@pippit-dev/cli 1.0.16 → 1.0.18

package/cmd/canvas/canvas.go

@@ -0,0 +1,235 @@
+package canvas
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	canvascore "github.com/Pippit-dev/pippit-cli/internal/canvas"
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+	"github.com/spf13/cobra"
+)
+
+const maxApplyRequestBytes = 64 << 20
+
+// NewCommand builds the provider-neutral personal Canvas command tree.
+func NewCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "canvas",
+		Short: "Create and operate personal novel canvases",
+		Args:  cobra.NoArgs,
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	cmd.AddCommand(newCreateCommand(stdout, stderr, runner))
+	cmd.AddCommand(newGetCommand(stdout, stderr, runner))
+	cmd.AddCommand(newAllocateCommand(stdout, stderr, runner))
+	cmd.AddCommand(newApplyCommand(stdout, stderr, runner))
+	cmd.AddCommand(newUploadCommand(stdout, stderr, runner))
+	return cmd
+}
+
+func newAllocateCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var count int
+	cmd := &cobra.Command{
+		Use:   "allocate",
+		Short: "Allocate IDs for assets created by a later Canvas transaction",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			result, err := canvascore.Allocate(cmd.Context(), count, runner)
+			if err != nil {
+				logCanvasError("canvas allocate", err, map[string]string{"count": fmt.Sprint(count)})
+				return err
+			}
+			return common.WriteJSON(stdout, result)
+		},
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	cmd.Flags().IntVar(&count, "count", 0, "number of unique Pippit asset IDs to allocate")
+	return cmd
+}
+
+func newCreateCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var opts canvascore.CreateOptions
+	cmd := &cobra.Command{
+		Use:   "create",
+		Short: "Create a personal novel Canvas project",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			if strings.TrimSpace(opts.RequestID) == "" {
+				requestID, err := newRequestID()
+				if err != nil {
+					return fmt.Errorf("generate canvas request ID: %w", err)
+				}
+				opts.RequestID = requestID
+			}
+			result, err := canvascore.Create(cmd.Context(), opts, runner)
+			if result != nil {
+				if writeErr := common.WriteJSON(stdout, result); writeErr != nil {
+					return writeErr
+				}
+			}
+			if err != nil {
+				logCanvasError("canvas create", err, map[string]string{"request_id": opts.RequestID})
+				return err
+			}
+			return nil
+		},
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	flags := cmd.Flags()
+	flags.StringVar(&opts.Title, "title", "", "project title (maximum 50 characters)")
+	flags.StringVar(&opts.RequestID, "request-id", "", "caller request ID; generated when omitted")
+	flags.BoolVar(&opts.Wait, "wait", false, "wait for the novel overview artifact")
+	flags.DurationVar(&opts.PollInterval, "poll-interval", time.Second, "artifact polling interval")
+	flags.DurationVar(&opts.WaitTimeout, "timeout", 2*time.Minute, "maximum artifact wait time")
+	return cmd
+}
+
+func newGetCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var assetIDs []string
+	cmd := &cobra.Command{
+		Use:   "get",
+		Short: "Get personal Canvas assets by ID",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			result, err := canvascore.Get(cmd.Context(), canvascore.GetOptions{AssetIDs: assetIDs}, runner)
+			if err != nil {
+				logCanvasError("canvas get", err, map[string]string{"asset_count": fmt.Sprint(len(assetIDs))})
+				return err
+			}
+			return common.WriteJSON(stdout, result)
+		},
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	cmd.Flags().StringArrayVar(&assetIDs, "asset-id", nil, "Pippit asset ID; repeat for multiple assets")
+	return cmd
+}
+
+func newApplyCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var filePath string
+	var projectID string
+	cmd := &cobra.Command{
+		Use:   "apply",
