@pippit-dev/cli 1.0.41 → 1.0.43

package/internal/auth/loopback_origins_test.go

@@ -0,0 +1,152 @@
+package auth
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/Pippit-dev/pippit-cli/internal/version"
+)
+
+func newOriginTestFlow(t *testing.T) (*browserFlow, accessKeyPayload) {
+	t.Helper()
+	authURL, _ := url.Parse(config.DefaultBaseURL)
+	deviceID, _ := randomEncoded(bytes.NewReader(bytes.Repeat([]byte{0x21}, deviceIDBytes)), deviceIDBytes)
+	flow, err := startBrowserFlow(authURL, bytes.NewReader(bytes.Repeat([]byte{0x42}, 2*randomBindingBytes)), deviceID, "", "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(flow.close)
+	return flow, accessKeyPayload{
+		Type: "access_key", AccessKey: "local-test-ak", UID: "test-user", TokenID: "test-token",
+		ExpiredAt: time.Now().Add(time.Hour).Unix(), RandomSecretKey: flow.secret,
+		Source: loginSource, CallbackURL: flow.callbackURL,
+	}
+}
+
+func originTestRequest(t *testing.T, flow *browserFlow, method, origin string, payload accessKeyPayload, mutations ...func(*http.Request)) *httptest.ResponseRecorder {
+	t.Helper()
+	body, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(method, flow.callbackURL, bytes.NewReader(body))
+	if origin != "" {
+		request.Header.Set("Origin", origin)
+	}
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("Access-Control-Request-Method", "POST")
+	request.Header.Set("Access-Control-Request-Headers", "Content-Type")
+	for _, mutate := range mutations {
+		mutate(request)
+	}
+	response := httptest.NewRecorder()
+	flow.handleCallback(response, request)
+	return response
+}
+
+func TestBrowserCallbackAcceptsBothOfficialOriginsWithMatchingCORS(t *testing.T) {
+	for _, origin := range []string{"https://xyq.jianying.com", "https://www.xiaoyunque.com"} {
+		t.Run(origin, func(t *testing.T) {
+			flow, payload := newOriginTestFlow(t)
+			for _, method := range []string{http.MethodOptions, http.MethodPost} {
+				response := originTestRequest(t, flow, method, origin, payload)
+				wantStatus := http.StatusOK
+				if method == http.MethodOptions {
+					wantStatus = http.StatusNoContent
+				}
+				if response.Code != wantStatus || response.Header().Get("Access-Control-Allow-Origin") != origin {
+					t.Fatalf("%s status/CORS = %d/%q", method, response.Code, response.Header().Get("Access-Control-Allow-Origin"))
+				}
+				if response.Header().Get("Access-Control-Allow-Private-Network") != "true" ||
+					!strings.Contains(strings.Join(response.Header().Values("Vary"), ","), "Origin") {
+					t.Fatal("callback lost private-network or Vary headers")
+				}
+			}
+			// Switching between the two trusted sites must not reset the one-shot binding.
+			otherOrigin := "https://xyq.jianying.com"
+			if origin == otherOrigin {
+				otherOrigin = "https://www.xiaoyunque.com"
+			}
+			if response := originTestRequest(t, flow, http.MethodPost, otherOrigin, payload); response.Code != http.StatusConflict {
+				t.Fatalf("cross-origin replay status = %d", response.Code)
+			}
+		})
+	}
+}
+
+func TestBrowserCallbackRejectsUntrustedOriginsBeforeCORS(t *testing.T) {
+	for _, origin := range []string{
+		"", "null", "http://xyq.jianying.com", "http://www.xiaoyunque.com",
+		"https://www.xiaoyunque.com:443", "https://www.xiaoyunque.com/",
+		"https://www.xiaoyunque.com.evil.example", "https://evil.example",
+		"https://other.xiaoyunque.com", "https://www.xiaoyunque.com https://xyq.jianying.com",
+	} {
+		t.Run(origin, func(t *testing.T) {
+			flow, payload := newOriginTestFlow(t)
+			for _, method := range []string{http.MethodOptions, http.MethodPost} {
+				response := originTestRequest(t, flow, method, origin, payload)
+				if response.Code != http.StatusForbidden || response.Header().Get("Access-Control-Allow-Origin") != "" {
+					t.Fatalf("%s untrusted origin status/CORS = %d/%q", method, response.Code, response.Header().Get("Access-Control-Allow-Origin"))
+				}
+			}
+			if len(flow.payload) != 0 {
+				t.Fatal("untrusted origin delivered a credential")
+			}
+		})
+	}
+}
+
+func TestNewAuthOriginStillRequiresEveryCallbackBinding(t *testing.T) {
+	for _, binding := range []string{"secret", "source", "callback_url", "state", "host"} {
+		t.Run(binding, func(t *testing.T) {
+			flow, payload := newOriginTestFlow(t)
+			switch binding {
+			case "secret":
+				payload.RandomSecretKey = "wrong"
+			case "source":
+				payload.Source = "wrong"
+			case "callback_url":
+				payload.CallbackURL += "&extra=1"
+			case "state":
+				flow.state = "wrong"
+			}
+			response := originTestRequest(t, flow, http.MethodPost, "https://www.xiaoyunque.com", payload, func(request *http.Request) {
+				if binding == "host" {
+					request.Host = "evil.example"
+				}
+			})
+			if response.Code != http.StatusBadRequest || len(flow.payload) != 0 {
+				t.Fatalf("invalid %s status = %d, queued callbacks = %d", binding, response.Code, len(flow.payload))
+			}
+		})
+	}
+}
+
+func TestBrowserLoginMetadataUsesBinaryVersionAndProtocol(t *testing.T) {
+	previous := version.Version
+	t.Cleanup(func() { version.Version = previous })
+	for _, buildVersion := range []string{"1.0.42", "1.0.42-canary.1", "dev", ""} {
+		t.Run(buildVersion, func(t *testing.T) {
+			version.Version = buildVersion
+			flow, _ := newOriginTestFlow(t)
+			loginURL, err := url.Parse(flow.loginURL)
+			if err != nil {
+				t.Fatal(err)
+			}
+			wantVersion := buildVersion
+			if wantVersion == "" {
+				wantVersion = "dev"
+			}
+			if query := loginURL.Query(); query.Get("cli_version") != wantVersion || query.Get("auth_protocol") != "1" {
+				t.Fatalf("auth metadata = version %q, protocol %q", query.Get("cli_version"), query.Get("auth_protocol"))
+			}
+		})
+	}
+}

