@pippit-dev/cli 1.0.17 → 1.0.20

package/cmd/short_drama_test.go

@@ -128,6 +128,7 @@ func TestRootHelpListsSupportedCommands(t *testing.T) {
 		"erase-video-subtitle",
 		"generate-video",
 		"download-result",
+		"get-credit-balance",
 		"get-thread",
 		"list-thread-file",
 		"query-result",
@@ -140,7 +141,7 @@ func TestRootHelpListsSupportedCommands(t *testing.T) {
 			t.Fatalf("help output = %q, want %q", got, want)
 		}
 	}
-	for _, unwanted := range []string{"completion", "version     "} {
+	for _, unwanted := range []string{"completion", "\n  version "} {
 		if strings.Contains(got, unwanted) {
 			t.Fatalf("help output = %q, should not contain %q", got, unwanted)
 		}
@@ -971,14 +972,11 @@ func assertAccessKeyGuidance(t *testing.T, err error) {
 		t.Fatal("error = nil, want access key guidance")
 	}
 	msg := err.Error()
-	if !strings.Contains(msg, "XYQ_ACCESS_KEY 缺失") {
+	if !strings.Contains(msg, "pippit-tool-cli login") {
 		t.Fatalf("error = %q, want access key guidance", err)
 	}
-	if !strings.Contains(msg, "https://xyq.jianying.com/home?tab_name=home") {
-		t.Fatalf("error = %q, want access key settings URL", err)
-	}
-	if !strings.Contains(msg, `export XYQ_ACCESS_KEY="<your-access-key>"`) {
-		t.Fatalf("error = %q, want setup command guidance", err)
+	if !strings.Contains(msg, "XYQ_ACCESS_KEY") {
+		t.Fatalf("error = %q, want CI override guidance", err)
 	}
 }
 

package/cmd/update/update.go

@@ -14,6 +14,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/Pippit-dev/pippit-cli/internal/auth"
 	"github.com/Pippit-dev/pippit-cli/internal/version"
 	"github.com/spf13/cobra"
 )
@@ -219,20 +220,48 @@ func runInherit(stderr io.Writer, name string, args ...string) error {
 
 func runInheritEnv(stderr io.Writer, env []string, name string, args ...string) error {
 	cmd := command(name, args...)
-	if len(env) > 0 {
-		cmd.Env = append(os.Environ(), env...)
-	}
+	cmd.Env = sanitizedUpdateEnv(os.Environ(), env)
 	cmd.Stdout = stderr
 	cmd.Stderr = stderr
 	return cmd.Run()
 }
 
+func sanitizedUpdateEnv(environment, overrides []string) []string {
+	merged := overlayEnvironment(environment, overrides)
+	return auth.SanitizedBrowserEnv(merged)
+}
+
+func overlayEnvironment(environment, overrides []string) []string {
+	result := make([]string, 0, len(environment)+len(overrides))
+	indexes := make(map[string]int, len(environment)+len(overrides))
+	for _, entry := range append(append([]string(nil), environment...), overrides...) {
+		name, _, found := strings.Cut(entry, "=")
+		if !found || strings.TrimSpace(name) == "" {
+			continue
+		}
+		key := name
+		if runtime.GOOS == "windows" {
+			key = strings.ToUpper(key)
+		}
+		if index, exists := indexes[key]; exists {
+			result[index] = entry
+			continue
+		}
+		indexes[key] = len(result)
+		result = append(result, entry)
+	}
+	return result
+}
 func command(name string, args ...string) *exec.Cmd {
+	var cmd *exec.Cmd
 	if runtime.GOOS == "windows" {
 		cmdArgs := append([]string{"/c", name}, args...)
-		return exec.Command("cmd.exe", cmdArgs...)
+		cmd = exec.Command("cmd.exe", cmdArgs...)
+	} else {
+		cmd = exec.Command(name, args...)
 	}
-	return exec.Command(name, args...)
+	cmd.Env = sanitizedUpdateEnv(os.Environ(), nil)
+	return cmd
 }
 