+		Short: "Apply one Canvas patch transaction",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			request, err := readApplyRequest(cmd.InOrStdin(), filePath)
+			if err != nil {
+				return err
+			}
+			result, err := canvascore.Apply(cmd.Context(), canvascore.ApplyOptions{
+				ProjectID: projectID,
+				Request:   request,
+			}, runner)
+			if err != nil {
+				logCanvasError("canvas apply", err, map[string]string{
+					"batch_id":     request.BatchID,
+					"project_id":   projectID,
+					"transactions": fmt.Sprint(len(request.Transactions)),
+				})
+				return err
+			}
+			return common.WriteJSON(stdout, result)
+		},
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	flags := cmd.Flags()
+	flags.StringVar(&filePath, "file", "-", "BatchPatch JSON request file, or - for stdin")
+	flags.StringVar(&projectID, "project-id", "", "personal novel project ID as a decimal string")
+	return cmd
+}
+
+func newUploadCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var opts canvascore.UploadOptions
+	cmd := &cobra.Command{
+		Use:   "upload",
+		Short: "Upload a file to personal assets and wait until it is queryable",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			result, err := canvascore.Upload(cmd.Context(), opts, runner)
+			if err != nil {
+				logCanvasError("canvas upload", err, map[string]string{"file_name": filepath.Base(strings.TrimSpace(opts.Path))})
+				return err
+			}
+			return common.WriteJSON(stdout, result)
+		},
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	flags := cmd.Flags()
+	flags.StringVar(&opts.Path, "path", "", "local file path to upload")
+	flags.DurationVar(&opts.PollInterval, "poll-interval", time.Second, "asset visibility polling interval")
+	flags.DurationVar(&opts.WaitTimeout, "timeout", 2*time.Minute, "maximum asset visibility wait time")
+	return cmd
+}
+
+func newRequestID() (string, error) {
+	random := make([]byte, 16)
+	if _, err := rand.Read(random); err != nil {
+		return "", err
+	}
+	return "pippit_cli_canvas_" + hex.EncodeToString(random), nil
+}
+
+func readApplyRequest(stdin io.Reader, filePath string) (canvascore.ApplyRequest, error) {
+	filePath = strings.TrimSpace(filePath)
+	if filePath == "" {
+		return canvascore.ApplyRequest{}, fmt.Errorf("canvas apply --file must not be empty")
+	}
+	var reader io.Reader
+	var file *os.File
+	if filePath == "-" {
+		reader = stdin
+	} else {
+		var err error
+		file, err = os.Open(filePath)
+		if err != nil {
+			return canvascore.ApplyRequest{}, fmt.Errorf("open canvas apply request: %w", err)
+		}
+		defer file.Close()
+		reader = file
+	}
+	limited := io.LimitReader(reader, maxApplyRequestBytes+1)
+	payload, err := io.ReadAll(limited)
+	if err != nil {
+		return canvascore.ApplyRequest{}, fmt.Errorf("read canvas apply request: %w", err)
+	}
+	if len(payload) > maxApplyRequestBytes {
+		return canvascore.ApplyRequest{}, fmt.Errorf("canvas apply request exceeds %d bytes", maxApplyRequestBytes)
+	}
+	decoder := json.NewDecoder(strings.NewReader(string(payload)))
+	decoder.DisallowUnknownFields()
+	var request canvascore.ApplyRequest
+	if err := decoder.Decode(&request); err != nil {
+		return canvascore.ApplyRequest{}, fmt.Errorf("decode canvas apply request: %w", err)
+	}
+	if err := ensureJSONEOF(decoder); err != nil {
+		return canvascore.ApplyRequest{}, err
+	}
+	return request, nil
+}
+
+func ensureJSONEOF(decoder *json.Decoder) error {
+	var trailing any
+	if err := decoder.Decode(&trailing); err == io.EOF {
+		return nil
+	} else if err != nil {
+		return fmt.Errorf("decode trailing canvas apply data: %w", err)
+	}
+	return fmt.Errorf("canvas apply request must contain exactly one JSON object")
+}
+
+func logCanvasError(command string, err error, fields map[string]string) {
+	_ = common.AppendDailyErrorLog(command, err, fields)
+}