package/internal/auth/space.go

@@ -0,0 +1,26 @@
+package auth
+
+import (
+	"context"
+	"errors"
+
+	"github.com/Pippit-dev/pippit-cli/internal/space"
+)
+
+// SpaceAccount uses the verified browser UID, stable across AK rotation.
+func (m *Manager) SpaceAccount(ctx context.Context) (string, error) {
+	// Re-read at request boundaries so an account switch in another process
+	// cannot keep using this process's cached identity or credential.
+	m.clearCredentialCache()
+	credential, err := m.loadCredential(ctx)
+	if errors.Is(err, ErrCredentialNotFound) {
+		return "", nil
+	}
+	if err != nil {
+		return "", err
+	}
+	if credential.UID == "" || credential.AccessKey == "" {
+		return "", nil
+	}
+	return "user:" + space.Digest(credential.UID), nil
+}

package/internal/auth/space_test.go

@@ -0,0 +1,42 @@
+package auth
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+)
+
+func TestSpaceAccountRefreshesCredentialAndSurvivesAKRotation(t *testing.T) {
+	ctx := context.Background()
+	cfg := config.Load()
+	cfg.AccessKey = ""
+	store := &memoryCredentialStore{credential: &Credential{UID: "user-a", AccessKey: "key-a", ExpiredAt: time.Now().Add(time.Hour).Unix()}}
+	manager := NewManager(cfg, WithCredentialStore(store))
+	a, err := manager.SpaceAccount(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(a, "user-a") || strings.Contains(a, "key-a") {
+		t.Fatal("raw identity leaked")
+	}
+	if err := store.Save(ctx, &Credential{UID: "user-a", AccessKey: "key-rotated", ExpiredAt: time.Now().Add(time.Hour).Unix()}); err != nil {
+		t.Fatal(err)
+	}
+	after, err := manager.SpaceAccount(ctx)
+	if err != nil || after != a {
+		t.Fatalf("rotation changed identity: %s, %v", after, err)
+	}
+	if key, err := manager.ResolveAccessKey(ctx); err != nil || key != "key-rotated" {
+		t.Fatalf("request used stale credential: %v", err)
+	}
+	if err := store.Save(ctx, &Credential{UID: "user-b", AccessKey: "key-b", ExpiredAt: time.Now().Add(time.Hour).Unix()}); err != nil {
+		t.Fatal(err)
+	}
+	b, err := manager.SpaceAccount(ctx)
+	if err != nil || b == a {
+		t.Fatal("new account inherited old identity", err)
+	}
+}

