@pippit-dev/cli 1.0.17 → 1.0.20

package/cmd/canvas/canvas.go

@@ -0,0 +1,241 @@
+package canvas
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	canvascore "github.com/Pippit-dev/pippit-cli/internal/canvas"
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+	"github.com/spf13/cobra"
+)
+
+const maxApplyRequestBytes = 64 << 20
+
+// NewCommand builds the provider-neutral personal Canvas command tree.
+func NewCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "canvas",
+		Short: "Create and operate personal novel canvases",
+		Args:  cobra.NoArgs,
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	cmd.AddCommand(newCreateCommand(stdout, stderr, runner))
+	cmd.AddCommand(newGetCommand(stdout, stderr, runner))
+	cmd.AddCommand(newAllocateCommand(stdout, stderr, runner))
+	cmd.AddCommand(newApplyCommand(stdout, stderr, runner))
+	cmd.AddCommand(newUploadCommand(stdout, stderr, runner))
+	return cmd
+}
+
+func newAllocateCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var count int
+	cmd := &cobra.Command{
+		Use:   "allocate",
+		Short: "Allocate IDs for assets created by a later Canvas transaction",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			result, err := canvascore.Allocate(cmd.Context(), count, runner)
+			if err != nil {
+				logCanvasError("canvas allocate", err, map[string]string{"count": fmt.Sprint(count)})
+				return err
+			}
+			return common.WriteJSON(stdout, result)
+		},
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	cmd.Flags().IntVar(&count, "count", 0, "number of unique Pippit asset IDs to allocate")
+	return cmd
+}
+
+func newCreateCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var opts canvascore.CreateOptions
+	cmd := &cobra.Command{
+		Use:   "create",
+		Short: "Create a personal novel Canvas project",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			if strings.TrimSpace(opts.RequestID) == "" {
+				requestID, err := newRequestID()
+				if err != nil {
+					return fmt.Errorf("generate canvas request ID: %w", err)
+				}
+				opts.RequestID = requestID
+			}
+			result, err := canvascore.Create(cmd.Context(), opts, runner)
+			if result != nil {
+				if writeErr := common.WriteJSON(stdout, result); writeErr != nil {
+					return writeErr
+				}
+			}
+			if err != nil {
+				logCanvasError("canvas create", err, map[string]string{"request_id": opts.RequestID})
+				return err
+			}
+			return nil
+		},
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	flags := cmd.Flags()
+	flags.StringVar(&opts.Title, "title", "", "project title (maximum 50 characters)")
+	flags.StringVar(&opts.RequestID, "request-id", "", "caller request ID; generated when omitted")
+	flags.BoolVar(&opts.Wait, "wait", false, "wait for the novel overview artifact")
+	flags.DurationVar(&opts.PollInterval, "poll-interval", time.Second, "artifact polling interval")
+	flags.DurationVar(&opts.WaitTimeout, "timeout", 2*time.Minute, "maximum artifact wait time")
+	return cmd
+}
+
+func newGetCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var assetIDs []string
+	cmd := &cobra.Command{
+		Use:   "get",
+		Short: "Get personal Canvas assets by ID",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			result, err := canvascore.Get(cmd.Context(), canvascore.GetOptions{AssetIDs: assetIDs}, runner)
+			if err != nil {
+				logCanvasError("canvas get", err, map[string]string{"asset_count": fmt.Sprint(len(assetIDs))})
+				return err
+			}
+			return common.WriteJSON(stdout, result)
+		},
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	cmd.Flags().StringArrayVar(&assetIDs, "asset-id", nil, "Pippit asset ID; repeat for multiple assets")
+	return cmd
+}
+
+func newApplyCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var filePath string
+	var projectID string
+	var transportResult bool
+	cmd := &cobra.Command{
+		Use:   "apply",
+		Short: "Apply one Canvas patch transaction",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			request, err := readApplyRequest(cmd.InOrStdin(), filePath)
