@pippit-dev/cli 1.0.38 → 1.0.41

package/README.md

@@ -2,6 +2,21 @@
 
 面向 Pippit / 小云雀工作流的命令行工具与智能体技能集合。
 
+## 本地运行配置
+
+CLI 每次启动时读取**当前工作目录**中的 `config.toml`。在仓库根目录执行 CLI 时使用仓库配置，修改后下一次执行直接生效，无需重新编译：
+
+```toml
+xyq_api_url = "https://xyq.jianying.com"
+x-tt-env = ""
+```
+
+`x-tt-env` 填写本次实际 PPE 环境名，格式为 `ppe_[A-Za-z0-9_]+`。非空时，发往 `xyq_api_url` 的提交、查询、上传等 API 请求自动携带 `x-tt-env: <环境名>` 和 `x-use-ppe: 1`；外部媒体下载不携带这两个 header。留空时不添加 PPE header。仓库默认留空，避免默认路由到某个个人泳道。
+
+文件不存在时继续使用线上默认配置；不会搜索父目录、用户目录或二进制目录。文件格式、字段名或值错误会终止执行。旧的 `PIPPIT_CLI_PPE_ENV` 不再生效；`XYQ_ACCESS_KEY` 等认证设置保持原有行为。
+
+`tests/` 中的验证脚本随源码仓库维护，不包含在 npm 发布包中，也不接入正式 CLI 二进制入口。
+
 ## 技能列表
 
 本仓库在 `skills/` 目录下包含三个智能体技能：
@@ -79,6 +94,45 @@ Canvas 任务使用 `ensure-cli.js --canvas`，额外返回 `canvas_entry`；原
 - 文档使用 Skill 内相对链接，打包时保留结构。规范副本位于 `skills/xyq-nest-skill/`，项目发现入口 `.agents/skills/xyq-skill` 指向该目录。
 - 修改后运行 `node scripts/skills.test.js` 与 `node scripts/install-cli.test.js`，检查引用完整、保留命令与安装检查一致及缺命令升级/缓存复用；Agent 行为用例见 [测试场景](skills/xyq-nest-skill/tests/agent_test_cases.md)。这些检查不代表真实生成已验证。
 
+## CLI 更新渠道与发布
+
+普通用户使用稳定渠道（npm `latest`）；试用用户主动选择 `canary`：
+
+```bash
+pippit-tool-cli update                  # 默认安装 latest
+pippit-tool-cli update --channel canary # 本次安装 canary，并更新配套 Skills
+pippit-tool-cli update --channel stable # 本次安装 latest，并更新配套 Skills
+```
+
+`--channel` 只影响本次更新，不保存渠道偏好。下一次不带参数的 `update` 仍走 `latest`，因此可能从试用版退回当前稳定版。显式 `--channel` 优先于 `PIPPIT_CLI_INSTALL_PACKAGE`；不传渠道时保留该环境变量指定包版本的既有行为。新版本提示仍检查稳定渠道。
+
+首次安装试用版，或旧 CLI 尚不支持 `--channel` 时，使用现有安装入口：
+
+```bash
+npx --prefer-online @pippit-dev/cli@canary install
+pippit-tool-cli --version
+```
+
+该命令会替换全局 CLI 和配套 Skills。`canary` 是公开 npm 分发渠道，适合主动参与的小范围试用，不限制谁可以下载。Skill 的 `ensure-cli.js` 在需要下载时仍使用 `latest`；希望试用的用户应先安装 canary。
+
+维护者发布步骤：
+
+1. 保持 `package.json`、`package-lock.json` 与 `vX.Y.Z` tag 的版本一致；使用普通版本号，不使用 `-beta` / `-rc` 后缀（现有安装器按普通版本号定位二进制）。
+2. 推送 tag 后，`Release` workflow 构建 GitHub Release 产物并执行 `npm publish --tag canary`，保留原 `latest`。GitHub Release 产物仍公开可见，本流程控制的是 npm 分发渠道。
+3. 试用用户安装 canary，核对版本并验证实际业务流程。
+4. 验证通过后，在 GitHub Actions 的 `Promote canary to latest` workflow 中点击 `Run workflow`，填写已验证的 `X.Y.Z`。该 workflow 须先合入默认分支才会显示手动入口，并复用仓库已有的 `NPM_TOKEN`。
+5. 提升流程要求输入版本与当前 `canary` 一致，只移动 npm `latest` 指针并回读确认，不重新构建或发布 npm 包。如果 canary 已更新，需要验证新的候选版本后再提升。
+
+维护者回滚步骤：
+
+1. 在 [GitHub Actions](https://github.com/Pippit-dev/cli/actions) 选择 `Rollback CLI`，点击 `Run workflow`。该 workflow 须先合入默认分支；复用 `NPM_TOKEN` 修改 npm 标签，使用只读 `GITHUB_TOKEN` 检查 Release。
+2. 填写 `channel`（`stable` 对应 `latest`，或 `canary`）、`expected_version`（预期渠道当前版本）和 `target_version`（已验证的目标旧版本）。两个版本均须为普通 `X.Y.Z`，目标必须更低；例如 `stable / 1.0.39 / 1.0.38`，仅在确认 `1.0.38` 可用后操作。
+3. 流水线核对渠道当前值、目标 npm 版本及 GitHub Release 元数据：版本 tag 匹配、已公开发布、六种平台/架构的压缩包及 `checksums.txt` 均已上传且非空。该检查不运行旧版程序，不替代业务验证；回滚依赖这些历史产物继续保留。
+4. 写入前再次核对当前渠道，随后只移动所选 npm 标签并回读确认。不会重新构建、发包、修改 Git tag 或改变另一渠道。Actions 日志和运行摘要会记录目标及确认结果；写入或回读失败时，先用 `npm view @pippit-dev/cli dist-tags --prefer-online` 核实实际状态，再决定是否重试。
+5. 已安装问题版本的用户需要主动执行 `pippit-tool-cli update --channel stable`（回滚 canary 时使用 `--channel canary`）并核对 `pippit-tool-cli --version`。旧 CLI 可执行默认 `update` 获取 `latest`，但须确保未设置 `PIPPIT_CLI_INSTALL_PACKAGE` 覆盖变量。已运行的进程及 Skill 独立缓存中的 CLI 不会被渠道回滚自动替换。
+
+发布、提升和回滚共用并发组，避免这些 workflow 同时修改渠道；不取消正在运行的任务。GitHub 默认只保留一个等待中的同组任务，连续触发时请检查是否有等待任务被替换。并发组不能锁住维护者在终端执行的 npm 写入，操作期间应避免其它渠道修改。此阶段不提供百分比放量或自动回滚，普通客户端也不会因指针变化而自动安装；显式指定问题版本的安装仍然可用。
+
 ## 短剧工作流技能
 
