@pippit-dev/cli 1.0.22 → 1.0.23

package/README.md

@@ -39,53 +39,58 @@
 
 - 生成：文生图、文生视频、图生视频、视频续写。
 - 编辑：局部修改、元素替换、镜头调整、风格迁移。
-- 复杂创作：一句话生成短剧、复刻视频/TVC/宣传片、音乐 MV 生成、产品展示片制作。
+- 复杂创作：复刻视频/TVC/宣传片、音乐 MV 生成、产品展示片制作。
 
 ### 配置
 
-所有 `xyq-skill` 脚本都使用 Bearer 令牌鉴权：
+单独上传 `xyq-skill` ZIP 时，保留 Skill 内的 `scripts/ensure-cli.js`。每次开始执行 Skill 任务先运行：
 
 ```bash
-export XYQ_ACCESS_KEY="<access-key>"
+node /path/to/xyq-skill/scripts/ensure-cli.js
 ```
 
-可选 API 地址：
+环境需要 Node.js 16+ 和 Python 3；首次安装或自动升级时需要 npm、`curl`、系统解压工具（macOS/Linux 的 `tar`，Windows 的 PowerShell）及访问 npm 源和 GitHub Release 的网络。脚本优先复用 PATH 或自身缓存中命令齐全的 CLI；均不存在或缺少必需命令时获取 `@pippit-dev/cli@latest`，安装到 `~/.cache/pippit-tool-cli/xyq-skill/<平台>-<架构>/current`，返回 `{ "cli_path": "CLI绝对路径", "version": "实际安装版本" }`。后续示例中的 `pippit-tool-cli` 替换为该绝对路径；同一任务内复用，不在轮询时重复安装。已有 CLI 缺少关键命令时自动升级；升级后的缓存可被后续任务复用，避免 PATH 旧版本触发重复下载。每次调用最多下载安装一次，升级失败保留原安装；最新版本仍缺少必需命令时报告阻塞。
+
+新入口 `node scripts/install-cli.js` 只安装 npm 包对应版本的 CLI 二进制，不安装或清理全局 Skill。ZIP 安装脚本先以 `--ignore-scripts` 获取 npm 包，再调用这个入口。发布包含新入口的 npm 包及对应 GitHub Release 后，ZIP 的最新版本安装流程才能完整使用。
+
+`submit-run` 和 `upload-file` 使用原生 CLI 登录凭证（`pippit-tool-cli login`），也可通过 `XYQ_ACCESS_KEY` 显式覆盖。保留的查询脚本 `get_thread.py` 仍需配置同一用户的 Bearer 凭证：
 
 ```bash
-export XYQ_OPENAPI_BASE="https://xyq.jianying.com"
-# 或
-export XYQ_BASE_URL="https://xyq.jianying.com"
+export XYQ_ACCESS_KEY="<access-key>"
 ```
 
+CLI 和 Python 脚本携带用户密钥的 API 请求地址固定为 `https://xyq.jianying.com`，不接受 `XYQ_OPENAPI_BASE` / `XYQ_BASE_URL` 覆盖。CLI 拒绝 API 跨域重定向，Python API 脚本禁止自动重定向。上传只在 Authorization 请求头携带密钥。
+
 ### 创建会话 / 发送消息
 
 ```bash
 # 创建新会话
-python3 skills/xyq-nest-skill/scripts/submit_run.py --message "生一个动漫视频"
+pippit-tool-cli submit-run --message "生一个动漫视频"
 
 # 向已有会话发送消息
-python3 skills/xyq-nest-skill/scripts/submit_run.py \
+pippit-tool-cli submit-run \
   --message "再生成一个故事视频" \
   --thread-id THREAD_ID
 
 # 携带参考文件发送
-python3 skills/xyq-nest-skill/scripts/submit_run.py \
+pippit-tool-cli submit-run \
   --message "参考这个视频做修改" \
-  --asset-ids asset_id1 asset_id2
+  --asset-ids asset_id1 --asset-ids asset_id2
 ```
 
 | 参数 | 必填 | 说明 |
 |------|------|------|
-| `--message` | 是 | 创作指令内容。 |
+| `--message` | 是 | 非空白的创作指令，原样发送。 |
 | `--thread-id` | 否 | 已有会话 ID，不传则创建新会话。 |
-| `--asset-ids` | 否 | 资产 ID 列表，支持多个。 |
+| `--asset-ids` | 否 | 每次传一个资产 ID；多个素材重复该参数。 |
 
