@pippit-dev/cli 1.0.38 → 1.0.40

package/dist/xyq-canvas-command-runtime.cjs.LEGAL.txt

@@ -304,212 +304,6 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 
-===== @swc/helpers@0.5.6 =====
-License metadata: Apache-2.0
-
---- LICENSE ---
-                              Apache License
-                        Version 2.0, January 2004
-                     http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-   "License" shall mean the terms and conditions for use, reproduction,
-   and distribution as defined by Sections 1 through 9 of this document.
-
-   "Licensor" shall mean the copyright owner or entity authorized by
-   the copyright owner that is granting the License.
-
-   "Legal Entity" shall mean the union of the acting entity and all
-   other entities that control, are controlled by, or are under common
-   control with that entity. For the purposes of this definition,
-   "control" means (i) the power, direct or indirect, to cause the
-   direction or management of such entity, whether by contract or
-   otherwise, or (ii) ownership of fifty percent (50%) or more of the
-   outstanding shares, or (iii) beneficial ownership of such entity.
-
-   "You" (or "Your") shall mean an individual or Legal Entity
-   exercising permissions granted by this License.
-
-   "Source" form shall mean the preferred form for making modifications,
-   including but not limited to software source code, documentation
-   source, and configuration files.
-
-   "Object" form shall mean any form resulting from mechanical
-   transformation or translation of a Source form, including but
-   not limited to compiled object code, generated documentation,
-   and conversions to other media types.
-
-   "Work" shall mean the work of authorship, whether in Source or
-   Object form, made available under the License, as indicated by a
-   copyright notice that is included in or attached to the work
-   (an example is provided in the Appendix below).
-
-   "Derivative Works" shall mean any work, whether in Source or Object
-   form, that is based on (or derived from) the Work and for which the
-   editorial revisions, annotations, elaborations, or other modifications
-   represent, as a whole, an original work of authorship. For the purposes
-   of this License, Derivative Works shall not include works that remain
-   separable from, or merely link (or bind by name) to the interfaces of,
-   the Work and Derivative Works thereof.
-
-   "Contribution" shall mean any work of authorship, including
-   the original version of the Work and any modifications or additions
-   to that Work or Derivative Works thereof, that is intentionally
-   submitted to Licensor for inclusion in the Work by the copyright owner
-   or by an individual or Legal Entity authorized to submit on behalf of
-   the copyright owner. For the purposes of this definition, "submitted"
-   means any form of electronic, verbal, or written communication sent
-   to the Licensor or its representatives, including but not limited to
-   communication on electronic mailing lists, source code control systems,
-   and issue tracking systems that are managed by, or on behalf of, the
-   Licensor for the purpose of discussing and improving the Work, but
-   excluding communication that is conspicuously marked or otherwise
-   designated in writing by the copyright owner as "Not a Contribution."
-
-   "Contributor" shall mean Licensor and any individual or Legal Entity
-   on behalf of whom a Contribution has been received by Licensor and
-   subsequently incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of
-   this License, each Contributor hereby grants to You a perpetual,
-   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-   copyright license to reproduce, prepare Derivative Works of,
-   publicly display, publicly perform, sublicense, and distribute the
-   Work and such Derivative Works in Source or Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of
-   this License, each Contributor hereby grants to You a perpetual,
-   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-   (except as stated in this section) patent license to make, have made,
-   use, offer to sell, sell, import, and otherwise transfer the Work,
-   where such license applies only to those patent claims licensable
-   by such Contributor that are necessarily infringed by their
-   Contribution(s) alone or by combination of their Contribution(s)
-   with the Work to which such Contribution(s) was submitted. If You
-   institute patent litigation against any entity (including a
-   cross-claim or counterclaim in a lawsuit) alleging that the Work
-   or a Contribution incorporated within the Work constitutes direct
-   or contributory patent infringement, then any patent licenses
-   granted to You under this License for that Work shall terminate
-   as of the date such litigation is filed.
-
-4. Redistribution. You may reproduce and distribute copies of the
-   Work or Derivative Works thereof in any medium, with or without
-   modifications, and in Source or Object form, provided that You
-   meet the following conditions:
-
-   (a) You must give any other recipients of the Work or
-       Derivative Works a copy of this License; and
