@pippit-dev/cli 1.0.41 → 1.0.42

package/checksums.txt

@@ -1,6 +1,6 @@
-6f7daba79b3423b148e30373bb87e7e8998df3d76be2196e39f84af209f0ea50  pippit-tool-cli-1.0.41-darwin-amd64.tar.gz
-9f03ae01c213a76f45b0dfa110272b45e5b5ecd54b188313c9d256ccbe512980  pippit-tool-cli-1.0.41-darwin-arm64.tar.gz
-ea603412d1c5b0baa42efd34bec92fcd0907333babd64a6e08514d4e2dcb86e5  pippit-tool-cli-1.0.41-linux-amd64.tar.gz
-cebd1f0f34157624c0fc8203eec306bd6c7e31a2db44089f52bca9c74c57ee03  pippit-tool-cli-1.0.41-linux-arm64.tar.gz
-729f413373d185964a42c178a7e0eeafc3fca490670fb753dc36fb38bb47aaf7  pippit-tool-cli-1.0.41-windows-amd64.zip
-b49491ae751e72f994da9388777a43f1b6b5781399dc2da15ced6d74f48dad6d  pippit-tool-cli-1.0.41-windows-arm64.zip
+a27b2392e4a291329599d6ee02dd704fde6eb2bf34f3390b30a973bce0009259  pippit-tool-cli-1.0.42-darwin-amd64.tar.gz
+921fa4fff779f0c7fca7a6176d0aa47c23fe3debd78df29d3bca50ae1eff0e54  pippit-tool-cli-1.0.42-darwin-arm64.tar.gz
+f786c2954c1d537638ef248c420bbf8d9fe8040f6ee6ce7a5467c6fe73689747  pippit-tool-cli-1.0.42-linux-amd64.tar.gz
+a6adb356975c1724e553ec8fdc9aa602a259a081171f41c84680946c1459cea9  pippit-tool-cli-1.0.42-linux-arm64.tar.gz
+9d1385bec216144594b83c42c244ebd9cc6eafe7758f54a1dc636f7ee231aea7  pippit-tool-cli-1.0.42-windows-amd64.zip
+008d4f238b2fd66db3e4ede1425ec6919853889359dd60b379939b7f73452154  pippit-tool-cli-1.0.42-windows-arm64.zip

package/cmd/root.go

@@ -20,6 +20,7 @@ import (
 	"github.com/Pippit-dev/pippit-cli/internal/common"
 	"github.com/Pippit-dev/pippit-cli/internal/config"
 	"github.com/Pippit-dev/pippit-cli/internal/version"
+	"github.com/Pippit-dev/pippit-cli/internal/versioncheck"
 	"github.com/spf13/cobra"
 )
 
@@ -89,6 +90,9 @@ func newRootCommandWithAdapter(stdout, stderr io.Writer, runner *common.Runner,
 	// Only commands already exposing --source receive attribution. Explicit empty
 	// flags suppress fallback, and no source is persisted between CLI processes.
 	root.PersistentPreRunE = func(cmd *cobra.Command, _ []string) error {
+		if policy.CLIOptions().SelfUpdateEnabled && cmd.Runnable() {
+			versioncheck.Check(cmd.Context(), stderr, version.BuildVersion(), cmd.Name())
+		}
 		flag := cmd.Flags().Lookup("source")
 		if flag != nil && !flag.Changed {
 			if source := common.DetectHostSource(); source != "" {