 返回示例：
 
 ```json
 {
   "thread_id": "90f05e0c-...",
-  "run_id": "abc123-..."
+  "run_id": "abc123-...",
+  "web_thread_link": "https://xyq.jianying.com/..."
 }
 ```
 
@@ -108,18 +113,20 @@ python3 skills/xyq-nest-skill/scripts/get_thread.py \
 
 ### 上传文件
 
+使用顶层 `upload-file --path`，每次上传一个本地图片、视频或 MP3/WAV 音频文件，文件须小于 500 MB（500000000 字节）。成功返回 `{"asset_id":"..."}`，可直接传给 `submit-run --asset-ids`。
+
 ```bash
 # 上传图片
-python3 skills/xyq-nest-skill/scripts/upload_file.py /path/to/image.png
+pippit-tool-cli upload-file --path /path/to/image.png
 
 # 上传视频
-python3 skills/xyq-nest-skill/scripts/upload_file.py /path/to/video.mp4
+pippit-tool-cli upload-file --path /path/to/video.mp4
 
 # 上传音频
-python3 skills/xyq-nest-skill/scripts/upload_file.py /path/to/audio.mp3
+pippit-tool-cli upload-file --path /path/to/audio.mp3
 ```
 
-仅支持 `image/*`、`video/*` 和 `.mp3/.wav` 音频文件，单文件大小限制 200 MB。
+仅支持 `image/*`、`video/*` 和 `.mp3/.wav` 音频文件，单文件大小限制 500 MB。
 
 返回示例：
 
@@ -131,65 +138,71 @@ python3 skills/xyq-nest-skill/scripts/upload_file.py /path/to/audio.mp3
 
 ### 下载结果
 
+每个产物 URL 调用一次 CLI，`--output-path` 必须包含文件名：
+
 ```bash
-python3 skills/xyq-nest-skill/scripts/download_results.py \
-  --urls URL1 URL2 URL3 \
-  --output-dir ./xyq_output \
-  --prefix "storyboard" \
-  --workers 5
+pippit-tool-cli download-result \
+  --url "URL1" \
+  --output-path "./xyq_output/storyboard_01.png"
 ```
 
 | 参数 | 必填 | 说明 |
 |------|------|------|
-| `--urls` | 是 | 要下载的 URL 列表。 |
-| `--output-dir` | 否 | 输出目录，默认 `./xyq_output`。 |
-| `--prefix` | 否 | 文件名前缀，例如 `storyboard_01.png`。 |
-| `--workers` | 否 | 并行下载线程数，默认 `5`。 |
+| `--url` | 是 | 单个产物的下载 URL。 |
+| `--output-path` | 是 | 包含文件名的本地目标路径。 |
+| `--updated-at` | 否 | 远端文件真实更新时间（Unix 秒），用于判断是否覆盖已有文件。 |
+| `--workers` | 否 | 下载 worker 数，默认 `5`；当前单 URL 调用实际只使用一个 worker。 |
 
-返回示例：
+Skill 沿用用户指定的输出目录，未指定时使用 `./xyq_output`，按 URL 列表顺序从 `01` 编号，组成 `前缀_01.ext`（无前缀时为 `01.ext`）。扩展名优先取 URL 查询参数 `filename`，其次取 URL 路径，无法取得时使用 `.bin`。多文件逐项调用，可最多并行执行 5 个命令；重试保持原目标路径。
+
+下载成功返回示例：
 
 ```json
 {
-  "output_dir": "./xyq_output",
-  "downloaded": ["./xyq_output/storyboard_01.png"],
-  "total": 1
+  "output_path": "./xyq_output/storyboard_01.png",
+  "downloaded": ["./xyq_output/storyboard_01.png"]
 }
 ```
 