-
-   (b) You must cause any modified files to carry prominent notices
-       stating that You changed the files; and
-
-   (c) You must retain, in the Source form of any Derivative Works
-       that You distribute, all copyright, patent, trademark, and
-       attribution notices from the Source form of the Work,
-       excluding those notices that do not pertain to any part of
-       the Derivative Works; and
-
-   (d) If the Work includes a "NOTICE" text file as part of its
-       distribution, then any Derivative Works that You distribute must
-       include a readable copy of the attribution notices contained
-       within such NOTICE file, excluding those notices that do not
-       pertain to any part of the Derivative Works, in at least one
-       of the following places: within a NOTICE text file distributed
-       as part of the Derivative Works; within the Source form or
-       documentation, if provided along with the Derivative Works; or,
-       within a display generated by the Derivative Works, if and
-       wherever such third-party notices normally appear. The contents
-       of the NOTICE file are for informational purposes only and
-       do not modify the License. You may add Your own attribution
-       notices within Derivative Works that You distribute, alongside
-       or as an addendum to the NOTICE text from the Work, provided
-       that such additional attribution notices cannot be construed
-       as modifying the License.
-
-   You may add Your own copyright statement to Your modifications and
-   may provide additional or different license terms and conditions
-   for use, reproduction, or distribution of Your modifications, or
-   for any such Derivative Works as a whole, provided Your use,
-   reproduction, and distribution of the Work otherwise complies with
-   the conditions stated in this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise,
-   any Contribution intentionally submitted for inclusion in the Work
-   by You to the Licensor shall be under the terms and conditions of
-   this License, without any additional terms or conditions.
-   Notwithstanding the above, nothing herein shall supersede or modify
-   the terms of any separate license agreement you may have executed
-   with Licensor regarding such Contributions.
-
-6. Trademarks. This License does not grant permission to use the trade
-   names, trademarks, service marks, or product names of the Licensor,
-   except as required for reasonable and customary use in describing the
-   origin of the Work and reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or
-   agreed to in writing, Licensor provides the Work (and each
-   Contributor provides its Contributions) on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-   implied, including, without limitation, any warranties or conditions
-   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-   PARTICULAR PURPOSE. You are solely responsible for determining the
-   appropriateness of using or redistributing the Work and assume any
-   risks associated with Your exercise of permissions under this License.
-
-8. Limitation of Liability. In no event and under no legal theory,
-   whether in tort (including negligence), contract, or otherwise,
-   unless required by applicable law (such as deliberate and grossly
-   negligent acts) or agreed to in writing, shall any Contributor be
-   liable to You for damages, including any direct, indirect, special,
-   incidental, or consequential damages of any character arising as a
-   result of this License or out of the use or inability to use the
-   Work (including but not limited to damages for loss of goodwill,
-   work stoppage, computer failure or malfunction, or any and all
-   other commercial damages or losses), even if such Contributor
-   has been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing
-   the Work or Derivative Works thereof, You may choose to offer,
-   and charge a fee for, acceptance of support, warranty, indemnity,
-   or other liability obligations and/or rights consistent with this
-   License. However, in accepting such obligations, You may act only
-   on Your own behalf and on Your sole responsibility, not on behalf
-   of any other Contributor, and only if You agree to indemnify,
-   defend, and hold each Contributor harmless for any liability
-   incurred by, or claims asserted against, such Contributor by reason
-   of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-   To apply the Apache License to your work, attach the following
-   boilerplate notice, with the fields enclosed by brackets "[]"
-   replaced with your own identifying information. (Don't include
-   the brackets!)  The text should be enclosed in the appropriate
-   comment syntax for the file format. We also recommend that a
-   file or class name and description of purpose be included on the
-   same "printed page" as the copyright notice for easier
-   identification within third-party archives.
-
-Copyright [yyyy] [name of copyright owner]
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-	http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-
 ===== dagre@0.8.5 =====
 License metadata: MIT
 