package/cmd/canvas/canvas_test.go

@@ -0,0 +1,126 @@
+package canvas
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+)
+
+type commandFakeClient struct {
+	response string
+	request  map[string]any
+	handler  func(string, any, any) error
+}
+
+func (f *commandFakeClient) SendRequest(_ context.Context, path string, body any, out any) error {
+	payload, _ := json.Marshal(body)
+	_ = json.Unmarshal(payload, &f.request)
+	if f.handler != nil {
+		return f.handler(path, body, out)
+	}
+	return json.Unmarshal([]byte(f.response), out)
+}
+
+func (f *commandFakeClient) SendRequestWithHeaders(ctx context.Context, path string, body any, _ map[string]string, out any) error {
+	return f.SendRequest(ctx, path, body, out)
+}
+
+func (f *commandFakeClient) SendMultipartRequest(context.Context, string, map[string]string, common.MultipartFile, any) error {
+	return nil
+}
+
+func TestCommandExposesOnlyProviderNeutralPublicVerbs(t *testing.T) {
+	cmd := NewCommand(&bytes.Buffer{}, &bytes.Buffer{}, &common.Runner{Client: &commandFakeClient{}})
+	got := make([]string, 0, len(cmd.Commands()))
+	for _, child := range cmd.Commands() {
+		got = append(got, child.Name())
+	}
+	if strings.Join(got, ",") != "allocate,apply,create,get,upload" {
+		t.Fatalf("commands = %v, want allocate/apply/create/get/upload", got)
+	}
+	for _, forbidden := range []string{"import", "bind", "team"} {
+		if strings.Contains(strings.ToLower(cmd.CommandPath()+" "+cmd.Short+" "+strings.Join(got, " ")), forbidden) {
+			t.Fatalf("public command surface contains forbidden verb %q", forbidden)
+		}
+	}
+}
+
+func TestAllocateCommandPrintsOneMachineReadableJSONLine(t *testing.T) {
+	client := &commandFakeClient{response: `{"ret":"0","log_id":"log-1","data":{"ids":["10","11"]}}`}
+	var stdout, stderr bytes.Buffer
+	cmd := NewCommand(&stdout, &stderr, &common.Runner{Client: client})
+	cmd.SetArgs([]string{"allocate", "--count", "2"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	if strings.Count(stdout.String(), "\n") != 1 {
+		t.Fatalf("stdout = %q, want one JSON line", stdout.String())
+	}
+	var result map[string]any
+	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &result); err != nil {
+		t.Fatalf("stdout is not JSON: %v", err)
+	}
+	if len(result["asset_ids"].([]any)) != 2 || client.request["count"] != float64(2) {
+		t.Fatalf("result/request = (%#v, %#v), want two allocated IDs", result, client.request)
+	}
+}
+
+func TestCreateCommandPrintsOneMachineReadableJSONLine(t *testing.T) {
+	client := &commandFakeClient{response: `{"ret":"0","log_id":"log-1","data":{"state":"creating","project_id":"100","thread_id":"thread-1","run_id":"run-1","canvas_asset_id":"200","web_url":"https://xyq.jianying.com/novel/detail/canvas?projectId=100&canvasId=200"}}`}
+	var stdout, stderr bytes.Buffer
+	cmd := NewCommand(&stdout, &stderr, &common.Runner{Client: client})
+	cmd.SetArgs([]string{"create", "--title", "Demo", "--request-id", "request-1"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	if strings.Count(stdout.String(), "\n") != 1 {
+		t.Fatalf("stdout = %q, want one JSON line", stdout.String())
+	}
+	var result map[string]any
+	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &result); err != nil {
+		t.Fatalf("stdout is not JSON: %v", err)
+	}
+	if result["request_id"] != "request-1" || result["project_id"] != "100" || client.request["surface"] != "novel" {
+		t.Fatalf("result/request = (%#v, %#v), want personal novel create", result, client.request)
+	}
+}
+
+func TestCreateCommandWaitTimeoutPrintsAcceptedIDs(t *testing.T) {
+	client := &commandFakeClient{handler: func(path string, _ any, out any) error {
+		response := `{"ret":"0","data":{"thread":{"run_list":[{"run_id":"run-1","state":1}]}}}`
+		if path == "/api/biz/v1/skill/canvas/create" {
+			response = `{"ret":"0","data":{"state":"creating","project_id":"100","thread_id":"thread-1","run_id":"run-1","canvas_asset_id":"200","web_url":"https://xyq.jianying.com/novel/detail/canvas?projectId=100&canvasId=200"}}`
+		}
+		return json.Unmarshal([]byte(response), out)
+	}}
+	var stdout, stderr bytes.Buffer
+	cmd := NewCommand(&stdout, &stderr, &common.Runner{Client: client})
+	cmd.SetArgs([]string{
+		"create", "--request-id", "request-1", "--wait",
+		"--poll-interval", "50ms", "--timeout", "1ms",
+	})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v, want accepted create outcome", err)
+	}
+	var result map[string]any
+	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &result); err != nil {
+		t.Fatalf("stdout = %q, want JSON: %v", stdout.String(), err)
+	}
+	if result["project_id"] != "100" || result["state"] != "creating" || result["warning"] == "" {
+		t.Fatalf("result = %#v, want accepted IDs and wait warning", result)
+	}
+}
+
+func TestApplyRequestRejectsTeamOrImportExtensions(t *testing.T) {
+	for _, field := range []string{"team_id", "provider", "import_source"} {
+		payload := `{"batch_id":"b","client_id":"c","transactions":[],"` + field + `":"x"}`
+		_, err := readApplyRequest(strings.NewReader(payload), "-")
+		if err == nil || !strings.Contains(err.Error(), "unknown field") {
+			t.Fatalf("readApplyRequest(%s) error = %v, want unknown field rejection", field, err)
+		}
+	}
+}