+			if err != nil {
+				return err
+			}
+			result, err := canvascore.Apply(cmd.Context(), canvascore.ApplyOptions{
+				ProjectID:                   projectID,
+				Request:                     request,
+				AllowNonAcknowledgedResults: transportResult,
+			}, runner)
+			if err != nil {
+				logCanvasError("canvas apply", err, map[string]string{
+					"batch_id":     request.BatchID,
+					"project_id":   projectID,
+					"transactions": fmt.Sprint(len(request.Transactions)),
+				})
+				return err
+			}
+			return common.WriteJSON(stdout, result)
+		},
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	flags := cmd.Flags()
+	flags.StringVar(&filePath, "file", "-", "BatchPatch JSON request file, or - for stdin")
+	flags.StringVar(&projectID, "project-id", "", "personal novel project ID as a decimal string")
+	flags.BoolVar(&transportResult, "transport-result", false, "return explicit transaction outcomes for transport decoding")
+	if err := flags.MarkHidden("transport-result"); err != nil {
+		panic(err)
+	}
+	return cmd
+}
+
+func newUploadCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var opts canvascore.UploadOptions
+	cmd := &cobra.Command{
+		Use:   "upload",
+		Short: "Upload a file to personal assets and wait until it is queryable",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			result, err := canvascore.Upload(cmd.Context(), opts, runner)
+			if err != nil {
+				logCanvasError("canvas upload", err, map[string]string{"file_name": filepath.Base(strings.TrimSpace(opts.Path))})
+				return err
+			}
+			return common.WriteJSON(stdout, result)
+		},
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	flags := cmd.Flags()
+	flags.StringVar(&opts.Path, "path", "", "local file path to upload")
+	flags.DurationVar(&opts.PollInterval, "poll-interval", time.Second, "asset visibility polling interval")
+	flags.DurationVar(&opts.WaitTimeout, "timeout", 2*time.Minute, "maximum asset visibility wait time")
+	return cmd
+}
+
+func newRequestID() (string, error) {
+	random := make([]byte, 16)
+	if _, err := rand.Read(random); err != nil {
+		return "", err
+	}
+	return "pippit_cli_canvas_" + hex.EncodeToString(random), nil
+}
+
+func readApplyRequest(stdin io.Reader, filePath string) (canvascore.ApplyRequest, error) {
+	filePath = strings.TrimSpace(filePath)
+	if filePath == "" {
+		return canvascore.ApplyRequest{}, fmt.Errorf("canvas apply --file must not be empty")
+	}
+	var reader io.Reader
+	var file *os.File
+	if filePath == "-" {
+		reader = stdin
+	} else {
+		var err error
+		file, err = os.Open(filePath)
+		if err != nil {
+			return canvascore.ApplyRequest{}, fmt.Errorf("open canvas apply request: %w", err)
+		}
+		defer file.Close()
+		reader = file
+	}
+	limited := io.LimitReader(reader, maxApplyRequestBytes+1)
+	payload, err := io.ReadAll(limited)
+	if err != nil {
+		return canvascore.ApplyRequest{}, fmt.Errorf("read canvas apply request: %w", err)
+	}
+	if len(payload) > maxApplyRequestBytes {
+		return canvascore.ApplyRequest{}, fmt.Errorf("canvas apply request exceeds %d bytes", maxApplyRequestBytes)
+	}
+	decoder := json.NewDecoder(strings.NewReader(string(payload)))
+	decoder.DisallowUnknownFields()
+	var request canvascore.ApplyRequest
+	if err := decoder.Decode(&request); err != nil {
+		return canvascore.ApplyRequest{}, fmt.Errorf("decode canvas apply request: %w", err)
+	}
+	if err := ensureJSONEOF(decoder); err != nil {
+		return canvascore.ApplyRequest{}, err
+	}
+	return request, nil
+}
+
+func ensureJSONEOF(decoder *json.Decoder) error {
+	var trailing any
+	if err := decoder.Decode(&trailing); err == io.EOF {
+		return nil
+	} else if err != nil {
+		return fmt.Errorf("decode trailing canvas apply data: %w", err)
+	}
+	return fmt.Errorf("canvas apply request must contain exactly one JSON object")
+}
+
+func logCanvasError(command string, err error, fields map[string]string) {
+	_ = common.AppendDailyErrorLog(command, err, fields)
+}

