@pippit-dev/cli 1.0.31 → 1.0.33

package/README.md

@@ -28,7 +28,7 @@
 npx skills add Pippit-dev/cli --skill xyq-marketing-skill
 ```
 
-需要 Node.js 16+，使用 Skill 内自包含脚本，无额外 npm 依赖。脚本从当前进程读取 `XYQ_ACCESS_KEY`；API 与 CLI 可使用同一 Access Key，但 CLI 浏览器登录不会设置此环境变量。密钥在本机安全配置，不写入请求 JSON 或命令参数。
+需要 Node.js 16+ 和支持 `marketing` 命令的 CLI。Skill 脚本通过原生 `marketing` 命令复用 CLI 登录态；先运行 `pippit-tool-cli status`，未登录时执行 `pippit-tool-cli login` 完成浏览器授权，无需用户提供 access_token 或 Access Key。生成请求通过 stdin 传入原生 CLI，凭据仅在 CLI 内用于鉴权。
 
 ```bash
 # 从仓库根目录执行；营销请求字段见接口契约，默认只预览
@@ -51,7 +51,7 @@ node skills/xyq-marketing-skill/scripts/marketing.js query --thread-id THREAD_ID
 | 登录授权 | `status` / `login` / `logout` | [授权](skills/xyq-nest-skill/commands/auth.md) |
 | 个人 Canvas 画布与节点编辑 | `canvas` | [画布](skills/xyq-nest-skill/commands/canvas.md) |
 | 生图、参考图编辑 | `generate-image` | [图片](skills/xyq-nest-skill/commands/generate-image.md) |
-| 查看可用视频模型、参数配置 | `model list` / `model describe` | [模型发现](skills/xyq-nest-skill/commands/model.md) |
+| 查看可用图片/视频模型、参数配置 | `model list` / `model describe` | [模型发现](skills/xyq-nest-skill/commands/model.md) |
 | 生视频、首尾帧 | `generate-video` | [视频](skills/xyq-nest-skill/commands/generate-video.md) |
 | 视频超分 | `video-super-resolution` | [超分](skills/xyq-nest-skill/commands/video-super-resolution.md) |
 | 擦字幕 | `erase-video-subtitle` | [擦字幕](skills/xyq-nest-skill/commands/erase-video-subtitle.md) |
@@ -205,20 +205,22 @@ pippit-tool-cli canvas command run xyq.generation.update_prompt \
 
 ## 生图 CLI
 
-`generate-image` 会上传本地参考图片，然后向综合 Nest Agent 提交生图请求：
+`generate-image` 使用图片模型的展示名称；先查询当前列表并选择模型，再上传本地参考图片并提交生图请求。以下假设列表包含该名称：
 
 ```bash
 pippit-tool-cli generate-image \
   --prompt "生成一张小猫海报" \
   --image "~/images/cat.png" \
-  --model "seedream_4.5" \
+  --model "智能图片V2.5 Fast" \
   --ratio 6 \
   --generate-image-count 2
 ```
 
-命令输出 `thread_id`、`run_id` 和 `web_thread_link`。提交 HTTP 请求时，`agent_name` 固定为 `pippit_nest_agent`，参考图会使用上传接口返回的 `pippit_asset_id` 写入顶层 `asset_ids`，生图模型写入 `general_agent_settings.image_model`，比例写入 `general_agent_settings.ratio`，生图数量写入 `general_agent_settings.generate_image_count`。`--model` 为必填参数，CLI 只做非空校验，具体模型值是否可用由服务端决定。
+命令输出 `thread_id`、`run_id` 和 `web_thread_link`。提交 HTTP 请求时，`agent_name` 固定为 `pippit_nest_agent`，参考图会使用上传接口返回的 `pippit_asset_id` 写入顶层 `asset_ids`，生图模型写入 `general_agent_settings.image_model`，比例写入 `general_agent_settings.ratio`，生图数量写入 `general_agent_settings.generate_image_count`。`--model` 为必填参数，填写 `model list --type image` 返回的完整名称，例如 `"智能图片V2.5 Fast"`。CLI 在上传素材前查询或复用有效缓存，解析名称后仅在提交请求中填写服务端模型标识；名称缺失、重复或未找到时停止，不猜测模型。
 
