@pippit-dev/cli 1.0.41 → 1.0.43

package/cmd/space_test.go

@@ -0,0 +1,469 @@
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
+	"github.com/Pippit-dev/pippit-cli/internal/auth"
+	canvascore "github.com/Pippit-dev/pippit-cli/internal/canvas"
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/Pippit-dev/pippit-cli/internal/space"
+)
+
+func TestSpaceCommandsAndBusinessTaskScope(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("XDG_CACHE_HOME", t.TempDir())
+	t.Setenv("LocalAppData", t.TempDir())
+	var requests []string
+	var requestRef space.References
+	listFailure := false
+	listTeamID := ""
+	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests = append(requests, r.URL.Path+":"+r.Header.Get("X-Team-Id"))
+		w.Header().Set("Content-Type", "application/json")
+		if r.URL.Path == config.GetLiteTeamListPath {
+			if r.Header.Get("X-Team-Id") != listTeamID {
+				t.Errorf("team list header = %q, want %q", r.Header.Get("X-Team-Id"), listTeamID)
+			}
+			var body struct {
+				Cursor string `json:"cursor"`
+				Count  int    `json:"count"`
+			}
+			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+				t.Error(err)
+			}
+			if body.Count != 100 {
+				t.Error("unexpected page size")
+			}
+			if listFailure {
+				_, _ = w.Write([]byte(`{"ret":"101","errmsg":"denied"}`))
+				return
+			}
+			if body.Cursor == "0" {
+				_, _ = w.Write([]byte(`{"ret":"0","data":{"team_info_list":[{"team_id":"12","team_name":"A","current_role":1}],"has_more":true,"next_cursor":"next"}}`))
+			} else {
+				_, _ = w.Write([]byte(`{"ret":"0","data":{"team_info_list":[{"team_id":"34","team_name":"B"}],"has_more":false}}`))
+			}
+			return
+		}
+		if r.URL.Path == config.UploadFilePath {
+			_, _ = io.Copy(io.Discard, r.Body)
+		} else {
+			requestRef = space.References{}
+			if err := json.NewDecoder(r.Body).Decode(&requestRef); err != nil {
+				t.Error(err)
+			}
+		}
+		switch r.URL.Path {
+		case canvascore.QueryPath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"Assets":[{"PippitAssetID":"canvas"}]}}`))
+		case config.SubmitRunPath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"run":{"thread_id":"thread-a","run_id":"run-a"}}}`))
+		case config.GetThreadPath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"readable_text":"task result"}}`))
+		case config.ListThreadFilePath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"files":[],"total":0}}`))
+		case config.UploadFilePath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"pippit_asset_id":"asset-a"}}`))
+		case marketingPaths["generate"]:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"run":{"thread_id":"marketing-thread","run_id":"marketing-run"}}}`))
+		case marketingPaths["query"]:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"thread_id":"marketing-thread","run_id":"marketing-run","run_state":2}}`))
+		case config.GetCreditBalancePath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"total_remain_amount":"100"}}`))
+		case config.GetAvailableModelListPath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"scene":"web_turbo_video_generator","config_key":"key","config":{"models":[{"key":"MiniMax-H3","name":"MiniMax","kind":"video","supported_ratio_list":[0,2,3],"default_ratio":3,"audio_total_limit":0}]}}}`))
+		default:
+			t.Errorf("unexpected request %s", r.URL.Path)
+		}
+	}))
+	defer api.Close()
+	cfg := config.Load()
+	cfg.BaseURL, cfg.AccessKey = api.URL, ""
+	runner := newRootRunner(cfg)
+	credentials := &marketingCredentialStore{credential: &auth.Credential{UID: "space-user", AccessKey: "space-test-key", ExpiredAt: time.Now().Add(time.Hour).Unix()}}
+	runner.Auth = auth.NewManager(cfg, auth.WithCredentialStore(credentials))
+	runner.SpaceStore = &space.Store{Dir: t.TempDir()}
+	store, err := common.SpaceStoreForRunner(context.Background(), runner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	execute := func(args ...string) (string, error) {
+		var out, warnings bytes.Buffer
+		root := newRootCommand(&out, &warnings, runner)
+		root.SetIn(strings.NewReader(""))
+		root.SetArgs(args)
+		err := root.Execute()
+		return out.String(), err
+	}
+	must := func(args ...string) string {
+		t.Helper()
+		out, err := execute(args...)
