Use shared Express API-key preparation for AK/SK-only SDK clients #143

Existing Express users with Alibaba Cloud AccessKeys must currently obtain and configure a separate sandbox API key. Implement the requested AK/SK-only onboarding and runtime path using confirmed credential-resource APIs, with explicit API keys taking precedence.

Acceptance criteria:

• One provider-owned implementation prepares and reuses a managed API key; CLI standard/native and Python standard/provider clients use it.
• Default Team is handled by the documented API; explicit Team and region stay isolated.
• Private local storage, cross-process coordination, real expiry/renewal, non-replayed uncertain writes, and no raw credential output.
• Missing configuration offers API Key or AK/SK; guidance and permission errors name required RAM actions and scope.
• Existing explicit API keys do not invoke management APIs or fall back after rejection.
• English/Chinese docs, engineering record, regression tests and real-component acceptance.

This is a new implementation against the official contract, not restoration of the retired guessed token exchange.

Companion: Alibaba-Agent-Sandbox/agent-sandbox#200

Final consent and delivery contract

Credential creation and renewal require explicit terminal confirmation, an explicit named preparation call, or the literal --ci flag. CI=true, JSON output and unrelated --yes are not consent. Cloud/key lifecycle stays in the Express provider; exact Team-scoped RAM policies and feature/action/resource tables are required.

Candidate: #145

Do not close cross-repository acceptance until both provider and Python consumer have landed. Supported remote CI passed and both dependent PRs are merged. Local environment-specific baseline failures remain tracked separately.

Delivered

CLI Alibaba-Agent-Sandbox/agent-sandbox#202 and Python #145 are merged after final-head required CI passed, in dependency order. Real AK/SK cloud acceptance and exact resource cleanup are recorded in both repositories. No npm/PyPI publication was requested or performed.