+未传 `--updated-at` 时，CLI 默认跳过已有文件，返回 `already_exist`，此时 `downloaded` 为 `null`；传入真实更新时间后，仅当本地文件修改时间早于该时间时覆盖更新。跳过不代表已校验本地内容与远端一致。
+
+下载失败时命令以非零退出码返回错误，不保证输出 JSON。Skill 汇总各次调用的下载成功、已存在跳过和失败项，只对失败项重试一次；仍有失败时明确报告未完整交付。
+
 ### 典型示例
 
 文生视频：
 
 ```text
-1. submit_run.py --message "生成一个赛博朋克风格的城市夜景视频"
+1. pippit-tool-cli submit-run --message "生成一个赛博朋克风格的城市夜景视频"
 2. 每 10 秒轮询：
    get_thread.py --thread-id THREAD_ID --run-id RUN_ID --after-seq SEQUENCE
 3. 拿到产物 URL 后下载：
-   download_results.py --urls URL1 URL2 --output-dir ./output --prefix "cyberpunk"
+   pippit-tool-cli download-result --url "URL1" --output-path "./output/cyberpunk_01.mp4"
+   pippit-tool-cli download-result --url "URL2" --output-path "./output/cyberpunk_02.mp4"
 ```
 
 编辑已有视频：
 
 ```text
-1. upload_file.py /path/to/video.mp4
-2. submit_run.py --message "把背景换成星空" --asset-ids asset_id
+1. pippit-tool-cli upload-file --path /path/to/video.mp4
+2. pippit-tool-cli submit-run --message "把背景换成星空" --asset-ids asset_id
 3. 按文生视频流程轮询和下载。
 ```
 
 多参考图/视频生成：
 
 ```text
-1. upload_file.py /path/to/ref1.png
-2. upload_file.py /path/to/ref2.png
-3. upload_file.py /path/to/ref3.mp4
-4. submit_run.py --message "根据参考图和视频生成科普故事视频" --asset-ids asset_id1 asset_id2 asset_id3
+1. pippit-tool-cli upload-file --path /path/to/ref1.png
+2. pippit-tool-cli upload-file --path /path/to/ref2.png
+3. pippit-tool-cli upload-file --path /path/to/ref3.mp4
+4. pippit-tool-cli submit-run --message "根据参考图和视频生成科普故事视频" --asset-ids asset_id1 --asset-ids asset_id2 --asset-ids asset_id3
 5. 按文生视频流程轮询和下载。
 ```
 
 在已有会话中追加需求：
 
 ```text
-1. submit_run.py --message "把刚才的视频加个片头" --thread-id EXISTING_THREAD_ID
+1. pippit-tool-cli submit-run --message "把刚才的视频加个片头" --thread-id EXISTING_THREAD_ID
 2. 使用新的 run_id 轮询和下载。
 ```
 

package/checksums.txt

@@ -1,6 +1,6 @@
-0ff3b8e87e45b5c39546b74588f7c45ffe5d463cc3618807855f498ed8bfa733  pippit-tool-cli-1.0.22-darwin-amd64.tar.gz
-1deea5a6c69b88146319eeca111cb121ffa24d28253a5d043b2985846ebeb602  pippit-tool-cli-1.0.22-darwin-arm64.tar.gz
-823e08be7d8a2a36176b95dc01a1b12d2dd50edb80901467629507a9ac5ff245  pippit-tool-cli-1.0.22-linux-amd64.tar.gz
-c286697382d43023657bca553c2ad5e34181e95329c4c702323eef00f6d8b279  pippit-tool-cli-1.0.22-linux-arm64.tar.gz
-ec53eae18219ce6456eebc43ba607f646c323b7e7f852d99d7e596e04fbd5591  pippit-tool-cli-1.0.22-windows-amd64.zip
-a913cc47ef12eaa71ffb7de4d4e58286351491fa3109d87fa62fe84001dcc1a4  pippit-tool-cli-1.0.22-windows-arm64.zip
+259ad5fb69598b646e035e5dd70fd6c905a25128b1b9c8e9689c58e09ec0a3d9  pippit-tool-cli-1.0.23-darwin-amd64.tar.gz
+610ec13e42a53a472759daf322701e178b062ff2ca2e854382cf5a8b6b894953  pippit-tool-cli-1.0.23-darwin-arm64.tar.gz
+3d371bb915e4b6adaf29cd3b1b06a9ee6a40896f962051ce97adeb1937a1b4a1  pippit-tool-cli-1.0.23-linux-amd64.tar.gz
+541f8a8e1913a591ad98ed3835525eba8459fd12ec289f9b206f9588812311c8  pippit-tool-cli-1.0.23-linux-arm64.tar.gz
+0ded272a827aa39427c53135465c99e6e1f94c81ef1f5e0982c6726d385e03bf  pippit-tool-cli-1.0.23-windows-amd64.zip
+ab6fd1baeac84e4e3cdde2392462534bd2a6279ee1cab0395437f1a03b5ace55  pippit-tool-cli-1.0.23-windows-arm64.zip