package/cmd/canvas/canvas_test.go

@@ -0,0 +1,182 @@
+package canvas
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+	"github.com/spf13/cobra"
+)
+
+type commandFakeClient struct {
+	response string
+	request  map[string]any
+	handler  func(string, any, any) error
+}
+
+func (f *commandFakeClient) SendRequest(_ context.Context, path string, body any, out any) error {
+	payload, _ := json.Marshal(body)
+	_ = json.Unmarshal(payload, &f.request)
+	if f.handler != nil {
+		return f.handler(path, body, out)
+	}
+	return json.Unmarshal([]byte(f.response), out)
+}
+
+func (f *commandFakeClient) SendRequestWithHeaders(ctx context.Context, path string, body any, _ map[string]string, out any) error {
+	return f.SendRequest(ctx, path, body, out)
+}
+
+func (f *commandFakeClient) SendMultipartRequest(context.Context, string, map[string]string, common.MultipartFile, any) error {
+	return nil
+}
+
+func TestCommandExposesOnlyProviderNeutralPublicVerbs(t *testing.T) {
+	cmd := NewCommand(&bytes.Buffer{}, &bytes.Buffer{}, &common.Runner{Client: &commandFakeClient{}})
+	got := make([]string, 0, len(cmd.Commands()))
+	for _, child := range cmd.Commands() {
+		got = append(got, child.Name())
+	}
+	if strings.Join(got, ",") != "allocate,apply,create,get,upload" {
+		t.Fatalf("commands = %v, want allocate/apply/create/get/upload", got)
+	}
+	for _, forbidden := range []string{"import", "bind", "team"} {
+		if strings.Contains(strings.ToLower(cmd.CommandPath()+" "+cmd.Short+" "+strings.Join(got, " ")), forbidden) {
+			t.Fatalf("public command surface contains forbidden verb %q", forbidden)
+		}
+	}
+}
+
+func TestAllocateCommandPrintsOneMachineReadableJSONLine(t *testing.T) {
+	client := &commandFakeClient{response: `{"ret":"0","log_id":"log-1","data":{"ids":["10","11"]}}`}
+	var stdout, stderr bytes.Buffer
+	cmd := NewCommand(&stdout, &stderr, &common.Runner{Client: client})
+	cmd.SetArgs([]string{"allocate", "--count", "2"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	if strings.Count(stdout.String(), "\n") != 1 {
+		t.Fatalf("stdout = %q, want one JSON line", stdout.String())
+	}
+	var result map[string]any
+	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &result); err != nil {
+		t.Fatalf("stdout is not JSON: %v", err)
+	}
+	if len(result["asset_ids"].([]any)) != 2 || client.request["count"] != float64(2) {
+		t.Fatalf("result/request = (%#v, %#v), want two allocated IDs", result, client.request)
+	}
+}
+
+func TestCreateCommandPrintsOneMachineReadableJSONLine(t *testing.T) {
+	client := &commandFakeClient{response: `{"ret":"0","log_id":"log-1","data":{"state":"creating","project_id":"100","thread_id":"thread-1","run_id":"run-1","canvas_asset_id":"200","web_url":"https://xyq.jianying.com/novel/detail/canvas?projectId=100&canvasId=200"}}`}
+	var stdout, stderr bytes.Buffer
+	cmd := NewCommand(&stdout, &stderr, &common.Runner{Client: client})
+	cmd.SetArgs([]string{"create", "--title", "Demo", "--request-id", "request-1"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	if strings.Count(stdout.String(), "\n") != 1 {
+		t.Fatalf("stdout = %q, want one JSON line", stdout.String())
+	}
+	var result map[string]any
+	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &result); err != nil {
+		t.Fatalf("stdout is not JSON: %v", err)
+	}
+	if result["request_id"] != "request-1" || result["project_id"] != "100" || client.request["surface"] != "novel" {
+		t.Fatalf("result/request = (%#v, %#v), want personal novel create", result, client.request)
+	}
+}
+
+func TestCreateCommandWaitTimeoutPrintsAcceptedIDs(t *testing.T) {
+	client := &commandFakeClient{handler: func(path string, _ any, out any) error {
+		response := `{"ret":"0","data":{"thread":{"run_list":[{"run_id":"run-1","state":1}]}}}`
+		if path == "/api/biz/v1/skill/canvas/create" {
+			response = `{"ret":"0","data":{"state":"creating","project_id":"100","thread_id":"thread-1","run_id":"run-1","canvas_asset_id":"200","web_url":"https://xyq.jianying.com/novel/detail/canvas?projectId=100&canvasId=200"}}`