package/cmd/generate_video/generate_video.go

@@ -48,7 +48,7 @@ func NewCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command
 	flags.StringArrayVar(&opts.AudioPaths, "audio", nil, "local reference audio path; repeat for multiple audios, up to 3")
 	flags.IntVar(&durationSec, "duration", 0, "video duration in seconds")
 	flags.StringVar(&opts.Ratio, "ratio", "", "video ratio, such as 9:16, 16:9, 3:4, 4:3")
-	flags.StringVar(&opts.Model, "model", "", "video model; normal users: Seedance_2.0_mini_lite; VIP-only: seedance2.0_vision, seedance2.0_fast_vision, Seedance_2.0_mini")
+	flags.StringVar(&opts.Model, "model", "", "video model; normal users: Seedance_2.0_mini_lite; VIP-only: seedance2.0_vision, seedance2.0_fast_vision, Seedance_2.0_mini, Seedance_2.5")
 	flags.StringVar(&opts.Resolution, "resolution", "", "video resolution, such as 720p, 1080p")
 	flags.Int64Var(&generateType, "generate-type", 0, "generation type passed to the service; set 1 for first-and-last-frame generation and provide two --image values in first-frame, last-frame order")
 	return cmd

package/cmd/root.go

@@ -1,17 +1,20 @@
 package cmd
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"os"
 	"strings"
 
-	// authcmd "github.com/Pippit-dev/pippit-cli/cmd/auth"
+	authcmd "github.com/Pippit-dev/pippit-cli/cmd/auth"
+	canvascmd "github.com/Pippit-dev/pippit-cli/cmd/canvas"
 	"github.com/Pippit-dev/pippit-cli/cmd/generate_image"
 	"github.com/Pippit-dev/pippit-cli/cmd/generate_video"
 	"github.com/Pippit-dev/pippit-cli/cmd/short_drama"
 	updatecmd "github.com/Pippit-dev/pippit-cli/cmd/update"
 	"github.com/Pippit-dev/pippit-cli/cmd/video_tool"
+	internal_auth "github.com/Pippit-dev/pippit-cli/internal/auth"
 	"github.com/Pippit-dev/pippit-cli/internal/common"
 	"github.com/Pippit-dev/pippit-cli/internal/config"
 	"github.com/Pippit-dev/pippit-cli/internal/version"
@@ -25,11 +28,30 @@ func Execute() error {
 
