DEV Community: xiaoru chen

Cloudflare's security-audit skill rejected my output 7 times

xiaoru chen — Wed, 07 Oct 2026 14:21:35 +0000

Security reports written by agents have a specific smell. The findings are confident, the file references are approximate, and some of them do not survive a ten-minute check. I have thrown away more of these than I have used, mostly because disproving a fabricated vulnerability costs more than finding a real one.

So when cloudflare/security-audit-skill showed up third on a third-party GitHub weekly ranking the week I was looking at it (+9,047 stars, aggregator numbers rather than an official GitHub list), I read past the pitch. The README opens with "A coding-agent skill that turns your agent into a security auditor." Fine. The part I cared about was two scripts with no dependencies that validate the artifacts the agent writes: validate-coverage-ledger.cjs and validate-findings.cjs.

I installed it, planted three vulnerabilities in a two-file demo repo of my own, and ran a restricted audit. The validators rejected my output seven times before anything counted. This is the show-and-tell version.

The setup

The skill is agent-agnostic. Its one requirement is quoted here exactly as written: "A coding agent with a model that supports tool use and parallel sub-agents".

Mine is Qwen Code with the model set to qwen3.8-max, baseUrl pointing at https://dashscope.aliyuncs.com/compatible-mode/v1 (Alibaba Cloud Model Studio, also known as Bailian). qwen3.8-max supports function calling, so tool use is covered. Keys come from the console API key page, region China Beijing.

Install, copied from the README:

npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

I ended up dropping the skill directory into my workspace's agent skills folder, which is the same thing on disk. Use the command above.

The repo contains SKILL.md, thirteen attack-surface knowledge files, a report-schema.json, the two validators, and tests. Six phases run in order: Reconnaissance, Coverage-led hunting, Candidate validation, Structured output, Independent record verification, Target-neutral reporting. Three profiles control how much work each phase does. I picked quick, the restricted path for small targets: coarse-grained coverage units, one hunter wave, one critic pass.

The target was mine, and the bugs were mine

Two files. Three vulnerabilities I wrote in deliberately:

a query parameter concatenated into eval()
a hardcoded key with a live-looking prefix sitting in source
an upload filename joined into a path with no sanitization

Worth saying out loud: nothing real was audited. The findings below describe my own throwaway code and nothing else.

Three rejections on the ledger

Phase 1 writes coverage-ledger.json. My first version was an object wrapping an array, because that is how I would design it. The validator disagreed immediately:

ERROR: $: expected a top-level array

Second version, top-level array, and it listed fourteen required fields I had left out: coverage_id, canonical_refs, subsystem, starting_paths, ordinary_attack_class_block, among others.

Third version was rejected on semantics rather than missing fields. coverage_id is not a label you make up. It is derived: take the unit's surface, boundary, subsystem, and attack class, percent-encode each, join with ::. unresolved must be an array. And a unit still in planned state cannot have an agent assigned, so agent_id stays null until something is actually working on it.

Fourth version:

PASS: 3 coverage units valid

The derived ID makes sense once you notice that the README describes repeat runs as additive. The skill reads the previous ledger and findings, re-verifies units whose source changed, and carries unchanged evidence forward with its fingerprint. Identity that comes from the unit's coordinates survives a re-run. Identity that comes from whoever wrote the file does not.

Four rejections on the findings

Hunting and falsification went as you would hope, and all three planted bugs reproduced:

1. eval injection    input: ' || '1'=='1                            -> returned rows: 1 (expected 0)
2. path traversal    resolve('/tmp/uploads/' + '../../etc/passwd')  -> /etc/passwd
3. hardcoded key     grep -n sk-live src/server.js                  -> 3:const API_KEY = 'sk-live-...'

Writing them into findings.json is where the skill got picky, across four failed versions:

every trace entry needs a kind of entrypoint, propagation, or sink, plus file, line, scope, description
evidence anchors to file and line; quoting a chunk of code is not evidence
conditions is an array
the execution block needs attacker_perspective, payloads, instructions, observed_result
severity and confidence are objects with a score and a reason, and severity additionally needs an overall_severity from a string enum
the array sorts lexicographically by fingerprint

Version five passed: PASS: 3 findings valid.

Read that list as a set of questions instead of a schema and it is a decent audit methodology. Where does attacker input enter? How does it reach the sink? What did you run, with what payload, and what came back? How severe, and why do you say so? Prose answers let you skip any of them. Structured fields do not.

What I would tell you before installing it

The seven rejections were never about the model being weak. Every one was container type, missing field, wrong enum, unsorted array, or an ID that had to be derived. That is the point of the design: fabricating a finding means fabricating a trace anchored to a real file and line, an execution block that reproduces, and a severity object that validates. Making things up gets more expensive than checking.

Also be clear about what my run does not cover. Quick profile on a two-file repo, one time through. Phases 5 and 6 never ran, so there was no independent re-verification of my records and no target-neutral report. I ran hunter and verifier serially in a single agent, which means the parallel sub-agent orchestration the README asks for is untested by me. And the star count is a third-party aggregator's weekly figure.

If you want the same experience, the loop is short: install the skill, plant two or three bugs in a repo you own, run the quick profile, and count your rejections. Mine was seven, and the number is the useful part, because each one points at a field you thought you could hand-wave.

Model side needs nothing exotic. The requirement is a coding agent whose model supports tool use and parallel sub-agents; mine runs on qwen3.8-max through Bailian, and I drove the whole audit from one agent. The Bailian CLI (bl) page covers the CLI and the model list on Alibaba Cloud Model Studio.

Has a schema ever talked you out of a finding you were sure about? I am curious whether other people's agents fail on the same fields, or whether overall_severity being a string enum was just my week.

I Missed a Watermark in My Own Photo. A Vision Model Read It Out Loud.

xiaoru chen — Thu, 24 Sep 2026 02:52:50 +0000

The corner I never looked at

I curated a batch of event photos for a colleague last week. Before sending them over I did my own pass: composition, exposure, stray bystanders, anything embarrassing in the background. All clear, so I hit send.

The next morning: "what's that line of text in the bottom-right corner?"

At 300% zoom there it was. A light-gray copyright line, small enough that I had looked straight at that corner several times and registered nothing. Human vision is blind to the unexpected periphery — you look at the subject, and the corners go dark. The annoying part wasn't the miss. It was realizing my "check" had never covered that class of thing at all.

So I re-ran the batch through the vision describe command in the Bailian CLI (bl), asking it what text was on screen. It read out every line, including the watermark I missed. Then I did the thing I should always do before trusting a model output that flatters me: I tried to make it fail.

One image proves nothing

Here's the failure mode that actually matters with vision models. It isn't blur, and it isn't misreading a character. It's answering about an image it never really inspected — producing a plausible-sounding description because the question implied one.

Ask "is there a watermark in this photo?" and a model that wants to be helpful has a cheap path to an answer. If I'd stopped at that one run, I'd have had a screenshot showing it found my watermark, and zero evidence it wasn't just agreeing with me.

That's why the test needs a control. Same media, one variable changed, same question both times. If the model reads the mark when it's there and says "nothing in the corners" when it isn't, it's looking. If it says "yes, watermark" both times, it's guessing.

Building the controls

I made my own media so I'd know the ground truth exactly:

One 900×600 image with an 18px light-gray line tucked into the bottom-right corner, and the identical image with that line removed
One four-second clip with a white label burned into the bottom-right corner, and the same clip rendered without it

Nothing about these is subtle by accident. The point of a control isn't to find the model's breaking point — it's to establish that it reports presence and absence differently. Difficulty comes later.

Four runs, four correct verdicts:

With the mark, it read the headline and the tiny corner line, character for character. Without it, the answer named only the headline and stated plainly that the corners held no watermark and no small text. Same split on video: label present, read aloud; label removed, "no text or watermark at all," followed by a straightforward description of what was on screen in each time range.

Runs two and four are the ones carrying the weight. A model that fabricates agreement dies there, and this one didn't.

The command is one line

bl vision describe --image ./press-photo.jpg --prompt "What text is in the image, including tiny corner text?"

Local paths go straight in; the CLI handles the upload, so there's no detour through a file host to get a public URL first. Video swaps one flag:

bl vision describe --video ./clip.mp4 --prompt "What text appears in the video?"

--image or --video depending on the media type, and --prompt has a working default if you omit it. I still write the question out every time. Vague questions get scene descriptions; specific questions get the inventory you actually wanted. "What text is on screen, including the corners" and "describe this image" return genuinely different documents.

The default model is qwen3-vl-plus. You can point --model at another vision model, but my controls only cover the default — if you switch, re-run the matrix. That's four commands, and it's the only way the result means anything for your setup.

What I use it for now

Watermark checking was the entry point, not the use case. Once the pattern worked I started pointing it at other things where eyes skip details:

Reuse clearance. Before publishing someone else's image or clip, ask what text and marks are on screen. Corner watermarks, channel bugs, attribution lines, photographer handles — one pass surfaces all of them, and the answer is text you can keep next to the asset instead of a memory of having checked.

Archive mining. A folder of training recordings or event replays becomes searchable by running "what text appears on screen" across it and filing by what comes back. Titles and lower-thirds get read out without scrubbing a single timeline.

Document scan double-check. Stamps, page numbers, reference codes in the margins of scanned contracts and reports. Have them read aloud, then compare against the body text. The machine is good at "here is everything printed on this page," which is exactly the tedious part.

Accessibility descriptions. Describing what an infographic literally says for a colleague who can't see it. Not a summary of the vibe — the actual text, in place.

All four are the same capability: marks on screen get missed by eyes and caught by a per-region scan.

Where it stops helping

My proof covers watermark-sized text. The line I hid was 18px light gray and it read it correctly. Smaller, fainter, or lower-contrast against the background — no promise. Run your own controls on your own media before you rely on it.

Video is understood per frame and per time range, which the output makes obvious: it tells you what was on screen "from 0.2s to 3s." That's sampling, not a continuous stream. My label sat in the corner for the whole four seconds, so it was never at risk. A half-second flash is a different question, and I haven't tested it.