+		}
+		return json.Unmarshal([]byte(response), out)
+	}}
+	var stdout, stderr bytes.Buffer
+	cmd := NewCommand(&stdout, &stderr, &common.Runner{Client: client})
+	cmd.SetArgs([]string{
+		"create", "--request-id", "request-1", "--wait",
+		"--poll-interval", "50ms", "--timeout", "1ms",
+	})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v, want accepted create outcome", err)
+	}
+	var result map[string]any
+	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &result); err != nil {
+		t.Fatalf("stdout = %q, want JSON: %v", stdout.String(), err)
+	}
+	if result["project_id"] != "100" || result["state"] != "creating" || result["warning"] == "" {
+		t.Fatalf("result = %#v, want accepted IDs and wait warning", result)
+	}
+}
+
+func TestApplyRequestRejectsTeamOrImportExtensions(t *testing.T) {
+	for _, field := range []string{"team_id", "provider", "import_source"} {
+		payload := `{"batch_id":"b","client_id":"c","transactions":[],"` + field + `":"x"}`
+		_, err := readApplyRequest(strings.NewReader(payload), "-")
+		if err == nil || !strings.Contains(err.Error(), "unknown field") {
+			t.Fatalf("readApplyRequest(%s) error = %v, want unknown field rejection", field, err)
+		}
+	}
+}
+
+func TestApplyTransportResultFlagIsHiddenAndPrintsExplicitReject(t *testing.T) {
+	client := &commandFakeClient{response: `{"ret":"0","log_id":"transport-log","data":{"results":[{"transaction_id":"tx-1","status":"reject","message":"version conflict","current_asset_versions":{"asset-1":9},"server_detail":{"reason":"conflict"}}]}}`}
+	var stdout, stderr bytes.Buffer
+	cmd := NewCommand(&stdout, &stderr, &common.Runner{Client: client})
+	var applyCommand *cobra.Command
+	for _, child := range cmd.Commands() {
+		if child.Name() == "apply" {
+			applyCommand = child
+			break
+		}
+	}
+	if applyCommand == nil {
+		t.Fatal("apply command not found")
+	}
+	flag := applyCommand.Flags().Lookup("transport-result")
+	if flag == nil || !flag.Hidden {
+		t.Fatalf("transport-result flag = %#v, want hidden flag", flag)
+	}
+
+	request := `{"batch_id":"batch-1","client_id":"client-1","transactions":[{"transaction_id":"tx-1","patches":[{"asset_id":"asset-1","op":"replace","path":"","value":{}}]}]}`
+	cmd.SetIn(strings.NewReader(request))
+	cmd.SetArgs([]string{"apply", "--file", "-", "--transport-result"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	var output map[string]any
+	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &output); err != nil {
+		t.Fatalf("stdout = %q, want JSON: %v", stdout.String(), err)
+	}
+	result := output["results"].([]any)[0].(map[string]any)
+	if result["status"] != "reject" || result["message"] != "version conflict" || result["server_detail"] == nil {
+		t.Fatalf("result = %#v, want complete explicit reject", result)
+	}
+}
+
+func TestApplyTransportResultPrintsRootCreateAckWithoutVersion(t *testing.T) {
+	client := &commandFakeClient{response: `{"ret":"0","data":{"results":[{"transaction_id":"tx-1","status":"ack","server_detail":{"created":true}}]}}`}
+	var stdout, stderr bytes.Buffer
+	cmd := NewCommand(&stdout, &stderr, &common.Runner{Client: client})
+	request := `{"batch_id":"batch-1","client_id":"client-1","transactions":[{"transaction_id":"tx-1","patches":[{"asset_id":"asset-new","op":"add","path":"","value":{}}]}]}`
+	cmd.SetIn(strings.NewReader(request))
+	cmd.SetArgs([]string{"apply", "--file", "-", "--transport-result"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	var output map[string]any
+	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &output); err != nil {
+		t.Fatalf("stdout = %q, want JSON: %v", stdout.String(), err)
+	}
+	result := output["results"].([]any)[0].(map[string]any)
+	if result["status"] != "ack" || result["asset_versions"] != nil || result["server_detail"] == nil {
+		t.Fatalf("result = %#v, want unchanged root-create ACK", result)
+	}
+}

