.exe`. `%` is doubled because cmd expands variables even
+ * inside quotes; embedded `"` becomes `""`.
+ */
+function quoteForCmd(value: string): string {
+  return `"${value.replaceAll("%", "%%").replaceAll('"', '""')}"`;
+}
+
+/**
+ * Command that opens `target` with the OS default handler.
+ *
+ * On Windows, `start` is a `cmd.exe` builtin. An empty argv slot is not enough:
+ * cmd re-parses the command line and treats an unquoted `&` as a separator, so
+ * `...&needapikey=true` never reaches the browser. `start` also consumes the
+ * first quoted argument as a window title. `/d` skips AutoRun, `/v:off` disables
+ * delayed expansion, and `/s /c` strips one outer quote pair, leaving:
+ * `start "" "<target>"`.
+ */
+export function buildOpenInvocation(target: string, platform = process.platform): OpenInvocation {
+  if (platform === "win32") {
+    const inner = `start "" ${quoteForCmd(target)}`;
+    return {
+      command: "cmd",
+      args: ["/d", "/v:off", "/s", "/c", `"${inner}"`],
+      windowsVerbatimArguments: true,
+    };
+  }
+  if (platform === "darwin") {
+    return { command: "open", args: [target] };
+  }
+  return { command: "xdg-open", args: [target] };
+}
+
 /**
  * Open a local file, directory, or URL with the OS default handler
- * (best-effort, cross-platform). Arguments are passed to `execFile` as an array
- * so the target is never interpreted by a shell.
+ * (best-effort, cross-platform).
  */
 export function openPath(target: string): Promise<void> {
-  const platform = process.platform;
-  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
-  const args = platform === "win32" ? ["/c", "start", "", target] : [target];
-
+  const invocation = buildOpenInvocation(target);
   return new Promise((resolve, reject) => {
-    execFile(cmd, args, { windowsHide: true }, (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
+    execFile(
+      invocation.command,
+      invocation.args,
+      {
+        windowsHide: true,
+        windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+      },
+      (err) => {
+        if (err) reject(err);
+        else resolve();
+      },
+    );
   });
 }
 
 
@@ -681,6 +681,47 @@ describe("e2e: auth", () => {
     expect(stderr).not.toContain("Cleared api_key");
   });
 
+  test("auth status 在只有控制台会话时标明模型 API Key 仍未配置", async () => {
+    const configDir = makeE2eOutputDir("auth-status-console-only");
+    writeFileSync(
+      join(configDir, "config.json"),
+      JSON.stringify({
+        language: "zh-CN",
+        access_token: "console-token-placeholder",
+        console_region: "cn-beijing",
+        console_site: "domestic",
+      }),
+    );
+    const env = {
+      BAILIAN_CONFIG_DIR: configDir,
+      DASHSCOPE_API_KEY: undefined,
+      DASHSCOPE_BASE_URL: undefined,
+      ALIBABA_CLOUD_ACCESS_KEY_ID: undefined,
+      ALIBABA_CLOUD_ACCESS_KEY_SECRET: undefined,
+      ALIBABA_CLOUD_SECURITY_TOKEN: undefined,
+    };
+
+    const json = await runCommandE2e(AUTH_ROUTES, ["auth", "status", "--output", "json"], env);
+    expect(json.exitCode, json.stderr).toBe(0);
+    const data = parseStdoutJson<{
+      authenticated?: boolean;
+      api_key?: unknown;
+      console?: { region?: string };
+      hint?: string;
+    }>(json.stdout);
+    expect(data.authenticated).toBe(true);
+    expect(data.api_key).toBeUndefined();
+    expect(data.console?.region).toBe("cn-beijing");
+    expect(data.hint).toContain("尚未配置模型 API Key");
+    expect(data.hint).toContain("bl auth login --api-key <key>");
+    expect(json.stdout).not.toContain("console-token-placeholder");
+
+    const text = await runCommandE2e(AUTH_ROUTES, ["auth", "status", "--output", "text"], env);
+    expect(text.exitCode, text.stderr).toBe(0);
+    expect(text.stdout).toContain("API key (model):  not configured");
+    expect(text.stdout).toContain("尚未配置模型 API Key");
+  });
+
   test("auth logout 清除当前 Config 的全部凭证和 Base URL，保留普通配置", async () => {
     const configDir = makeE2eOutputDir("auth-logout-all");
     writeFileSync(