 包发布后可以通过 npm 安装。安装器会按当前系统下载匹配的预构建二进制文件，支持 macOS、Linux 和 Windows：
@@ -349,6 +403,35 @@ pippit-tool-cli query-result \
 
 `query-result` 会查询指定 Run 并输出 JSON。Run 成功完成后下载视频和图片产物，`completed=true`，`videos` 和 `images` 中各包含 `download_url` 和 `output_path`；图片扩展名取自产物 `metadata.format`，缺省时兜底 `.png`。Run 失败也视为终态，`completed=true` 且填充 `error_message`；Run 未到终态时 `completed=false`。
 
+## Adapter 接入边界
+
+公共接口位于 `internal/adapter`，通过实例注入适用于当前运行环境的命令和 HTTP 请求策略；公共命令与 HTTP 层只依赖接口，不依赖具体实现。接口提供 `CLIOptions`、`PrepareAPIRequest`、`WrapTransport`、`StripSensitiveHeaders` 四个方法，`adapter.Default{}` 提供默认行为。
+
+- 根入口 `main.go` 调用 `cmd.Execute()`，使用完整命令、本机认证和原始 API 路由。
+- 同进程集成可使用 `cmd.NewRootCommandWithAdapter(stdout, stderr, policy)` 或 `common.NewHTTPClientWithAdapter(baseURL, timeout, authorizer, policy)`；传 nil 使用默认 adapter，不存在全局 adapter 注册。
+- 同源判断由公共 HTTP client 按 scheme、hostname、有效端口执行；只有同源 API 请求才调用 `PrepareAPIRequest`。非同源请求清除默认认证和 adapter 管理的敏感字段；API 跨域重定向会被拒绝。
+- `AuthProvided` 只表示 adapter 已附加认证材料，不代表服务端验证通过；失败立即返回，不回退到本机认证。`UseDefaultAuth` 才调用默认认证器，未知决策会被拒绝。
+- CLI 策略与 Cobra 解耦。`DefaultAllowRootCommands` 明确指定是否默认放行一级业务命令；为 false 时只开放 `AllowedRootCommands` 白名单，nil 和空列表都表示没有白名单命令。默认 adapter 将该开关设为 true，本机认证和自更新仍受各自开关控制；标准帮助和版本行为仍由 Cobra 提供。可通过 `auth.WithCLIOptions` 将本机认证能力配置应用于独立 Manager。
+- 业务 client 与更新遥测 client 都在构造时包装 Transport；遥测 client 属于命令实例，避免使用不同 adapter 的实例共享可变客户端。
+
+例如，自定义 adapter 可以复用默认实现，仅调整命令能力，并在自己的程序入口注入：
+
+```go
+type customAdapter struct {
+    adapter.Default
+}
+
+func (customAdapter) CLIOptions() adapter.CLIOptions {
+    options := adapter.Default{}.CLIOptions()
+    options.SelfUpdateEnabled = false
+    return options
+}
+
+// 程序入口：cmd.ExecuteWithAdapter(customAdapter{})
+```
+
+新增业务请求应复用 `Runner.Client`；需要独立 `http.Client` 时，通过所注入策略的 `WrapTransport` 包装。直接创建未包装的客户端不会自动应用策略。
+
 ## HTTP 客户端
 