package/cmd/root.go

@@ -56,7 +56,7 @@ func newRootCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Comm
 	root := &cobra.Command{
 		Use:   "pippit-tool-cli",
 		Short: "Pippit CLI",
-		Long: "Pippit CLI generates and processes videos and images, queries credit balances, submits short-drama workflows, downloads generated assets, and updates the installed CLI package.\n\n" +
+		Long: "Pippit CLI generates and processes videos and images, queries credit balances, submits creative conversations and short-drama workflows, downloads generated assets, and updates the installed CLI package.\n\n" +
 			canvascmd.CommandDiscoveryHelp + "\n\nInstallation help (npm launcher): pippit-tool-cli install --help",
 		Version:       version.Current(),
 		SilenceUsage:  true,
@@ -73,6 +73,8 @@ func newRootCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Comm
 	root.AddCommand(newDownloadResultCommand(stdout, stderr, runner))
 	root.AddCommand(newGetCreditBalanceCommand(stdout, stderr, runner))
 	root.AddCommand(newGetThreadCommand(stdout, stderr, runner))
+	root.AddCommand(newSubmitRunCommand(stdout, stderr, runner))
+	root.AddCommand(newUploadFileCommand(stdout, stderr, runner))
 	root.AddCommand(newListThreadFileCommand(stdout, stderr, runner))
 	root.AddCommand(generate_image.NewCommand(stdout, stderr, runner))
 	root.AddCommand(generate_video.NewCommand(stdout, stderr, runner))

package/cmd/submit_run.go

@@ -0,0 +1,40 @@
+package cmd
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+	"github.com/spf13/cobra"
+)
+
+func newSubmitRunCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var body struct {
+		Message  string   `json:"message"`
+		ThreadID string   `json:"thread_id,omitempty"`
+		AssetIDs []string `json:"asset_ids,omitempty"`
+	}
+	cmd := &cobra.Command{
+		Use:   "submit-run",
+		Short: "Create a creative conversation or send a message to an existing thread",
+		Args:  cobra.NoArgs,
+		RunE: withErrorLog("submit-run", nil, func(cmd *cobra.Command, _ []string) error {
+			if strings.TrimSpace(body.Message) == "" {
+				return fmt.Errorf("缺少必填参数 --message")
+			}
+			// Preserve the original message and identifiers; the backend owns routing.
+			result, err := common.SubmitRun(cmd.Context(), "submit-run", body, runner)
+			if err != nil {
+				return err
+			}
+			return common.WriteJSON(stdout, result)
+		}),
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	cmd.Flags().StringVar(&body.Message, "message", "", "original message to send (required)")
+	cmd.Flags().StringVar(&body.ThreadID, "thread-id", "", "existing thread ID; omit to create a new thread")
+	cmd.Flags().StringArrayVar(&body.AssetIDs, "asset-ids", nil, "asset ID to attach; repeat for multiple assets")
+	return cmd
+}