package/cmd/root_update_check_test.go

@@ -0,0 +1,139 @@
+package cmd
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
+	"github.com/Pippit-dev/pippit-cli/internal/version"
+	"github.com/spf13/cobra"
+)
+
+type noSelfUpdateAdapter struct{ adapter.Default }
+
+func (noSelfUpdateAdapter) CLIOptions() adapter.CLIOptions {
+	options := adapter.Default{}.CLIOptions()
+	options.SelfUpdateEnabled = false
+	return options
+}
+
+func setupRootUpdateCache(t *testing.T) string {
+	t.Helper()
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
+	for _, key := range []string{"CI", "PIPPIT_CLI_DISABLE_UPDATE_CHECK", "PIPPIT_CLI_UPDATE_CHECKED"} {
+		t.Setenv(key, "")
+	}
+	previous := version.Version
+	version.Version = "1.0.41"
+	t.Cleanup(func() { version.Version = previous })
+	cacheFile := filepath.Join(home, ".pippit_tool_cli", "version-check.json")
+	if err := os.MkdirAll(filepath.Dir(cacheFile), 0700); err != nil {
+		t.Fatal(err)
+	}
+	data := fmt.Sprintf(`{"latest":"1.0.42","checkedAt":%d}`, time.Now().UnixMilli())
+	if err := os.WriteFile(cacheFile, []byte(data), 0600); err != nil {
+		t.Fatal(err)
+	}
+	return cacheFile
+}
+
+func TestNativeBusinessInvocationReportsUpdateBeforeUnchangedJSON(t *testing.T) {
+	setupRootUpdateCache(t)
+	for _, commandName := range []string{"probe", "login"} {
+		for range 2 {
+			var stdout, stderr bytes.Buffer
+			root := NewRootCommand(&stdout, &stderr)
+			probe := &cobra.Command{Use: "probe"}
+			if commandName == "login" {
+				probe, _, _ = root.Find([]string{"login"})
+			} else {
+				root.AddCommand(probe)
+			}
+			probe.RunE = func(*cobra.Command, []string) error {
+				if !strings.Contains(stderr.String(), "1.0.41 -> 1.0.42") {
+					t.Fatal("business operation started before the synchronous notice")
+				}
+				_, err := fmt.Fprintln(&stdout, `{"ok":true}`)
+				return err
+			}
+			root.SetArgs([]string{commandName})
+			if err := root.Execute(); err != nil {
+				t.Fatal(err)
+			}
+			if !json.Valid(stdout.Bytes()) || stdout.String() != "{\"ok\":true}\n" ||
+				strings.Count(stderr.String(), "New version available") != 1 {
+				t.Fatalf("stdout/stderr contract changed: %q / %q", stdout.String(), stderr.String())
+			}
+			if (commandName == "login") != strings.Contains(stderr.String(), "authorization fails") {
+				t.Fatal("login-specific notice was omitted or leaked into another command")
+			}
+		}
+	}
+}
+
+func TestNativeUpdateCheckRespectsAdapterAndInvocationBoundaries(t *testing.T) {
+	setupRootUpdateCache(t)
+	for _, scenario := range []string{"help", "version", "empty", "invalid", "invalid flag", "update", "adapter", "dev", "CI", "PIPPIT_CLI_DISABLE_UPDATE_CHECK", "PIPPIT_CLI_UPDATE_CHECKED"} {
+		t.Run(scenario, func(t *testing.T) {
+			policy := adapter.Adapter(adapter.Default{})
+			args := []string{"probe"}
+			switch scenario {
+			case "help":
+				args = []string{"probe", "--help"}
+			case "version":
+				args = []string{"--version"}
+			case "empty":
+				args = []string{}
+			case "invalid":
+				args = []string{"unknown-command"}
+			case "invalid flag":
+				args = []string{"probe", "--unknown"}
+			case "update":
+				args = []string{"update"}
+			case "adapter":
+				policy = noSelfUpdateAdapter{}
+			case "dev":
+				previous := version.Version
+				version.Version = "dev"
+				t.Cleanup(func() { version.Version = previous })
+			default:
+				t.Setenv(scenario, "1")
+			}
+			var stdout, stderr bytes.Buffer
+			root := NewRootCommandWithAdapter(&stdout, &stderr, policy)
+			root.AddCommand(&cobra.Command{Use: "probe", Run: func(*cobra.Command, []string) {}})
+			if scenario == "update" {
+				update, _, _ := root.Find([]string{"update"})
+				update.RunE = func(*cobra.Command, []string) error { return nil }
+			}
+			root.SetArgs(args)
+			err := root.Execute()
+			if (scenario == "invalid" || scenario == "invalid flag") != (err != nil) {
+				t.Fatalf("unexpected command result: %v", err)
+			}
+			if strings.Contains(stderr.String(), "New version available") {
+				t.Fatalf("skipped invocation emitted an update notice: %s", stderr.String())
+			}
+		})
+	}
+}
+
+func TestConstructingRootHasNoVersionCheckSideEffects(t *testing.T) {
+	cacheFile := setupRootUpdateCache(t)
+	if err := os.Remove(cacheFile); err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	_ = NewRootCommand(&stdout, &stderr)
+	if _, err := os.Stat(cacheFile); !os.IsNotExist(err) || stdout.Len() != 0 || stderr.Len() != 0 {
+		t.Fatal("constructing the root queried versions, wrote cache or produced output")
+	}
+}

package/dist/checksums.txt

@@ -1,6 +1,6 @@
-6f7daba79b3423b148e30373bb87e7e8998df3d76be2196e39f84af209f0ea50  pippit-tool-cli-1.0.41-darwin-amd64.tar.gz
-9f03ae01c213a76f45b0dfa110272b45e5b5ecd54b188313c9d256ccbe512980  pippit-tool-cli-1.0.41-darwin-arm64.tar.gz
-ea603412d1c5b0baa42efd34bec92fcd0907333babd64a6e08514d4e2dcb86e5  pippit-tool-cli-1.0.41-linux-amd64.tar.gz
-cebd1f0f34157624c0fc8203eec306bd6c7e31a2db44089f52bca9c74c57ee03  pippit-tool-cli-1.0.41-linux-arm64.tar.gz
-729f413373d185964a42c178a7e0eeafc3fca490670fb753dc36fb38bb47aaf7  pippit-tool-cli-1.0.41-windows-amd64.zip
-b49491ae751e72f994da9388777a43f1b6b5781399dc2da15ced6d74f48dad6d  pippit-tool-cli-1.0.41-windows-arm64.zip
+a27b2392e4a291329599d6ee02dd704fde6eb2bf34f3390b30a973bce0009259  pippit-tool-cli-1.0.42-darwin-amd64.tar.gz
+921fa4fff779f0c7fca7a6176d0aa47c23fe3debd78df29d3bca50ae1eff0e54  pippit-tool-cli-1.0.42-darwin-arm64.tar.gz
+f786c2954c1d537638ef248c420bbf8d9fe8040f6ee6ce7a5467c6fe73689747  pippit-tool-cli-1.0.42-linux-amd64.tar.gz
+a6adb356975c1724e553ec8fdc9aa602a259a081171f41c84680946c1459cea9  pippit-tool-cli-1.0.42-linux-arm64.tar.gz
+9d1385bec216144594b83c42c244ebd9cc6eafe7758f54a1dc636f7ee231aea7  pippit-tool-cli-1.0.42-windows-amd64.zip
+008d4f238b2fd66db3e4ede1425ec6919853889359dd60b379939b7f73452154  pippit-tool-cli-1.0.42-windows-arm64.zip

package/internal/auth/loopback.go

@@ -5,7 +5,6 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"io"
 	"mime"
 	"net"
@@ -14,6 +13,8 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/version"
 )
 