-`--ratio` 可选，填写服务端 `Ratio` 枚举值。CLI 只做整数格式解析，不检查枚举值是否在下表范围内；具体值是否可用由服务端决定。常用枚举值含义如下：
+图片 `model list/search/describe` 返回给宿主的是 API 下发的展示名称 `name`，例如 `美学模型 8.2`。生成时填写 `--model "美学模型 8.2"`，CLI 仅在提交请求中使用该条目对应的 `key`。名称、可用模型和参数均由接口动态提供，不维护静态名称映射。
+
+`--ratio` 可选，只接受服务端 `Ratio` 数字枚举，例如 `--ratio 3` 表示 `9:16`。通过 `model describe "模型名称" --type image` 查看当前可用的数字 `options/default`，`option_labels` 说明每个数字对应的比例。CLI 校验整数格式，模型是否支持该枚举由服务端决定。常用枚举值含义如下：
 
 | ratio 参数 | IDL 枚举 | 含义 |
 | ---: | --- | --- |
@@ -232,18 +234,27 @@ pippit-tool-cli generate-image \
 
 `--generate-image-count` 可选，填写生图数量，对应 IDL 字段 `GeneralSettingsPart.GenerateImageCount` / JSON 字段 `generate_image_count`。CLI 只校验不能为负数；具体数量范围由服务端决定。
 
-图片支持 `.jpg`、`.jpeg`、`.png`、`.gif`、`.bmp`、`.webp`、`.svg`。CLI 会在提交前校验 prompt、model 必填、ratio 整数格式、generate-image-count 非负和文件后缀。
+`--resolution` 写入 `general_agent_settings.resolution`（转大写），新增 `--effort` 写入 `general_agent_settings.image_effort`（转小写）。分辨率和推理强度选项都来自该模型的动态配置；没有 `effort` 维度的模型不展示推理强度选择。只传用户指定的参数，未指定时省略，不自动补查询默认值。
+
+图片支持 `.jpg`、`.jpeg`、`.png`、`.gif`、`.bmp`、`.webp`、`.svg`。CLI 会在提交前校验 prompt、model 必填、ratio 格式、generate-image-count 非负和文件后缀；不新增模型或参数组合白名单。
 
-## 视频模型发现
+## 图片与视频模型发现
 
 ```bash
+# 图片模型及可选参数
+pippit-tool-cli model list --type image
+pippit-tool-cli model search "智能图片" --type image
+pippit-tool-cli model describe "智能图片V2.5 Fast" --type image
+pippit-tool-cli model list --type image --refresh
+
+# 省略 --type 保持查询视频
 pippit-tool-cli model list
 pippit-tool-cli model search MiniMax
 pippit-tool-cli model describe MiniMax-H3
 pippit-tool-cli model list --refresh
 ```
 
-使用当前登录凭证查询服务端；成功结果按账号和环境隔离缓存 5 分钟，`--refresh` 强制刷新。失败时提示重试，不回退静态列表或过期缓存。`describe` 将比例枚举转换为可直接传给 `--ratio` 的字符串，并整理分辨率、时长和素材限制；不展示内部 `config_key`，未知比例枚举跳过。生成仍由服务端校验。详见 [模型发现](skills/xyq-nest-skill/commands/model.md)。
+使用当前个人登录凭证查询服务端 Skill 模型接口；图片 scene 为 `web_image_agent`，视频为 `web_turbo_video_generator`，不传 TeamID。成功结果按账号、环境和场景隔离缓存 5 分钟，`--refresh` 强制刷新。失败时提示重试，不回退静态列表或过期缓存。`describe` 提供可直接传给生成命令的参数：图片比例保留数字枚举并附比例说明，视频比例转换为字符串，同时整理分辨率、图片推理强度、视频时长和素材限制；不展示内部 `config_key`，未知比例枚举跳过。图片列表和详情仅用 `name` 标识模型，不展示底层模型枚举；搜索、详情查询和 `generate-image --model` 均使用名称，包含空格时加引号。图片详情保留原始 `parameter_config`，包括条件、必选标记、选项说明和参数组合约束。生成仍由服务端校验；服务端尚未开放图片场景或提交参数时会返回错误，不回退静态模型清单。详见 [模型发现](skills/xyq-nest-skill/commands/model.md)。
 