 命令模块通过 `common.Runner` 发起服务调用。运行时配置，例如基础地址、HTTP 超时时间和接口路径，由 `internal/config` 加载，并在运行器中与 `common.Client` 组合使用。
@@ -375,7 +458,7 @@ pippit-tool-cli update --source HOST
 
 ### 宿主来源统计
 
-生成提交命令均支持可选 `--source`：`submit-run`、`generate-image`、`generate-video`、`video-super-resolution`、`erase-video-subtitle`、`short-drama +submit-run`、`marketing generate`。
+生成提交命令均支持可选 `--source`：`generate-image`、`generate-video`、`video-super-resolution`、`erase-video-subtitle`、`short-drama +submit-run`、`marketing generate`。
 
 由宿主 Agent 根据实际环境静默填写稳定标识，例如豆包办公 `doubao_office`、WorkBuddy `workbuddy`、Codex `codex`。其它来源可使用其真实产品标识；来源未知时省略，不询问用户，也不从 prompt 猜测。该值去掉首尾空白后写入请求顶层 `platform`，仅供统计，不参与创作、模型选择或鉴权；无法解析来源或显式空值时不发送该字段。省略 `--source` 时，CLI 按以下顺序尽力补齐来源：
 

package/checksums.txt

@@ -1,6 +1,6 @@
-3fca50bc9ffb2c14e74ea65781fb706d4fa2c79484d5b20b3c08ad15847afc30  pippit-tool-cli-1.0.38-darwin-amd64.tar.gz
-0e7d976179d944a2b8f99800acb91c6d3c035f0920cf4ec4348010b3a03d9e38  pippit-tool-cli-1.0.38-darwin-arm64.tar.gz
-4f5723713fc910121982885172079ab1e787d2af9f2515961e59f7e53ba48737  pippit-tool-cli-1.0.38-linux-amd64.tar.gz
-07d8ff5920dfa6748ad46076fcffbabc7b5d8dcef6714d802c7fa5b4b515494e  pippit-tool-cli-1.0.38-linux-arm64.tar.gz
-61f18a00f457ffff80c20593b3c0af84b93a3e8db871b00ed043f61024c6b441  pippit-tool-cli-1.0.38-windows-amd64.zip
-c07399e11956f7c6565e00c74a24f864012613539a61341636f9900d85a72654  pippit-tool-cli-1.0.38-windows-arm64.zip
+6f7daba79b3423b148e30373bb87e7e8998df3d76be2196e39f84af209f0ea50  pippit-tool-cli-1.0.41-darwin-amd64.tar.gz
+9f03ae01c213a76f45b0dfa110272b45e5b5ecd54b188313c9d256ccbe512980  pippit-tool-cli-1.0.41-darwin-arm64.tar.gz
+ea603412d1c5b0baa42efd34bec92fcd0907333babd64a6e08514d4e2dcb86e5  pippit-tool-cli-1.0.41-linux-amd64.tar.gz
+cebd1f0f34157624c0fc8203eec306bd6c7e31a2db44089f52bca9c74c57ee03  pippit-tool-cli-1.0.41-linux-arm64.tar.gz
+729f413373d185964a42c178a7e0eeafc3fca490670fb753dc36fb38bb47aaf7  pippit-tool-cli-1.0.41-windows-amd64.zip
+b49491ae751e72f994da9388777a43f1b6b5781399dc2da15ced6d74f48dad6d  pippit-tool-cli-1.0.41-windows-arm64.zip

