[bug] local file upload (upload policy) always 401 InvalidApiKey under token-plan profile

[zentnertrench-design]

Environment

• CLI: bl 1.17.0
• Skill: 1.17.0
• Node: v26.0.0
• OS: macOS 26.6.2 (arm64)
• Region: cn-beijing (domestic site)
• Profile: token-plan (base_url https://token-plan.cn-beijing.maas.aliyuncs.com, API key sk-sp-*** [REDACTED])

Reproduce

# key stored via `bl auth login --config token-plan --api-key sk-sp-***` (CLI reported "Testing key... Valid")
bl file upload --file /tmp/probe.txt --model qwen3-vl-plus --config token-plan
# equivalently:
bl vision describe --config token-plan --video ~/video.mp4 --prompt "describe"

Expected

The CLI uploads the local file to DashScope temporary storage (oss://, 48h) and the command proceeds — documented behavior for every command that accepts a file URL; token-plan is a supported profile.

Actual

The upload-policy request fails with HTTP 401 InvalidApiKey; exit code 1. Model calls with the same key work fine.

Full output

Error:       Failed to get upload policy (HTTP 401): {"code":"InvalidApiKey","message":"Invalid API-key provided.","request_id":"52d748d6-093f-9051-b780-1954c855683b"}
Exit code:   1

JSON error

{
  "error": {
    "code": 1,
    "message": "Failed to get upload policy (HTTP 401): {\"code\":\"InvalidApiKey\",\"message\":\"Invalid API-key provided.\",\"request_id\":\"52d748d6-093f-9051-b780-1954c855683b\"}"
  }
}

Evidence (curl probes with the same API key)

1. Key is valid for model calls on the token-plan gateway:
   • bl auth login --config token-plan --api-key sk-sp-*** → "Testing key... Valid"
   • bl text chat --config token-plan → 200 OK (qwen3.8-max)
2. POST https://token-plan.cn-beijing.maas.aliyuncs.com/api/v1/uploads?action=getPolicy&model=qwen3-vl-plus with Authorization: Bearer sk-sp-*** → 404 (uploads API not present on the token-plan gateway)
3. POST https://dashscope.aliyuncs.com/api/v1/uploads?action=getPolicy&model=qwen3-vl-plus with the same key → 401 InvalidApiKey (request_id 90e8ef4f-2d13-93a3-afe2-43a1b0a9d44e; standard gateway does not accept sk-sp- keys)

Inference: under the token-plan profile there is no working endpoint for the upload-policy flow — the CLI's upload path is rejected by the standard gateway (401) while the token-plan gateway does not expose the uploads API at all (404). Local-file auto-upload is therefore unusable with Token Plan, although it is documented and the profile is otherwise functional.

Additional request IDs from bl runs: 3e92b78d-8812-9cf8-84d4-73eea102a745 (bl vision describe --video), 1c1bee55-c6c8-9fce-af28-f44b160d21d8 (bl file upload).

Already tried

• CLI version == skill version (1.17.0); npm registry unreachable for update check
• bl auth status healthy; login re-validated the key as Valid
• Retried multiple times — 100% repro
• curl probes confirm the failure is endpoint-level, not argument-level

Notes

• Frequency: always
• Invoked via: agent (DeepSeek Harness)
• Impact: any local file input (vision describe --image/--video, image/video/speech commands) fails under token-plan; workaround requires externally hosted URLs.