 ## 生视频 CLI
 

package/checksums.txt

@@ -1,6 +1,6 @@
-0023facaf65dc042d7dd08b285efbd046efd3dd4cebd29f31e3421b919d38bc9  pippit-tool-cli-1.0.31-darwin-amd64.tar.gz
-a6989ce590556924da7a2ceb5d94a8d75f81b459dae5fe016d0d929ae9c31a0f  pippit-tool-cli-1.0.31-darwin-arm64.tar.gz
-2ccc7bfb01fc00a0a7c2948abb18eda6da0769c7c1f21bca3db942a1e7b3a0b3  pippit-tool-cli-1.0.31-linux-amd64.tar.gz
-2a6c10aada4090701a97ef8af69ad91abf4d0fda000634c344157487c7895da7  pippit-tool-cli-1.0.31-linux-arm64.tar.gz
-fcf2e3e988952e046e23a4505630d758e7471d6d7125541eba7d5882588b67cb  pippit-tool-cli-1.0.31-windows-amd64.zip
-5b9ce586c808866404c3d6e006c9ed359d1d8aecee105ac38e0015b79be78d64  pippit-tool-cli-1.0.31-windows-arm64.zip
+dd742dedf06e2645d02bc13a4cfa1af45778ae0200a8a6e67df177ba7e069775  pippit-tool-cli-1.0.33-darwin-amd64.tar.gz
+8d9fc0112650839c430e58cb7d6917e5bb1b95fde49659aecbbf14d1421c28f5  pippit-tool-cli-1.0.33-darwin-arm64.tar.gz
+f2f2f741c920b115b2a1a9c4c4f074c1a07fd6cbc3a442cf4dc4d793c1b9ef5a  pippit-tool-cli-1.0.33-linux-amd64.tar.gz
+2ed6e791c7dbea0e2ea8a1d05a0db298442218ecfc17ec47d70d49639f1d91b6  pippit-tool-cli-1.0.33-linux-arm64.tar.gz
+f713c05325043f177f4a9e01a433b6a7fc8f57fea123f712ee459707955d199e  pippit-tool-cli-1.0.33-windows-amd64.zip
+7e637f67fbbb818db0e66c49f7814d7e79cd71857d8c3bd6a5397af9d18533ce  pippit-tool-cli-1.0.33-windows-arm64.zip

package/cmd/generate_image/generate_image.go

@@ -34,6 +34,7 @@ func NewCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command
 					"model":                strings.TrimSpace(opts.Model),
 					"ratio":                strings.TrimSpace(opts.Ratio),
 					"resolution":           strings.ToUpper(strings.TrimSpace(opts.Resolution)),
+					"effort":               strings.ToLower(strings.TrimSpace(opts.Effort)),
 					"generate_image_count": optionalIntString(opts.GenerateImageCount),
 				})
 				return err
@@ -47,9 +48,10 @@ func NewCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command
 	flags.StringVar(&opts.Source, "source", "", "optional host agent/platform identifier for statistics only; filled silently by the host agent (e.g. doubao_office, workbuddy, codex)")
 	flags.StringVar(&opts.Prompt, "prompt", "", "image generation prompt")
 	flags.StringArrayVar(&opts.ImagePaths, "image", nil, "local reference image path; repeat for multiple images")
-	flags.StringVar(&opts.Model, "model", "", "image model; supported: seedream_5.0_pro, seedream_5.0, seedream_4.3, nova2, seedream_4.5, seedream_4.1, seedream_4")
+	flags.StringVar(&opts.Model, "model", "", "exact image model name from 'model list --type image' (quote names containing spaces)")
 	flags.StringVar(&opts.Ratio, "ratio", "", "image ratio; "+internalgen.SupportedRatioUsage())
-	flags.StringVar(&opts.Resolution, "resolution", "", "image resolution; only seedream_5.0_pro supports these options: 1K, 2K, 4K")
+	flags.StringVar(&opts.Resolution, "resolution", "", "image resolution; use 'model describe \"MODEL_NAME\" --type image' for available values")
+	flags.StringVar(&opts.Effort, "effort", "", "image reasoning effort; only use values exposed by 'model describe \"MODEL_NAME\" --type image'")
 	flags.IntVar(&generateImageCount, "generate-image-count", 0, "generated image count")
 	return cmd
 }

package/cmd/generate_image_test.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"bytes"
+	"encoding/json"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -10,18 +11,29 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/Pippit-dev/pippit-cli/internal/config"
 	"github.com/bytedance/sonic"
 )
 
 func TestGenerateImage(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("XDG_CACHE_HOME", t.TempDir())
+	t.Setenv("LocalAppData", t.TempDir())
 	var uploaded bool
+	var modelQueried bool
 