package/cmd/submit_run_test.go

@@ -0,0 +1,103 @@
+package cmd
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+)
+
+func TestSubmitRunCommandPreservesScriptContract(t *testing.T) {
+	for _, existing := range []bool{false, true} {
+		t.Run(map[bool]string{false: "new", true: "existing_with_assets"}[existing], func(t *testing.T) {
+			message := "  根据参考素材生成视频\n保留原文  "
+			want := map[string]any{"message": message}
+			args := []string{"submit-run", "--message", message}
+			if existing {
+				want["thread_id"] = "skill_original_thread"
+				want["asset_ids"] = []any{"asset_original_1", "asset_original_2"}
+				args = append(args, "--thread-id", "skill_original_thread", "--asset-ids", "asset_original_1", "--asset-ids", "asset_original_2")
+			}
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.Method != http.MethodPost || r.URL.Path != config.SubmitRunPath {
+					t.Errorf("request = %s %s", r.Method, r.URL.Path)
+				}
+				if r.Header.Get("Authorization") != "Bearer test-token" {
+					t.Error("missing bearer authorization")
+				}
+				var got map[string]any
+				if err := json.NewDecoder(r.Body).Decode(&got); err != nil {
+					t.Error(err)
+				}
+				if !reflect.DeepEqual(got, want) {
+					t.Errorf("body = %#v, want %#v", got, want)
+				}
+				_, _ = w.Write([]byte(`{"ret":"0","data":{"run":{"thread_id":"thread_1","run_id":"run_1"},"web_thread_link":"https://xyq.jianying.com/thread_1"}}`))
+			}))
+			defer server.Close()
+			var stdout, stderr bytes.Buffer
+			root := newTestRootCommand(t, &stdout, &stderr, server.URL)
+			root.SetArgs(args)
+			if err := root.Execute(); err != nil {
+				t.Fatal(err)
+			}
+			if got := stdout.String(); got != "{\"thread_id\":\"thread_1\",\"run_id\":\"run_1\",\"web_thread_link\":\"https://xyq.jianying.com/thread_1\"}\n" {
+				t.Fatalf("unexpected output: %s", got)
+			}
+		})
+	}
+}
+
+func TestSubmitRunCommandValidatesBeforeRequest(t *testing.T) {
+	for _, args := range [][]string{
+		{"submit-run"},
+		{"submit-run", "--message", " \n "},
+		{"submit-run", "--message", "hello", "unexpected"},
+	} {
+		var stdout, stderr bytes.Buffer
+		root := newRootCommand(&stdout, &stderr, nil)
+		root.SetArgs(args)
+		if err := root.Execute(); err == nil {
+			t.Fatalf("Execute(%v) should fail before accessing the runner", args)
+		}
+	}
+}
+
+func TestSubmitRunHelpDoesNotRequireCredentials(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := newRootCommand(&stdout, &stderr, nil)
+	root.SetArgs([]string{"submit-run", "--help"})
+	if err := root.Execute(); err != nil {
+		t.Fatal(err)
+	}
+	for _, flag := range []string{"--message", "--thread-id", "--asset-ids"} {
+		if !strings.Contains(stdout.String(), flag) {
+			t.Errorf("help missing %s", flag)
+		}
+	}
+}
+
+func TestSubmitRunCommandRejectsInvalidResponse(t *testing.T) {
+	for _, response := range []string{
+		`{"ret":"1","errmsg":"rejected"}`,
+		`{"ret":"0","data":{"run":{"run_id":"run_1"}}}`,
+		`{"ret":"0","data":{"run":{"thread_id":"thread_1"}}}`,
+	} {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			_, _ = w.Write([]byte(response))
+		}))
+		var stdout, stderr bytes.Buffer
+		root := newTestRootCommand(t, &stdout, &stderr, server.URL)
+		root.SetArgs([]string{"submit-run", "--message", "hello"})
+		err := root.Execute()
+		server.Close()
+		if err == nil || stdout.Len() != 0 {
+			t.Fatalf("response %s: error = %v, stdout = %s", response, err, stdout.String())
+		}
+	}
+}