+		if err != nil {
+			t.Fatalf("%v: %v", args, err)
+		}
+		return out
+	}
+	checkList := func(teamID string) {
+		t.Helper()
+		var result struct {
+			Spaces  []listedSpace    `json:"spaces"`
+			Current *space.Selection `json:"current"`
+		}
+		out := must("space", "list")
+		if err := json.Unmarshal([]byte(out), &result); err != nil {
+			t.Fatal(err)
+		}
+		if result.Current == nil || result.Current.TeamID != teamID || len(result.Spaces) != 3 {
+			t.Fatalf("unexpected space list: %s", out)
+		}
+		for _, item := range result.Spaces {
+			if item.Current != (item.TeamID == teamID) {
+				t.Fatalf("wrong current marker: %+v", item)
+			}
+		}
+	}
+	checkList("0")
+	must("space", "use", "12")
+	listTeamID = "12"
+	checkList("12")
+	file := filepath.Join(t.TempDir(), "image.png")
+	if err := os.WriteFile(file, []byte("media"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if out := must("upload-file", "--path", file); !strings.Contains(out, `"team_id":"12"`) {
+		t.Fatal(out)
+	}
+	if out := must("short-drama", "+submit-run", "--message", "create", "--asset-ids", "asset-a"); !strings.Contains(out, `"team_id":"12"`) {
+		t.Fatal(out)
+	}
+	must("space", "use", "34")
+	listTeamID = "34"
+	checkList("34")
+	must("model", "list", "--refresh")
+	if requests[len(requests)-1] != config.GetAvailableModelListPath+":34" {
+		t.Fatal("model query did not forward the selected team", requests)
+	}
+	must("model", "list", "--refresh", "--team-id", "0")
+	if requests[len(requests)-1] != config.GetAvailableModelListPath+":" {
+		t.Fatal("personal model query carried a team header", requests)
+	}
+	must("get-thread", "--thread-id", "thread-a", "--run-id", "run-a")
+	if requests[len(requests)-1] != config.GetThreadPath+":12" {
+		t.Fatal("old task used new default", requests)
+	}
+	for _, tc := range []struct {
+		args []string
+		path string
+	}{
+		{[]string{"get-thread", "--thread-id", " thread-a ", "--run-id", " run-a "}, config.GetThreadPath},
+		{[]string{"list-thread-file", "--thread-id", " thread-a "}, config.ListThreadFilePath},
+		{[]string{"short-drama", "+submit-run", "--thread-id", " thread-a ", "--message", "continue"}, config.SubmitRunPath},
+	} {
+		must(tc.args...)
+		if requests[len(requests)-1] != tc.path+":12" || requestRef.ThreadID != "thread-a" {
+			t.Fatalf("normalized task used wrong space: %v, %+v", requests, requestRef)
+		}
+		if tc.path == config.GetThreadPath && requestRef.RunID != "run-a" {
+			t.Fatalf("run ID was not normalized: %+v", requestRef)
+		}
+	}
+	must("get-credit-balance")
+	if requests[len(requests)-1] != config.GetCreditBalancePath+":34" {
+		t.Fatal(requests)
+	}
+	must("get-credit-balance", "--team-id", "0")
+	if requests[len(requests)-1] != config.GetCreditBalancePath+":" {
+		t.Fatal(requests)
+	}
+	// Canvas uses the same default, override and cross-process binding as other commands.
+	for _, tc := range []struct {
+		flags  []string
+		teamID string
+	}{
+		{nil, "34"},
+		{[]string{"--team-id", "12"}, "12"},
+		{[]string{"--team-id", "0"}, "0"},
+	} {
+		var result canvascore.GetResult
+		out := must(append([]string{"canvas", "get", "--asset-id", "canvas"}, tc.flags...)...)