 const maxCallbackBodyBytes = 64 << 10
@@ -37,7 +38,6 @@ type browserFlow struct {
 	secret       string
 	state        string
 	source       string
-	origin       string
 	listener     net.Listener
 	server       *http.Server
 	payload      chan accessKeyPayload
@@ -93,6 +93,9 @@ func startBrowserFlow(authBaseURL *url.URL, randomReader io.Reader, deviceID, to
 	query.Set("callback", callback.String())
 	query.Set("random_secret_key", secret)
 	query.Set("source", loginSource)
+	query.Set("cli_version", version.BuildVersion())
+	// Protocol 1 supports callbacks from both official login origins.
+	query.Set("auth_protocol", "1")
 	query.Set("device_id", deviceID)
 	if tokenID != "" {
 		query.Set("token_id", tokenID)
@@ -111,7 +114,6 @@ func startBrowserFlow(authBaseURL *url.URL, randomReader io.Reader, deviceID, to
 		secret:      secret,
 		state:       state,
 		source:      loginSource,
-		origin:      originOf(authBaseURL),
 		listener:    listener,
 		payload:     make(chan accessKeyPayload, 1),
 		serveErr:    make(chan error, 1),
@@ -166,11 +168,12 @@ func (f *browserFlow) handleCallback(writer http.ResponseWriter, request *http.R
 		http.Error(writer, "invalid callback target", http.StatusBadRequest)
 		return
 	}
-	if !constantTimeEqual(request.Header.Get("Origin"), f.origin) {
+	origin := request.Header.Get("Origin")
+	if !isAllowedAuthOrigin(origin) {
 		http.Error(writer, "origin not allowed", http.StatusForbidden)
 		return
 	}
-	f.setCORSHeaders(writer.Header())
+	f.setCORSHeaders(writer.Header(), origin)
 
 	if request.Method == http.MethodOptions {
 		if !strings.EqualFold(strings.TrimSpace(request.Header.Get("Access-Control-Request-Method")), http.MethodPost) ||
@@ -288,8 +291,14 @@ func (f *browserFlow) callbackURLHost() string {
 	return parsed.Host
 }
 
-func (f *browserFlow) setCORSHeaders(header http.Header) {
-	header.Set("Access-Control-Allow-Origin", f.origin)
+// Authentication trusts only these official HTTPS origins, independently of
+// runtime business API configuration or browser-supplied query parameters.
+func isAllowedAuthOrigin(origin string) bool {
+	return origin == "https://xyq.jianying.com" || origin == "https://www.xiaoyunque.com"
+}
+
+func (f *browserFlow) setCORSHeaders(header http.Header, origin string) {
+	header.Set("Access-Control-Allow-Origin", origin)
 	header.Set("Access-Control-Allow-Methods", "POST")
 	header.Set("Access-Control-Allow-Headers", "Content-Type")
 	header.Set("Access-Control-Allow-Private-Network", "true")
@@ -318,7 +327,3 @@ func ensureJSONEOF(decoder *json.Decoder) error {
 	}
 	return err
 }
-
-func originOf(value *url.URL) string {
-	return fmt.Sprintf("%s://%s", strings.ToLower(value.Scheme), value.Host)
-}