And it reads what's there, not what's true. A typo in the image gets read aloud faithfully, and a copyright line being legible tells you nothing about whether the license is in order. First pass, not final pass — the last pair of eyes stays human.

Run it yourself

npm install -g bailian-cli
bl vision describe --image your-photo.jpg --prompt "What text is in the image, including tiny corner text?"

Keys come from the console API key page (region: China Beijing). Pick a photo you've looked at a dozen times without really inspecting, ask what text is on it, and see whether the answer includes something you missed. Mine did.

What's the smallest text a vision model has correctly caught for you — and did you test the negative case, or take the first flattering answer?

Four AI Invoices a Month Taught Me to Audit a Subscription Before Paying for It

xiaoru chen — Wed, 23 Sep 2026 01:43:31 +0000

The part of AI tooling nobody demos: the invoices

When I moved from writing to video, the hard part wasn't the craft. It was the overhead. One coding agent for drafts and images, a separate voice service for narration, two more platforms for search and clip generation. Four dashboards, four API keys, four invoices — each metered in a different unit, so reconciling them at the end of the month meant converting tokens, characters, seconds and images into the same currency by hand.

I started to suspect my side project had become a bookkeeping exercise.

So when Alibaba Cloud Model Studio upgraded its Token Plan — one subscription, one Credits pool covering text, image, video, speech recognition and realtime voice, plus built-in tools like web search and code interpreter — my first reaction wasn't excitement. It was: does this actually consolidate the mess, or just add a fifth line to it?

Standard and Pro tiers also bundle Harness perks (free monthly quota and discounts on AgentStudio tools), metered separately so they don't draw from Credits. That's the pitch. I have been burned by a plan that looked generous and went half-unused, so I run three audits before subscribing to anything. Here they are, with the actual commands.

Audit 1: the price, and a clock that starts when you do

Official list prices for the personal edition: Lite at CNY 60/month with 2,500 Credits, Standard at CNY 180/month with 10,000, Pro at CNY 600/month with 40,000. Top-up packs are CNY 100 each, up to five held at once. Promo prices show up from time to time; whatever the subscription page charges you is the real number.

The arithmetic on list price works out to roughly CNY 0.024 per Credit on Lite, 0.018 on Standard, 0.015 on Pro — bigger plans are cheaper per unit. That's the part marketing leads with, and it's the part I care about least, because the limit rules decide whether the cheap unit price is real or fictional:

A fixed 7-day window: the clock starts at your first call of each cycle; hit the cap mid-window and service pauses
No rollover: unused Credits expire with the window
Four escape hatches at the cap: buy a top-up pack, upgrade tiers, spend a reset charge, or wait out the seven days
Concurrency caps: 1–2 on Lite, 3–4 on Standard, 6–8 on Pro

This is a weekly-throughput subscription, not a monthly stockpile. The practical shift in how I read it: I stopped asking "how many Credits do I need per month" and started asking "how many do I burn per week". If your output is steady, the window is invisible. If you publish once a month and spend a whole week's quota in an afternoon, the window will fight you constantly, and no-rollover turns your leftover balance into a loss rather than an asset.

My cadence is two to three videos a week — narration, cover art, the occasional stock clip. Judged against the official Credits deduction table, Standard's weekly allowance covers that with headroom for a sudden topic. That judgment, not the unit price, is what made me consider it.

One scheduling lever worth knowing: a limited-time night window (22:00–08:00) halves Credits consumption on qwen3.8-max and three DeepSeek tiers. Anything that can be deferred effectively costs half, which for batch work is the same thing as doubling your quota. Promo windows change, so check the page rather than trusting my number.

Audit 2: the roster, checked against the live catalog

A plan page listing model names is marketing. A catalog query returning your model ID is evidence. I trust the second one.

The roster spans five families: Qwen (qwen3.8-max, qwen3.8-flash, the 3.7 line, qwen3.6-flash, qwen-image-3.0-pro, and the qwen-audio-3.0 trio for TTS, ASR and realtime), Wan (wan2.7-image and pro), four DeepSeek v4 variants, Zhipu's glm-5.2/5.3, and HappyHorse 1.1 for image-to-video, text-to-video and reference-to-video.

I verified eight of those IDs against the live catalog with the Bailian CLI (bl):

bl model list --model qwen3.8-max --output json

Eight out of eight present, including the two I care about most: qwen-audio-3.0-tts-plus for narration and happyhorse-1.1-t2v for clips. This command needs no authentication, which means you can run the whole audit before you have an account, let alone a subscription.

Then I pulled the plan's TTS voice list — also free information:

bl speech synthesize --config token-plan --model qwen-audio-3.0-tts-plus --list-voices

Two system voices came back, both bilingual Chinese/English. Whether narration is worth subscribing to is a style question, not a spec question, and this is the cheapest way to answer it before paying.

Audit 3: the credential that had quietly expired

Audits one and two passed, so I went to run a real call:

bl text chat --config token-plan --message "Introduce yourself in one sentence"

HTTP 401 InvalidApiKey.

The cause was mundane: the subscription key stored on my machine was from a previous period and had long expired. Nothing warned me. The failure arrived as an auth error, which points at the credential while telling you nothing about which of your stored keys lost the argument.

I also tried to read my Credits consumption directly:

bl usage token-plan

That one needs a console login session, and mine had expired too — so the consumption detail is something I'll read on the subscription page and in the console, not from the CLI on a machine that only holds an API key.

Which means this post contains zero usage impressions. I won't invent them. How natural the TTS actually sounds, whether the image quota survives a real production week — that's the next post, after I refresh the key. Today's post is the audit trail only, and every number in it is either official documentation or something I ran and can show you.

The reusable lesson is smaller than the plan and applies to any subscription: subscription keys and pay-as-you-go keys are different animals with different lifecycles, and expiry sends no notification. Before you pay for a new period, run one cheap call to validate the credential. A 401 means don't pay yet — fix the key, then decide. Keys live on the console API key page, and the region matters: pick China (Beijing).

What the three audits are worth

Running them took maybe twenty minutes and one terminal. What they bought me:

A per-Credit number I derived myself instead of one quoted at me, plus the limit rules that decide whether it's meaningful
Proof that eight specific model IDs exist in the catalog today, rather than on a launch slide
Knowledge that my stored credential was dead — discovered before payment instead of during a production run

The third one is the reason I keep doing this. Every subscription I've regretted failed at the credential or the cadence, never at the feature list.

Who this fits, who should skip it

Subscribe if your output cadence is steady week to week, your toolchain is fragmented across voice/image/search vendors, and you work inside a coding agent — the plan plugs into mainstream coding agents and clients, so it's a key swap rather than a workflow migration, and the learning cost stays near zero.

Skip it if you produce once a month (the weekly window plus no-rollover will waste the balance), if you're optimizing for one model's peak quality (a bundle optimizes for coverage), or if several people would share one seat and your parallel workload exceeds the concurrency cap for that tier. Credits are not the only capacity axis; concurrency is, and it's the one that silently queues your jobs.

If you're on the fence, do what I did: run a shadow month. Take your existing invoices, convert the usage into Credits against the official deduction table, and see which week your real consumption lands in. It costs nothing and it kills the most common mistake — buying a plan that looks generous for the way you work on paper.

Next post: the hands-on bill, in real Credits, once my key is live.

My First LLM API Call Took 11 Minutes. I Now Hand This Exact Route to Everyone Who Asks

xiaoru chen — Tue, 22 Sep 2026 02:04:34 +0000

Every time someone asks me how to make their first LLM API call, I watch them hit the same wall. It is never the code.

The wall is setup. One tutorial says put the key in an environment variable, another says edit a config file, a third uses a command that doesn't exist on your machine. Three tabs, three incompatible mechanisms, and eventually a 401 that doesn't tell you which of the three lost. Nobody can debug that, because the error points at the credential while the actual problem is that three documents disagreed and the reader had no way to arbitrate.

So instead of pointing people at tutorials, I wrote down the route I use myself — then re-ran the whole thing end to end this week on my own machine, to be sure I wasn't handing out stale steps. Eleven minutes from minting a key to reading the token bill of a real call. Four steps, one CLI, no SDK.

Step 1: mint a key, and pick the region on purpose

Keys come from the console API key page. The part almost every write-up skips: the region matters.

Free quota on Alibaba Cloud Model Studio exists only in the China (Beijing) region, and keys are bound to a region. A key minted somewhere else doesn't throw an error, doesn't warn you, doesn't behave oddly — it authenticates fine and quietly bills you instead of drawing down free quota. I found this out the expensive way during my first week, which is why it's now step one of the route rather than a footnote.

Copy the key when it appears. It's shown in full exactly once.

Step 2: one install command

npm install -g bailian-cli

bl --version

Mine reports bl 1.27.0 today. Version numbers drift; the command signatures below have been stable across the releases I've used.

Step 3: the first call is a sentence, not a program

bl text chat --message "Introduce yourself in one sentence"

The first run asks for your API key. If you'd rather not paste it every time, store it once:

bl auth login --api-key sk-your-key

Then the model answers. My actual output this week:

I'm Qwen, a large language model developed by Alibaba Group, here to help you think, write, and solve problems.

That's the whole call. No client object, no request signing, no response parsing, no dependency pinned to a version that conflicts with the rest of your project. One sentence in, one sentence out. For a first contact with a model, that's the right amount of machinery: enough to prove the credential, the endpoint and the account all work, and nothing else in the way.

Step 4: the tier swap that doubles as an honesty test

The default model is the most capable tier in the catalog, and most everyday questions don't need it. One flag moves you down a tier:

bl text chat --model qwen3.8-flash --message "Is today a good day to go outside in Berlin? Two sentences."

What I like about the answer isn't the advice, it's the disclaimer:

I can't access real-time weather or air quality for Berlin today, so I can't judge reliably. If it's mild and clear, go out; if there's wind, rain or smog, keep it short or protect yourself.

No live data, and it says so, then gives you the conditional version. That's a useful first signal about whether a model fabricates. A hallucination-prone one would have cheerfully told me "sunny, 22°C, perfect day" and I'd have spent a week trusting it before noticing.

My working rule since then: drafts, summaries, classification and quick questions go to the flash tier; hard reasoning and code go back to the default tier. Same key, same command, one flag — which means the switch is a policy decision you can write down, not a refactor.