+		if err := json.Unmarshal([]byte(out), &result); err != nil {
+			t.Fatal(err)
+		}
+		header := tc.teamID
+		if header == "0" {
+			header = ""
+		}
+		if result.TeamID != tc.teamID || requests[len(requests)-1] != canvascore.QueryPath+":"+header {
+			t.Fatalf("canvas space = %s, requests = %v", out, requests)
+		}
+		binding, err := space.DecodeBinding(result.SpaceContext)
+		if err != nil || binding.TeamID != tc.teamID || binding.Account != store.Account || binding.Origin != store.Origin {
+			t.Fatalf("canvas binding = %+v, %v", binding, err)
+		}
+		must("canvas", "get", "--asset-id", "canvas", "--space-context", result.SpaceContext)
+		if requests[len(requests)-1] != canvascore.QueryPath+":"+header {
+			t.Fatal("canvas binding did not preserve the original space", requests)
+		}
+	}
+	before := len(requests)
+	for _, args := range [][]string{
+		{"get-thread", "--thread-id", "thread-a", "--team-id", "34"},
+		{"short-drama", "+submit-run", "--message", "wrong asset", "--asset-ids", "asset-a"},
+		{"get-credit-balance", "--team-id", "-1"},
+		{"space", "use"},
+		{"space", "use", "12", "34"},
+		{"space", "current"},
+	} {
+		if _, err := execute(args...); err == nil {
+			t.Errorf("accepted %v", args)
+		}
+	}
+	if len(requests) != before {
+		t.Fatal("invalid operations reached API")
+	}
+	if _, err := execute("space", "use", "99"); err == nil {
+		t.Fatal("nonmember selection saved")
+	}
+	listFailure = true
+	if _, err := execute("space", "use", "12"); err == nil {
+		t.Fatal("list failure ignored")
+	}
+	if selected, err := store.Current(); err != nil || selected.TeamID != "34" {
+		t.Fatalf("failed selection changed default: %+v, %v", selected, err)
+	}
+	before = len(requests)
+	must("space", "use", "0")
+	listTeamID = ""
+	if len(requests) != before {
+		t.Fatal("personal switch depends on team list")
+	}
+	if selected, err := store.Current(); err != nil || selected.TeamID != "0" {
+		t.Fatalf("personal selection not saved: %+v, %v", selected, err)
+	}
+	listFailure = false
+	checkList("0")
+	before = len(requests)
+	// Marketing preview resolves an existing thread before reading the new default.
+	if err := store.SaveDefault(space.Selection{TeamID: "34", Name: "B"}); err != nil {
+		t.Fatal(err)
+	}
+	requestFile := filepath.Join(t.TempDir(), "request.json")
+	if err := os.WriteFile(requestFile, []byte(`{"thread_id":"thread-a","message":"continue","general_agent_settings":{"video_model":"model"}}`), 0600); err != nil {
+		t.Fatal(err)
+	}
+	loadsBefore := credentials.loads
+	if out := must("marketing", "generate", "--request", requestFile); !strings.Contains(out, `"team_id":"12"`) {
+		t.Fatal(out)
+	}
+	if credentials.loads-loadsBefore != 2 {
+		t.Fatal("preview must read identity at initialization and check it once")
+	}
+	if len(requests) != before {
+		t.Fatal("preview contacted API")
+	}
+	if err := os.WriteFile(requestFile, []byte(`{"message":"new marketing task","general_agent_settings":{"video_model":"model"}}`), 0600); err != nil {
+		t.Fatal(err)
+	}
+	loadsBefore = credentials.loads
+	if out := must("marketing", "generate", "--request", requestFile, "--execute"); !strings.Contains(out, `"team_id":"34"`) || !strings.Contains(out, `"space_context"`) {
+		t.Fatal(out)
+	}
+	if credentials.loads-loadsBefore != 2 {
+		t.Fatal("submission must read identity at initialization and check it only at the HTTP boundary")
+	}
+	if requests[len(requests)-1] != marketingPaths["generate"]+":34" {
+		t.Fatal("independent marketing client lost scope", requests)
+	}