package/internal/canvas/get.go

@@ -14,6 +14,8 @@ type GetOptions struct {
 }
 
 type GetResult struct {
+	TeamID            string            `json:"team_id"`
+	SpaceContext      string            `json:"space_context,omitempty"`
 	RequestedAssetIDs []string          `json:"requested_asset_ids"`
 	Assets            []json.RawMessage `json:"assets"`
 	LogID             string            `json:"log_id,omitempty"`
@@ -77,11 +79,16 @@ func queryAssets(ctx context.Context, assetIDs []string, requireAll bool, runner
 			envelope.LogID,
 		)
 	}
-	return &GetResult{
+	result := &GetResult{
+		TeamID:            common.SpaceTeamID(ctx),
 		RequestedAssetIDs: append([]string(nil), assetIDs...),
 		Assets:            ordered,
 		LogID:             strings.TrimSpace(envelope.LogID),
-	}, nil
+	}
+	if session := common.SpaceSession(ctx); session != nil {
+		result.SpaceContext = session.Token()
+	}
+	return result, nil
 }
 
 func normalizeAssetIDs(values []string) ([]string, error) {

package/internal/commandnames/names.go

@@ -2,8 +2,13 @@
 package commandnames
 
 const (
-	Login  = "login"
-	Logout = "logout"
-	Status = "status"
-	Update = "update"
+	Login          = "login"
+	Logout         = "logout"
+	Status         = "status"
+	Space          = "space"
+	Update         = "update"
+	Completion     = "completion"
+	Help           = "help"
+	Model          = "model"
+	DownloadResult = "download-result"
 )

package/internal/common/client.go

@@ -90,6 +90,11 @@ func (c *httpClient) SendRequest(ctx context.Context, path string, body any, out
 }
 
 func (c *httpClient) SendRequestWithHeaders(ctx context.Context, path string, body any, headers map[string]string, out any) error {
+	var scopeErr error
+	ctx, scopeErr = c.prepareSpaceRequest(ctx, path, body)
+	if scopeErr != nil {
+		return scopeErr
+	}
 	method := http.MethodPost
 	if body == nil {
 		method = http.MethodGet
@@ -145,6 +150,11 @@ func (c *httpClient) SendRequestWithHeaders(ctx context.Context, path string, bo
 }
 
 func (c *httpClient) SendMultipartRequest(ctx context.Context, path string, fields map[string]string, file MultipartFile, out any) error {
+	var scopeErr error
+	ctx, scopeErr = c.prepareSpaceRequest(ctx, path, nil)
+	if scopeErr != nil {
+		return scopeErr
+	}
 	reqURL, err := c.resolveURL(path, nil)
 	if err != nil {
 		return err
@@ -242,6 +252,7 @@ func (c *httpClient) prepareRequest(ctx context.Context, req *http.Request, head
 	c.injectHeaders(req, headers)
 	// Rebuild the authentication header only for requests to the configured API origin; general request headers cannot override it.
 	req.Header.Del("Authorization")
+	req.Header.Del("X-Team-Id")
 	if !isAPIOrigin {
 		c.adapter.StripSensitiveHeaders(req)
 		return nil
@@ -250,6 +261,16 @@ func (c *httpClient) prepareRequest(ctx context.Context, req *http.Request, head
 	if err != nil {
 		return err
 	}
+	// The selected space, like credentials, is rebuilt only for the API origin.
+	if session := SpaceSession(ctx); session != nil {
+		if err := session.CheckIdentity(ctx); err != nil {
+			return err
+		}
+		req.Header.Del("X-Team-Id")
+		if session.TeamID() != "0" {
+			req.Header.Set("X-Team-Id", session.TeamID())
+		}
+	}
 	switch decision {
 	case adapter.AuthProvided:
 		return nil
@@ -313,6 +334,7 @@ func (c *httpClient) checkRedirect(req *http.Request, via []*http.Request) error
 	}
 	if !trusted {
 		req.Header.Del("Authorization")
+		req.Header.Del("X-Team-Id")
 		c.adapter.StripSensitiveHeaders(req)
 	}
 	return nil
@@ -362,6 +384,7 @@ func (c *httpClient) do(req *http.Request, out any) error {
 	if err := sonic.Unmarshal(data, out); err != nil {
 		return fmt.Errorf("解析响应体失败: %w", err)
 	}
+	rememberSpaceResponse(req.Context(), data)
 	return nil
 }
 

package/internal/common/host_source.go

@@ -22,6 +22,11 @@ func detectHostSource(getenv func(string) string) string {
 		{"CLAUDECODE", "claude_code"},
 		{"CURSOR_AGENT", "cursor"},
 		{"GEMINI_CLI", "gemini_cli"},
+		{"OPENCODE", "opencode"},
+		{"QWEN_CODE", "qwen_code"},
+		{"CLINE_ACTIVE", "cline"},
+		{"COPILOT_CLI", "github_copilot_cli"},
+		{"COPILOT_AGENT_SESSION_ID", "github_copilot_cli"},
 	} {
 		value := strings.ToLower(strings.TrimSpace(getenv(marker.key)))
 		if value == "" || value == "0" || value == "false" {