package/internal/auth/loopback_origins_test.go

@@ -0,0 +1,152 @@
+package auth
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/Pippit-dev/pippit-cli/internal/version"
+)
+
+func newOriginTestFlow(t *testing.T) (*browserFlow, accessKeyPayload) {
+	t.Helper()
+	authURL, _ := url.Parse(config.DefaultBaseURL)
+	deviceID, _ := randomEncoded(bytes.NewReader(bytes.Repeat([]byte{0x21}, deviceIDBytes)), deviceIDBytes)
+	flow, err := startBrowserFlow(authURL, bytes.NewReader(bytes.Repeat([]byte{0x42}, 2*randomBindingBytes)), deviceID, "", "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(flow.close)
+	return flow, accessKeyPayload{
+		Type: "access_key", AccessKey: "local-test-ak", UID: "test-user", TokenID: "test-token",
+		ExpiredAt: time.Now().Add(time.Hour).Unix(), RandomSecretKey: flow.secret,
+		Source: loginSource, CallbackURL: flow.callbackURL,
+	}
+}
+
+func originTestRequest(t *testing.T, flow *browserFlow, method, origin string, payload accessKeyPayload, mutations ...func(*http.Request)) *httptest.ResponseRecorder {
+	t.Helper()
+	body, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(method, flow.callbackURL, bytes.NewReader(body))
+	if origin != "" {
+		request.Header.Set("Origin", origin)
+	}
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("Access-Control-Request-Method", "POST")
+	request.Header.Set("Access-Control-Request-Headers", "Content-Type")
+	for _, mutate := range mutations {
+		mutate(request)
+	}
+	response := httptest.NewRecorder()
+	flow.handleCallback(response, request)
+	return response
+}
+
+func TestBrowserCallbackAcceptsBothOfficialOriginsWithMatchingCORS(t *testing.T) {
+	for _, origin := range []string{"https://xyq.jianying.com", "https://www.xiaoyunque.com"} {
+		t.Run(origin, func(t *testing.T) {
+			flow, payload := newOriginTestFlow(t)
+			for _, method := range []string{http.MethodOptions, http.MethodPost} {
+				response := originTestRequest(t, flow, method, origin, payload)
+				wantStatus := http.StatusOK
+				if method == http.MethodOptions {
+					wantStatus = http.StatusNoContent
+				}
+				if response.Code != wantStatus || response.Header().Get("Access-Control-Allow-Origin") != origin {
+					t.Fatalf("%s status/CORS = %d/%q", method, response.Code, response.Header().Get("Access-Control-Allow-Origin"))
+				}
+				if response.Header().Get("Access-Control-Allow-Private-Network") != "true" ||
+					!strings.Contains(strings.Join(response.Header().Values("Vary"), ","), "Origin") {
+					t.Fatal("callback lost private-network or Vary headers")
+				}
+			}
+			// Switching between the two trusted sites must not reset the one-shot binding.
+			otherOrigin := "https://xyq.jianying.com"
+			if origin == otherOrigin {
+				otherOrigin = "https://www.xiaoyunque.com"
+			}
+			if response := originTestRequest(t, flow, http.MethodPost, otherOrigin, payload); response.Code != http.StatusConflict {
+				t.Fatalf("cross-origin replay status = %d", response.Code)
+			}
+		})
+	}
+}
+
+func TestBrowserCallbackRejectsUntrustedOriginsBeforeCORS(t *testing.T) {
+	for _, origin := range []string{
+		"", "null", "http://xyq.jianying.com", "http://www.xiaoyunque.com",
+		"https://www.xiaoyunque.com:443", "https://www.xiaoyunque.com/",
+		"https://www.xiaoyunque.com.evil.example", "https://evil.example",
+		"https://other.xiaoyunque.com", "https://www.xiaoyunque.com https://xyq.jianying.com",
+	} {
+		t.Run(origin, func(t *testing.T) {
+			flow, payload := newOriginTestFlow(t)
+			for _, method := range []string{http.MethodOptions, http.MethodPost} {
+				response := originTestRequest(t, flow, method, origin, payload)
+				if response.Code != http.StatusForbidden || response.Header().Get("Access-Control-Allow-Origin") != "" {
+					t.Fatalf("%s untrusted origin status/CORS = %d/%q", method, response.Code, response.Header().Get("Access-Control-Allow-Origin"))
+				}
+			}
+			if len(flow.payload) != 0 {
+				t.Fatal("untrusted origin delivered a credential")
+			}
+		})
+	}
+}
+
+func TestNewAuthOriginStillRequiresEveryCallbackBinding(t *testing.T) {
+	for _, binding := range []string{"secret", "source", "callback_url", "state", "host"} {
+		t.Run(binding, func(t *testing.T) {
+			flow, payload := newOriginTestFlow(t)
+			switch binding {
+			case "secret":
+				payload.RandomSecretKey = "wrong"
+			case "source":
+				payload.Source = "wrong"
+			case "callback_url":
+				payload.CallbackURL += "&extra=1"
+			case "state":
+				flow.state = "wrong"
+			}
+			response := originTestRequest(t, flow, http.MethodPost, "https://www.xiaoyunque.com", payload, func(request *http.Request) {
+				if binding == "host" {
+					request.Host = "evil.example"
+				}
+			})
+			if response.Code != http.StatusBadRequest || len(flow.payload) != 0 {
+				t.Fatalf("invalid %s status = %d, queued callbacks = %d", binding, response.Code, len(flow.payload))
+			}
+		})
+	}
+}
+
+func TestBrowserLoginMetadataUsesBinaryVersionAndProtocol(t *testing.T) {
+	previous := version.Version
+	t.Cleanup(func() { version.Version = previous })
+	for _, buildVersion := range []string{"1.0.42", "1.0.42-canary.1", "dev", ""} {
+		t.Run(buildVersion, func(t *testing.T) {
+			version.Version = buildVersion
+			flow, _ := newOriginTestFlow(t)
+			loginURL, err := url.Parse(flow.loginURL)
+			if err != nil {
+				t.Fatal(err)
+			}
+			wantVersion := buildVersion
+			if wantVersion == "" {
+				wantVersion = "dev"
+			}
+			if query := loginURL.Query(); query.Get("cli_version") != wantVersion || query.Get("auth_protocol") != "1" {
+				t.Fatalf("auth metadata = version %q, protocol %q", query.Get("cli_version"), query.Get("auth_protocol"))
+			}
+		})
+	}
+}

package/internal/version/version.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
+	"runtime/debug"
 	"strings"
 )
 
@@ -17,6 +18,18 @@ type packageJSON struct {
 	Version string `json:"version"`
 }
 
+// BuildVersion identifies the running binary. A local go run/build must not
+// advertise package.json's release version as a verified binary version.
+func BuildVersion() string {
+	if value := strings.TrimSpace(Version); value != "" && value != "dev" {
+		return value
+	}
+	if info, ok := debug.ReadBuildInfo(); ok && info.Main.Version != "" && info.Main.Version != "(devel)" {
+		return strings.TrimPrefix(info.Main.Version, "v")
+	}
+	return "dev"
+}
+
 func Current() string {
 	if strings.TrimSpace(Version) != "" && Version != "dev" {
 		return strings.TrimSpace(Version)

package/internal/version/version_test.go

@@ -0,0 +1,38 @@
+package version
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestBuildVersionNeverInfersAReleaseFromWorkingDirectory(t *testing.T) {
+	previous := Version
+	t.Cleanup(func() { Version = previous })
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "package.json"), []byte(`{"name":"@pippit-dev/cli","version":"99.0.0"}`), 0600); err != nil {
+		t.Fatal(err)
+	}
+	previousDir, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chdir(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := os.Chdir(previousDir); err != nil {
+			t.Error(err)
+		}
+	})
+	for _, value := range []string{"", "dev", " dev "} {
+		Version = value
+		if got := BuildVersion(); got != "dev" {
+			t.Fatalf("BuildVersion(%q) = %q", value, got)
+		}
+	}
+	Version = " 1.0.42-canary.1 "
+	if got := BuildVersion(); got != "1.0.42-canary.1" {
+		t.Fatalf("release BuildVersion = %q", got)
+	}
+}