 func NewRootCommand(stdout, stderr io.Writer) *cobra.Command {
 	cfg := config.Load()
-	client := common.NewHTTPClient(cfg.BaseURL, cfg.HTTPTimeout, common.NewAccessKeyAuthorizer(cfg.AccessKey))
-	runner := common.NewRunner(cfg, client)
+	runner := newRootRunner(cfg)
 	return newRootCommand(stdout, stderr, runner)
 }
 
+func newRootRunner(cfg *config.Config) *common.Runner {
+	runner := common.NewRunner(cfg, nil)
+	runner.Auth = internal_auth.NewManager(cfg)
+	runner.Client = common.NewHTTPClient(
+		cfg.BaseURL,
+		cfg.HTTPTimeout,
+		newRunnerAuthorizer(runner),
+	)
+	return runner
+}
+
+func newRunnerAuthorizer(runner *common.Runner) common.RequestAuthorizer {
+	return common.NewAccessKeyContextProviderAuthorizer(func(ctx context.Context) (string, error) {
+		if runner.Auth == nil {
+			return "", nil
+		}
+		return runner.Auth.ResolveAccessKey(ctx)
+	})
+}
+
 func newRootCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
 	root := &cobra.Command{
 		Use:           "pippit-tool-cli",
@@ -43,7 +65,10 @@ func newRootCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Comm
 	root.SetVersionTemplate("{{.Version}}\n")
 	root.SetOut(stdout)
 	root.SetErr(stderr)
-	// root.AddCommand(authcmd.NewCommand(stdout, stderr, runner)) // temporarily disabled; auth is via access key injection
+	root.AddCommand(authcmd.NewLoginCommand(stdout, stderr, runner))
+	root.AddCommand(authcmd.NewStatusCommand(stdout, stderr, runner))
+	root.AddCommand(authcmd.NewLogoutCommand(stdout, stderr, runner))
+	root.AddCommand(canvascmd.NewCommand(stdout, stderr, runner))
 	root.AddCommand(newDownloadResultCommand(stdout, stderr, runner))
 	root.AddCommand(newGetThreadCommand(stdout, stderr, runner))
 	root.AddCommand(newListThreadFileCommand(stdout, stderr, runner))

package/cmd/root_test.go

@@ -0,0 +1,60 @@
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+)
+
+func TestRootRunnerReadsUpdatedAccessKeyForEveryRequest(t *testing.T) {
+	received := make([]string, 0, 2)
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		received = append(received, request.Header.Get("Authorization"))
+		writer.Header().Set("Content-Type", "application/json")
+		_, _ = writer.Write([]byte(`{"ok":true}`))
+	}))
+	defer server.Close()
+
+	cfg := config.Load()
+	cfg.BaseURL = server.URL
+	cfg.HTTPTimeout = time.Second
+	cfg.AccessKey = "first-key"
+	runner := newRootRunner(cfg)
+
+	for _, accessKey := range []string{"first-key", "second-key"} {
+		runner.Config.AccessKey = accessKey
+		var response map[string]any
+		if err := runner.Client.SendRequest(context.Background(), "/probe", map[string]any{}, &response); err != nil {
+			t.Fatalf("SendRequest(%q) error = %v", accessKey, err)
+		}
+	}
+	if got, want := strings.Join(received, ","), "Bearer first-key,Bearer second-key"; got != want {
+		t.Fatalf("Authorization headers = %q, want %q", got, want)
+	}
+}
+
+func TestRootRegistersCanvas(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	command, _, err := root.Find([]string{"canvas"})
+	if err != nil || command == nil || command.Name() != "canvas" {
+		t.Fatalf("root.Find(%q) = %#v, %v", "canvas", command, err)
+	}
+}
+
+func TestRootRegistersTopLevelBrowserAuthCommands(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	for _, name := range []string{"login", "status", "logout"} {
+		command, _, err := root.Find([]string{name})
+		if err != nil || command == nil || command.Name() != name {
+			t.Fatalf("root.Find(%q) = %#v, %v", name, command, err)
+		}
+	}
+}