+	if err := store.SaveDefault(space.Selection{TeamID: "12", Name: "A"}); err != nil {
+		t.Fatal(err)
+	}
+	must("marketing", "query", "--thread-id", "marketing-thread", "--run-id", "marketing-run")
+	if requests[len(requests)-1] != marketingPaths["query"]+":34" {
+		t.Fatal("marketing task lost scope", requests)
+	}
+}
+
+type spaceExternalAuthAdapter struct{ adapter.Default }
+
+func (spaceExternalAuthAdapter) CLIOptions() adapter.CLIOptions {
+	options := adapter.Default{}.CLIOptions()
+	options.LocalCredentialsEnabled = false
+	return options
+}
+
+func (spaceExternalAuthAdapter) PrepareAPIRequest(_ context.Context, req *http.Request) (adapter.AuthDecision, error) {
+	req.Header.Set("Authorization", "Bearer adapter-key")
+	return adapter.AuthProvided, nil
+}
+
+type spaceUnavailableAccount struct{ common.AuthManager }
+
+func (spaceUnavailableAccount) SpaceAccount(context.Context) (string, error) {
+	return "", errors.New("credential metadata unavailable")
+}
+
+func TestSpaceUsesAvailableIdentityInsteadOfLocalLoginSwitch(t *testing.T) {
+	var requests []string
+	denied := false
+	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "Bearer adapter-key" {
+			t.Error("adapter authentication was not used")
+		}
+		requests = append(requests, r.URL.Path+":"+r.Header.Get("X-Team-Id"))
+		switch r.URL.Path {
+		case config.GetLiteTeamListPath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"team_info_list":[{"team_id":"12","team_name":"A"}],"has_more":false}}`))
+		case config.GetCreditBalancePath:
+			if denied {
+				_, _ = w.Write([]byte(`{"ret":"101","errmsg":"denied"}`))
+				return
+			}
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"total_remain_amount":"100"}}`))
+		case config.UploadFilePath:
+			_, _ = io.Copy(io.Discard, r.Body)
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"pippit_asset_id":"asset-a"}}`))
+		case config.SubmitRunPath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"run":{"thread_id":"thread-a","run_id":"run-a"}}}`))
+		case config.GetThreadPath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"readable_text":"task result"}}`))
+		case config.QueryGenerateVideoResultPath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"thread_id":"thread-a","run_id":"run-a","run_state":2}}`))
+		default:
+			t.Errorf("unexpected request: %s", r.URL.Path)
+		}
+	}))
+	defer api.Close()
+	cfg := config.Load()
+	// This AK is not used by the adapter and must not supply a false identity.
+	cfg.BaseURL, cfg.AccessKey = api.URL, "unrelated-environment-key"
+	policy := spaceExternalAuthAdapter{}
+	runner := newRootRunnerWithAdapter(cfg, policy)
+	dir := filepath.Join(t.TempDir(), "space-records")
+	runner.SpaceStore = &space.Store{Dir: dir}
+	execute := func(args ...string) (string, error) {
+		var out bytes.Buffer
+		root := newRootCommandWithAdapter(&out, io.Discard, runner, policy)
+		root.SetArgs(args)
+		err := root.Execute()
+		return out.String(), err
+	}
+	out, err := execute("space", "list")
+	if err != nil || !strings.Contains(out, `"team_id":"12"`) || !strings.Contains(out, `"current":null`) {
+		t.Fatalf("space list without local identity = %s, %v", out, err)
+	}
+	if requests[len(requests)-1] != config.GetLiteTeamListPath+":" {
+		t.Fatal("team list used a selected team", requests)
+	}
+	before := len(requests)
+	for _, args := range [][]string{
+		{"space", "use", "0"}, {"space", "use", "12"},
+	} {
+		if _, err := execute(args...); err == nil || !strings.Contains(err.Error(), "无法识别当前账号") {
+			t.Fatalf("%v: %v", args, err)
+		}
+	}
+	if len(requests) != before {