package/cmd/get_credit_balance.go

@@ -0,0 +1,37 @@
+package cmd
+
+import (
+	"io"
+
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+	"github.com/spf13/cobra"
+)
+
+func newGetCreditBalanceCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var withLogID bool
+	cmd := &cobra.Command{
+		Use:   "get-credit-balance",
+		Short: "Get the effective credit balance",
+		Args:  cobra.NoArgs,
+		RunE: withErrorLog("get-credit-balance", nil, func(cmd *cobra.Command, _ []string) error {
+			result, err := common.GetCreditBalance(cmd.Context(), runner)
+			if err != nil {
+				return err
+			}
+			if withLogID {
+				return common.WriteJSON(stdout, struct {
+					TotalRemainAmount int64  `json:"total_remain_amount,string"`
+					LogID             string `json:"log_id"`
+				}{
+					TotalRemainAmount: result.TotalRemainAmount,
+					LogID:             result.LogID,
+				})
+			}
+			return common.WriteJSON(stdout, result)
+		}),
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	cmd.Flags().BoolVar(&withLogID, "with-log-id", false, "include the request log ID in JSON output")
+	return cmd
+}

package/cmd/get_credit_balance_test.go

@@ -0,0 +1,73 @@
+package cmd
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestGetCreditBalanceCommand(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Fatalf("method = %s, want POST", r.Method)
+		}
+		if r.URL.Path != "/api/biz/v1/skill/get_credit_balance" {
+			t.Fatalf("path = %s, want get_credit_balance path", r.URL.Path)
+		}
+		if r.Header.Get("Authorization") != "Bearer test-token" {
+			t.Fatalf("Authorization = %q, want test bearer token", r.Header.Get("Authorization"))
+		}
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Fatalf("read body: %v", err)
+		}
+		if string(body) != "{}" {
+			t.Fatalf("body = %s, want empty JSON object", body)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"ret":"0","data":{"total_remain_amount":"0"}}`))
+	}))
+	defer server.Close()
+
+	var stdout, stderr bytes.Buffer
+	root := newTestRootCommand(t, &stdout, &stderr, server.URL)
+	root.SetArgs([]string{"get-credit-balance"})
+
+	if err := root.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v, stderr = %s", err, stderr.String())
+	}
+	if got, want := stdout.String(), "{\"total_remain_amount\":\"0\"}\n"; got != want {
+		t.Fatalf("stdout = %q, want %q", got, want)
+	}
+}
+
+func TestGetCreditBalanceCommandRejectsArguments(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	root.SetArgs([]string{"get-credit-balance", "unexpected"})
+
+	if err := root.Execute(); err == nil {
+		t.Fatal("Execute() error = nil, want argument rejection")
+	}
+}
+
+func TestGetCreditBalanceCommandSupportsLogID(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"ret":"0","log_id":"log_123","data":{"total_remain_amount":"48592"}}`))
+	}))
+	defer server.Close()
+
+	var stdout, stderr bytes.Buffer
+	root := newTestRootCommand(t, &stdout, &stderr, server.URL)
+	root.SetArgs([]string{"get-credit-balance", "--with-log-id"})
+
+	if err := root.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v, stderr = %s", err, stderr.String())
+	}
+	if got, want := stdout.String(), "{\"total_remain_amount\":\"48592\",\"log_id\":\"log_123\"}\n"; got != want {
+		t.Fatalf("stdout = %q, want %q", got, want)
+	}
+}

package/cmd/root.go

@@ -1,17 +1,20 @@
 package cmd
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"os"
 	"strings"
 
-	// authcmd "github.com/Pippit-dev/pippit-cli/cmd/auth"
+	authcmd "github.com/Pippit-dev/pippit-cli/cmd/auth"
+	canvascmd "github.com/Pippit-dev/pippit-cli/cmd/canvas"
 	"github.com/Pippit-dev/pippit-cli/cmd/generate_image"
 	"github.com/Pippit-dev/pippit-cli/cmd/generate_video"
 	"github.com/Pippit-dev/pippit-cli/cmd/short_drama"
 	updatecmd "github.com/Pippit-dev/pippit-cli/cmd/update"
 	"github.com/Pippit-dev/pippit-cli/cmd/video_tool"
+	internal_auth "github.com/Pippit-dev/pippit-cli/internal/auth"
 	"github.com/Pippit-dev/pippit-cli/internal/common"
 	"github.com/Pippit-dev/pippit-cli/internal/config"
 	"github.com/Pippit-dev/pippit-cli/internal/version"
@@ -25,16 +28,35 @@ func Execute() error {
 
 func NewRootCommand(stdout, stderr io.Writer) *cobra.Command {
 	cfg := config.Load()
-	client := common.NewHTTPClient(cfg.BaseURL, cfg.HTTPTimeout, common.NewAccessKeyAuthorizer(cfg.AccessKey))
-	runner := common.NewRunner(cfg, client)
+	runner := newRootRunner(cfg)
 	return newRootCommand(stdout, stderr, runner)
 }
 