package/dist/xyq-canvas-command-runtime.cjs.sha256

@@ -1,2 +1,2 @@
-19661847115778622c6fbfc8c02e8d4c958d4f5f7729d56d51f5c8008e780028  xyq-canvas-command-runtime.cjs
-e915ba38d7f96e9fc85f584bacaafaaad0b7a0d02b5746d9eea57ec626ef12da  xyq-canvas-command-runtime.cjs.LEGAL.txt
+f258da52a41a6e5631c169037db8f6bfd34b06c96926e094d85cd6418e6fca31  xyq-canvas-command-runtime.cjs
+3b97217c41dfb3c298185c80b1e70c2b469f552450e53d00fc1dcf7098740ffb  xyq-canvas-command-runtime.cjs.LEGAL.txt

package/internal/adapter/adapter.go

@@ -0,0 +1,73 @@
+// Package adapter defines the CLI command and HTTP request policy interfaces.
+// Different runtimes can implement them without depending on a specific platform or command framework.
+package adapter
+
+import (
+	"context"
+	"net/http"
+)
+
+type Adapter interface {
+	CLIAdapter
+	HTTPAdapter
+}
+
+type CLIAdapter interface {
+	CLIOptions() CLIOptions
+}
+
+type HTTPAdapter interface {
+	// Called only after the common client confirms the API origin matches. The client owns the request, so its path and authentication headers may be changed.
+	PrepareAPIRequest(context.Context, *http.Request) (AuthDecision, error)
+	// Wraps the HTTP transport. A nil next uses the standard default transport.
+	// Returning nil lets http.Client use its default transport.
+	WrapTransport(next http.RoundTripper) http.RoundTripper
+	// Removes sensitive request headers used by this implementation. The common client handles Authorization removal and origin checks.
+	StripSensitiveHeaders(*http.Request)
+}
+
+type CLIOptions struct {
+	// Whether to allow top-level business commands by default. Local authentication and self-update have separate switches.
+	DefaultAllowRootCommands bool
+	// When commands are denied by default, this allowlist enables them. Nil and empty slices both mean no commands are allowed.
+	AllowedRootCommands     []string
+	LocalCredentialsEnabled bool
+	SelfUpdateEnabled       bool
+	// An empty string keeps the common help text.
+	RootHelpOverride string
+}
+
+type AuthDecision uint8
+
+const (
+	UseDefaultAuth AuthDecision = iota
+	// AuthProvided means authentication material was attached, not that the server has authenticated the request.
+	AuthProvided
+)
+
+// Default allows all commands, local authentication, and self-update. HTTP requests use the client's default authentication and transport.
+type Default struct{}
+
+var _ Adapter = Default{}
+
+func (Default) CLIOptions() CLIOptions {
+	return CLIOptions{DefaultAllowRootCommands: true, LocalCredentialsEnabled: true, SelfUpdateEnabled: true}
+}
+func (Default) PrepareAPIRequest(context.Context, *http.Request) (AuthDecision, error) {
+	return UseDefaultAuth, nil
+}
+func (Default) WrapTransport(next http.RoundTripper) http.RoundTripper { return next }
+func (Default) StripSensitiveHeaders(*http.Request)                    {}
+
+func OrDefault(value Adapter) Adapter {
+	if value == nil {
+		return Default{}
+	}
+	return value
+}
+func HTTPOrDefault(value HTTPAdapter) HTTPAdapter {
+	if value == nil {
+		return Default{}
+	}
+	return value
+}

package/internal/adapter/ppe.go

@@ -0,0 +1,36 @@
+package adapter
+
+import (
+	"context"
+	"net/http"
+)
+
+// WithPPE applies runtime routing only to requests accepted by the common
+// client's API-origin check, while preserving the supplied adapter's policies.
+func WithPPE(policy HTTPAdapter, env string) HTTPAdapter {
+	policy = HTTPOrDefault(policy)
+	if env == "" {
+		return policy
+	}
+	return ppeAdapter{HTTPAdapter: policy, env: env}
+}
+
+type ppeAdapter struct {
+	HTTPAdapter
+	env string
+}
+
+func (a ppeAdapter) PrepareAPIRequest(ctx context.Context, req *http.Request) (AuthDecision, error) {
+	decision, err := a.HTTPAdapter.PrepareAPIRequest(ctx, req)
+	if err == nil {
+		req.Header.Set("x-tt-env", a.env)
+		req.Header.Set("x-use-ppe", "1")
+	}
+	return decision, err
+}
+
+func (a ppeAdapter) StripSensitiveHeaders(req *http.Request) {
+	a.HTTPAdapter.StripSensitiveHeaders(req)
+	req.Header.Del("x-tt-env")
+	req.Header.Del("x-use-ppe")
+}

package/internal/adaptercli/commands.go

@@ -0,0 +1,27 @@
+// Package adaptercli configures Cobra command availability and help text from CLIOptions.
+package adaptercli
+
+import (
+	"slices"
+
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
+	"github.com/Pippit-dev/pippit-cli/internal/commandnames"
+	"github.com/spf13/cobra"
+)
+
+// Configure removes disallowed top-level commands and their aliases after registration.
+// It retains allowed commands and all their subcommands, then applies the configured help text.
+func Configure(root *cobra.Command, options adapter.CLIOptions) {
+	commands := append([]*cobra.Command(nil), root.Commands()...)
+	for _, child := range commands {
+		name := child.Name()
+		allowed := options.DefaultAllowRootCommands || slices.Contains(options.AllowedRootCommands, name)
+		if !allowed || (!options.LocalCredentialsEnabled && slices.Contains([]string{commandnames.Login, commandnames.Logout, commandnames.Status}, name)) ||
+			(!options.SelfUpdateEnabled && name == commandnames.Update) {
+			root.RemoveCommand(child)
+		}
+	}
+	if options.RootHelpOverride != "" {
+		root.Long = options.RootHelpOverride
+	}
+}