package/internal/versioncheck/check.go

@@ -0,0 +1,147 @@
+// Package versioncheck reports available CLI updates without changing command results.
+package versioncheck
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+const (
+	latestURL        = "https://registry.npmjs.org/@pippit-dev%2Fcli/latest"
+	cacheTTL         = 24 * time.Hour
+	failureTTL       = 5 * time.Minute
+	requestTimeout   = time.Second
+	maxResponseBytes = 64 << 10
+)
+
+type cache struct {
+	Latest    string `json:"latest"`
+	CheckedAt int64  `json:"checkedAt"`
+}
+
+type options struct {
+	cacheFile string
+	now       func() time.Time
+	getenv    func(string) string
+	client    *http.Client
+}
+
+// Check writes notices only to stderr. Registry, cache and output failures never
+// affect the business command, and no background work outlives this call.
+func Check(ctx context.Context, stderr io.Writer, current, command string) {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return
+	}
+	check(ctx, stderr, current, command, options{
+		cacheFile: filepath.Join(home, ".pippit_tool_cli", "version-check.json"),
+		now:       time.Now,
+		getenv:    os.Getenv,
+		client: &http.Client{
+			Timeout: requestTimeout,
+			CheckRedirect: func(*http.Request, []*http.Request) error {
+				return http.ErrUseLastResponse
+			},
+		},
+	})
+}
+
+func check(ctx context.Context, stderr io.Writer, current, command string, opts options) {
+	if command == "" || command == "help" || command == "version" || command == "install" || command == "update" ||
+		opts.getenv("CI") != "" || opts.getenv("PIPPIT_CLI_DISABLE_UPDATE_CHECK") == "1" ||
+		opts.getenv("PIPPIT_CLI_UPDATE_CHECKED") == "1" {
+		return
+	}
+	if _, ok := parseVersion(current); !ok {
+		return
+	}
+	now := opts.now()
+	cached := readCache(opts.cacheFile)
+	ttl := cacheTTL
+	if cached.Latest == "" {
+		ttl = failureTTL
+	}
+	age := now.Sub(time.UnixMilli(cached.CheckedAt))
+	if cached.CheckedAt <= 0 || age < 0 || age >= ttl {
+		cached = cache{Latest: fetchLatest(ctx, opts.client), CheckedAt: now.UnixMilli()}
+		writeCache(opts.cacheFile, cached)
+	}
+	if !isNewer(cached.Latest, current) || stderr == nil {
+		return
+	}
+	_, _ = fmt.Fprintf(stderr, "[pippit-tool-cli] New version available: %s -> %s. Run: pippit-tool-cli update\n", current, cached.Latest)
+	if command == "login" {
+		_, _ = fmt.Fprintln(stderr, "[pippit-tool-cli] If browser authorization fails, update the CLI and run pippit-tool-cli login again.")
+	}
+}
+
+func fetchLatest(ctx context.Context, client *http.Client) string {
+	ctx, cancel := context.WithTimeout(ctx, requestTimeout)
+	defer cancel()
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, latestURL, nil)
+	if err != nil {
+		return ""
+	}
+	response, err := client.Do(request)
+	if err != nil {
+		return ""
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return ""
+	}
+	data, err := io.ReadAll(io.LimitReader(response.Body, maxResponseBytes+1))
+	if err != nil || len(data) > maxResponseBytes {
+		return ""
+	}
+	var pkg struct {
+		Version string `json:"version"`
+	}
+	if json.Unmarshal(data, &pkg) != nil {
+		return ""
+	}
+	if _, ok := parseVersion(pkg.Version); !ok {
+		return ""
+	}
+	return pkg.Version
+}
+
+func readCache(path string) cache {
+	file, err := os.Open(path)
+	if err != nil {
+		return cache{}
+	}
+	defer file.Close()
+	var value cache
+	if json.NewDecoder(io.LimitReader(file, maxResponseBytes)).Decode(&value) != nil {
+		return cache{}
+	}
+	if value.Latest != "" {
+		if _, ok := parseVersion(value.Latest); !ok {
+			return cache{}
+		}
+	}
+	return value
+}
+
+func writeCache(path string, value cache) {
+	if os.MkdirAll(filepath.Dir(path), 0700) != nil {
+		return
+	}
+	file, err := os.CreateTemp(filepath.Dir(path), ".version-check-*")
+	if err != nil {
+		return
+	}
+	defer os.Remove(file.Name())
+	err = json.NewEncoder(file).Encode(value)
+	closeErr := file.Close()
+	if err == nil && closeErr == nil {
+		_ = os.Rename(file.Name(), path)
+	}
+}