Step 5: read what one call costs

Cost intuition is the thing beginners lack most, and they lack it because the bill is invisible by default. One flag fixes that:

bl text chat --message "Answer in one sentence: what is 1+1?" --output json

The response carries a usage block:

{
  "prompt_tokens": 71,
  "completion_tokens": 49,
  "total_tokens": 120
}

prompt_tokens is what my question cost, completion_tokens what the answer cost. A one-sentence round trip is a little over a hundred tokens. Multiply by the published unit price on the model's page and you can price any call yourself — that 1+1 question landed four decimal places below one cent.

Doing this on the first call, rather than the fiftieth, changes how the rest of the project gets scoped. You stop reasoning about "AI costs" in the abstract and start reasoning about tokens per request times requests per day.

The free-quota rules, stated completely

"Free credits" undersells how specific the rules are. As published:

Valid for 90 days, counted from whichever is later: account activation or model release
Per model, typically 1M tokens each; quotas do not pool across models
Beijing region only — which is why step 1 insists on the region
Unused quota still expires and is not reissued
Once quota runs out: verified accounts switch to pay-as-you-go automatically; unverified accounts simply stop
There's a "stop when free quota is exhausted" switch in the console. With it on, an exhausted quota returns HTTP 403 instead of a bill

That switch is the one I'd enable before letting anyone experiment on an account I'm paying for. A 403 is a clear signal at the moment it matters; a line item on next month's invoice is not.

For your own remaining balance and expiry date, the console quota page is the source of truth. The CLI's quota self-check commands need a console login session, so they won't help you on a fresh machine.

What this route is not

An honest caveat, because I don't want anyone shipping a service this way: a CLI call is a probe, not a production architecture. A service needs typed errors it can match on, a retry and backoff policy it owns, connection reuse, and request shaping that lives in the same runtime as the rest of the code. That's what the SDK or the HTTP API is for, and moving to it should be a deliberate step rather than something you discover during an incident.

The first call has a different job. It has to succeed quickly, cost nothing unexpected, and leave you able to explain what happened — and one command with a --output json flag does all three better than a directory of boilerplate ever did for me.

Install docs and the full command list: Bailian CLI (bl). Image, speech and video live in the same CLI under other command groups, with the same rhythm: read --help, run one command, read the output.

An Open-Source Code Review Tool, 7 Qwen Tiers, and the Real Cost of a Single PR

xiaoru chen — Mon, 21 Sep 2026 01:45:39 +0000

The tool that made me curious

This week, Alibaba open-sourced open-code-review (CLI name ocr). It climbed to #1 on GitHub Trending with +15,028 stars in a week. Apache-2.0, Go binary, and — here is the part that caught my attention — it ships a built-in provider named dashscope whose base URL is DashScope's OpenAI-compatible endpoint, with Qwen models pre-listed.

No custom provider file to write. No YAML to assemble. Pick a provider, pick a model, and it works.

So I set up a single-variable experiment: one buggy file, seven Qwen tiers, and a real cost table. Not a per-million-token sticker price — the actual bill for one review.

What the tool does

ocr reads your code through tool calling (function calling). The model must natively support it; the project FAQ explicitly names qwen3 as working. Models that merely narrate tool calls in text output cannot drive it, regardless of how clever the prompt is.

It has four modes:

ocr review                                        # review staged/unstaged/untracked changes
ocr review --from main --to feature-branch         # review a branch range
ocr review --commit abc123                         # review a single commit
ocr scan --path some/dir                          # full-file scan, no git history needed

The setup

Three things to know before you run it:

DASHSCOPE_API_KEY alone is not enough. The resolver wants the full tuple of (URL, key, model). The env var supplies only the key. You still need ocr config set provider dashscope and ocr config set model <name>.
The provider is built-in. internal/llm/providers.go in the repo defines dashscope with base URL https://dashscope.aliyuncs.com/compatible-mode/v1 and a model list that starts with five Qwen models. No need to register a custom provider.
Region matters. API keys are region-bound. A Beijing key against a Virginia endpoint returns 401. If you migrated to a workspace domain, override the URL with ocr config set providers.dashscope.url https://<WorkspaceId>.cn-beijing.maas.aliyuncs.com/compatible-mode/v1.

The shortest path to a working setup:

npm install -g @alibaba-group/open-code-review
ocr config set provider dashscope
ocr config set model qwen3.8-max
ocr config set providers.dashscope.api_key sk-your-key
ocr llm test

Create an API key in the Bailian console before the fourth command.

The experiment

One 64-line Python order service with four planted defects:

A fetchone() result used without a null check (crashes on missing user)
An f-string interpolated into SQL (textbook injection)
A counter += 1 without lock acquisition (concurrency bug)
An open() without with (handle leak)

Plus two decoys: an @lru_cache on a pure function (correct usage) and a redundant except Exception: raise (harmless, and the bare raise correctly preserves the traceback).

Same prompt, byte-identical input, seven Qwen tiers. Token counts from the API's own usage block. Unit prices from bl model list --model <name> --output json, a command that needs no account and no auth, so every price is checkable.

Prices are in CNY.

The table

Model	Thinking tokens	Found /4	Missed	False +	Score	Wall time	In tok	Out tok	Cost per review
qwen-turbo	none	2	2	4	-2.0	7.4s	468	1,005	¥0.0007
qwen3-coder-plus	none	3	1	1	2.0	10.1s	464	712	tiered / see console
qwen-plus	none	2	1	1	1.5	39.3s	464	1,766	¥0.0039
qwen3.7-plus	1,182	4	0	0	4.0	23.4s	502	2,052	not published / see console
qwen3.6-flash	4,258	4	0	1	3.0	42.6s	502	5,075	not published / see console
qwen3.8-flash	9,517	4	0	0	4.0	241.0s	540	12,909	¥0.0353
qwen3.8-max	9,770	4	0	0	4.0	293.1s	540	11,064	¥0.4048

One run per configuration. Score is found minus false positives, out of 4. Three cells say "see console": qwen3-coder is officially tiered-priced, and qwen3.7-plus / qwen3.6-flash return no unit price from the lookup command. I do not fill gaps with guesses.

Three things I did not expect

The flagship bought nothing on this file. qwen3.7-plus scored 4.0 in 23.4 seconds. qwen3.8-max also scored 4.0, in 293.1 seconds. The extra 8,588 thinking tokens and 270 seconds bought three genuine findings I had not planted (including that amount <= 0 does not reject float('nan')), but no extra points.

The divider is thinking, not price. Three tiers that did not think all missed at least one bug. Five that thought missed nothing. Past roughly 1,200 thinking tokens the score stops moving.

Line numbers are only trustworthy on thinking tiers. turbo was 0 of 9 correct, plus 0 of 4. qwen3.7-plus and above were accurate to within one line. Treat a non-thinking tier's output as a lead list and find the code yourself.

One observation worth noting: qwen-plus missed the null deref, qwen3-coder-plus missed the race condition. Their blind spots did not overlap. Running both cross-reads the gaps, at the cost of stacked false positives and a human in the loop. Seven configurations measured once each — this is an observation, not a rule.

Unit price versus unit cost

qwen-turbo costs ¥0.3 per million input tokens. qwen3.8-max costs ¥12. That is 40x on the pricing page. Per review, turbo spent ¥0.0007 and max spent ¥0.4048, which is 545x, because the expensive run wrote eleven thousand output tokens and most of them were reasoning.

Budget from the pricing page and your invoice will not agree. Budget from a real review.

What I would pick

Scenario	Tier	Per review	Reviews per ¥1
Coarse sieve on every commit, you read the code anyway	qwen-turbo	¥0.0007	≈1,345
Cheap pass with a published price	qwen-plus	¥0.0039	≈256
Default PR gate, line numbers you can jump to	qwen3.7-plus	≤¥0.0799 (bound)	price unpublished
Hard diff, deep reasoning	qwen3.8-flash	¥0.0353	≈28
The gnarliest file in the repo	qwen3.8-max	¥0.4048	≈2

The ¥0.0799 is a bound, not an estimate: priced at flagship rates, that run's tokens come to ¥0.0799, one fifth of the flagship's ¥0.4048, and its real price cannot be higher. For tiers with no published price, check the console model pages rather than any reposted number.

Recalculate it yourself

from decimal import Decimal, ROUND_HALF_UP

def cost(in_tok, out_tok, price_in, price_out):
    """prices in CNY per million tokens"""
    c = (Decimal(in_tok) * Decimal(price_in) + Decimal(out_tok) * Decimal(price_out)) / Decimal(1000000)
    return c.quantize(Decimal("0.0001"), rounding=ROUND_HALF_UP)

print(cost(540, 11064, "12", "36"))  # 0.4048: qwen3.8-max, one review

Use Decimal with ROUND_HALF_UP, because Python's round() does banker's rounding and your invoice will not explain the gap.

Boundaries and honest limits

A community member reported 1,400 PRs taking over ten hours. A few-line PR still takes minutes. This is not a pre-commit tool. It does not replace SAST: a rules engine reports deterministic pattern hits, while ocr reports what a model understood about your code. And if your team already pays for a hosted review product that works, this is not a pitch to switch.

Sample size is one file, four bugs, one run per configuration. I ran two of the models twice and their scores moved. Read every number above as "this run", not as a benchmark.

The new-user free quota is per model and independent (typically 1M tokens each), valid for 90 days, Beijing region only, with no reissue after expiry and no automatic failover to another model when it runs out. Create the key here. Install the Bailian CLI to look up prices on your own machine with no account required.

Three Models, One Verdict: The Cheapest Code Review I Have Ever Run

xiaoru chen — Sun, 20 Sep 2026 05:22:50 +0000

TL;DR: every number below came out of my own terminal on 2026-09-18, three bl text chat calls, total cost under two US cents of compute at marketplace unit prices (labeled estimate, usage fields not captured).

The gap nobody prices

One model telling you "no bugs found" is worth almost nothing. You have no idea whether it looked or just agreed with itself. Two models that never talked to each other, naming the same three lines independently, is a different kind of evidence entirely. That second kind used to cost you a colleague's afternoon. It now costs a few cents.