package/cmd/auth/auth.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	internal_auth "github.com/Pippit-dev/pippit-cli/internal/auth"
+	"github.com/Pippit-dev/pippit-cli/internal/commandnames"
 	"github.com/Pippit-dev/pippit-cli/internal/common"
 	"github.com/spf13/cobra"
 )
@@ -31,7 +32,7 @@ type logoutResult struct {
 func NewLoginCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
 	var forceRefresh bool
 	command := &cobra.Command{
-		Use:   "login",
+		Use:   commandnames.Login,
 		Short: "通过浏览器登录小云雀 CLI",
 		Args:  cobra.NoArgs,
 		RunE: func(command *cobra.Command, _ []string) error {
@@ -66,7 +67,7 @@ func NewLoginCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Com
 // NewStatusCommand creates the top-level `pippit-tool-cli status` command.
 func NewStatusCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
 	command := &cobra.Command{
-		Use:   "status",
+		Use:   commandnames.Status,
 		Short: "查看小云雀 CLI 登录状态",
 		Args:  cobra.NoArgs,
 		RunE: func(command *cobra.Command, _ []string) error {
@@ -95,7 +96,7 @@ func NewStatusCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Co
 // modified or revoked by this command.
 func NewLogoutCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
 	command := &cobra.Command{
-		Use:   "logout",
+		Use:   commandnames.Logout,
 		Short: "清除本机小云雀 CLI 登录（不撤销远程 Access Key）",
 		Args:  cobra.NoArgs,
 		RunE: func(command *cobra.Command, _ []string) error {

package/cmd/marketing.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
 	"github.com/Pippit-dev/pippit-cli/internal/common"
 	"github.com/Pippit-dev/pippit-cli/internal/config"
 	"github.com/spf13/cobra"
@@ -25,17 +26,17 @@ var marketingPaths = map[string]string{
 
 // Marketing uses the same AuthManager as login/status and all other commands.
 // Only fixed public endpoints are exposed; credentials never leave the CLI.
-func newMarketingCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+func newMarketingCommand(stdout, stderr io.Writer, runner *common.Runner, policy adapter.HTTPAdapter) *cobra.Command {
 	root := &cobra.Command{Use: "marketing", Short: "Marketing API using the shared CLI login"}
 	root.SetOut(stdout)
 	root.SetErr(stderr)
 	for _, action := range []string{"generate", "query", "upload", "balance"} {
-		root.AddCommand(newMarketingAction(action, stdout, stderr, runner))
+		root.AddCommand(newMarketingAction(action, stdout, stderr, runner, policy))
 	}
 	return root
 }
 
-func newMarketingAction(action string, stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+func newMarketingAction(action string, stdout, stderr io.Writer, runner *common.Runner, policy adapter.HTTPAdapter) *cobra.Command {
 	var requestFile, file, threadID, runID, source string
 	var execute bool
 	var timeout time.Duration
@@ -123,7 +124,7 @@ func newMarketingAction(action string, stdout, stderr io.Writer, runner *common.
 		}
 		ctx, cancel := context.WithTimeout(cmd.Context(), timeout)
 		defer cancel()
-		client := common.NewNonRedirectingHTTPClient(runner.Config.BaseURL, timeout, newRunnerAuthorizer(runner))
+		client := common.NewNonRedirectingHTTPClientWithAdapter(runner.Config.BaseURL, timeout, newRunnerAuthorizer(runner), adapter.WithPPE(policy, runner.Config.PPEEnv))
 		var result map[string]json.RawMessage
 		var err error
 		if action == "upload" {

package/cmd/marketing_test.go

@@ -14,6 +14,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
 	"github.com/Pippit-dev/pippit-cli/internal/auth"
 	"github.com/Pippit-dev/pippit-cli/internal/config"
 )
@@ -34,6 +35,63 @@ func (s *marketingCredentialStore) Load(context.Context) (*auth.Credential, erro
 
 const marketingRequest = `{"message":"make an ad","general_agent_settings":{"video_model":"chosen-model","show_subtitle":false}}`
 