+		t.Fatal("unknown identity tried to persist a default space")
+	}
+	for _, teamID := range []string{"0", "12", "34"} {
+		if _, err := execute("get-credit-balance", "--team-id", teamID); err != nil {
+			t.Fatal(err)
+		}
+		wantHeader := teamID
+		if teamID == "0" {
+			wantHeader = ""
+		}
+		if requests[len(requests)-1] != config.GetCreditBalancePath+":"+wantHeader {
+			t.Fatal("explicit space was not forwarded", requests)
+		}
+	}
+	file := filepath.Join(t.TempDir(), "image.png")
+	if err := os.WriteFile(file, []byte("image"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		args []string
+		path string
+	}{
+		{[]string{"upload-file", "--path", file}, config.UploadFilePath},
+		{[]string{"short-drama", "+submit-run", "--message", "test", "--asset-ids", "asset-a"}, config.SubmitRunPath},
+		{[]string{"get-thread", "--thread-id", "thread-a"}, config.GetThreadPath},
+		{[]string{"marketing", "query", "--thread-id", "thread-a", "--run-id", "run-a"}, config.QueryGenerateVideoResultPath},
+	} {
+		if _, err := execute(append(tc.args, "--team-id", "12")...); err != nil {
+			t.Fatalf("%v: %v", tc.args, err)
+		}
+		if requests[len(requests)-1] != tc.path+":12" {
+			t.Fatal("explicit task space was not forwarded", requests)
+		}
+	}
+	before = len(requests)
+	denied = true
+	if _, err := execute("get-credit-balance", "--team-id", "12"); err == nil || !strings.Contains(err.Error(), "denied") {
+		t.Fatalf("server denial was not returned: %v", err)
+	}
+	denied = false
+	if len(requests) != before+1 || requests[len(requests)-1] != config.GetCreditBalancePath+":12" {
+		t.Fatal("server denial retried or switched spaces", requests)
+	}
+	if _, err := os.Stat(dir); !os.IsNotExist(err) {
+		t.Fatalf("unknown identity created local space records: %v", err)
+	}
+	if _, err := execute("get-credit-balance"); err != nil {
+		t.Fatal("ordinary adapter requests must remain available", err)
+	}
+	// Metadata lookup failure must not block an explicitly scoped API request.
+	cfg.AccessKey = ""
+	runner.Auth = spaceUnavailableAccount{}
+	if _, err := execute("get-credit-balance", "--team-id", "12"); err != nil {
+		t.Fatal("local metadata failure blocked adapter authentication", err)
+	}
+	if requests[len(requests)-1] != config.GetCreditBalancePath+":12" {
+		t.Fatal("metadata failure dropped explicit space", requests)
+	}
+	if _, err := execute("get-credit-balance"); err == nil {
+		t.Fatal("implicit space silently ignored metadata failure")
+	}
+	// With a known matching account, the login-command switch must not suppress
+	// saved defaults or their use by business requests.
+	cfg.AccessKey = "adapter-key"
+	runner.Auth = auth.NewManager(cfg, auth.WithCredentialStore(&marketingCredentialStore{credential: &auth.Credential{UID: "adapter-user", AccessKey: "adapter-key"}}))
+	if _, err := execute("space", "use", "12"); err != nil {
+		t.Fatal(err)
+	}
+	out, err = execute("space", "list")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var result struct {
+		Current *space.Selection `json:"current"`
+	}
+	if err := json.Unmarshal([]byte(out), &result); err != nil || result.Current == nil || result.Current.TeamID != "12" {
+		t.Fatalf("space list = %s, %v", out, err)
+	}
+	if _, err := execute("get-credit-balance"); err != nil {
+		t.Fatal(err)
+	}
+	if requests[len(requests)-1] != config.GetCreditBalancePath+":12" {
+		t.Fatal("saved default was ignored", requests)
+	}
+	if _, err := execute("get-credit-balance", "--team-id", "0"); err != nil {
+		t.Fatal(err)
+	}
+	if requests[len(requests)-1] != config.GetCreditBalancePath+":" {