package/internal/common/host_source_test.go

@@ -14,9 +14,17 @@ func TestDetectHostSource(t *testing.T) {
 		{"claude", map[string]string{"CLAUDECODE": "1"}, "claude_code"},
 		{"cursor", map[string]string{"CURSOR_AGENT": "1"}, "cursor"},
 		{"gemini", map[string]string{"GEMINI_CLI": "1"}, "gemini_cli"},
+		{"opencode", map[string]string{"OPENCODE": "1"}, "opencode"},
+		{"qwen", map[string]string{"QWEN_CODE": "1"}, "qwen_code"},
+		{"cline", map[string]string{"CLINE_ACTIVE": " true "}, "cline"},
+		{"copilot cli", map[string]string{"COPILOT_CLI": "1"}, "github_copilot_cli"},
+		{"copilot session", map[string]string{"COPILOT_AGENT_SESSION_ID": "secret"}, "github_copilot_cli"},
+		{"copilot markers agree", map[string]string{"COPILOT_CLI": "1", "COPILOT_AGENT_SESSION_ID": "secret"}, "github_copilot_cli"},
 		{"ambiguous", map[string]string{"CODEX_THREAD_ID": "secret", "CURSOR_AGENT": "1"}, ""},
+		{"new markers conflict", map[string]string{"OPENCODE": "1", "CLINE_ACTIVE": "true"}, ""},
 		{"disabled markers", map[string]string{"CLAUDECODE": "0", "GEMINI_CLI": " false "}, ""},
-		{"configuration is not runtime evidence", map[string]string{"CODEX_HOME": "/home/example", "ANTHROPIC_API_KEY": "secret", "TERM_PROGRAM": "vscode"}, ""},
+		{"new markers disabled", map[string]string{"OPENCODE": "0", "QWEN_CODE": " FALSE ", "CLINE_ACTIVE": "", "COPILOT_CLI": "false", "COPILOT_AGENT_SESSION_ID": " "}, ""},
+		{"configuration is not runtime evidence", map[string]string{"CODEX_HOME": "/home/example", "ANTHROPIC_API_KEY": "secret", "TERM_PROGRAM": "vscode", "AGENT": "1", "OPENCODE_CONFIG": "/example/config.json", "QWEN_API_KEY": "secret", "COPILOT_HOME": "/example/copilot"}, ""},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			if got := detectHostSource(func(key string) string { return tc.env[key] }); got != tc.want {

package/internal/common/runner.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/Pippit-dev/pippit-cli/internal/auth"
 	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/Pippit-dev/pippit-cli/internal/space"
 )
 
 // AuthManager is the credential boundary shared by native CLI commands. It
@@ -20,9 +21,10 @@ type AuthManager interface {
 
 // Runner carries runtime dependencies for command execution.
 type Runner struct {
-	Config *config.Config
-	Client Client
-	Auth   AuthManager
+	Config     *config.Config
+	Client     Client
+	Auth       AuthManager
+	SpaceStore *space.Store
 }
 