The setup

A snippet with three real defects planted: skipped first element, divide-by-zero on empty input, and a discount function returning the discount amount instead of the discounted price. I did not tell the models what to look for.

The three commands

bl text chat --model qwen3.8-flash --timeout 120 --message "<code> List only real problems, one per line, no explanation"
bl text chat --model kimi-k3 --timeout 150 --message "<code> List only real problems, one per line, no explanation"
bl text chat --model qwen3.8-max --timeout 150 --message "<code + both reviews> False positives or misses? Which fix first? One line of fix code"

Reviewer A took 98 seconds and returned three lines. Reviewer B took 18 seconds and returned the same three lines plus a fix for the third. The judge took 104 seconds, confirmed neither review had false positives or misses, picked the divide-by-zero as first-to-fix, and produced return sum(prices) / len(prices) if prices else 0. I checked that line by hand: it fixes both the skipped element and the division by zero.

Why agreement beats confidence

The judge's most useful output was not the verdict. It was the ordering. "Fix this one first" is exactly the judgment that consumes human reviewer time; finding the lines is the cheap part. Getting that ordering from a third model that read both opinions is a workflow, not a demo.

Two boundaries, stated plainly. This is a review workflow, not a safety mechanism; a human still reads the verdict. And review-style prompts make models think for one to two minutes, so keep --timeout in the command or a non-streamed long-thinking request will look hung. I lost ten minutes to that one before I understood it.

Run it, then argue with it

The CLI is on the install page; from the second call you need an API key from the console, and new accounts carry free quota. The platform overview is here if you want the wider picture first.

If your roundtable catches something mine missed, or your judge overrules two agreeing reviewers, I want that case. Three opinions are only worth what the fourth one finds.

I Ran the Viral AI-Novel Workflow on a CLI: 800 Words for Half a Cent

xiaoru chen — Sun, 20 Sep 2026 02:16:42 +0000

TL;DR: on 2026-09-18 I reproduced a high-voted Chinese Q&A workflow for AI fiction on Alibaba Cloud Model Studio's CLI (bl). Skeleton in one call (100 tokens in / 505 out), 798-character opening in a second (158 in / 7,728 out). Total ≈ ¥0.022, about $0.003, computed from measured usage × marketplace unit prices, not an invoice. The third step of the original workflow is human editing, and my attempt to delegate it timed out twice — which turned out to be the point.

The workflow I copied

The top answer under "Can AI actually write novels?" prescribes three steps: lift the skeleton from bestselling shorts, fill the flesh with a persona prompt, then hand-edit three spots (opening hook, reversal logic, emotional landing). No tool named. I used bl text chat.

Step one asks for structure only:

bl text chat --model qwen3.8-flash --message "<premise> output a skeleton under 100 words, structure only, no prose"

Fourteen seconds: a four-beat skeleton — lowball offer, papers falling out of the piano lid, a recording hidden in the strings, the buyback. Skeletons are diffable and reviewable; prose is not. That is the first reason this pipeline survives contact with a production process.

Step two: persona in, opening out

bl text chat --model qwen3.8-flash --system "web-serial author, six years: colloquial, fast, core conflict inside 300 chars, one reversal per 800 words" --messages-file msgs.json

The opening came back at 798 Chinese characters: layoff in paragraph one, a haggling scene by paragraph three. 158 tokens in, 7,728 out.

Two traps worth your time. First, if you build the messages file with a quoted shell heredoc, $(cat outline.txt) never expands; the model receives the literal string and invents its own premise. My first run produced a transmigration romance unrelated to my input, 7,537 output tokens of it. Assemble the JSON in a script. Second, I tried delegating the rewrite step: a reasoning model given the full draft timed out past two minutes twice, and the fast model timed out on 600 characters. Long input plus a thinking model plus a non-streamed CLI call is slow. The original workflow's third step is human for a reason.

What the numbers do and do not say

At this cost the generation step stops being a cost line at all; the human checkpoint and the premise selection are the budget. The answer's author claims six years of short-fiction income and a mentee paid on day ten; those are his self-reports. The durable lines are the other ones: platforms reject pure-AI slush, not AI-assisted drafts; community consensus puts plot coherence collapse past roughly 50k characters; and per-thousand-character rates are a market range, not a promise.

The CLI is on the install page; step two needs an API key from the console, and new accounts carry free quota — check your console for what remains. Platform entry point is here.

If your serial-fiction workflow has a skeleton step I'm missing, or a checkpoint you'd put elsewhere, I want that diff. Half a cent buys you the right to argue with this pipeline from experience.

Panel 2 Is Where AI Comics Die: Character Consistency, Measured

xiaoru chen — Fri, 18 Sep 2026 03:14:49 +0000

TL;DR: I drew a comic character with one command, asked for the same character in a second scene, and got a stranger back wearing her hoodie. This post is the run that fixed it: four CLI commands, four panels, one lip-synced clip, every step stamped with its price and wall-clock time on 2026-09-17. The panel pipeline cost about eleven US cents.

The pitch you keep hearing is that AI comic drama is the next gold rush. The pitch is not wrong about demand, it is wrong about where the work actually is. Panel one is free-ish and easy; panel two is where your character dies, and almost no beginner tutorial says so out loud.

I'm not here to adjudicate the gold-rush claim. I can't verify anyone's view counts, so I won't cite them. What I can hand you is a measured run on my own machine, with the failure included.

What the gold rush looks like from inside

Before the technique, one piece of context that changes what this topic is. I pulled Zhihu's site-wide hot list on 2026-09-17, thirty items: zero comic-drama entries. Of the seven existing Zhihu questions about AI comic drama, five ask "can I make money from this" and none ask about technique. This is a livelihood vertical, not a mass spectacle, and the people in it ask about income first.

The stratification is blunt. Consumption is still growing: the August top-100 playback increment ran +44% month over month (second-hand, via DataEye). The supply-side dividend is closed: industry tracking puts active production studios at 1,216 falling to 698 within Q1, and revenue per 10k views down roughly tenfold (both second-hand). Tutorials are oversupplied and homogeneous. The empty niche is not "how to draw a panel"; it is what happens after you draw one, which is compliance and cost accounting. Both are below.

The gap nobody's tutorial names

Ask an image model for "a girl with round wire glasses, a bright yellow hoodie, black bob with straight bangs" and you get a perfectly good character sheet. Ask for that same girl on a rooftop at night and you get a different girl: glasses gone, hair a shade off, hoodie redesigned, face subtly someone else's. One broken panel and every panel after it is waste, because a comic is a sequence and a sequence needs one face.

That gap, between one nice illustration and an actual comic, is the whole game.

My setup, pinned so you can reproduce or distrust it: Alibaba Cloud Model Studio CLI bl 1.22.0, image model qwen-image-3.0, TTS cosyvoice-v3-flash, video wan3.0-video. Unit prices read from bl model list --model <name> --output json, not estimated. Runs happened 2026-09-17, 20:41 to 20:48 local time.

Step 1: write the identity down before you draw it

Vague features cannot be locked later. Three identifiable traits go into the prompt, and two flags keep the output usable downstream:

bl image generate --prompt "anime-style character sheet, a girl with round wire glasses, a bright yellow hoodie, black bob hair with straight bangs, half body, front view, calm slightly curious expression, clean lineart, cel shading, pure white background, no text" --model qwen-image-3.0 --size 3:4 --watermark false --prompt-extend false --out-dir . --out-prefix char-sheet

--watermark false, or every downstream panel carries a mark. --prompt-extend false, because prompt expansion invents details and a character sheet needs precision, not surprise.

Cost: ¥0.18, roughly two US cents.

Step 2: the lock is a reference image, not a seed

Here is my failure, in full, because it is the failure most tutorials hand you as advice. My first instinct was --seed. Fix the seed, I reasoned, and the character stays fixed. It does not. A seed reproduces the same image from the same prompt; change the scene description and you get a different person wearing similar clothes. I burned two panels learning that the seed is a reproducibility switch, not an identity switch.

The identity switch is reference-image editing. Feed the sheet from step 1 as --image, and in the prompt change only scene and composition while stating that face, hair, glasses and clothing stay identical:

bl image edit --image ./char-sheet.png --prompt "keep this character's face, hair, round glasses and bright yellow hoodie exactly unchanged; change only scene and composition: she stands at the edge of a rooftop at night, in profile, looking up; background is bokeh city lights and deep blue night sky; comic panel framing, cel shading" --model qwen-image-3.0 --size 3:4 --watermark false --out-dir . --out-prefix panel-1

61 seconds later:

I ran the same sheet through two more scenes to check whether the lock holds or whether I got lucky once:

Glasses, hoodie, bob, face shape: preserved across all three. The outputs even came back with comic panel borders. Per panel: ¥0.20 (¥0.18 edit plus ¥0.02 input), 61 to 70 seconds.

Scope, stated plainly because overclaiming here would be worse than useless: tested is three scenes and four poses (half body, profile, head-down, three-quarter). Untested is cumulative drift past three scenes, full-body action, costume changes, extreme close-ups, multi-character frames. Treat the tested range as tested.

One upgrade path and one trap from the wider community, both consistent with what I measured. The community consensus for consistency is layered stacking, and the turnaround or multi-angle character sheet is its accepted first step; my single sheet held three scenes, and a multi-angle sheet is the recommended upgrade once your storyboard multiplies angles beyond what one view can vouch for. The trap: accessories vanish unless you repeat them in the prompt. A first-hand overseas comparison of single-character references found exactly this, and it matches my own outputs, where the hoodie drawstrings survived only because the prompt kept naming the hoodie.

Step 3: the voice line, and the alignment trap

bl speech synthesize --text "原来城市晚上，这么亮啊。" --voice longcheng_v3 --format mp3 --out voice-1.mp3

Twelve Chinese characters, 3.264 seconds of audio, about ¥0.01. List voices with --list-voices instead of guessing IDs.

The trap: audio length and clip length are independent. My line is 3.26 seconds; in a 5-second clip the character spends the last 1.7 seconds with a closed mouth. Write dialogue that fills the duration, or take the silence as breathing room. Knowing which one you chose is the difference between direction and a bug you cannot find.