+type marketingTestAdapter struct{}
+
+func (marketingTestAdapter) CLIOptions() adapter.CLIOptions {
+	return adapter.CLIOptions{DefaultAllowRootCommands: true}
+}
+
+func (marketingTestAdapter) PrepareAPIRequest(_ context.Context, req *http.Request) (adapter.AuthDecision, error) {
+	req.Header.Set("X-Test-Adapter-Auth", "present")
+	return adapter.AuthProvided, nil
+}
+
+func (marketingTestAdapter) WrapTransport(next http.RoundTripper) http.RoundTripper {
+	if next == nil {
+		next = http.DefaultTransport
+	}
+	return marketingTestTransport{next: next}
+}
+
+func (marketingTestAdapter) StripSensitiveHeaders(*http.Request) {}
+
+type marketingTestTransport struct{ next http.RoundTripper }
+
+func (t marketingTestTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	cloned := req.Clone(req.Context())
+	cloned.Header.Set("X-Test-Adapter-Transport", "present")
+	return t.next.RoundTrip(cloned)
+}
+
+func TestMarketingUsesRootAdapterForIndependentClient(t *testing.T) {
+	called := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		called++
+		if r.Header.Get("X-Test-Adapter-Auth") != "present" || r.Header.Get("X-Test-Adapter-Transport") != "present" {
+			t.Errorf("marketing request bypassed root adapter: %#v", r.Header)
+		}
+		if r.Header.Get("x-tt-env") != "ppe_fixture" || r.Header.Get("x-use-ppe") != "1" {
+			t.Error("marketing request bypassed runtime PPE config")
+		}
+		fmt.Fprint(w, `{"ret":"0","data":{}}`)
+	}))
+	defer server.Close()
+
+	cfg := config.Load()
+	cfg.BaseURL = server.URL
+	cfg.PPEEnv = "ppe_fixture"
+	policy := marketingTestAdapter{}
+	runner := newRootRunnerWithAdapter(cfg, policy)
+	root := newRootCommandWithAdapter(io.Discard, io.Discard, runner, policy)
+	root.SetArgs([]string{"marketing", "balance"})
+	if err := root.Execute(); err != nil {
+		t.Fatal(err)
+	}
+	if called != 1 {
+		t.Fatalf("marketing requests = %d, want 1", called)
+	}
+}
+
 func TestMarketingUsesSharedBrowserAuth(t *testing.T) {
 	for _, action := range []string{"generate", "query", "upload", "balance"} {
 		t.Run(action, func(t *testing.T) {

package/cmd/root.go

@@ -14,6 +14,8 @@ import (
 	"github.com/Pippit-dev/pippit-cli/cmd/short_drama"
 	updatecmd "github.com/Pippit-dev/pippit-cli/cmd/update"
 	"github.com/Pippit-dev/pippit-cli/cmd/video_tool"
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
+	"github.com/Pippit-dev/pippit-cli/internal/adaptercli"
 	internal_auth "github.com/Pippit-dev/pippit-cli/internal/auth"
 	"github.com/Pippit-dev/pippit-cli/internal/common"
 	"github.com/Pippit-dev/pippit-cli/internal/config"
@@ -22,24 +24,42 @@ import (
 )
 
 // Execute runs the pippit-tool-cli command tree.
-func Execute() error {
-	return NewRootCommand(os.Stdout, os.Stderr).Execute()
+func Execute() error { return ExecuteWithAdapter(adapter.Default{}) }
+
+func ExecuteWithAdapter(policy adapter.Adapter) error {
+	cfg, err := config.LoadFile(config.FileName)
+	if err != nil {
+		return err
+	}
+	policy = adapter.OrDefault(policy)
+	runner := newRootRunnerWithAdapter(cfg, policy)
+	return newRootCommandWithAdapter(os.Stdout, os.Stderr, runner, policy).Execute()
 }
 
 func NewRootCommand(stdout, stderr io.Writer) *cobra.Command {
+	return NewRootCommandWithAdapter(stdout, stderr, adapter.Default{})
+}
+
+func NewRootCommandWithAdapter(stdout, stderr io.Writer, policy adapter.Adapter) *cobra.Command {
+	policy = adapter.OrDefault(policy)
 	cfg := config.Load()
-	runner := newRootRunner(cfg)
-	return newRootCommand(stdout, stderr, runner)
+	runner := newRootRunnerWithAdapter(cfg, policy)
+	return newRootCommandWithAdapter(stdout, stderr, runner, policy)
 }
 
 func newRootRunner(cfg *config.Config) *common.Runner {
+	return newRootRunnerWithAdapter(cfg, adapter.Default{})
+}
+
+func newRootRunnerWithAdapter(cfg *config.Config, policy adapter.Adapter) *common.Runner {
 	runner := common.NewRunner(cfg, nil)
-	runner.Auth = internal_auth.NewManager(cfg)
-	runner.Client = common.NewHTTPClient(
-		cfg.BaseURL,
-		cfg.HTTPTimeout,
-		newRunnerAuthorizer(runner),
-	)
+	var authorizer common.RequestAuthorizer
+	options := policy.CLIOptions()
+	if options.LocalCredentialsEnabled {
+		runner.Auth = internal_auth.NewManager(cfg, internal_auth.WithCLIOptions(options))
+		authorizer = newRunnerAuthorizer(runner)
+	}
+	runner.Client = common.NewHTTPClientWithAdapter(cfg.BaseURL, cfg.HTTPTimeout, authorizer, adapter.WithPPE(policy, cfg.PPEEnv))
 	return runner
 }
 