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Header.Get("Authorization") != "Bearer test-token" {
 			t.Fatalf("Authorization = %q, want test bearer token", r.Header.Get("Authorization"))
 		}
 		switch r.URL.Path {
+		case "/api/biz/v1/skill/get_available_model_list":
+			modelQueried = true
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"scene":"web_image_agent","config_key":"image-key","config":{"models":[{"key":"seedream_5.0_pro","name":"Seedream 5.0 Pro","kind":"image"}]}}}`))
 		case "/api/biz/v1/skill/upload_file":
+			if !modelQueried {
+				t.Fatal("image name must be resolved before uploading")
+			}
 			if r.Method != http.MethodPost {
 				t.Fatalf("upload method = %s, want POST", r.Method)
 			}
@@ -100,7 +112,7 @@ func TestGenerateImage(t *testing.T) {
 		"generate-image",
 		"--prompt", "生成小猫海报",
 		"--image", image,
-		"--model", "seedream_5.0_pro",
+		"--model", "Seedream 5.0 Pro",
 		"--ratio", "6",
 		"--resolution", "4K",
 		"--generate-image-count", "2",
@@ -137,3 +149,140 @@ func TestGenerateImageRequiresModel(t *testing.T) {
 		t.Fatalf("error = %q, want model validation", err)
 	}
 }
+
+func TestGenerateImageDynamicParameters(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("XDG_CACHE_HOME", t.TempDir())
+	t.Setenv("LocalAppData", t.TempDir())
+	requests := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests++
+		if r.URL.Path == "/api/biz/v1/skill/get_available_model_list" {
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"scene":"web_image_agent","config_key":"image-key","config":{"models":[{"key":"future-image-model","name":"未来图片模型","kind":"image"}]}}}`))
+			return
+		}
+		if r.URL.Path != "/api/biz/v1/skill/submit_run" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+		raw, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Error(err)
+			return
+		}
+		var body struct {
+			AgentName string `json:"agent_name"`
+			Settings  struct {
+				Model      string `json:"image_model"`
+				Ratio      int    `json:"ratio"`
+				Resolution string `json:"resolution"`
+				Effort     string `json:"image_effort"`
+			} `json:"general_agent_settings"`
+		}
+		if err := sonic.Unmarshal(raw, &body); err != nil {
+			t.Error(err)
+			return
+		}
+		if body.AgentName != "pippit_nest_agent" || body.Settings.Model != "future-image-model" || body.Settings.Ratio != 13 || body.Settings.Resolution != "8K" || body.Settings.Effort != "future-effort" {
+			t.Errorf("incorrect request mapping: %s", raw)
+		}
+		_, _ = w.Write([]byte(`{"ret":"0","data":{"run":{"thread_id":"image-thread","run_id":"image-run"}}}`))
+	}))
+	defer server.Close()
+	var stdout, stderr bytes.Buffer
+	root := newTestRootCommand(t, &stdout, &stderr, server.URL)
+	root.SetArgs([]string{"generate-image", "--prompt", "image", "--model", "未来图片模型", "--ratio", "13", "--resolution", "8k", "--effort", " FUTURE-EFFORT "})
+	if err := root.Execute(); err != nil || requests != 2 {
+		t.Fatalf("Execute: err=%v requests=%d", err, requests)
+	}
+}
+
+func TestImageModelNameFromDiscoveryToSubmission(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("XDG_CACHE_HOME", t.TempDir())
+	t.Setenv("LocalAppData", t.TempDir())
+	queries, submits := 0, 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case config.GetAvailableModelListPath:
+			queries++
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"scene":"web_image_agent","config_key":"image-key","config":{"models":[{"key":"ali_midjourney_8_2","name":"美学模型 8.2","benefit_map_by_combination":{"ali_midjourney_8_2":{"resource_id":"ali_midjourney_8_2"}},"kind":"image"}]}}}`))
+		case config.SubmitRunPath:
+			submits++
+			var body struct {