package/cmd/upload_file.go

@@ -0,0 +1,64 @@
+package cmd
+
+import (
+	"fmt"
+	"io"
+	"mime"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+	"github.com/spf13/cobra"
+)
+
+const maxMediaUploadBytes int64 = 500 * 1000 * 1000
+
+func newUploadFileCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var opts common.UploadFileOptions
+	cmd := &cobra.Command{
+		Use:   "upload-file",
+		Short: "Upload an image, video, or MP3/WAV audio file",
+		Args:  cobra.NoArgs,
+		RunE: withErrorLog("upload-file", nil, func(cmd *cobra.Command, _ []string) error {
+			opts.Path = strings.TrimSpace(opts.Path)
+			if err := validateMediaUpload(opts.Path); err != nil {
+				return err
+			}
+			result, err := common.UploadFile(cmd.Context(), opts, runner)
+			if err != nil {
+				return err
+			}
+			return common.WriteJSON(stdout, result)
+		}),
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	cmd.Flags().StringVar(&opts.Path, "path", "", "local media file to upload (required, less than 500 MB)")
+	return cmd
+}
+
+func validateMediaUpload(path string) error {
+	if path == "" {
+		return fmt.Errorf("缺少必填参数 --path")
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		return fmt.Errorf("获取上传文件信息失败: %w", err)
+	}
+	if !info.Mode().IsRegular() {
+		return fmt.Errorf("上传路径必须是普通文件")
+	}
+	if info.Size() >= maxMediaUploadBytes {
+		return fmt.Errorf("上传文件必须小于 500 MB（500000000 字节）")
+	}
+	ext := strings.ToLower(filepath.Ext(path))
+	contentType := mime.TypeByExtension(ext)
+	if strings.HasPrefix(contentType, "image/") || strings.HasPrefix(contentType, "video/") {
+		return nil
+	}
+	if ext == ".mp3" || ext == ".wav" {
+		return nil
+	}
+	return fmt.Errorf("不支持的文件类型 %q，仅支持图片、视频和 .mp3/.wav 音频", ext)
+}