@@ -53,10 +73,14 @@ func newRunnerAuthorizer(runner *common.Runner) common.RequestAuthorizer {
 }
 
 func newRootCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Command {
+	return newRootCommandWithAdapter(stdout, stderr, runner, adapter.Default{})
+}
+
+func newRootCommandWithAdapter(stdout, stderr io.Writer, runner *common.Runner, policy adapter.Adapter) *cobra.Command {
 	root := &cobra.Command{
 		Use:   "pippit-tool-cli",
 		Short: "Pippit CLI",
-		Long: "Pippit CLI generates and processes videos and images, queries credit balances, submits creative conversations and short-drama workflows, downloads generated assets, and updates the installed CLI package.\n\n" +
+		Long: "Pippit CLI generates and processes videos and images, queries credit balances, submits short-drama workflows, downloads generated assets, and updates the installed CLI package.\n\n" +
 			canvascmd.CommandDiscoveryHelp + "\n\nInstallation help (npm launcher): pippit-tool-cli install --help",
 		Version:       version.Current(),
 		SilenceUsage:  true,
@@ -84,9 +108,10 @@ func newRootCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Comm
 	root.AddCommand(newDownloadResultCommand(stdout, stderr, runner))
 	root.AddCommand(newGetCreditBalanceCommand(stdout, stderr, runner))
 	root.AddCommand(newModelCommand(stdout, stderr, runner))
-	root.AddCommand(newMarketingCommand(stdout, stderr, runner))
+	root.AddCommand(newMarketingCommand(stdout, stderr, runner, policy))
 	root.AddCommand(newGetThreadCommand(stdout, stderr, runner))
-	root.AddCommand(newSubmitRunCommand(stdout, stderr, runner))
+	// 暂停对外提供通用综合 Agent 提交入口，保留实现供后续恢复。
+	// root.AddCommand(newSubmitRunCommand(stdout, stderr, runner))
 	root.AddCommand(newUploadFileCommand(stdout, stderr, runner))
 	root.AddCommand(newListThreadFileCommand(stdout, stderr, runner))
 	root.AddCommand(generate_image.NewCommand(stdout, stderr, runner))
@@ -95,7 +120,8 @@ func newRootCommand(stdout, stderr io.Writer, runner *common.Runner) *cobra.Comm
 	root.AddCommand(video_tool.NewSuperResolutionCommand(stdout, stderr, runner))
 	root.AddCommand(video_tool.NewEraseSubtitleCommand(stdout, stderr, runner))
 	root.AddCommand(short_drama.NewCommand(stdout, stderr, runner))
-	root.AddCommand(updatecmd.NewCommand(stdout, stderr))
+	root.AddCommand(updatecmd.NewCommandWithAdapter(stdout, stderr, policy))
+	adaptercli.Configure(root, policy.CLIOptions())
 	localizeFlagErrors(root)
 	return root
 }

package/cmd/root_test.go

@@ -3,15 +3,78 @@ package cmd
 import (
 	"bytes"
 	"context"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/Pippit-dev/pippit-cli/internal/common"
 	"github.com/Pippit-dev/pippit-cli/internal/config"
 )
 