package/cmd/short_drama_test.go

@@ -140,7 +140,7 @@ func TestRootHelpListsSupportedCommands(t *testing.T) {
 			t.Fatalf("help output = %q, want %q", got, want)
 		}
 	}
-	for _, unwanted := range []string{"completion", "version     "} {
+	for _, unwanted := range []string{"completion", "\n  version "} {
 		if strings.Contains(got, unwanted) {
 			t.Fatalf("help output = %q, should not contain %q", got, unwanted)
 		}
@@ -971,14 +971,11 @@ func assertAccessKeyGuidance(t *testing.T, err error) {
 		t.Fatal("error = nil, want access key guidance")
 	}
 	msg := err.Error()
-	if !strings.Contains(msg, "XYQ_ACCESS_KEY 缺失") {
+	if !strings.Contains(msg, "pippit-tool-cli login") {
 		t.Fatalf("error = %q, want access key guidance", err)
 	}
-	if !strings.Contains(msg, "https://xyq.jianying.com/home?tab_name=home") {
-		t.Fatalf("error = %q, want access key settings URL", err)
-	}
-	if !strings.Contains(msg, `export XYQ_ACCESS_KEY="<your-access-key>"`) {
-		t.Fatalf("error = %q, want setup command guidance", err)
+	if !strings.Contains(msg, "XYQ_ACCESS_KEY") {
+		t.Fatalf("error = %q, want CI override guidance", err)
 	}
 }
 

package/cmd/update/update.go

@@ -14,6 +14,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/Pippit-dev/pippit-cli/internal/auth"
 	"github.com/Pippit-dev/pippit-cli/internal/version"
 	"github.com/spf13/cobra"
 )
@@ -219,20 +220,48 @@ func runInherit(stderr io.Writer, name string, args ...string) error {
 
 func runInheritEnv(stderr io.Writer, env []string, name string, args ...string) error {
 	cmd := command(name, args...)
-	if len(env) > 0 {
-		cmd.Env = append(os.Environ(), env...)
-	}
+	cmd.Env = sanitizedUpdateEnv(os.Environ(), env)
 	cmd.Stdout = stderr
 	cmd.Stderr = stderr
 	return cmd.Run()
 }
 
+func sanitizedUpdateEnv(environment, overrides []string) []string {
+	merged := overlayEnvironment(environment, overrides)
+	return auth.SanitizedBrowserEnv(merged)
+}
+
+func overlayEnvironment(environment, overrides []string) []string {
+	result := make([]string, 0, len(environment)+len(overrides))
+	indexes := make(map[string]int, len(environment)+len(overrides))
+	for _, entry := range append(append([]string(nil), environment...), overrides...) {
+		name, _, found := strings.Cut(entry, "=")
+		if !found || strings.TrimSpace(name) == "" {
+			continue
+		}
+		key := name
+		if runtime.GOOS == "windows" {
+			key = strings.ToUpper(key)
+		}
+		if index, exists := indexes[key]; exists {
+			result[index] = entry
+			continue
+		}
+		indexes[key] = len(result)
+		result = append(result, entry)
+	}
+	return result
+}
 func command(name string, args ...string) *exec.Cmd {
+	var cmd *exec.Cmd
 	if runtime.GOOS == "windows" {
 		cmdArgs := append([]string{"/c", name}, args...)
-		return exec.Command("cmd.exe", cmdArgs...)
+		cmd = exec.Command("cmd.exe", cmdArgs...)
+	} else {
+		cmd = exec.Command(name, args...)
 	}
-	return exec.Command(name, args...)
+	cmd.Env = sanitizedUpdateEnv(os.Environ(), nil)
+	return cmd
 }
 