package/internal/versioncheck/check_test.go

@@ -0,0 +1,204 @@
+package versioncheck
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) { return f(request) }
+
+func testOptions(t *testing.T, transport roundTripFunc) options {
+	t.Helper()
+	return options{
+		cacheFile: filepath.Join(t.TempDir(), "version-check.json"),
+		now:       func() time.Time { return time.UnixMilli(1_800_000_000_000) },
+		getenv:    func(string) string { return "" },
+		client:    &http.Client{Timeout: requestTimeout, Transport: transport},
+	}
+}
+
+func response(body string) *http.Response {
+	return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(body))}
+}
+
+func TestCheckUsesSharedCacheAndWarnsForEveryInvocation(t *testing.T) {
+	fetches := 0
+	opts := testOptions(t, func(request *http.Request) (*http.Response, error) {
+		fetches++
+		if request.Method != "GET" || request.URL.String() != latestURL || request.Header.Get("Authorization") != "" {
+			t.Fatalf("unexpected registry request: %s %s", request.Method, request.URL)
+		}
+		if deadline, ok := request.Context().Deadline(); !ok || time.Until(deadline) > requestTimeout {
+			t.Fatal("registry request has no bounded context deadline")
+		}
+		return response(`{"version":"1.0.42","unrelated_metadata":true}`), nil
+	})
+	for index := range 2 {
+		var stderr bytes.Buffer
+		check(context.Background(), &stderr, "1.0.41", "login", opts)
+		if strings.Count(stderr.String(), "New version available: 1.0.41 -> 1.0.42") != 1 ||
+			!strings.Contains(stderr.String(), "pippit-tool-cli update") || !strings.Contains(stderr.String(), "authorization fails") {
+			t.Fatalf("invocation %d notice = %q", index, stderr.String())
+		}
+	}
+	if fetches != 1 {
+		t.Fatalf("fetches = %d, want one daily lookup", fetches)
+	}
+	data, err := os.ReadFile(opts.cacheFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var shared map[string]any
+	if json.Unmarshal(data, &shared) != nil || shared["latest"] != "1.0.42" || shared["checkedAt"] != float64(opts.now().UnixMilli()) {
+		t.Fatalf("cache does not match the npm wrapper contract: %s", data)
+	}
+	if info, err := os.Stat(opts.cacheFile); err != nil || info.Mode().Perm() != 0600 {
+		t.Fatalf("cache permissions are not 0600: %v", err)
+	}
+	for _, current := range []string{"1.0.42", "1.0.43"} {
+		var stderr bytes.Buffer
+		check(context.Background(), &stderr, current, "status", opts)
+		if stderr.Len() != 0 {
+			t.Fatalf("up-to-date binary received a notice: %q", stderr.String())
+		}
+	}
+	oldNow := opts.now()
+	opts.now = func() time.Time { return oldNow.Add(cacheTTL) }
+	check(context.Background(), io.Discard, "1.0.41", "status", opts)
+	if fetches != 2 {
+		t.Fatalf("expired daily cache fetches = %d", fetches)
+	}
+}
+
+func TestCheckSkipsDisabledAndNonBusinessInvocations(t *testing.T) {
+	for _, tc := range []struct {
+		name, current, command, env string
+	}{
+		{"dev", "dev", "status", ""}, {"invalid", "1.0", "status", ""},
+		{"empty command", "1.0.41", "", ""}, {"help", "1.0.41", "help", ""},
+		{"version", "1.0.41", "version", ""}, {"install", "1.0.41", "install", ""},
+		{"update", "1.0.41", "update", ""}, {"CI", "1.0.41", "status", "CI"},
+		{"disabled", "1.0.41", "status", "PIPPIT_CLI_DISABLE_UPDATE_CHECK"},
+		{"wrapper checked", "1.0.41", "status", "PIPPIT_CLI_UPDATE_CHECKED"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			opts := testOptions(t, func(*http.Request) (*http.Response, error) {
+				t.Fatal("skipped invocation queried registry")
+				return nil, errors.New("unexpected network")
+			})
+			opts.getenv = func(key string) string {
+				if key == tc.env {
+					return "1"
+				}
+				return ""
+			}
+			var stderr bytes.Buffer
+			check(context.Background(), &stderr, tc.current, tc.command, opts)
+			if _, err := os.Stat(opts.cacheFile); !os.IsNotExist(err) || stderr.Len() != 0 {
+				t.Fatal("skipped invocation wrote cache or output")
+			}
+		})
+	}
+}
+
+func TestFailedChecksStaySilentAndShareFiveMinuteCooldown(t *testing.T) {
+	for _, failure := range []string{"network", "http", "json", "version", "oversize"} {
+		t.Run(failure, func(t *testing.T) {
+			fetches := 0
+			opts := testOptions(t, func(*http.Request) (*http.Response, error) {
+				fetches++
+				switch failure {
+				case "network":
+					return nil, errors.New("offline")
+				case "http":
+					result := response(`{}`)
+					result.StatusCode = http.StatusServiceUnavailable
+					return result, nil
+				case "json":
+					return response(`not json`), nil
+				case "version":
+					return response(`{"version":"dev"}`), nil
+				default:
+					return response(strings.Repeat(" ", maxResponseBytes+1)), nil
+				}
+			})
+			var stderr bytes.Buffer
+			check(context.Background(), &stderr, "1.0.41", "status", opts)
+			cached := readCache(opts.cacheFile)
+			if cached.Latest != "" || cached.CheckedAt != opts.now().UnixMilli() {
+				t.Fatal("failed lookup did not write the shared failure cooldown")
+			}
+			initial := opts.now()
+			opts.now = func() time.Time { return initial.Add(failureTTL - time.Millisecond) }
+			check(context.Background(), &stderr, "1.0.41", "status", opts)
+			if fetches != 1 || stderr.Len() != 0 {
+				t.Fatal("failed lookup retried during cooldown or emitted output")
+			}
+			opts.now = func() time.Time { return initial.Add(failureTTL) }
+			check(context.Background(), &stderr, "1.0.41", "status", opts)
+			if fetches != 2 || stderr.Len() != 0 {
+				t.Fatal("expired failure cooldown did not retry silently")
+			}
+		})
+	}
+}
+
+func TestRegistryLookupHasOneSecondTotalDeadline(t *testing.T) {
+	opts := testOptions(t, func(request *http.Request) (*http.Response, error) {
+		<-request.Context().Done()
+		return nil, request.Context().Err()
+	})
+	start := time.Now()
+	var stderr bytes.Buffer
+	check(context.Background(), &stderr, "1.0.41", "status", opts)
+	if elapsed := time.Since(start); elapsed > 2*time.Second || stderr.Len() != 0 {
+		t.Fatalf("deadline exceeded budget or emitted output: %v / %q", elapsed, stderr.String())
+	}
+}
+
+func TestRegistryOrCacheFailureCannotSuppressKnownNotice(t *testing.T) {
+	opts := testOptions(t, func(*http.Request) (*http.Response, error) {
+		return response(`{"version":"1.0.42"}`), nil
+	})
+	// A regular file in place of the cache directory makes cache persistence fail.
+	blocker := filepath.Join(t.TempDir(), "file")
+	if err := os.WriteFile(blocker, nil, 0600); err != nil {
+		t.Fatal(err)
+	}
+	opts.cacheFile = filepath.Join(blocker, "version-check.json")
+	var stderr bytes.Buffer
+	check(context.Background(), &stderr, "1.0.41", "status", opts)
+	if !strings.Contains(stderr.String(), "New version available") {
+		t.Fatal("cache write failure suppressed a valid update notice")
+	}
+}
+
+func TestSemanticVersionOrderingRejectsInvalidAndDevelopmentVersions(t *testing.T) {
+	for _, tc := range []struct {
+		latest, current string
+		newer           bool
+	}{
+		{"1.0.42", "1.0.41", true}, {"1.1.0", "1.0.99", true}, {"2.0.0", "1.99.99", true},
+		{"1.0.41", "1.0.42", false}, {"1.0.42", "1.0.42+build.1", false},
+		{"1.0.42", "1.0.42-canary.1", true}, {"1.0.42-canary.2", "1.0.42-canary.1", true},
+		{"1.0.42-canary.10", "1.0.42-canary.2", true}, {"1.0.42-beta", "1.0.42-alpha.1", true},
+		{"1.0.42-alpha.1", "1.0.42-alpha", true}, {"v1.0.42", "v1.0.41", true},
+		{"1.0.42", "dev", false}, {"bad", "1.0.41", false}, {"1.0.42", "1.0", false},
+		{"1.0.42", "1.00.41", false}, {"1.0.42", "1.0.41-01", false}, {"1.0.42", "1.0.41 junk", false},
+	} {
+		if got := isNewer(tc.latest, tc.current); got != tc.newer {
+			t.Errorf("isNewer(%q, %q) = %v, want %v", tc.latest, tc.current, got, tc.newer)
+		}
+	}
+}