package/internal/adaptercli/commands_test.go

@@ -0,0 +1,41 @@
+package adaptercli
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
+	"github.com/spf13/cobra"
+)
+
+func TestConfigureDefaultAllowRootCommands(t *testing.T) {
+	for _, tc := range []struct {
+		name         string
+		defaultAllow bool
+		allowlist    []string
+		want         []string
+	}{
+		{name: "默认拒绝且 nil 白名单"},
+		{name: "默认拒绝且空白名单", allowlist: []string{}},
+		{name: "默认拒绝且有白名单", allowlist: []string{"canvas"}, want: []string{"canvas"}},
+		{name: "默认放行且 nil 白名单", defaultAllow: true, want: []string{"canvas", "future-command"}},
+		{name: "默认放行且空白名单", defaultAllow: true, allowlist: []string{}, want: []string{"canvas", "future-command"}},
+		{name: "默认放行且有白名单", defaultAllow: true, allowlist: []string{"canvas"}, want: []string{"canvas", "future-command"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			root := &cobra.Command{Use: "tool"}
+			for _, name := range []string{"canvas", "future-command", "login", "logout", "status", "update"} {
+				root.AddCommand(&cobra.Command{Use: name})
+			}
+			Configure(root, adapter.CLIOptions{DefaultAllowRootCommands: tc.defaultAllow, AllowedRootCommands: tc.allowlist})
+			var got []string
+			for _, child := range root.Commands() {
+				got = append(got, child.Name())
+			}
+			slices.Sort(got)
+			if !slices.Equal(got, tc.want) {
+				t.Fatalf("命令范围异常: got=%v want=%v", got, tc.want)
+			}
+		})
+	}
+}

package/internal/auth/manager.go

@@ -11,22 +11,29 @@ import (
 	"sync"
 	"time"
 
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
 	"github.com/Pippit-dev/pippit-cli/internal/config"
 )
 
 type Manager struct {
-	cfg                   *config.Config
-	store                 CredentialStore
-	authBaseURL           *url.URL
-	random                io.Reader
-	now                   func() time.Time
-	credentialMu          sync.Mutex
-	cachedCredential      *Credential
-	credentialCacheLoaded bool
+	localCredentialsEnabled bool
+	cfg                     *config.Config
+	store                   CredentialStore
+	authBaseURL             *url.URL
+	random                  io.Reader
+	now                     func() time.Time
+	credentialMu            sync.Mutex
+	cachedCredential        *Credential
+	credentialCacheLoaded   bool
 }
 
 type ManagerOption func(*Manager)
 
+// WithCLIOptions sets whether local login is allowed at construction. Direct Login calls also check this setting.
+func WithCLIOptions(options adapter.CLIOptions) ManagerOption {
+	return func(manager *Manager) { manager.localCredentialsEnabled = options.LocalCredentialsEnabled }
+}
+
 func WithCredentialStore(store CredentialStore) ManagerOption {
 	return func(manager *Manager) {
 		if store != nil {
@@ -41,11 +48,12 @@ func NewManager(cfg *config.Config, options ...ManagerOption) *Manager {
 	serviceName := config.DefaultAuthStoreServiceName
 	authBaseURL, _ := url.Parse(config.DefaultBaseURL)
 	manager := &Manager{
-		cfg:         cfg,
-		store:       NewDefaultCredentialStore(serviceName),
-		authBaseURL: authBaseURL,
-		random:      rand.Reader,
-		now:         time.Now,
+		localCredentialsEnabled: true,
+		cfg:                     cfg,
+		store:                   NewDefaultCredentialStore(serviceName),
+		authBaseURL:             authBaseURL,
+		random:                  rand.Reader,
+		now:                     time.Now,
 	}
 	for _, option := range options {
 		if option != nil {
@@ -75,6 +83,10 @@ func (m *Manager) ResolveAccessKey(ctx context.Context) (string, error) {
 }
 
 func (m *Manager) Login(ctx context.Context, options LoginOptions) (*Credential, error) {
+	// When local credentials are disabled, reject direct calls before reading credentials or opening a browser, even if command filtering is bypassed.
+	if m != nil && !m.localCredentialsEnabled {
+		return nil, errors.New("当前 CLI 不支持本机网页登录或登录回调，请使用当前运行环境提供的认证方式")
+	}
 	if err := m.validate(); err != nil {
 		return nil, err
 	}

package/internal/canvas/apply.go

@@ -100,6 +100,9 @@ func Apply(ctx context.Context, opts ApplyOptions, runner *common.Runner) (*Appl
 	if err := validateApplyRequest(&request); err != nil {
 		return nil, err
 	}
+	if err := validateApplyMediaIdentities(ctx, request, runner); err != nil {
+		return nil, err
+	}
 
 	var envelope responseEnvelope
 	if err := client.SendRequest(ctx, pathWithProjectID(ApplyPath, projectID), request, &envelope); err != nil {