Step 4 (optional): make her talk

Movement plus lip sync in one command, with --image and --image-voice paired by position and referenced in the prompt as Image 1 and Audio 1:

bl video ref --prompt "Image 1 stands on the rooftop at night, looking up; night wind moves her hair and hoodie drawstrings; she speaks: Audio 1. Camera slowly pushes in; city lights bokeh and flicker" --image ./panel-1.png --image-voice ./voice-1.mp3 --model wan3.0-video --duration 5 --resolution 720P --ratio 9:16 --watermark false --download clip-1.mp4

Two flags will bite you. --resolution defaults to 1080P, the expensive tier; write 720P on your first clip. And the CLI warns these jobs take 5 to 10 minutes; mine returned in 3 minutes 6 seconds, 720×1280, 150 frames, mouth moving with the audio from about the two-second mark.

The reference budget has hard ceilings, and one number circulating in tutorials is wrong. Officially, wan3.0-video accepts at most 10 reference images; reference video is capped at 5 clips and 15 seconds total; reference audio likewise 5 clips and 15 seconds total; and first-frame or last-frame inputs are mutually exclusive with any reference input in a single request. Images, video and audio are counted independently, which is why the prompt markers read Image 1, Video 1, Audio 1 as separate series. The circulating claim of "up to 20 reference images" is false: 10 is the image cap, and 20 is the total across all reference types.

Treat lip sync as an optional advanced step, not a pipeline requirement, for three reasons. The platform's API layer has dedicated talking-head models (wan2.2-s2v, which handles cartoon subjects, and videoretalk), but the CLI at version 1.22.0 does not wrap them; I checked bl --help, so I am not going to invent commands for models the CLI does not expose. Community measurement puts AI lip sync at draft quality that still needs manual calibration. And overseas sentiment toward AI-dubbed anime has been resistant since the December 2025 discussion cluster on Hacker News. The --image-voice route above is the cheap way in; everything beyond it is deliberate extra work.

This is where the money goes: 5 seconds at ¥0.6 per second is ¥3.00. Which is why my advice runs opposite to most tutorials. Lock the panels cheap first; render video only once the sequence is right. Every screenshot above is a comic panel, and the clip exists only to prove the next step is real.

The budget, and the one cost rule that matters

Step	Unit price	Usage	Subtotal
Character sheet	¥0.18/image	1	¥0.18
Panels (reference edit)	¥0.20/image	3	¥0.60
Voice line	per character	12 chars	≈¥0.01
Panel pipeline		4 images	≈¥0.8 (~$0.11)
Lip-synced clip (optional)	¥0.6/second	5 s	¥3.00
With one clip			≈¥3.8 (~$0.53)

For readers used to token math: there is no prompt-cache lever in image generation. Every panel is a fresh call, so panel count is the budget, full stop. The cache-read economics that dominate LLM bills do not apply here, which makes per-image price transparency the only number worth arguing about. I won't quote your remaining free quota; reading it needs a browser login I can't do for you, so check your own console's quota page.

On the free tier's promise, stated at its boundary: quotas are 90-day, per-model, and independent of each other, and the exact amounts live on each model's console detail page rather than in any single summary I trust. The honest summary is that free quota is enough to run this whole pipeline once as a demo, and not enough to finish one episode for free. At the community-reported 28.7% usable-take rate, thirty free video seconds do not even yield three usable shots.

Three cost numbers circulate in this space and they answer different questions, so here they are side by side without a verdict. Alibaba Cloud's own official comic-creation solution page, which I opened and read directly, quotes a 15-minute deploy and roughly ¥70 per episode with a free trial quota, and never mentions the CLI this post uses; that is the price of a managed, batteries-included route. My bare CLI run above is ¥0.8 for four panels, or ¥3.8 including one five-second lip-synced clip; that is the price of doing each step yourself. And first-hand media reports of beginner earnings put the other side of the ledger at ¥2.28 after thirty days online, ¥16.8 for eight episodes and 40k views, and one creator's summary of per-episode income as "not a few mao, but five-plus yuan." Quote cost and revenue in the same breath and you get nonsense; keep them in separate columns and the picture is at least honest.

A fourth number, labeled as an estimate because it is one: a 90-second episode runs about thirty shots, and at that same 28.7% usable-take rate you render far more than thirty clips to get them, which lands roughly ¥110 to ¥215 per episode at 720P or 480P. Nearly all of it burns on image-to-video retries; images and voice are rounding errors. That estimate, not the ¥0.8 demo figure, is the number to hold against the ¥70 managed-solution quote and the ¥2.28 first-month earnings report.

What you'll actually hit when you publish

Searching beginner questions surfaced two camps: one calling comic drama the last content dividend for ordinary creators, one calling it another course-selling cycle where every tutorial funnels into a paid course. On the second camp there is at least one official datapoint: BOSS Zhipin, a major Chinese job platform, issued a notice on 2026-04-16 naming "recruit-to-train" scams that bait applicants with "high-pay AI comic artist" and "earn 100k on your first drama" promises before collecting training fees. I'm citing the platform's notice, not naming any course or vendor. The counter-move is the same one that applies to the technique: these four commands cost under a dollar and under half an hour to run yourself, so the judgment is worth making firsthand.

Then there is the regulation nobody's tutorial has caught up with. China's NRTA Order No. 16, the Micro-Short Drama Development Management Measures, took effect 2026-09-01, and Article 34 requires a visible AI-disclosure label on every episode of an AI micro-drama. Filing splits by class: Class-1 applicants must hold a Radio & TV Program Production License, while Class-3 goes through platform self-review plus a program number. In practice the label is the part that reaches solo creators first, because it lands on the episode itself. How strictly the entity-qualification side is enforced varies by platform and I found no plain-language official guidance, so confirm against the platform you actually publish on before you act on any of this; treat my summary as a pointer to the order, not as legal advice.

If you publish overseas instead, the disclosure picture is narrower than people fear, and the scope is worth stating exactly. YouTube's disclosure requirement applies to AI that photorealistically alters or generates realistic content; animation and clearly unrealistic content are exempt from proactive disclosure, and non-photoreal AI labels surface in the expanded description rather than on the player. Since May 2026 YouTube also auto-detects videos carrying large amounts of photoreal AI material. For a comic or anime pipeline that materially lowers the compliance burden, and it is the reason this post's screenshots are panels rather than photoreal frames. The exemption is not a free pass elsewhere in the same platform: refusing disclosure on photoreal content can bring labeling, takedown, or removal from the YouTube Partner Program.

On the ownership side, the US position settled negatively and then stopped moving. On 2026-03-02 the Supreme Court declined cert in Thaler v. Perlmutter, leaving purely AI-generated works uncopyrightable for lack of human authorship. What remains protectable runs through three paths: selection and arrangement of the AI output, substantial human modification of it, or expressive human input that is clearly perceptible in the result; mere selection of prompts is not enough. There is no anime-specific rule, and I am not going to claim one. Practically, that pushes value toward the parts of this workflow a human actually authors: the sequence, the edit, the pacing, the panel selection.

The last publishing constraint is the one you choose yourself. Cloning a living artist's signature style for commercial work, or feeding photographs of real people in as reference, carries infringement risk; designing your own character and using your own generated sheet as the sole reference source is the clean path, and it is also the path this post's pipeline assumes.

Your turn

If you have pushed reference-image editing past three scenes, or into multi-character frames, I want the panel number where it broke. Same if you found a cheaper lock that survives a scene change. Comments are the point of posting this.

One expectation to set before you start: everything after the renders is manual. Choosing which takes are usable, shot order, pacing, grading, and the judgment calls in between are yours; FFmpeg will concat, subtitle and mix-export, and that is the extent of its opinion. Budget an evening of editing for every evening of generating.

The CLI lives on the install page; steps 3 and 4 need an API key from the console. And if you'd rather look around the platform first, start here.

Agent Skills Have No Provenance. A Content Hash Helps.

xiaoru chen — Fri, 18 Sep 2026 02:30:01 +0000

TL;DR: everything below was verified on my own laptop on 2026-09-17 against bl 1.22.0, including one command I assumed was side-effect-free and wasn't. The article, its two figures, and every pasted output came out of running the thing it describes.

The question nobody's tooling answers

The hard part of agent skills was never writing one.

The hard part is answering: what exactly did I just install?

I run three coding agents on one laptop. A year of accumulated skills, plugins, and hand-edited instruction files, and until last week I could not tell you which came from a registry, which I copied off a blog, and which I wrote myself. On disk they are indistinguishable. They load identically. One of them had been edited by an update I don't remember approving.

In a recent two-week Hacker News window, the highest-engagement post in the whole skills category was a one-line question with two comments: has anyone measured how often agents use the skills you ship? The tooling posts (a package manager, an inspector, a context-cost auditor, a risk-scanned catalog) all sat between two and four points. We are building skill infrastructure faster than we are building trust in it.

So when I found a first-party registry that stores a SHA-256 hash per installed skill, I took it apart. Here's what holds up, and one thing that doesn't.

What the registry records

Alibaba Cloud Model Studio ships a CLI called bl. Its skill group is five commands, and the surprise is that none of them need an API key. List, install, update, and remove all run without authentication. Grab the CLI from the install page if you want to follow along.

bl skill list diffs the registry index against local installs. Fifteen skills, five states. The states are the interesting part:

bailian-gen        installed
bailian-sandbox    installed
spark-video        not-installed

missing means the lockfile knows the skill but the directory is gone. untracked means a directory exists that the lockfile has never heard of, usually something you copied in by hand. That distinction is the first real diagnostic I've seen in skill tooling: it separates "I installed this and it vanished" from "something unmanaged is sitting here."