+		t.Fatal("personal override was ignored", requests)
+	}
+}

package/cmd/upload_file_test.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"bytes"
+	"encoding/json"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -77,7 +78,8 @@ func TestUploadFileMediaContract(t *testing.T) {
 			if err := root.Execute(); err != nil {
 				t.Fatal(err)
 			}
-			if stdout.String() != "{\"asset_id\":\"asset_original\"}\n" || calls != 1 {
+			var output map[string]string
+			if json.Unmarshal(stdout.Bytes(), &output) != nil || output["asset_id"] != "asset_original" || output["team_id"] != "0" || calls != 1 {
 				t.Fatalf("stdout = %q, requests = %d", stdout.String(), calls)
 			}
 		})

package/dist/checksums.txt

@@ -1,6 +1,6 @@
-6f7daba79b3423b148e30373bb87e7e8998df3d76be2196e39f84af209f0ea50  pippit-tool-cli-1.0.41-darwin-amd64.tar.gz
-9f03ae01c213a76f45b0dfa110272b45e5b5ecd54b188313c9d256ccbe512980  pippit-tool-cli-1.0.41-darwin-arm64.tar.gz
-ea603412d1c5b0baa42efd34bec92fcd0907333babd64a6e08514d4e2dcb86e5  pippit-tool-cli-1.0.41-linux-amd64.tar.gz
-cebd1f0f34157624c0fc8203eec306bd6c7e31a2db44089f52bca9c74c57ee03  pippit-tool-cli-1.0.41-linux-arm64.tar.gz
-729f413373d185964a42c178a7e0eeafc3fca490670fb753dc36fb38bb47aaf7  pippit-tool-cli-1.0.41-windows-amd64.zip
-b49491ae751e72f994da9388777a43f1b6b5781399dc2da15ced6d74f48dad6d  pippit-tool-cli-1.0.41-windows-arm64.zip
+e7ee32acef1c0a16912c46500ae7f15c46d920953792d1012886fac7e6424b2e  pippit-tool-cli-1.0.43-darwin-amd64.tar.gz
+57e4df86eaa244cd9845eb966299c8c2e1186f74495da0c16f0b378fb4bc5125  pippit-tool-cli-1.0.43-darwin-arm64.tar.gz
+21823c7a675ebcaadebe2ddbfa0324b9e939220d4dd74d5d5d4546f5e6938060  pippit-tool-cli-1.0.43-linux-amd64.tar.gz
+e387bc8eaeafa430a9a594ed1cc381964953b598875b520a6d009a12aec9d619  pippit-tool-cli-1.0.43-linux-arm64.tar.gz
+4569d389a20c75f0485ecc24ad5034308a818f294886dabdf07b2804e915f3a2  pippit-tool-cli-1.0.43-windows-amd64.zip
+078fb4fb09353a58095e1370668884664aad1760ae065983bb23abfdcd9939d1  pippit-tool-cli-1.0.43-windows-arm64.zip

package/internal/adaptercli/commands_test.go

@@ -12,22 +12,26 @@ func TestConfigureDefaultAllowRootCommands(t *testing.T) {
 	for _, tc := range []struct {
 		name         string
 		defaultAllow bool
+		localAuth    bool
 		allowlist    []string
 		want         []string
 	}{
 		{name: "默认拒绝且 nil 白名单"},
 		{name: "默认拒绝且空白名单", allowlist: []string{}},
 		{name: "默认拒绝且有白名单", allowlist: []string{"canvas"}, want: []string{"canvas"}},
-		{name: "默认放行且 nil 白名单", defaultAllow: true, want: []string{"canvas", "future-command"}},
-		{name: "默认放行且空白名单", defaultAllow: true, allowlist: []string{}, want: []string{"canvas", "future-command"}},
-		{name: "默认放行且有白名单", defaultAllow: true, allowlist: []string{"canvas"}, want: []string{"canvas", "future-command"}},
+		{name: "默认放行且 nil 白名单", defaultAllow: true, want: []string{"canvas", "future-command", "space"}},
+		{name: "默认放行且空白名单", defaultAllow: true, allowlist: []string{}, want: []string{"canvas", "future-command", "space"}},
+		{name: "默认放行且有白名单", defaultAllow: true, allowlist: []string{"canvas"}, want: []string{"canvas", "future-command", "space"}},
+		{name: "启用本地账号", defaultAllow: true, localAuth: true, want: []string{"canvas", "future-command", "login", "logout", "space", "status"}},
+		{name: "启用本地账号仍受白名单限制", localAuth: true, allowlist: []string{"space"}, want: []string{"space"}},
+		{name: "关闭本地登录仍允许空间命令", allowlist: []string{"login", "logout", "space", "status"}, want: []string{"space"}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			root := &cobra.Command{Use: "tool"}