+func TestRootRunnerUsesRuntimePPERouting(t *testing.T) {
+	headers := make(chan http.Header, 1)
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		headers <- r.Header.Clone()
+		_, _ = w.Write([]byte(`{}`))
+	})
+	api := httptest.NewServer(handler)
+	defer api.Close()
+	media := httptest.NewServer(handler)
+	defer media.Close()
+	dir := t.TempDir()
+	configPath, mediaPath := filepath.Join(dir, config.FileName), filepath.Join(dir, "sample.txt")
+	if err := os.WriteFile(mediaPath, []byte("fixture"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	// Re-read the same file after changes, including clearing the PPE setting.
+	for _, env := range []string{"ppe_first", "ppe_second", ""} {
+		contents := fmt.Sprintf("xyq_api_url = %q\nx-tt-env = %q\n", api.URL, env)
+		if err := os.WriteFile(configPath, []byte(contents), 0600); err != nil {
+			t.Fatal(err)
+		}
+		cfg, err := config.LoadFile(configPath)
+		if err != nil {
+			t.Fatal(err)
+		}
+		cfg.AccessKey = "fixture-key"
+		runner := newRootRunner(cfg)
+		for _, request := range []struct {
+			name     string
+			external bool
+			send     func() error
+		}{
+			{"submit", false, func() error {
+				return runner.Client.SendRequest(context.Background(), config.SubmitRunPath, map[string]any{}, nil)
+			}},
+			{"query", false, func() error { return runner.Client.SendRequest(context.Background(), config.GetThreadPath, nil, nil) }},
+			{"upload", false, func() error {
+				return runner.Client.SendMultipartRequest(context.Background(), config.UploadFilePath, nil, common.MultipartFile{FieldName: "file", Path: mediaPath}, nil)
+			}},
+			{"media", true, func() error { return runner.Client.SendRequest(context.Background(), media.URL, nil, nil) }},
+		} {
+			if err := request.send(); err != nil {
+				t.Fatalf("%s: %v", request.name, err)
+			}
+			got := <-headers
+			wantEnv, wantUsePPE := env, ""
+			if request.external {
+				wantEnv = ""
+			}
+			if wantEnv != "" {
+				wantUsePPE = "1"
+			}
+			if got.Get("x-tt-env") != wantEnv || got.Get("x-use-ppe") != wantUsePPE {
+				t.Fatalf("%s with env %q: unexpected PPE headers", request.name, env)
+			}
+		}
+	}
+}
+
 func TestRootRunnerReadsUpdatedAccessKeyForEveryRequest(t *testing.T) {
 	received := make([]string, 0, 2)
 	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {

package/cmd/source_test.go

@@ -23,14 +23,13 @@ func TestSkillSubmitSourcePreservesCreativeRequest(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("XDG_CACHE_HOME", t.TempDir())
 	t.Setenv("LocalAppData", t.TempDir())
-	for _, name := range []string{"submit-run", "generate-image", "generate-video", "video-super-resolution", "erase-video-subtitle", "short-drama"} {
+	for _, name := range []string{"generate-image", "generate-video", "video-super-resolution", "erase-video-subtitle", "short-drama"} {
 		t.Run(name, func(t *testing.T) {
 			video := filepath.Join(t.TempDir(), "input.mp4")
 			if err := os.WriteFile(video, []byte("test-video"), 0600); err != nil {
 				t.Fatal(err)
 			}
 			args := map[string][]string{
-				"submit-run":             {"submit-run", "--message", "  保留原文\nworkbuddy 只是内容  ", "--thread-id", "skill_existing", "--asset-ids", "asset_1"},
 				"generate-image":         {"generate-image", "--prompt", "cat", "--model", "Seedream 5.0 Pro", "--ratio", "6", "--resolution", "4K"},
 				"generate-video":         {"generate-video", "--prompt", "cat", "--model", "Seedance_2.0_mini", "--duration", "4", "--ratio", "16:9"},
 				"video-super-resolution": {"video-super-resolution", "--video", video, "--output-resolution", "1080p"},
@@ -192,7 +191,7 @@ func TestSkillSubmitSourcePreservesCreativeRequest(t *testing.T) {
 
 func TestSourceHelpWithoutCredentials(t *testing.T) {
 	for _, args := range [][]string{
-		{"submit-run"}, {"generate-image"}, {"generate-video"},
+		{"generate-image"}, {"generate-video"},
 		{"video-super-resolution"}, {"erase-video-subtitle"}, {"short-drama", "+submit-run"},
 	} {
 		var stdout, stderr bytes.Buffer

package/cmd/submit_run_test.go

@@ -2,102 +2,41 @@ package cmd
 
 import (
 	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"reflect"
 	"strings"
 	"testing"
-
-	"github.com/Pippit-dev/pippit-cli/internal/config"
 )
 