package/internal/versioncheck/semver.go

@@ -0,0 +1,84 @@
+package versioncheck
+
+import (
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+var semverPattern = regexp.MustCompile(`^v?(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$`)
+
+type semver struct {
+	core [3]uint64
+	pre  []string
+}
+
+func parseVersion(value string) (semver, bool) {
+	var parsed semver
+	if len(value) > 256 {
+		return parsed, false
+	}
+	parts := semverPattern.FindStringSubmatch(value)
+	if parts == nil {
+		return parsed, false
+	}
+	for index := range parsed.core {
+		part, err := strconv.ParseUint(parts[index+1], 10, 64)
+		if err != nil {
+			return parsed, false
+		}
+		parsed.core[index] = part
+	}
+	if parts[4] != "" {
+		parsed.pre = strings.Split(parts[4], ".")
+		for _, identifier := range parsed.pre {
+			if numeric(identifier) && len(identifier) > 1 && identifier[0] == '0' {
+				return parsed, false
+			}
+		}
+	}
+	return parsed, true
+}
+
+func isNewer(latest, current string) bool {
+	a, validA := parseVersion(latest)
+	b, validB := parseVersion(current)
+	if !validA || !validB {
+		return false
+	}
+	for index, part := range a.core {
+		if part != b.core[index] {
+			return part > b.core[index]
+		}
+	}
+	if len(a.pre) == 0 || len(b.pre) == 0 {
+		return len(a.pre) == 0 && len(b.pre) != 0
+	}
+	for index, part := range a.pre {
+		if index >= len(b.pre) {
+			return true
+		}
+		other := b.pre[index]
+		if part == other {
+			continue
+		}
+		numericA, numericB := numeric(part), numeric(other)
+		if numericA != numericB {
+			return !numericA
+		}
+		if numericA && len(part) != len(other) {
+			return len(part) > len(other)
+		}
+		return part > other
+	}
+	return false
+}
+
+func numeric(value string) bool {
+	for _, character := range value {
+		if character < '0' || character > '9' {
+			return false
+		}
+	}
+	return value != ""
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pippit-dev/cli",
-  "version": "1.0.41",
+  "version": "1.0.42",
   "description": "Pippit CLI",
   "bin": {
     "pippit-tool-cli": "scripts/run.js"

package/scripts/canvas-command.js

@@ -17,6 +17,8 @@ const DEFAULT_SDK_MODULE = path.join(
   "xyq-canvas-command-runtime.cjs"
 );
 const MAX_INPUT_BYTES = 64 * 1024 * 1024;
+const UPGRADE_NOTICE_PREFIX = "[pippit-tool-cli] New version available:";
+const LOGIN_UPGRADE_NOTICE = "[pippit-tool-cli] If browser authorization fails, update the CLI and run pippit-tool-cli login again.";
 const PERSISTENCE_VERSION = 1;
 const OPTIONAL_SCHEMA = Symbol("optional canvas command schema");
 const CHECKPOINT_COMMANDS = new Set([
@@ -144,6 +146,7 @@ function spawnProcess(invocation, args, options = {}) {
     }
     const child = spawn(invocation.command, [...(invocation.prefixArgs || []), ...args], {
       cwd: options.cwd,
+      env: invocation.env || process.env,
       shell: false,
       stdio: options.interactive ? "inherit" : ["pipe", "pipe", "pipe"],
       windowsHide: true,
@@ -201,11 +204,17 @@ class NativeCanvasClient {
       input: input === undefined ? undefined : JSON.stringify(input),
     });
     if (result.exitCode !== 0) throw new NativeCommandError(args, result);
+    let output;
     try {
-      return JSON.parse(result.stdout);
+      output = JSON.parse(result.stdout);
     } catch (error) {
       throw new Error(`原生 CLI 未返回有效 JSON（${args.join(" ")}）：${error.message}`);
     }
+    const notices = result.stderr.split(/\r?\n/).filter((line) =>
+      line.startsWith(UPGRADE_NOTICE_PREFIX) || line === LOGIN_UPGRADE_NOTICE
+    );
+    if (notices.length) this.stderr.write(`${notices.join("\n")}\n`);
+    return output;
   }
 