 func NewRunner(cfg *config.Config, client Client) *Runner {

package/internal/common/space.go

@@ -0,0 +1,185 @@
+package common
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/url"
+
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/Pippit-dev/pippit-cli/internal/space"
+)
+
+type spaceContextKey struct{}
+type spaceRequestKey struct{}
+type spaceRequest struct {
+	operation string
+	refs      space.References
+}
+
+func WithSpace(ctx context.Context, session *space.Session) context.Context {
+	return context.WithValue(ctx, spaceContextKey{}, session)
+}
+
+func SpaceSession(ctx context.Context) *space.Session {
+	session, _ := ctx.Value(spaceContextKey{}).(*space.Session)
+	return session
+}
+
+func SpaceTeamID(ctx context.Context) string { return SpaceSession(ctx).TeamID() }
+
+// spaceOperation classifies successful responses for local records only.
+// It does not decide whether a request carries the selected TeamID.
+func spaceOperation(path string) string {
+	u, err := url.Parse(path)
+	if err != nil {
+		return ""
+	}
+	switch u.Path {
+	case config.SubmitRunPath, config.SubmitMarketingRunPath:
+		return "submit"
+	case config.GetThreadPath, config.QueryGenerateVideoResultPath:
+		return "query"
+	case config.ListThreadFilePath:
+		return "files"
+	case config.UploadFilePath:
+		return "upload"
+	}
+	return ""
+}
+
+func SpaceReferences(body any) (space.References, error) {
+	var ref space.References
+	if body == nil {
+		return ref, nil
+	}
+	data, err := json.Marshal(body)
+	if err != nil {
+		return ref, err
+	}
+	if err := json.Unmarshal(data, &ref); err != nil {
+		return ref, fmt.Errorf("任务或素材 ID 格式无效: %w", err)
+	}
+	return ref, nil
+}
+
+func (c *httpClient) prepareSpaceRequest(ctx context.Context, path string, body any) (context.Context, error) {
+	session := SpaceSession(ctx)
+	if session == nil {
+		return ctx, nil
+	}
+	if target, err := url.Parse(path); err == nil && target.IsAbs() {
+		trusted, err := c.isBaseURLOrigin(target)
+		if err != nil {
+			return ctx, err
+		}
+		if !trusted {
+			return ctx, nil
+		}
+	}
+	ref, err := SpaceReferences(body)
+	if err != nil {
+		return ctx, err
+	}
+	if _, err := session.Resolve(ref); err != nil {
+		return ctx, err
+	}
+	return context.WithValue(ctx, spaceRequestKey{}, spaceRequest{operation: spaceOperation(path), refs: ref}), nil
+}
+
+func rememberSpaceResponse(ctx context.Context, data []byte) {
+	session := SpaceSession(ctx)
+	request, ok := ctx.Value(spaceRequestKey{}).(spaceRequest)
+	if session == nil || !ok || request.operation == "" {
+		return
+	}
+	var response struct {
+		Ret  json.RawMessage `json:"ret"`
+		Data *struct {
+			ThreadID      string `json:"thread_id"`
+			RunID         string `json:"run_id"`
+			PippitAssetID string `json:"pippit_asset_id"`
+			Run           struct {
+				ThreadID string `json:"thread_id"`
+				RunID    string `json:"run_id"`
+			} `json:"run"`
+		} `json:"data"`
+	}
+	if json.Unmarshal(data, &response) != nil || response.Data == nil || (string(response.Ret) != `"0"` && string(response.Ret) != "0") {
+		return
+	}
+	ref := request.refs
+	switch request.operation {
+	case "submit":
+		if response.Data.Run.ThreadID == "" || response.Data.Run.RunID == "" {
+			return
+		}
+		if ref.ThreadID != "" && ref.ThreadID != response.Data.Run.ThreadID {
+			return
+		}
+		ref.ThreadID, ref.RunID = response.Data.Run.ThreadID, response.Data.Run.RunID
+	case "query", "files":
+		if ref.ThreadID == "" {
+			return
+		}
+		if response.Data.ThreadID != "" && response.Data.ThreadID != ref.ThreadID {
+			return
+		}
+		if response.Data.RunID != "" && response.Data.RunID != ref.RunID {
+			return
+		}
+	case "upload":
+		if response.Data.PippitAssetID == "" {
+			return
+		}
+		ref.AssetIDs = []string{response.Data.PippitAssetID}
+	default:
+		return
+	}
+	session.Remember(ref)
+}
+
+func SpaceAccount(ctx context.Context, runner *Runner) (string, error) {
+	// Without an AuthManager, authentication belongs to the adapter. An unused
+	// environment AK must not stand in for the adapter's actual account.
+	if runner.Auth == nil {
+		return "", nil
+	}
+	if provider, ok := runner.Auth.(interface {
+		SpaceAccount(context.Context) (string, error)
+	}); ok {
+		return provider.SpaceAccount(ctx)
+	}
+	status, err := runner.Auth.Status(ctx)
+	if err != nil {
+		return "", err
+	}
+	if status != nil && status.UID != "" {
+		return "user:" + space.Digest(status.UID), nil
+	}
+	return "", nil
+}
+
+// SpaceStoreForRunner returns nil when the current account cannot be identified.
+// Callers can use an explicit space without persisting local records.
+func SpaceStoreForRunner(ctx context.Context, runner *Runner) (*space.Store, error) {
+	account, err := SpaceAccount(ctx, runner)
+	if err != nil {
+		return nil, err
+	}
+	if account == "" {
+		return nil, nil
+	}
+	base := config.DefaultBaseURL
+	if runner.Config != nil && runner.Config.BaseURL != "" {
+		base = runner.Config.BaseURL
+	}
+	store, err := space.NewStore(base, account)
+	if err != nil {
+		return nil, err
+	}
+	if runner.SpaceStore != nil {
+		store.Dir = runner.SpaceStore.Dir
+	}
+	return store, nil
+}