The lockfile is where it gets good. Each installed skill records:

{
  "contentHash": "sha256:d56618ed7fbd14cc4a22830f6df364566c5b725c614faf99c5bbd5a209961044",
  "publishedAt": "2026-09-17T14:04:49+08:00",
  "installedAt": "2026-09-17T07:22:38.894Z",
  "sourceType": "oss",
  "links": [
    "/Users/me/.copilot/skills/bailian-docs-llm-wiki",
    "/Users/me/.qoder/skills/bailian-docs-llm-wiki",
    "/Users/me/.qwen/skills/bailian-docs-llm-wiki"
  ]
}

Four fields, four questions answered. contentHash: are my bytes the published bytes? Checkable now, not assumed. sourceType: vendor object storage, not someone's repo. publishedAt vs installedAt: two timestamps, so "am I behind?" is a comparison. links: every host pointing at this skill, which is why removal reports a count instead of deleting whatever it finds.

I'm not citing the circulating skill-security percentages. They come from different scans over different corpora and don't compare. A hash I can recompute myself is a weaker headline and stronger evidence.

One copy, three hosts

Every entry in all three host skill directories is a symlink to one canonical copy:

lrwxr-xr-x  bailian-gen -> /Users/me/.bailian/skills/bailian-gen

Two consequences I'd assumed were unsolvable. Updates are atomic across hosts: bl skill update patches the single copy and all three see it; I ran it, ten entries, all up-to-date. Removal is accountable: the lockfile enumerates links, so uninstall reported removedLinks: 3, and two skills I keep by hand in one host survived untouched.

This is the missing piece in the "skills are the asset, the harness is replaceable" argument. Portability only becomes cheap when the asset is stored once and referenced many.

The bug I hit: `--dry-run` isn't dry here

bl --help lists --dry-run as a global flag, described in three words. Nothing says which groups honor it. So I did the polite thing:

bl skill add --name spark-video --dry-run

{ "skills": [ { "name": "spark-video", "status": "installed" } ] }

installed. Not "would install."

I checked disk immediately: the skill existed in all four locations. Before the command, all four were absent and bl skill list said not-installed. One command with the dry-run flag in between. The skill group silently ignores --dry-run and installs for real.

Recovery is clean, which is why this is a footnote and not a warning label:

bl skill remove --name spark-video
# { "skills": [ { "name": "spark-video", "status": "removed", "removedLinks": 3 } ] }

All four paths gone, unmanaged skills untouched. If you want a zero-write preview, read the agents field from a --dry-run response (that part is real), but use bl skill list for the view that truly touches nothing.

What you get

bl skill init installs the ten bailian-* skills; the five scenario skills need an explicit --name. The payoff is in one description: bailian-gen names five command groups verbatim: bl image, bl video, bl speech, bl vision describe, bl omni. One skill wires image generation, video, TTS, ASR, and image/video understanding into whichever agents the CLI detected. On my machine: GitHub Copilot, Qoder, Qwen Code.

Caveat, stated plainly: the registry also ships bailian-sandbox, whose command group doesn't exist in CLI 1.22.0. Installing it doesn't error; using it would. Wait for an update or run bl update yourself.

Everything above is free and keyless. The first paid model call happens when you ask the agent to generate something; you'll need an API key from here at that point, and quota is something to check in your own console, because the commands that read it need a browser login I can't do for you.

Which skills to delete

There's a real camp deleting skills now: base models improve, so skills that teach the model how to think get absorbed and just burn context. They're half right. Prompt-class skills (choreography, formatting, reasoning scaffolds) are exactly what model progress obsoletes. Capability-class skills are not. No base model calls an image API on its own. Those abilities live in endpoints, not weights.

My test is one line: after installing, did the agent gain a paragraph of instructions, or a set of commands? Instructions expire. Commands don't.

Your turn

The compressed version:

npm install -g bailian-cli   # skip if you have bl
bl skill list
bl skill init
bl skill update
bl skill remove --name all

If you run this and hit something I got wrong (a state I misread, a host the CLI fails to detect, a lockfile field that lies), I want the report; that's how the next post happens. Issues and PRs welcome. And if you'd rather explore the platform itself first, the entry point is here.

CJK Poster Text: 3 Image Tiers, 19 Elements, Counted by Hand

xiaoru chen — Thu, 17 Sep 2026 10:15:48 +0000

I stopped trusting the zoom-out

I make bilingual promo assets: an event poster, an OG image for the release post, a membership notice for a partner in Taipei. The artwork is never the problem. The small print is, because a generated headline forgives everything and a generated footer line forgives nothing.

My process used to be re-roll until it looked right at normal zoom. Then a wrong year reached a published asset, and I decided to measure the failure instead of dodging it.

Two days, two prompts, three model tiers, 19 required text elements, each one read character by character at zoom. This is the ledger, plus the two flags that surprised me.

Everything ran through the Bailian CLI (bl). Timings are wall clock from my machine. Prices came out of bl model list on the day I ran the tests.

The two prompts

Round one is an event poster: headline, sub-headline, three bullet lines that carry numbers, and a footer line with a date, a time and a venue. Ten required text elements.

Round two is nastier on purpose: a membership benefits notice with a headline, a sub-headline, five bullets, and two footer lines. One footer line is a date range, the other is a legal sentence, and the bullets include a 1:1.5 decimal. Nine required text elements.

Each prompt ran against all three tiers. Only --model changed between runs, and every other flag stayed at CLI default. Scoring was manual and deliberately dumb: find the element, zoom in, check each character, log it as correct, wrong glyph, missing stroke, transposed or absent.

npm install -g bailian-cli
bl auth login --api-key <your-key>
bl image generate --prompt "$(cat poster.txt)" --model z-image-turbo --size 3:4 --out-dir ./out/turbo

Tier	Price per image	Notes
`z-image-turbo`	¥0.1 (about $0.014)	The official model card claims first place among open source text-to-image models on Artificial Analysis, with 6B parameters and 8 inference steps. That is a vendor statement; I did not re-verify the leaderboard.
`qwen-image-3.0`	¥0.18 (about $0.025)	Same price at 1K and 2K. Aimed at dense information layouts.
`qwen-image-3.0-pro`	¥0.25 at 1K (about $0.035), ¥0.5 at 2K	Pro tier of the same family, with layout and text rendering strengthened.

Those dollar figures are rough conversions of the yuan list prices, so read them as approximations.

Round one was the boring result

All three tiers scored 10 out of 10. Headline, sub-headline including its comma, three bullets with their numbers, footer date, time and venue. No errors anywhere.

The assumption that CJK fine print is a coin flip does not hold on these three tiers at poster-scale type. Round one was still worth the afternoon, because it produced two things I did not expect.

Speed inverts the price ladder. z-image-turbo came back in 5.1 seconds, qwen-image-3.0-pro in 53.8 seconds, and qwen-image-3.0 in 101.1 seconds. The most expensive tier took about half the wall clock of the middle one, and the cheapest was roughly twenty times faster than Standard.

Watermark behaviour differs between tiers. With identical flags, the Standard image carried an orange corner badge clipped by the canvas edge, with half of the word still visible, and the Pro image had nothing in that corner. --help says the watermark defaults to on. A follow-up run with --watermark false removed the badge cleanly, so the flag works. The inconsistency sits between tiers, not in the flag.

Round two, where the cheap tier slipped

Round one's type was still fairly large. The interesting test is footer-scale text carrying digits and long sentences.

z-image-turbo, 5.1 seconds: 8 out of 9. The footer asked for a date range opening on 2026-10-01 and rendered that year as 2016. One digit, a 2 that became a 1. The other eight elements were correct, including the decimal and the legal sentence.

qwen-image-3.0, 112.4 seconds: 9 out of 9.

qwen-image-3.0-pro, 81.8 seconds: 9 out of 9.

Aggregate over both rounds: turbo 18 of 19 (94.7%), Standard 19 of 19, Pro 19 of 19.

Gibberish would have been obvious and I would have caught it at a glance. What I got was a plausible-looking digit in the smallest line on the page, which is precisely where nobody proofreads. On a published promo asset a wrong year is an ops incident.

The trade, in numbers you can recompute: 5.1 seconds against 112.4 seconds, ¥0.1 against ¥0.18 or ¥0.25, for a 5.3 point accuracy gap that lived entirely in footer-scale digits.

Patching instead of re-rolling

When turbo wrote 2016, my first instinct was to patch the image rather than regenerate it.

bl image edit --image ./out/turbo/poster.png --prompt "Change the year 2016 in the first footer line to 2026; keep every other character, layout and colour exactly the same" --model qwen-image-3.0

Half good. Both footer lines came back correct and 2026 was restored. Half bad: the artwork did not survive. The source was an illustrated poster with figures and colour, and the output was a plain white text-only layout. It corrected the glyphs and re-rendered the whole canvas.

That gives me a simple rule. bl image edit suits text-dominant assets such as price lists and benefit notices. If the asset is illustration-heavy and you want to move one line, regenerate from the original prompt on Standard or Pro instead of editing.

The second trap was seed. I assumed --seed would make runs comparable for an A/B read. It does not on this path. Same model, same prompt, same seed 42, only the watermark flag different, and the two images came back with completely different compositions. Do not build retry or comparison logic on the assumption that a fixed seed returns the same picture.

Reproduce it in an afternoon

Install the Bailian CLI (bl), create a key on the console key management page, and loop the tiers over one prompt file:

for m in z-image-turbo qwen-image-3.0 qwen-image-3.0-pro; do bl image generate --prompt "$(cat poster.txt)" --model "$m" --size 3:4 --seed 42 --watermark false --out-dir "./out/$m" --out-prefix poster; done

Time each iteration with whatever your shell gives you, and pull the price back as data you can log:

bl model list --model qwen-image-3.0 --output json

Three settings matter once you batch. --n goes up to 6 per request, --concurrent defaults to 1, and --size accepts a ratio (3:4, 16:9, 1:1) or explicit pixels (2048*2048), which is what you want when the artifact has to fill a fixed slot like a social card.

On money: my entire run caps at ¥0.86 at list price, about $0.12. The official free quota ledger shows 10 free generations each for qwen-image-3.0 and -pro, expiring 2026-11-03, and no free quota at all for z-image-turbo. Whether any of that lands on your account depends on your own console bill and quota page, so check there instead of trusting my numbers.

What I changed

Anything published, meaning anything carrying a date, a price, a legal line or contact info, now goes to qwen-image-3.0 or -pro. Both scored 19 of 19 across the two rounds with no footer-digit failures. Between them I lean Pro: ¥0.07 more per image (about $0.01) and faster in both rounds, 53.8 seconds against 101.1 in round one and 81.8 against 112.4 in round two, which adds up when you batch localized variants.