package/cmd/upload_file_test.go

@@ -0,0 +1,155 @@
+package cmd
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+)
+
+func TestUploadFileMediaContract(t *testing.T) {
+	for _, name := range []string{"image.png", "image.WEBP", "video.mp4", "audio.mp3", "audio.WAV"} {
+		t.Run(name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), name)
+			if err := os.WriteFile(path, []byte("media-content"), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			calls := 0
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				calls++
+				if r.Method != http.MethodPost || r.URL.Path != config.UploadFilePath {
+					t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
+				}
+				if r.Header.Get("Authorization") != "Bearer test-token" {
+					t.Error("missing bearer authorization")
+				}
+				body, err := io.ReadAll(r.Body)
+				if err != nil {
+					t.Error(err)
+					return
+				}
+				if bytes.Contains(body, []byte("test-token")) || bytes.Contains(body, []byte(`name="accessKey"`)) {
+					t.Error("credentials must not appear in multipart body")
+				}
+				r.Body = io.NopCloser(bytes.NewReader(body))
+				if err := r.ParseMultipartForm(1 << 20); err != nil {
+					t.Error(err)
+					return
+				}
+				defer r.MultipartForm.RemoveAll()
+				files := r.MultipartForm.File["file"]
+				if len(files) != 1 || files[0].Filename != name {
+					t.Errorf("unexpected file parts: %#v", files)
+					return
+				}
+				contentType := files[0].Header.Get("Content-Type")
+				prefix := "audio/"
+				if strings.HasPrefix(name, "image") {
+					prefix = "image/"
+				} else if strings.HasPrefix(name, "video") {
+					prefix = "video/"
+				}
+				if !strings.HasPrefix(contentType, prefix) {
+					t.Errorf("content type = %s, want %s", contentType, prefix)
+				}
+				file, err := files[0].Open()
+				if err != nil {
+					t.Error(err)
+					return
+				}
+				defer file.Close()
+				data, err := io.ReadAll(file)
+				if err != nil || string(data) != "media-content" {
+					t.Errorf("uploaded content = %q, err = %v", data, err)
+				}
+				_, _ = w.Write([]byte(`{"ret":"0","data":{"pippit_asset_id":"asset_original"}}`))
+			}))
+			defer server.Close()
+			var stdout, stderr bytes.Buffer
+			root := newTestRootCommand(t, &stdout, &stderr, server.URL)
+			root.SetArgs([]string{"upload-file", "--path", path})
+			if err := root.Execute(); err != nil {
+				t.Fatal(err)
+			}
+			if stdout.String() != "{\"asset_id\":\"asset_original\"}\n" || calls != 1 {
+				t.Fatalf("stdout = %q, requests = %d", stdout.String(), calls)
+			}
+		})
+	}
+}
+
+func TestValidateMediaUpload(t *testing.T) {
+	dir := t.TempDir()
+	for _, tc := range []struct {
+		name string
+		size int64
+		ok   bool
+	}{
+		{"below-limit.png", maxMediaUploadBytes - 1, true},
+		{"at-limit.png", maxMediaUploadBytes, false},
+		{"over-limit.png", maxMediaUploadBytes + 1, false},
+		{"script.docx", 1, false},
+		{"audio.flac", 1, false},
+		{"file.unknown", 1, false},
+	} {
+		path := filepath.Join(dir, tc.name)
+		if err := os.WriteFile(path, nil, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		// Sparse files exercise the exact size boundary without large allocations.
+		if err := os.Truncate(path, tc.size); err != nil {
+			t.Fatal(err)
+		}
+		if err := validateMediaUpload(path); (err == nil) != tc.ok {
+			t.Errorf("validateMediaUpload(%s) = %v, want accepted=%t", tc.name, err, tc.ok)
+		}
+	}
+	for _, path := range []string{"", dir, filepath.Join(dir, "missing.png")} {
+		if err := validateMediaUpload(path); err == nil {
+			t.Errorf("validateMediaUpload(%q) should fail", path)
+		}
+	}
+}
+
+func TestUploadFileCommandHelpAndArguments(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := newRootCommand(&stdout, &stderr, nil)
+	root.SetArgs([]string{"upload-file", "--help"})
+	if err := root.Execute(); err != nil || !strings.Contains(stdout.String(), "--path") {
+		t.Fatalf("help must work without credentials: %v, %s", err, stdout.String())
+	}
+	for _, args := range [][]string{{"upload-file"}, {"upload-file", "--path", " "}, {"upload-file", "unexpected"}} {
+		root := newRootCommand(&stdout, &stderr, nil)
+		root.SetArgs(args)
+		if err := root.Execute(); err == nil {
+			t.Errorf("Execute(%v) should fail", args)
+		}
+	}
+}
+
+func TestUploadFileRejectsInvalidResponse(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "image.png")
+	if err := os.WriteFile(path, []byte("media"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	for _, response := range []string{`{"ret":"1","errmsg":"rejected"}`, `{"ret":"0","data":{"asset_id":"wrong_field"}}`} {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			_, _ = io.Copy(io.Discard, r.Body)
+			_, _ = w.Write([]byte(response))
+		}))
+		var stdout, stderr bytes.Buffer
+		root := newTestRootCommand(t, &stdout, &stderr, server.URL)
+		root.SetArgs([]string{"upload-file", "--path", path})
+		err := root.Execute()
+		server.Close()
+		if err == nil || stdout.Len() != 0 {
+			t.Errorf("response %s: error = %v, stdout = %s", response, err, stdout.String())
+		}
+	}
+}

package/dist/checksums.txt

@@ -1,6 +1,6 @@
-0ff3b8e87e45b5c39546b74588f7c45ffe5d463cc3618807855f498ed8bfa733  pippit-tool-cli-1.0.22-darwin-amd64.tar.gz
-1deea5a6c69b88146319eeca111cb121ffa24d28253a5d043b2985846ebeb602  pippit-tool-cli-1.0.22-darwin-arm64.tar.gz
-823e08be7d8a2a36176b95dc01a1b12d2dd50edb80901467629507a9ac5ff245  pippit-tool-cli-1.0.22-linux-amd64.tar.gz
-c286697382d43023657bca553c2ad5e34181e95329c4c702323eef00f6d8b279  pippit-tool-cli-1.0.22-linux-arm64.tar.gz
-ec53eae18219ce6456eebc43ba607f646c323b7e7f852d99d7e596e04fbd5591  pippit-tool-cli-1.0.22-windows-amd64.zip
-a913cc47ef12eaa71ffb7de4d4e58286351491fa3109d87fa62fe84001dcc1a4  pippit-tool-cli-1.0.22-windows-arm64.zip
+259ad5fb69598b646e035e5dd70fd6c905a25128b1b9c8e9689c58e09ec0a3d9  pippit-tool-cli-1.0.23-darwin-amd64.tar.gz
+610ec13e42a53a472759daf322701e178b062ff2ca2e854382cf5a8b6b894953  pippit-tool-cli-1.0.23-darwin-arm64.tar.gz
+3d371bb915e4b6adaf29cd3b1b06a9ee6a40896f962051ce97adeb1937a1b4a1  pippit-tool-cli-1.0.23-linux-amd64.tar.gz
+541f8a8e1913a591ad98ed3835525eba8459fd12ec289f9b206f9588812311c8  pippit-tool-cli-1.0.23-linux-arm64.tar.gz
+0ded272a827aa39427c53135465c99e6e1f94c81ef1f5e0982c6726d385e03bf  pippit-tool-cli-1.0.23-windows-amd64.zip
+ab6fd1baeac84e4e3cdde2392462534bd2a6279ee1cab0395437f1a03b5ace55  pippit-tool-cli-1.0.23-windows-arm64.zip