+				Settings map[string]json.RawMessage `json:"general_agent_settings"`
+			}
+			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+				t.Error(err)
+			}
+			if string(body.Settings["image_model"]) != `"ali_midjourney_8_2"` || len(body.Settings) != 1 {
+				t.Errorf("wire model not resolved or unrequested defaults filled: %v", body.Settings)
+			}
+			_, _ = w.Write([]byte(`{"ret":"1","errmsg":"ali_midjourney_8_2 暂时不可用","log_id":"image-log"}`))
+		default:
+			t.Errorf("unexpected request: %s", r.URL.Path)
+		}
+	}))
+	defer server.Close()
+	execute := func(args ...string) (string, string, error) {
+		var stdout, stderr bytes.Buffer
+		root := newTestRootCommand(t, &stdout, &stderr, server.URL)
+		root.SetArgs(args)
+		err := root.Execute()
+		return stdout.String(), stderr.String(), err
+	}
+	list, _, err := execute("model", "list", "--type", "image")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var output struct{ Models []struct{ Name string } }
+	if err := json.Unmarshal([]byte(list), &output); err != nil || len(output.Models) != 1 {
+		t.Fatalf("list=%s err=%v", list, err)
+	}
+	name := output.Models[0].Name
+	if name != "美学模型 8.2" {
+		t.Fatalf("unexpected display name: %q", name)
+	}
+	detail, _, err := execute("model", "describe", name, "--type", "image")
+	if err != nil || !strings.Contains(detail, name) || strings.Contains(list+detail, "ali_midjourney_8_2") {
+		t.Fatalf("user-facing identity changed: list=%s detail=%s err=%v", list, detail, err)
+	}
+	stdout, stderr, err := execute("generate-image", "--prompt", "一张猫咪图片", "--model", name)
+	if err == nil || !strings.Contains(err.Error(), name) || !strings.Contains(err.Error(), "image-log") || strings.Contains(stdout+stderr+err.Error(), "ali_midjourney_8_2") {
+		t.Fatalf("server rejection must keep name and log ID: stdout=%s stderr=%s err=%v", stdout, stderr, err)
+	}
+	if queries != 1 || submits != 1 {
+		t.Fatalf("expected shared cache and no submit retry: queries=%d submits=%d", queries, submits)
+	}
+}
+
+func TestImageNameFailureStopsBeforeUploadAndSubmit(t *testing.T) {
+	for _, tc := range []struct{ name, selection, models string }{
+		{"unknown name", "不存在", `[{"key":"private-image","name":"图片模型","kind":"image"}]`},
+		{"wire key", "private-image", `[{"key":"private-image","name":"图片模型","kind":"image"}]`},
+		{"missing name", "图片模型", `[{"key":"private-image","kind":"image"}]`},
+		{"duplicate name", "图片模型", `[{"key":"private-image","name":"图片模型","kind":"image"},{"key":"private-image-2","name":"图片模型","kind":"image"}]`},
+		{"empty list", "图片模型", `[]`},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv("HOME", t.TempDir())
+			t.Setenv("XDG_CACHE_HOME", t.TempDir())
+			t.Setenv("LocalAppData", t.TempDir())
+			requests := 0
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				requests++
+				if r.URL.Path != config.GetAvailableModelListPath {
+					t.Errorf("must not upload or submit: %s", r.URL.Path)
+				}
+				_, _ = w.Write([]byte(`{"ret":"0","data":{"scene":"web_image_agent","config_key":"image-key","config":{"models":` + tc.models + `}}}`))
+			}))
+			defer server.Close()
+			var stdout, stderr bytes.Buffer
+			root := newTestRootCommand(t, &stdout, &stderr, server.URL)
+			root.SetArgs([]string{"generate-image", "--prompt", "image", "--model", tc.selection, "--image", "/missing.png"})
+			err := root.Execute()
+			if err == nil || requests != 1 || strings.Contains(stdout.String()+stderr.String()+err.Error(), "private-image") {
+				t.Fatalf("invalid name accepted or exposed: requests=%d stdout=%s stderr=%s err=%v", requests, stdout.String(), stderr.String(), err)
+			}
+		})
+	}
+}