Drafts and direction-finding go to z-image-turbo. Five seconds, ¥0.1, and a wrong digit does not matter because the draft is getting rewritten anyway. Its large and mid-size type was as clean as the other two tiers.

One habit stays regardless of tier: after generating anything with a date, a price or a phone number, zoom in and read the digits. The 2016 was only visible at zoom, and the rest of that poster looked perfect.

If you generate CJK or bilingual assets from a pipeline, what does your proofreading step look like? Mine is still a human with a magnified crop, and I would like to hear about anything better.

Terminal-Generated B-Roll: Six Runs, Timings and File Sizes

xiaoru chen — Thu, 17 Sep 2026 07:27:00 +0000

I keep needing five seconds of nothing

I make short promotional video on my own: a weekly newsletter, a small video channel, the occasional launch clip for a friend's coffee roastery. I never struggle with the writing; what stalls me is the five second gap at the top of every video.

A stock footage subscription charges per clip and still costs an evening of searching. Shooting it myself means lights, a tripod and waiting on the weather. The shots I want are deliberately dull: steam lifting off a cup, mist sliding across water, a patch of sun moving over a desk. Nothing happens in them, which is why they are awkward to buy and awkward to film.

I tried a browser-based video generator last month and came away annoyed. An overseas signup, a card that kept getting refused, a queue, and twenty minutes for five seconds of footage I did not dare publish, because I could not tell what it would end up costing me.

This week I went back through a command line, chasing one claim: that happyhorse-1.1 had reached number one on the Artificial Analysis video arena with an Elo of 1365. I believe half of that sentence. I pulled the ranking myself on the morning of September 16 from a single source and kept no snapshot, so the order may well have moved since. Following the thread turned up something better than a ranking: my account was sitting on free video quota that lapses in five days. So I ran six generations to see what the command line hands back.

Everything below ran on bl 1.22.0 on my own machine, and the wall clock times are mine. Prices came out of bl model list that same day. The dollar figures are rough conversions of the yuan list prices, so read them as approximations.

The quota already in the account

Install the Bailian CLI (bl) and one read-only command lists the free quota attached to your account:

bl auth login --console
bl usage free --expiring 7

The login opens a browser once, which is one step more than creating an API key. The query consumes no quota and costs nothing. My video rows came back like this:

Model	Free runs	Expires
`happyhorse-1.1-t2v` (text to video)	10	2026-09-21
`happyhorse-1.1-i2v` (image to video)	10	2026-09-21
`happyhorse-1.1-r2v` (reference to video)	10	2026-09-21
`wan3.0-video`	30	2026-11-05

The top three rows add up to 30 runs expiring on 2026-09-21, and the official documentation is explicit that expired quota is not reissued.

There is one thing I cannot report, because I never confirmed it. Right after my first generation I ran the query again and happyhorse-1.1-t2v still read 10 of 10, with nothing deducted. That could be ledger lag, or that call may not have landed on the free tier at all. So this post quotes the counts and expiry dates printed in the ledger and says nothing about how fast they fall.

Run one: from a sentence to an mp4

I had no assets prepared, so this was a single line:

bl video generate --prompt "清晨的西湖，薄雾贴着水面缓慢流动，一艘小木船从远处划来，桨声惊起两只白鹭，镜头缓慢向前推进" --model happyhorse-1.1-t2v --resolution 720P --ratio 9:16 --duration 5 --download xihu.mp4

That prompt is in Chinese. It asks for mist moving low across West Lake at dawn, a small wooden boat coming in from a distance, oars startling two egrets, and a slow push-in. I wrote it in the language I could describe the scene most precisely in, and the model took it as given.

Enter at 18:39:18, finished at 18:40:42, so 84.6 seconds. A 3.1 MB mp4 appeared on my desktop: 9:16 vertical, five seconds long, status SUCCEEDED. Nothing queued or errored, and I never left the terminal.

The willow branches, the mist, the boat and its reflection were all in the frame. The egrets got startled too, which was the specific beat I had written into the prompt.

Run two: a still photo that starts moving

B-roll is half the job. The other half is the photographs I already own: product shots, storefronts, event photos sitting in a folder doing nothing.

I generated the source still first with bl image generate, which took 51.1 seconds on qwen-image-3.0. The response carried a temporary URL, and that URL went straight into the video command with no upload step in between:

bl video generate --image <temporary URL from the previous step> --prompt "杯口的热气缓缓上升，窗外晨光轻微变化，镜头极缓慢推近杯身" --model happyhorse-1.1-i2v --resolution 720P --duration 5 --download coffee.mp4

74.5 seconds, 1.8 MB. The steam climbs, the light on the table shifts, and the cup and the wood grain match the source image. In English that prompt asks for steam rising slowly off the rim, morning light changing a little outside the window, and a very slow push toward the cup.

All this path asks for is one decent still. If you make assets rather than films, it is the more useful of the two directions.

Run three: whether the watermark comes off

Out of the box the video carries a "Happy Horse" mark in the lower right corner. --help documents --watermark false, and I did not want to take the help text's word for it.

Same prompt, same --seed 42, only the watermark flag different:

	Filename in the returned URL	Size	Frame 30, lower right
default	`..._refiner_watermark.mp4`	1009.2 KB	"Happy Horse" visible
`--watermark false`	`..._refiner.mp4`	884.0 KB, 12.4% smaller	clean

Three independent signals point the same way, so the flag does what it says. The filename is the one I like best: the returned URL encodes whether the watermark was on, which means a script can check the name instead of looking at pixels.

The same pair of runs also broke a plan I had. Both carried seed 42 and the footage was completely different, a ceramic mug in one and a glass cup on a tray in the other. --seed does not give you the same picture back on the video path. If you were hoping to hold a seed still while comparing two settings, do what I did here instead: change one variable, keep everything else identical, and accept that the frame itself will differ.

Run four: what 1080P costs over 720P

bl model list gave me the per-second list prices for wan3.0-video: ¥0.6 per second at 720P, about $0.085, and ¥1.2 per second at 1080P, about $0.17. Five seconds works out at ¥3 against ¥6, so roughly 42 cents against 84 cents.

Same prompt, same seed, same model, only --resolution different:

Resolution	Wall clock	Size	Five second cost
720P	137.2 s	4.9 MB	¥3, about $0.42
1080P	173.8 s, 27% longer	11.2 MB, 2.3 times larger	¥6, about $0.84

Since that run my habit has been drafts and internal previews at 720P, where it is quicker and the file is less than half the size, and 1080P only for what ships or gets projected in a room.

I could not price the happyhorse-1.1 tier at all. bl model list --model happyhorse-1.1 returns Model not found, and its per-second rate lives on a console model page, so there is no figure for it in this post.

What happens when the free runs are gone

The default state spends money, which matters more than any number above.

The official documentation says that on an authenticated account, calls switch to pay-as-you-go automatically once free quota is used up. There is a console switch named "stop when free quota is used up", and on accounts that have completed identity verification that switch is off by default. The quota runs out, your calls keep going, and the bill keeps growing. If you want the hard stop you have to turn it on yourself; with it on, an exhausted quota returns HTTP 403 carrying AllocationQuota.FreeTierOnly.

Unverified accounts get the opposite treatment. The stop is forced on and the switch is not even visible, so calls stop working when the quota is gone and nothing bills, but you have to verify and add funds before they start again.

Keys, the quota ledger and that switch all live in the console.

Two commands I verified without running

I do not want this to read as though I tested everything. Two capabilities are documented in the local --help output, and I confirmed the flags exist without pressing enter.

First and last frame control: bl video generate --image <first> --last-frame <last> pins both ends of the shot and lets the model fill the middle, which is the shape you want for a cup going from full to empty or a street going from afternoon to night. I have both source images sitting in a folder.

Multiple subjects with their own voices: bl video ref --image A --image B --image-voice <voiceA> --image-voice <voiceB>. --image repeats for each subject, voices pair by position, and the prompt refers to them as image1 and Audio 1. That is the route to a person who stays the same person across shots and speaks, which text to video on its own cannot give you. bl video ref has no --last-frame.

Those get their own post once I have run them.

Where it fits, and where it does not

Short atmospheric shots are what it is good for: an opening shot, a moving background behind slides, a channel cover that breathes, one still photo that had to become a clip. If your budget is tight, the 30 free runs across the three happyhorse-1.1 directions lapse on September 21.

Dialogue with a specific face, a logo that has to appear at second three, anything longer than five seconds: those still belong to an editor. The watermark is on unless you say otherwise, so --watermark false goes in the command before anything ships. And generated B-roll will not rescue weak content; it removes the cost of filming or licensing those five seconds and nothing more.

Reproduce it

npm install -g bailian-cli

Create a key on the console key management page, then run bl usage free --expiring 7 and look at what your own account holds and when it lapses. Every ledger is different, so do not copy my counts. Model list, per-second pricing and quota are all checkable from the Model Studio console.

Every timing and file size above came off my machine on September 16, 2026. Flags and their allowed values follow whatever --help reports in the version you install.

What does your B-roll workflow look like for shots too small to film and too specific to license? Mine is still "generate it, then check the corner for a watermark", and I would like to hear better.

I Priced a Single Code Review Across 7 Model Tiers

xiaoru chen — Wed, 16 Sep 2026 13:23:56 +0000

A $1.20 question with no answer

A post hit the Hacker News front page yesterday asking whether a $1.20 model is good enough for code review. 114 comments, no consensus. The thread kept circling one trap: pricing pages quote dollars per million tokens, and nobody pays per million tokens. You pay per review.

So I measured a review. One 64-line Python file with bugs planted in it, seven Qwen tiers, identical prompts, a client-side stopwatch. The runner was Alibaba's open-source open-code-review (ocr), which shipped v1.12.1 the same week and sat at #2 on GitHub Trending with 26k stars. Token counts are the API's own usage block. Unit prices come from bl model list --model <name> --output json, which needs no account and no auth, so every price below is checkable.

Prices are in CNY because that is what the lookup command returns.