package/internal/common/upload_file.go

@@ -18,7 +18,7 @@ type UploadFileOptions struct {
 	FileName string `json:"file_name"`
 }
 
-// UploadFileResult is the JSON envelope printed by `pippit-tool-cli short-drama +upload-file`.
+// UploadFileResult is the shared JSON output for media and short-drama uploads.
 type UploadFileResult struct {
 	AssetID string `json:"asset_id"`
 }

package/internal/config/config_test.go

@@ -32,3 +32,13 @@ func TestLoadReadsAccessKey(t *testing.T) {
 		t.Fatalf("AccessKey = %q, want trimmed token", cfg.AccessKey)
 	}
 }
+
+func TestLoadIgnoresUntrustedBaseURLEnvironment(t *testing.T) {
+	for _, name := range []string{"XYQ_OPENAPI_BASE", "XYQ_BASE_URL"} {
+		t.Setenv(name, "https://untrusted.example")
+	}
+	cfg := Load()
+	if cfg.BaseURL != "https://xyq.jianying.com" {
+		t.Fatalf("BaseURL must remain the production HTTPS origin")
+	}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pippit-dev/cli",
-  "version": "1.0.22",
+  "version": "1.0.23",
   "description": "Pippit CLI",
   "bin": {
     "pippit-tool-cli": "scripts/run.js"
@@ -9,7 +9,7 @@
     "postinstall": "node scripts/install.js",
     "prepack": "node scripts/prepare-canvas-runtime.js",
     "prepare:canvas-runtime": "node scripts/prepare-canvas-runtime.js",
-    "test": "node scripts/version-check.test.js && node scripts/skills.test.js && node scripts/install-wizard.test.js && node scripts/run-help.test.js && node scripts/canvas-command.test.js && node scripts/canvas-command-schema.test.js && node scripts/canvas-command-guides.test.js && node scripts/prepare-canvas-runtime.test.js && node scripts/canvas-command-runtime.test.js && npm run test:canvas-operations && go test ./... && go vet ./...",
+    "test": "node scripts/version-check.test.js && node scripts/skills.test.js && node scripts/install-wizard.test.js && node scripts/install-cli.test.js && node scripts/run-help.test.js && node scripts/canvas-command.test.js && node scripts/canvas-command-schema.test.js && node scripts/canvas-command-guides.test.js && node scripts/prepare-canvas-runtime.test.js && node scripts/canvas-command-runtime.test.js && npm run test:canvas-operations && go test ./... && go vet ./...",
     "verify:canvas-runtime": "node scripts/prepare-canvas-runtime.js --check-only",
     "test:canvas-runtime": "node scripts/canvas-command-runtime.test.js",
     "test:canvas-operations": "node scripts/canvas-command-canvas-operations.test.js && node scripts/canvas-command-scene3d-operations.test.js && node scripts/canvas-command-timeline-operations.test.js"
@@ -36,6 +36,7 @@
     "internal",
     "skills",
     "scripts/install.js",
+    "scripts/install-cli.js",
     "scripts/install-wizard.js",
     "scripts/canvas-command.js",
     "scripts/canvas-command-discovery.js",