package/cmd/marketing.go

@@ -0,0 +1,144 @@
+package cmd
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"mime"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/spf13/cobra"
+)
+
+var marketingPaths = map[string]string{
+	"generate": "/api/biz/v1/agent/submit_marketing_run",
+	"query":    "/api/biz/v1/agent/query_generate_video_result",
+	"upload":   config.UploadFilePath,
+	"balance":  config.GetCreditBalancePath,
+}
+
+// Marketing uses the same AuthManager as login/status and all other commands.
+// Only fixed public endpoints are exposed; credentials never leave the CLI.
+func newMarketingCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	root := &cobra.Command{Use: "marketing", Short: "Marketing API using the shared CLI login"}
+	root.SetOut(stdout)
+	root.SetErr(stderr)
+	for _, action := range []string{"generate", "query", "upload", "balance"} {
+		root.AddCommand(newMarketingAction(action, stdout, stderr, runner))
+	}
+	return root
+}
+
+func newMarketingAction(action string, stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	var requestFile, file, threadID, runID string
+	var execute bool
+	var timeout time.Duration
+	command := &cobra.Command{Use: action, Args: cobra.NoArgs, Short: "Call marketing " + action}
+	command.SetOut(stdout)
+	command.SetErr(stderr)
+	command.Flags().DurationVar(&timeout, "timeout", 60*time.Second, "request deadline (e.g. 60s)")
+	switch action {
+	case "generate":
+		command.Flags().StringVar(&requestFile, "request", "", "request JSON file, or - for stdin")
+		command.Flags().BoolVar(&execute, "execute", false, "submit generation; otherwise preview only")
+	case "query":
+		command.Flags().StringVar(&threadID, "thread-id", "", "marketing thread ID")
+		command.Flags().StringVar(&runID, "run-id", "", "marketing run ID")
+	case "upload":
+		command.Flags().StringVar(&file, "file", "", "local media file")
+	}
+	command.RunE = func(cmd *cobra.Command, _ []string) error {
+		if timeout <= 0 || timeout > 30*time.Minute {
+			return fmt.Errorf("timeout 必须大于 0 且不超过 30m")
+		}
+		var body any = map[string]any{}
+		switch action {
+		case "generate":
+			if requestFile == "" {
+				return fmt.Errorf("缺少必填参数 --request")
+			}
+			reader := cmd.InOrStdin()
+			if requestFile != "-" {
+				f, err := os.Open(requestFile)
+				if err != nil {
+					return err
+				}
+				defer f.Close()
+				reader = f
+			}
+			var value map[string]json.RawMessage
+			decoder := json.NewDecoder(io.LimitReader(reader, 8*1024*1024+1))
+			if err := decoder.Decode(&value); err != nil {
+				return fmt.Errorf("请求 JSON 无效: %w", err)
+			}
+			var extra any
+			if err := decoder.Decode(&extra); err != io.EOF {
+				return fmt.Errorf("请求只能包含一个 JSON 对象")
+			}
+			for key := range value {
+				if key != "message" && key != "asset_ids" && key != "thread_id" && key != "general_agent_settings" {
+					return fmt.Errorf("未支持的营销请求字段: %s", key)
+				}
+			}
+			var message string
+			var settings struct {
+				VideoModel string `json:"video_model"`
+			}
+			if json.Unmarshal(value["message"], &message) != nil || strings.TrimSpace(message) == "" {
+				return fmt.Errorf("message 必须为非空字符串")
+			}
+			if json.Unmarshal(value["general_agent_settings"], &settings) != nil || strings.TrimSpace(settings.VideoModel) == "" {
+				return fmt.Errorf("general_agent_settings.video_model 必填")
+			}
+			body = value
+			if !execute {
+				return common.WriteJSON(stdout, map[string]any{"dry_run": true, "url": config.DefaultBaseURL + marketingPaths[action], "body": body})
+			}
+		case "query":
+			if strings.TrimSpace(threadID) == "" || strings.TrimSpace(runID) == "" {
+				return fmt.Errorf("query 需要 --thread-id 和 --run-id")
+			}
+			body = map[string]string{"thread_id": threadID, "run_id": runID}
+		case "upload":
+			if err := validateMediaUpload(file); err != nil {
+				return err
+			}
+			info, err := os.Stat(file)
+			if err != nil {
+				return err
+			}
+			if info.Size() == 0 {
+				return fmt.Errorf("上传需要非空文件")
+			}
+		}
+		ctx, cancel := context.WithTimeout(cmd.Context(), timeout)
+		defer cancel()
+		client := common.NewNonRedirectingHTTPClient(runner.Config.BaseURL, timeout, newRunnerAuthorizer(runner))
+		var result map[string]json.RawMessage
+		var err error
+		if action == "upload" {
+			contentType := mime.TypeByExtension(strings.ToLower(filepath.Ext(file)))
+			err = client.SendMultipartRequest(ctx, marketingPaths[action], nil, common.MultipartFile{FieldName: "file", Path: file, ContentType: contentType}, &result)
+		} else {
+			err = client.SendRequest(ctx, marketingPaths[action], body, &result)
+		}
+		if err != nil {
+			return err
+		}
+		ret := strings.TrimSpace(string(result["ret"]))
+		if ret != `"0"` && ret != "0" {
+			var message, logID string
+			_ = json.Unmarshal(result["errmsg"], &message)
+			_ = json.Unmarshal(result["log_id"], &logID)
+			return common.NewLogIDError(fmt.Sprintf("营销 API 失败: ret=%s errmsg=%s", ret, message), logID)
+		}
+		return common.WriteJSON(stdout, result)
+	}
+	return command
+}