   async ensureAuthenticated() {

package/scripts/run.js

@@ -3,12 +3,14 @@
 const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
-const { isCanvasCommand, runCanvasCommand } = require('./canvas-command');
+const { isCanvasCommand, parseCanvasCommandArgs, runCanvasCommand } = require('./canvas-command');
 const { maybeWarnNewVersion } = require('./version-check');
 
 const ext = process.platform === 'win32' ? '.exe' : '';
 const bin = path.join(__dirname, '..', 'bin', 'pippit-tool-cli' + ext);
 const args = process.argv.slice(2);
+// The launcher owns the notice for this invocation, including native children.
+const nativeEnv = { ...process.env, PIPPIT_CLI_UPDATE_CHECKED: '1' };
 
 const oldBin = bin + '.old';
 function restoreOldBinary() {
@@ -25,7 +27,7 @@ function restoreOldBinary() {
 
 function runCanvas() {
   runCanvasCommand(args, {
-    nativeInvocation: { command: bin },
+    nativeInvocation: { command: bin, env: nativeEnv },
   })
     .then((exitCode) => {
       if (exitCode) process.exitCode = exitCode;
@@ -44,6 +46,15 @@ function main() {
 
   const helpRequested = args.includes('--help') || args.includes('-h') || args[0] === 'help';
   if (isCanvasCommand(args) && (args[2] !== 'run' || helpRequested)) {
+    // Discovery commands also need update notices. Keep help and invalid
+    // commands free of network checks and cache writes.
+    if (!helpRequested) {
+      try {
+        if (parseCanvasCommandArgs(args).action !== 'help') maybeWarnNewVersion(args);
+      } catch (_) {
+        // runCanvas reports argument errors through the existing path.
+      }
+    }
     return runCanvas();
   }
 
@@ -88,7 +99,7 @@ function main() {
     runCanvas();
   } else {
     try {
-      execFileSync(bin, args, { stdio: 'inherit' });
+      execFileSync(bin, args, { stdio: 'inherit', env: nativeEnv });
     } catch (e) {
       process.exit(e.status || 1);
     }

package/scripts/version-check.js

@@ -5,6 +5,7 @@ const { runSilent } = require("./platform");
 const { DEFAULT_PKG } = require("./skills");
 
 const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const RETRY_INTERVAL_MS = 5 * 60 * 1000;
 
 function defaultCacheFile() {
   return path.join(os.homedir(), ".pippit_tool_cli", "version-check.json");
@@ -49,7 +50,7 @@ function writeCache(cacheFile, data) {
 }
 
 function fetchLatestVersion(pkg = DEFAULT_PKG) {
-  return runSilent("npm", ["view", pkg, "version"], { timeout: 3000 }).toString().trim();
+  return runSilent("npm", ["view", pkg, "version"], { timeout: 1000 }).toString().trim();
 }
 
 function shouldSkip(args, env) {
@@ -70,6 +71,7 @@ function maybeWarnNewVersion(args = [], opts = {}) {
   const cacheFile = opts.cacheFile || defaultCacheFile();
   const cache = readCache(cacheFile);
   const cacheFresh = cache && now - cache.checkedAt < CHECK_INTERVAL_MS;
+  if (cacheFresh && !cache.latest && now - cache.checkedAt < RETRY_INTERVAL_MS) return;
 
   let latest = cacheFresh ? cache.latest : "";
   if (!latest) {
@@ -77,6 +79,7 @@ function maybeWarnNewVersion(args = [], opts = {}) {
       latest = (opts.fetchLatestVersion || fetchLatestVersion)(opts.pkg || DEFAULT_PKG);
       writeCache(cacheFile, { latest, checkedAt: now });
     } catch (_) {
+      writeCache(cacheFile, { latest: "", checkedAt: now });
       return;
     }
   }
@@ -86,10 +89,14 @@ function maybeWarnNewVersion(args = [], opts = {}) {
 
   const warn = opts.warn || console.error;
   warn(`[pippit-tool-cli] New version available: ${current} -> ${latest}. Run: pippit-tool-cli update`);
+  if (args[0] === "login") {
+    warn("[pippit-tool-cli] If browser authorization fails, update the CLI and run pippit-tool-cli login again.");
+  }
 }
 
 module.exports = {
   CHECK_INTERVAL_MS,
+  RETRY_INTERVAL_MS,
   compareSemver,
   defaultCacheFile,
   maybeWarnNewVersion,

package/skills/xyq-marketing-skill/scripts/marketing.js

@@ -113,9 +113,17 @@ function invokeCLI(args, input, timeout, invocation = resolveCLI()) {
       clearTimeout(timer);
       if (failure) return reject(failure);
       if (code !== 0) return reject(new Error(`CLI 调用失败：${stderr.trim() || `退出码 ${code}`}；请求未重试。若不支持 marketing 命令，请更新 CLI。`));
-      if (args.includes('--help')) return resolve(stdout);
-      try { resolve(JSON.parse(stdout)); }
-      catch (_) { reject(new Error('CLI 未返回有效 JSON；提交结果可能不明确，请勿自动重提')); }
+      let result;
+      try { result = args.includes('--help') ? stdout : JSON.parse(stdout); }
+      catch (_) { return reject(new Error('CLI 未返回有效 JSON；提交结果可能不明确，请勿自动重提')); }
+      // Only successful CLI notices are safe to relay; backend logs stay buffered.
+      for (const notice of stderr.split(/\r?\n/)) {
+        if (notice.startsWith('[pippit-tool-cli] New version available:') ||
+            notice === '[pippit-tool-cli] If browser authorization fails, update the CLI and run pippit-tool-cli login again.') {
+          process.stderr.write(`${notice}\n`);
+        }
+      }
+      resolve(result);
     });
     child.stdin.end(input);
   });