 func prepareSelfReplace() (func(), error) {

package/cmd/update/update_test.go

@@ -171,3 +171,87 @@ func TestStripPrereleaseVersion(t *testing.T) {
 		}
 	}
 }
+
+func TestRunInheritEnvSanitizesPippitCredentials(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("test uses a POSIX shell script to capture the child environment")
+	}
+
+	binDir := t.TempDir()
+	capturePath := filepath.Join(t.TempDir(), "environment.txt")
+	commandPath := filepath.Join(binDir, "capture-update-environment")
+	script := "#!/bin/sh\n/usr/bin/env > \"$CAPTURE_ENV\"\n"
+	if err := os.WriteFile(commandPath, []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	basePath := binDir + string(os.PathListSeparator) + "/base/path"
+	overriddenPath := binDir + string(os.PathListSeparator) + "/overridden/path"
+	t.Setenv("PATH", basePath)
+	t.Setenv("CAPTURE_ENV", capturePath)
+	t.Setenv("SAFE_INHERITED", "kept")
+	t.Setenv("XYQ_ACCESS_KEY", "xyq-secret")
+	t.Setenv("PIPPIT_ACCESS_KEY", "pippit-secret")
+	t.Setenv("PIPPIT_AK", "legacy-secret")
+	t.Setenv("PIPPIT_CLI_TOKEN", "pippit-token")
+	t.Setenv("XYQ_CLIENT_SECRET", "xyq-client-secret")
+	t.Setenv("NPM_TOKEN", "npm-secret")
+	t.Setenv("NODE_AUTH_TOKEN", "registry-secret")
+
+	var stderr bytes.Buffer
+	err := runInheritEnv(&stderr, []string{
+		"PATH=" + overriddenPath,
+		"SAFE_INHERITED=overridden",
+		"SAFE_EXPLICIT=kept",
+		"PIPPIT_CLI_SKIP_SKILLS=1",
+		"XYQ_ACCESS_KEY=override-must-not-leak",
+		"PIPPIT_OVERRIDE_SECRET=override-must-not-leak",
+		"REGISTRY_TOKEN=explicit-registry-secret",
+	}, "capture-update-environment")
+	if err != nil {
+		t.Fatalf("runInheritEnv() error = %v, stderr = %s", err, stderr.String())
+	}
+
+	captured, err := os.ReadFile(capturePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := parseEnvironment(string(captured))
+	for _, forbidden := range []string{
+		"XYQ_ACCESS_KEY",
+		"PIPPIT_ACCESS_KEY",
+		"PIPPIT_AK",
+		"PIPPIT_CLI_TOKEN",
+		"XYQ_CLIENT_SECRET",
+		"PIPPIT_OVERRIDE_SECRET",
+	} {
+		if value, exists := got[forbidden]; exists {
+			t.Fatalf("child environment retained %s=%q", forbidden, value)
+		}
+	}
+	for name, want := range map[string]string{
+		"PATH":                   overriddenPath,
+		"CAPTURE_ENV":            capturePath,
+		"SAFE_INHERITED":         "overridden",
+		"SAFE_EXPLICIT":          "kept",
+		"PIPPIT_CLI_SKIP_SKILLS": "1",
+		"NPM_TOKEN":              "npm-secret",
+		"NODE_AUTH_TOKEN":        "registry-secret",
+		"REGISTRY_TOKEN":         "explicit-registry-secret",
+	} {
+		if value := got[name]; value != want {
+			t.Fatalf("child environment %s = %q, want %q", name, value, want)
+		}
+	}
+}
+
+func parseEnvironment(environment string) map[string]string {
+	result := make(map[string]string)
+	for _, entry := range strings.Split(environment, "\n") {
+		name, value, found := strings.Cut(entry, "=")
+		if found {
+			result[name] = value
+		}
+	}
+	return result
+}