package/cmd/marketing_test.go

@@ -0,0 +1,179 @@
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/auth"
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+)
+
+type marketingCredentialStore struct {
+	auth.CredentialStore
+	credential *auth.Credential
+	loads      int
+}
+
+func (s *marketingCredentialStore) Load(context.Context) (*auth.Credential, error) {
+	s.loads++
+	if s.credential == nil {
+		return nil, auth.ErrCredentialNotFound
+	}
+	return s.credential, nil
+}
+
+const marketingRequest = `{"message":"make an ad","general_agent_settings":{"video_model":"chosen-model","show_subtitle":false}}`
+
+func TestMarketingUsesSharedBrowserAuth(t *testing.T) {
+	for _, action := range []string{"generate", "query", "upload", "balance"} {
+		t.Run(action, func(t *testing.T) {
+			calls := 0
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				calls++
+				if r.Header.Get("Authorization") != "Bearer browser-secret" {
+					t.Error("browser login not reused")
+				}
+				if r.URL.Path != marketingPaths[action] || r.Method != "POST" {
+					t.Error("wrong endpoint")
+				}
+				data, _ := io.ReadAll(r.Body)
+				if bytes.Contains(data, []byte("browser-secret")) {
+					t.Error("credential leaked into payload")
+				}
+				if action == "upload" && !bytes.Contains(data, []byte(`name="file"`)) {
+					t.Error("missing multipart file")
+				}
+				fmt.Fprint(w, `{"ret":"0","log_id":"log-test","data":{"thread_id":"thread","run_id":"run"}}`)
+			}))
+			defer server.Close()
+			cfg := config.Load()
+			cfg.BaseURL = server.URL
+			cfg.AccessKey = ""
+			store := &marketingCredentialStore{credential: &auth.Credential{AccessKey: "browser-secret", UID: "user", DeviceID: "device", ExpiredAt: time.Now().Add(time.Hour).Unix()}}
+			runner := newRootRunner(cfg)
+			runner.Auth = auth.NewManager(cfg, auth.WithCredentialStore(store))
+			var output bytes.Buffer
+			root := newRootCommand(&output, io.Discard, runner)
+			args := []string{"marketing", action}
+			switch action {
+			case "generate":
+				args = append(args, "--request", "-", "--execute")
+				root.SetIn(strings.NewReader(marketingRequest))
+			case "query":
+				args = append(args, "--thread-id", "thread", "--run-id", "run")
+			case "upload":
+				file := filepath.Join(t.TempDir(), "product.png")
+				if err := os.WriteFile(file, []byte("image"), 0600); err != nil {
+					t.Fatal(err)
+				}
+				args = append(args, "--file", file)
+			}
+			root.SetArgs(args)
+			if err := root.Execute(); err != nil {
+				t.Fatal(err)
+			}
+			if calls != 1 || store.loads != 1 {
+				t.Fatalf("HTTP calls=%d credential loads=%d", calls, store.loads)
+			}
+			if strings.Contains(output.String(), "browser-secret") || !strings.Contains(output.String(), "log-test") {
+				t.Fatal("raw result or credential boundary broken")
+			}
+		})
+	}
+}
+
+func TestMarketingAuthFailureAndEnvironmentPrecedence(t *testing.T) {