-func TestSubmitRunCommandPreservesScriptContract(t *testing.T) {
-	for _, existing := range []bool{false, true} {
-		t.Run(map[bool]string{false: "new", true: "existing_with_assets"}[existing], func(t *testing.T) {
-			message := "  根据参考素材生成视频\n保留原文  "
-			want := map[string]any{"message": message}
-			args := []string{"submit-run", "--message", message, "--source", ""}
-			if existing {
-				want["thread_id"] = "skill_original_thread"
-				want["asset_ids"] = []any{"asset_original_1", "asset_original_2"}
-				args = append(args, "--thread-id", "skill_original_thread", "--asset-ids", "asset_original_1", "--asset-ids", "asset_original_2")
-			}
-			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				if r.Method != http.MethodPost || r.URL.Path != config.SubmitRunPath {
-					t.Errorf("request = %s %s", r.Method, r.URL.Path)
-				}
-				if r.Header.Get("Authorization") != "Bearer test-token" {
-					t.Error("missing bearer authorization")
-				}
-				var got map[string]any
-				if err := json.NewDecoder(r.Body).Decode(&got); err != nil {
-					t.Error(err)
-				}
-				if !reflect.DeepEqual(got, want) {
-					t.Errorf("body = %#v, want %#v", got, want)
-				}
-				_, _ = w.Write([]byte(`{"ret":"0","data":{"run":{"thread_id":"thread_1","run_id":"run_1"},"web_thread_link":"https://xyq.jianying.com/thread_1"}}`))
-			}))
-			defer server.Close()
-			var stdout, stderr bytes.Buffer
-			root := newTestRootCommand(t, &stdout, &stderr, server.URL)
-			root.SetArgs(args)
-			if err := root.Execute(); err != nil {
-				t.Fatal(err)
-			}
-			if got := stdout.String(); got != "{\"thread_id\":\"thread_1\",\"run_id\":\"run_1\",\"web_thread_link\":\"https://xyq.jianying.com/thread_1\"}\n" {
-				t.Fatalf("unexpected output: %s", got)
-			}
-		})
-	}
-}
-
-func TestSubmitRunCommandValidatesBeforeRequest(t *testing.T) {
-	for _, args := range [][]string{
-		{"submit-run"},
-		{"submit-run", "--message", " \n "},
-		{"submit-run", "--message", "hello", "unexpected"},
-	} {
-		var stdout, stderr bytes.Buffer
-		root := newRootCommand(&stdout, &stderr, nil)
-		root.SetArgs(args)
-		if err := root.Execute(); err == nil {
-			t.Fatalf("Execute(%v) should fail before accessing the runner", args)
-		}
-	}
-}
-
-func TestSubmitRunHelpDoesNotRequireCredentials(t *testing.T) {
+func TestSubmitRunIsNotExposedInRootHelp(t *testing.T) {
 	var stdout, stderr bytes.Buffer
 	root := newRootCommand(&stdout, &stderr, nil)
-	root.SetArgs([]string{"submit-run", "--help"})
+	root.SetArgs([]string{"--help"})
 	if err := root.Execute(); err != nil {
 		t.Fatal(err)
 	}
-	for _, flag := range []string{"--message", "--thread-id", "--asset-ids"} {
-		if !strings.Contains(stdout.String(), flag) {
-			t.Errorf("help missing %s", flag)
-		}
+	if strings.Contains(stdout.String(), "submit-run") || strings.Contains(stdout.String(), "creative conversations") {
+		t.Fatalf("root help still exposes creative conversations: %s", stdout.String())
+	}
+	command, _, err := root.Find([]string{"short-drama", "+submit-run"})
+	if err != nil || command == nil || command.Name() != "+submit-run" {
+		t.Fatalf("short-drama submission must remain available: command=%v, err=%v", command, err)
 	}
 }
 
-func TestSubmitRunCommandRejectsInvalidResponse(t *testing.T) {
-	for _, response := range []string{
-		`{"ret":"1","errmsg":"rejected"}`,
-		`{"ret":"0","data":{"run":{"run_id":"run_1"}}}`,
-		`{"ret":"0","data":{"run":{"thread_id":"thread_1"}}}`,
+func TestSubmitRunIsUnavailable(t *testing.T) {
+	for _, args := range [][]string{
+		{"submit-run"},
+		{"submit-run", "--message", "生成一个小猫在花园散步的视频"},
+		{"submit-run", "--help"},
 	} {
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			_, _ = w.Write([]byte(response))
-		}))
 		var stdout, stderr bytes.Buffer
-		root := newTestRootCommand(t, &stdout, &stderr, server.URL)
-		root.SetArgs([]string{"submit-run", "--message", "hello"})
+		root := newRootCommand(&stdout, &stderr, nil)
+		root.SetArgs(args)
 		err := root.Execute()
-		server.Close()
-		if err == nil || stdout.Len() != 0 {
-			t.Fatalf("response %s: error = %v, stdout = %s", response, err, stdout.String())
+		if err == nil || !strings.Contains(err.Error(), "unknown command") {
+			t.Fatalf("Execute(%v) = %v, want unknown command", args, err)
+		}
+		if stdout.Len() != 0 {
+			t.Fatalf("disabled command produced output: %s", stdout.String())
 		}
 	}
 }