+func newRootRunner(cfg *config.Config) *common.Runner {
+	runner := common.NewRunner(cfg, nil)
+	runner.Auth = internal_auth.NewManager(cfg)
+	runner.Client = common.NewHTTPClient(
+		cfg.BaseURL,
+		cfg.HTTPTimeout,
+		newRunnerAuthorizer(runner),
+	)
+	return runner
+}
+
+func newRunnerAuthorizer(runner *common.Runner) common.RequestAuthorizer {
+	return common.NewAccessKeyContextProviderAuthorizer(func(ctx context.Context) (string, error) {
+		if runner.Auth == nil {
+			return "", nil
+		}
+		return runner.Auth.ResolveAccessKey(ctx)
+	})
+}
+
 func newRootCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
 	root := &cobra.Command{
 		Use:           "pippit-tool-cli",
 		Short:         "Pippit CLI",
-		Long:          "Pippit CLI generates and processes videos and images, submits short-drama workflows, downloads generated assets, and updates the installed CLI package.",
+		Long:          "Pippit CLI generates and processes videos and images, queries credit balances, submits short-drama workflows, downloads generated assets, and updates the installed CLI package.",
 		Version:       version.Current(),
 		SilenceUsage:  true,
 		SilenceErrors: true,
@@ -43,8 +65,12 @@ func newRootCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Comm
 	root.SetVersionTemplate("{{.Version}}\n")
 	root.SetOut(stdout)
 	root.SetErr(stderr)
-	// root.AddCommand(authcmd.NewCommand(stdout, stderr, runner)) // temporarily disabled; auth is via access key injection
+	root.AddCommand(authcmd.NewLoginCommand(stdout, stderr, runner))
+	root.AddCommand(authcmd.NewStatusCommand(stdout, stderr, runner))
+	root.AddCommand(authcmd.NewLogoutCommand(stdout, stderr, runner))
+	root.AddCommand(canvascmd.NewCommand(stdout, stderr, runner))
 	root.AddCommand(newDownloadResultCommand(stdout, stderr, runner))
+	root.AddCommand(newGetCreditBalanceCommand(stdout, stderr, runner))
 	root.AddCommand(newGetThreadCommand(stdout, stderr, runner))
 	root.AddCommand(newListThreadFileCommand(stdout, stderr, runner))
 	root.AddCommand(generate_image.NewCommand(stdout, stderr, runner))

package/cmd/root_test.go

@@ -0,0 +1,69 @@
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+)
+
+func TestRootRunnerReadsUpdatedAccessKeyForEveryRequest(t *testing.T) {
+	received := make([]string, 0, 2)
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		received = append(received, request.Header.Get("Authorization"))
+		writer.Header().Set("Content-Type", "application/json")
+		_, _ = writer.Write([]byte(`{"ok":true}`))
+	}))
+	defer server.Close()
+
+	cfg := config.Load()
+	cfg.BaseURL = server.URL
+	cfg.HTTPTimeout = time.Second
+	cfg.AccessKey = "first-key"
+	runner := newRootRunner(cfg)
+
+	for _, accessKey := range []string{"first-key", "second-key"} {
+		runner.Config.AccessKey = accessKey
+		var response map[string]any
+		if err := runner.Client.SendRequest(context.Background(), "/probe", map[string]any{}, &response); err != nil {
+			t.Fatalf("SendRequest(%q) error = %v", accessKey, err)
+		}
+	}
+	if got, want := strings.Join(received, ","), "Bearer first-key,Bearer second-key"; got != want {
+		t.Fatalf("Authorization headers = %q, want %q", got, want)
+	}
+}
+
+func TestRootRegistersCanvas(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	command, _, err := root.Find([]string{"canvas"})
+	if err != nil || command == nil || command.Name() != "canvas" {
+		t.Fatalf("root.Find(%q) = %#v, %v", "canvas", command, err)
+	}
+}
+
+func TestRootRegistersGetCreditBalance(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	command, _, err := root.Find([]string{"get-credit-balance"})
+	if err != nil || command == nil || command.Name() != "get-credit-balance" {
+		t.Fatalf("root.Find(%q) = %#v, %v", "get-credit-balance", command, err)
+	}
+}
+
+func TestRootRegistersTopLevelBrowserAuthCommands(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	for _, name := range []string{"login", "status", "logout"} {
+		command, _, err := root.Find([]string{name})
+		if err != nil || command == nil || command.Name() != name {
+			t.Fatalf("root.Find(%q) = %#v, %v", name, command, err)
+		}
+	}
+}