[jcstein]

Fixes #4625.

blob submit --input-file blobs.json now works without placeholder positional arguments or a panic. Mixed file/positional input and excess arguments return errors. blob submit <namespace> - reads raw bytes from stdin, preserving binary data and newlines without hex decoding.

Remote RPC commands using --url no longer require a dummy token. Explicit --token and --node.store authentication still work, and local node discovery remains available when --url is omitted. Calls using --url that previously relied on automatically discovered local credentials must now specify --token or --node.store. Servers still enforce their own authentication.

Review level: [high] — changes CLI authentication selection and blob submission input handling.

Validation:

• Passed tests for ./cmd, ./nodebuilder/blob/cmd, ./nodebuilder/state/cmd, and ./nodebuilder/share/cmd.
• Passed go test -race ./cmd ./nodebuilder/blob/cmd -count=1.
• Built ./cmd/celestia and exercised the binary against a local HTTP RPC server: file-only submission, binary stdin, unauthenticated requests, explicit tokens, and existing hex input.
• Formatting and git diff --check passed.
• go vet ./... reports the pre-existing discarded timeout cancellation at cmd/rpc.go:86 (formerly line 88).
• GitHub Actions passed on 8bfb8cbd: Linux and macOS unit suites, coverage, all nine integration jobs, all 13 Tastora E2E suites, lint/imports, dependency checks, and OpenRPC generation. CI run, E2E run.
• Codecov reports all modified coverable lines covered by tests; Greptile found no actionable issues.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 39.36%. Comparing base (f197272) to head (8bfb8cb).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5366      +/-   ##
==========================================
+ Coverage   38.77%   39.36%   +0.59%     
==========================================
  Files         323      323              
  Lines       22459    22463       +4     
==========================================
+ Hits         8708     8843     +135     
+ Misses      12706    12553     -153     
- Partials     1045     1067      +22     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The checked blob submission and authentication paths behaved as intended, with no outstanding issues blocking merge.

Summary

This PR fixes file-only blob submission and adds raw stdin input. Runtime checks confirmed that file-only submission no longer panics, binary stdin and newlines reach the RPC endpoint unchanged, existing positional hex input still works, and mixed or excess arguments are rejected before submission.

Authentication checks confirmed that requests using only --url omit credentials, while explicit tokens, explicit node stores, and local discovery continue to work. Protected server calls still require the appropriate permissions.

No actionable issues were found. The checked behavior supports merging this PR.

• RPC commands choose credentials based on the URL and node store.
• Blob submission accepts JSON files alone and raw data from stdin.

_{Reviews (1) · Last reviewed commit: "fix(cmd): shorten blob input flag descri..." · Reviewed by Greptile}