The file

A small order service. Four real defects:

A fetchone() result used without a null check. Crashes when the user does not exist.
An f-string interpolated straight into SQL. Textbook injection.
A global counter incremented with += while the lock defined two lines above is never acquired. Two concurrent orders lose one update.
An open() without with. If parsing throws halfway through, the handle leaks.

Plus two decoys that look suspicious and are correct: an @lru_cache on a pure function, and a redundant except Exception: raise that preserves the traceback exactly as a bare raise should. Flagging either counts as a false positive, and false positives are what make a cheap tier look expensive.

The table

Model	Thinking tokens	Found /4	Missed	False +	Score	Wall time	In tok	Out tok	Cost per review
qwen-turbo	none	2	2	4	-2.0	7.4s	468	1,005	¥0.0007
qwen3-coder-plus	none	3	1	1	2.0	10.1s	464	712	tiered pricing / see console
qwen-plus	none	2	1	1	1.5	39.3s	464	1,766	¥0.0039
qwen3.7-plus	1,182	4	0	0	4.0	23.4s	502	2,052	not published / see console
qwen3.6-flash	4,258	4	0	1	3.0	42.6s	502	5,075	not published / see console
qwen3.8-flash	9,517	4	0	0	4.0	241.0s	540	12,909	¥0.0353
qwen3.8-max	9,770	4	0	0	4.0	293.1s	540	11,064	¥0.4048

One run per configuration. Same system prompt, same user message, byte-identical payloads, max_tokens pinned to the CLI default of 4096, wall clock timed on the client including network round trips. Score is found bugs minus false positives, out of 4. The qwen3-coder family is officially tiered-priced, and qwen3.6-flash plus qwen3.7-plus return no unit price from the lookup command at all, so those cells point at the console instead of a guess.

Four things I did not expect

The flagship bought nothing on this file. qwen3.7-plus scored a perfect 4.0 in 23.4 seconds with 2,052 output tokens and correct line numbers. qwen3.8-max also scored 4.0, and it caught three real problems I had not planted, including that amount <= 0 does not reject float('nan') because nan <= 0 is False. It took 293.1 seconds and 9,770 thinking tokens to get there. The extra 8,588 thinking tokens bought time, nothing else.

The divider is thinking, not price. The three tiers that did not think scored -2.0, 2.0 and 1.5, and every one of them missed at least one planted bug. The five that thought scored 3.0 or better and missed nothing. Past roughly 1,200 thinking tokens the score stops moving. 1,182 tokens of thought is a perfect score here. So is 9,770.

Unit price and total bill are different animals. qwen-turbo costs ¥0.3 per million input tokens and qwen3.8-max costs ¥12, which is 40x. Per review, turbo spent ¥0.0007 and max spent ¥0.4048, which is 545x, because the expensive run also wrote eleven thousand output tokens and most of them were reasoning. Budget from the pricing page and you will be wrong by an order of magnitude.

Line numbers are only trustworthy on the thinking tiers. turbo placed the SQL injection on line 9 (it is line 18) and the null deref on line 10 (line 13). Descriptions right, coordinates wrong. qwen3.7-plus and above were accurate to within one line. Treat a cheap tier's output as a lead list and find the code yourself; treat a thinking tier's output as navigation.

One control run worth recording: qwen3.8-flash with --enable-thinking forced on. It thought harder (11,611 tokens), wrote more (14,954), cost 16% more, and scored the same 4.0 as its default run. On this task the switch only buys a bigger invoice.

Wiring ocr to DashScope in five commands

ocr ships a built-in provider named dashscope. Its base URL is DashScope's OpenAI-compatible endpoint and the Qwen models are preset, so there is no custom provider file to write.

npm install -g @alibaba-group/open-code-review
ocr config set provider dashscope
ocr config set model qwen3.7-plus
ocr config set providers.dashscope.api_key sk-your-key
ocr llm test

Then ocr review inside a repo, or ocr scan --path some/dir for a full-file pass with no git history. Create an API key in the Bailian console before the fourth command.

Two notes if you run outside China. DashScope also serves Virginia (https://dashscope-us.aliyuncs.com/compatible-mode/v1), Singapore and Tokyo, and API keys are region-bound: a key created in one region returns 401 against another region's endpoint. The new-user free quota is per model and independent (typically 1M tokens each), valid for 90 days, Beijing region only, with no reissue after expiry and no automatic failover to another model when it runs out. From Virginia or Singapore you are on pay-as-you-go from the first call, so budget for it.

What I would pick

Scenario	Tier	Per review	Reviews per ¥1	10/day × 22 working days
Coarse sieve on every commit, you read the code anyway	qwen-turbo	¥0.0007	≈1,345	¥0.16
Cheap pass with a published price	qwen-plus	¥0.0039	≈256	¥0.86
Default PR gate, line numbers you can jump to	qwen3.7-plus	≤¥0.0799 (upper bound; real price unpublished)	price unpublished	price unpublished
Hard diff, deep reasoning, still cheap	qwen3.8-flash	¥0.0353	≈28	¥7.76
Same, thinking forced on	qwen3.8-flash with `--enable-thinking`	¥0.0408	≈24	¥8.98
The gnarliest file in the repo	qwen3.8-max	¥0.4048	≈2	¥89.05

The ¥0.0799 is a bound, not an estimate: priced at the flagship's ¥12 and ¥36 rates, that run's 502 input and 2,052 output tokens come to ¥0.0799, one fifth of the flagship's ¥0.4048, and its real price cannot be higher. For the tiers with no published price, check the model pages in the console rather than any reposted number.

One observation, not a conclusion: the two cheap non-thinking tiers missed different bugs. qwen-plus missed the null deref, qwen3-coder-plus missed the race condition, and their misses did not overlap. Running both and cross-reading the reports covers that blind spot at the price of stacked false positives and a human in the loop. With seven configurations measured I would not call this a rule.

Recalculate it yourself

from decimal import Decimal, ROUND_HALF_UP

def cost(in_tok, out_tok, price_in, price_out):
    """prices in CNY per million tokens"""
    c = (Decimal(in_tok) * Decimal(price_in) + Decimal(out_tok) * Decimal(price_out)) / Decimal(1000000)
    return c.quantize(Decimal("0.0001"), rounding=ROUND_HALF_UP)

print(cost(502, 2052, "12", "36"))  # 0.0799: what qwen3.7-plus would cost even at flagship prices

Use Decimal, not Python's round(), or your totals will disagree with the invoice and neither will explain why.

Where this falls down

A community member reported 1,400 PRs taking over ten hours, and even a few-line PR takes minutes. This is not a pre-commit tool, and the flagship tier definitely is not. It does not replace SAST: a rules engine reports deterministic pattern hits, while ocr reports what a model understood about your code. They complement each other. And if your team already pays for a hosted review product that works, this is not a pitch to switch.

Sample size is one file, four bugs, one run per configuration. I ran two of the models twice and their scores moved: qwen-plus went 2.0 then 1.5, and turbo missed the null deref once and caught it the next time. Read every number above as "this run", not as a benchmark.

Your turn

Install the Bailian CLI and run the price lookup on your own machine; that command needs no account. The same CLI carries bl advisor recommend --message "...", and when I asked it to pick a review model on a budget its first choice was a cheaper third-party model rather than the Qwen flagship. I kept that detail in because it is more useful than any claim of objectivity I could make.

What would you pay per PR review, and which tier would you trust on a merge gate? Tell me in the comments what your worst file costs.

DEV Community: xiaoru chen

Cloudflare's security-audit skill rejected my output 7 times

The setup

The target was mine, and the bugs were mine

Three rejections on the ledger

Four rejections on the findings

What I would tell you before installing it

I Missed a Watermark in My Own Photo. A Vision Model Read It Out Loud.

The corner I never looked at

One image proves nothing

Building the controls

The command is one line

What I use it for now

Where it stops helping

Run it yourself

Four AI Invoices a Month Taught Me to Audit a Subscription Before Paying for It

The part of AI tooling nobody demos: the invoices

Audit 1: the price, and a clock that starts when you do

Audit 2: the roster, checked against the live catalog

Audit 3: the credential that had quietly expired

What the three audits are worth

Who this fits, who should skip it

My First LLM API Call Took 11 Minutes. I Now Hand This Exact Route to Everyone Who Asks

Step 1: mint a key, and pick the region on purpose

Step 2: one install command

Step 3: the first call is a sentence, not a program

Step 4: the tier swap that doubles as an honesty test

Step 5: read what one call costs

The free-quota rules, stated completely

What this route is not

An Open-Source Code Review Tool, 7 Qwen Tiers, and the Real Cost of a Single PR

The tool that made me curious

What the tool does

The setup

The experiment

The table

Three things I did not expect

Unit price versus unit cost

What I would pick

Recalculate it yourself

Boundaries and honest limits

Three Models, One Verdict: The Cheapest Code Review I Have Ever Run

The gap nobody prices

The setup

The three commands

Why agreement beats confidence

Run it, then argue with it

I Ran the Viral AI-Novel Workflow on a CLI: 800 Words for Half a Cent

The workflow I copied

Step two: persona in, opening out

What the numbers do and do not say

Panel 2 Is Where AI Comics Die: Character Consistency, Measured

What the gold rush looks like from inside

The gap nobody's tutorial names

Step 1: write the identity down before you draw it

Step 2: the lock is a reference image, not a seed

Step 3: the voice line, and the alignment trap

Step 4 (optional): make her talk

The budget, and the one cost rule that matters

What you'll actually hit when you publish

Your turn

Agent Skills Have No Provenance. A Content Hash Helps.

The question nobody's tooling answers

What the registry records

One copy, three hosts

The bug I hit: --dry-run isn't dry here

What you get

Which skills to delete

Your turn

CJK Poster Text: 3 Image Tiers, 19 Elements, Counted by Hand

I stopped trusting the zoom-out

The two prompts

Round one was the boring result

Round two, where the cheap tier slipped

Patching instead of re-rolling

Reproduce it in an afternoon

What I changed

Terminal-Generated B-Roll: Six Runs, Timings and File Sizes

I keep needing five seconds of nothing

The quota already in the account

The bug I hit: `--dry-run` isn't dry here