-			for _, name := range []string{"canvas", "future-command", "login", "logout", "status", "update"} {
+			for _, name := range []string{"canvas", "future-command", "login", "logout", "space", "status", "update"} {
 				root.AddCommand(&cobra.Command{Use: name})
 			}
-			Configure(root, adapter.CLIOptions{DefaultAllowRootCommands: tc.defaultAllow, AllowedRootCommands: tc.allowlist})
+			Configure(root, adapter.CLIOptions{DefaultAllowRootCommands: tc.defaultAllow, AllowedRootCommands: tc.allowlist, LocalCredentialsEnabled: tc.localAuth})
 			var got []string
 			for _, child := range root.Commands() {
 				got = append(got, child.Name())

package/internal/auth/loopback.go

@@ -5,7 +5,6 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"io"
 	"mime"
 	"net"
@@ -14,6 +13,8 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/version"
 )
 
 const maxCallbackBodyBytes = 64 << 10
@@ -37,7 +38,6 @@ type browserFlow struct {
 	secret       string
 	state        string
 	source       string
-	origin       string
 	listener     net.Listener
 	server       *http.Server
 	payload      chan accessKeyPayload
@@ -93,6 +93,9 @@ func startBrowserFlow(authBaseURL *url.URL, randomReader io.Reader, deviceID, to
 	query.Set("callback", callback.String())
 	query.Set("random_secret_key", secret)
 	query.Set("source", loginSource)
+	query.Set("cli_version", version.BuildVersion())
+	// Protocol 1 supports callbacks from both official login origins.
+	query.Set("auth_protocol", "1")
 	query.Set("device_id", deviceID)
 	if tokenID != "" {
 		query.Set("token_id", tokenID)
@@ -111,7 +114,6 @@ func startBrowserFlow(authBaseURL *url.URL, randomReader io.Reader, deviceID, to
 		secret:      secret,
 		state:       state,
 		source:      loginSource,
-		origin:      originOf(authBaseURL),
 		listener:    listener,
 		payload:     make(chan accessKeyPayload, 1),
 		serveErr:    make(chan error, 1),
@@ -166,11 +168,12 @@ func (f *browserFlow) handleCallback(writer http.ResponseWriter, request *http.R
 		http.Error(writer, "invalid callback target", http.StatusBadRequest)
 		return
 	}
-	if !constantTimeEqual(request.Header.Get("Origin"), f.origin) {
+	origin := request.Header.Get("Origin")
+	if !isAllowedAuthOrigin(origin) {
 		http.Error(writer, "origin not allowed", http.StatusForbidden)
 		return
 	}
-	f.setCORSHeaders(writer.Header())
+	f.setCORSHeaders(writer.Header(), origin)
 
 	if request.Method == http.MethodOptions {
 		if !strings.EqualFold(strings.TrimSpace(request.Header.Get("Access-Control-Request-Method")), http.MethodPost) ||
@@ -288,8 +291,14 @@ func (f *browserFlow) callbackURLHost() string {
 	return parsed.Host
 }
 
-func (f *browserFlow) setCORSHeaders(header http.Header) {
-	header.Set("Access-Control-Allow-Origin", f.origin)
+// Authentication trusts only these official HTTPS origins, independently of
+// runtime business API configuration or browser-supplied query parameters.
+func isAllowedAuthOrigin(origin string) bool {
+	return origin == "https://xyq.jianying.com" || origin == "https://www.xiaoyunque.com"
+}
+
+func (f *browserFlow) setCORSHeaders(header http.Header, origin string) {
+	header.Set("Access-Control-Allow-Origin", origin)
 	header.Set("Access-Control-Allow-Methods", "POST")
 	header.Set("Access-Control-Allow-Headers", "Content-Type")
 	header.Set("Access-Control-Allow-Private-Network", "true")
@@ -318,7 +327,3 @@ func ensureJSONEOF(decoder *json.Decoder) error {
 	}
 	return err
 }
-
-func originOf(value *url.URL) string {
-	return fmt.Sprintf("%s://%s", strings.ToLower(value.Scheme), value.Host)
-}