+	for _, scenario := range []string{"missing", "expired", "override"} {
+		t.Run(scenario, func(t *testing.T) {
+			calls := 0
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				calls++
+				if r.Header.Get("Authorization") != "Bearer explicit-key" {
+					t.Error("environment override not preserved")
+				}
+				fmt.Fprint(w, `{"ret":"0","data":{}}`)
+			}))
+			defer server.Close()
+			cfg := config.Load()
+			cfg.BaseURL = server.URL
+			cfg.AccessKey = ""
+			store := &marketingCredentialStore{}
+			if scenario == "expired" {
+				store.credential = &auth.Credential{AccessKey: "expired", ExpiredAt: 1}
+			}
+			if scenario == "override" {
+				cfg.AccessKey = "explicit-key"
+			}
+			runner := newRootRunner(cfg)
+			runner.Auth = auth.NewManager(cfg, auth.WithCredentialStore(store))
+			root := newRootCommand(io.Discard, io.Discard, runner)
+			root.SetArgs([]string{"marketing", "balance"})
+			err := root.Execute()
+			if scenario == "override" {
+				if err != nil || calls != 1 || store.loads != 0 {
+					t.Fatalf("override: err=%v calls=%d loads=%d", err, calls, store.loads)
+				}
+			} else if err == nil || !strings.Contains(err.Error(), "pippit-tool-cli login") || calls != 0 {
+				t.Fatalf("missing/expired: err=%v calls=%d", err, calls)
+			}
+		})
+	}
+}
+
+func TestMarketingPreviewAndHelpDoNotReadCredentials(t *testing.T) {
+	for _, args := range [][]string{{"marketing", "--help"}, {"marketing", "generate", "--request", "-"}, {"marketing", "query"}} {
+		cfg := config.Load()
+		cfg.AccessKey = ""
+		store := &marketingCredentialStore{}
+		runner := newRootRunner(cfg)
+		runner.Auth = auth.NewManager(cfg, auth.WithCredentialStore(store))
+		root := newRootCommand(io.Discard, io.Discard, runner)
+		root.SetIn(strings.NewReader(marketingRequest))
+		root.SetArgs(args)
+		err := root.Execute()
+		if args[1] != "query" && err != nil {
+			t.Fatal(err)
+		}
+		if args[1] == "query" && err == nil {
+			t.Fatal("missing IDs accepted")
+		}
+		if store.loads != 0 {
+			t.Fatal("offline operation accessed credentials")
+		}
+	}
+}
+
+func TestMarketingDoesNotReplaySubmission(t *testing.T) {
+	for _, status := range []int{302, 307, 504} {
+		t.Run(fmt.Sprint(status), func(t *testing.T) {
+			calls := 0
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				calls++
+				w.Header().Set("Location", "/unexpected")
+				w.WriteHeader(status)
+			}))
+			defer server.Close()
+			cfg := config.Load()
+			cfg.BaseURL = server.URL
+			cfg.AccessKey = "test-key"
+			root := newRootCommand(io.Discard, io.Discard, newRootRunner(cfg))
+			root.SetIn(strings.NewReader(marketingRequest))
+			root.SetArgs([]string{"marketing", "generate", "--request", "-", "--execute"})
+			if err := root.Execute(); err == nil {
+				t.Fatal("failed/redirected request succeeded")
+			}
+			if calls != 1 {
+				t.Fatalf("submission replayed %d times", calls)
+			}
+		})
+	}
+}