 func prepareSelfReplace() (func(), error) {

package/cmd/update/update_test.go

@@ -171,3 +171,87 @@ func TestStripPrereleaseVersion(t *testing.T) {
 		}
 	}
 }
+
+func TestRunInheritEnvSanitizesPippitCredentials(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("test uses a POSIX shell script to capture the child environment")
+	}
+
+	binDir := t.TempDir()
+	capturePath := filepath.Join(t.TempDir(), "environment.txt")
+	commandPath := filepath.Join(binDir, "capture-update-environment")
+	script := "#!/bin/sh\n/usr/bin/env > \"$CAPTURE_ENV\"\n"
+	if err := os.WriteFile(commandPath, []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	basePath := binDir + string(os.PathListSeparator) + "/base/path"
+	overriddenPath := binDir + string(os.PathListSeparator) + "/overridden/path"
+	t.Setenv("PATH", basePath)
+	t.Setenv("CAPTURE_ENV", capturePath)
+	t.Setenv("SAFE_INHERITED", "kept")
+	t.Setenv("XYQ_ACCESS_KEY", "xyq-secret")
+	t.Setenv("PIPPIT_ACCESS_KEY", "pippit-secret")
+	t.Setenv("PIPPIT_AK", "legacy-secret")
+	t.Setenv("PIPPIT_CLI_TOKEN", "pippit-token")
+	t.Setenv("XYQ_CLIENT_SECRET", "xyq-client-secret")
+	t.Setenv("NPM_TOKEN", "npm-secret")
+	t.Setenv("NODE_AUTH_TOKEN", "registry-secret")
+
+	var stderr bytes.Buffer
+	err := runInheritEnv(&stderr, []string{
+		"PATH=" + overriddenPath,
+		"SAFE_INHERITED=overridden",
+		"SAFE_EXPLICIT=kept",
+		"PIPPIT_CLI_SKIP_SKILLS=1",
+		"XYQ_ACCESS_KEY=override-must-not-leak",
+		"PIPPIT_OVERRIDE_SECRET=override-must-not-leak",
+		"REGISTRY_TOKEN=explicit-registry-secret",
+	}, "capture-update-environment")
+	if err != nil {
+		t.Fatalf("runInheritEnv() error = %v, stderr = %s", err, stderr.String())
+	}
+
+	captured, err := os.ReadFile(capturePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := parseEnvironment(string(captured))
+	for _, forbidden := range []string{
+		"XYQ_ACCESS_KEY",
+		"PIPPIT_ACCESS_KEY",
+		"PIPPIT_AK",
+		"PIPPIT_CLI_TOKEN",
+		"XYQ_CLIENT_SECRET",
+		"PIPPIT_OVERRIDE_SECRET",
+	} {
+		if value, exists := got[forbidden]; exists {
+			t.Fatalf("child environment retained %s=%q", forbidden, value)
+		}
+	}
+	for name, want := range map[string]string{
+		"PATH":                   overriddenPath,
+		"CAPTURE_ENV":            capturePath,
+		"SAFE_INHERITED":         "overridden",
+		"SAFE_EXPLICIT":          "kept",
+		"PIPPIT_CLI_SKIP_SKILLS": "1",
+		"NPM_TOKEN":              "npm-secret",
+		"NODE_AUTH_TOKEN":        "registry-secret",
+		"REGISTRY_TOKEN":         "explicit-registry-secret",
+	} {
+		if value := got[name]; value != want {
+			t.Fatalf("child environment %s = %q, want %q", name, value, want)
+		}
+	}
+}
+
+func parseEnvironment(environment string) map[string]string {
+	result := make(map[string]string)
+	for _, entry := range strings.Split(environment, "\n") {
+		name, value, found := strings.Cut(entry, "=")
+		if found {
+			result[name] = value
+		}
+	}
+	return result
+}

package/dist/checksums.txt

@@ -0,0 +1,6 @@
+8bbce765a6e25262d7b65c426f74809cb1b56f38e8509c821cff8a5b06d59ba9  pippit-tool-cli-1.0.20-darwin-amd64.tar.gz
+0cc1d8f2cf1197dcc2992f19e593279e9bc4fb1c72f25f220a933288ab7c8877  pippit-tool-cli-1.0.20-darwin-arm64.tar.gz
+38e1fb6590cbe62876625ffbc027099992db1a0cb42099c4b3b64e1cc5aae5b3  pippit-tool-cli-1.0.20-linux-amd64.tar.gz
+d44a96fa3cadd7da7e9e1279cb49659d2d9ab7da12f8695267deeb4fd08b33bc  pippit-tool-cli-1.0.20-linux-arm64.tar.gz
+53d350752fcacb60667f0a1733b9edc0be4e2b77744e042f90726584493fb506  pippit-tool-cli-1.0.20-windows-amd64.zip
+2c04a6f002f3aa0005e6cab4eb18dba5d87bc4f1e158b432bf19c658e4f59b1f  pippit-tool-cli-1.0.20-windows-arm64.zip