@pippit-dev/cli 1.0.41 → 1.0.43

package/internal/common/space_test.go

@@ -0,0 +1,132 @@
+package common
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/Pippit-dev/pippit-cli/internal/space"
+)
+
+type spaceRewriteAdapter struct{ adapter.Default }
+
+func (spaceRewriteAdapter) PrepareAPIRequest(_ context.Context, r *http.Request) (adapter.AuthDecision, error) {
+	r.URL.Path = "/rewritten" + r.URL.Path
+	return adapter.UseDefaultAuth, nil
+}
+
+func TestSpaceHeadersAndTaskRecoveryThroughHTTP(t *testing.T) {
+	var headers []string
+	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		headers = append(headers, r.Header.Get("X-Team-Id"))
+		if r.Header.Get("Authorization") != "Bearer test-key" {
+			t.Error("missing authorization")
+		}
+		_, _ = io.Copy(io.Discard, r.Body)
+		switch r.URL.Path {
+		case config.UploadFilePath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"pippit_asset_id":"asset"}}`))
+		case config.SubmitRunPath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"run":{"thread_id":"thread","run_id":"run"}}}`))
+		default:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{}}`))
+		}
+	}))
+	defer api.Close()
+	store := &space.Store{Dir: t.TempDir(), Account: "account", Origin: api.URL}
+	if err := store.SaveDefault(space.Selection{TeamID: "12", Name: "A"}); err != nil {
+		t.Fatal(err)
+	}
+	account, identityChecks := store.Account, 0
+	ctx := WithSpace(context.Background(), &space.Session{Store: store, Identity: func(context.Context) (string, error) {
+		identityChecks++
+		return account, nil
+	}})
+	client := NewHTTPClient(api.URL, time.Second, NewAccessKeyAuthorizer("test-key"))
+	file := filepath.Join(t.TempDir(), "image.png")
+	if err := os.WriteFile(file, []byte("image"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	var result map[string]any
+	if err := client.SendMultipartRequest(ctx, config.UploadFilePath, nil, MultipartFile{FieldName: "file", Path: file}, &result); err != nil {
+		t.Fatal(err)
+	}
+	if identityChecks != 1 {
+		t.Fatalf("identity checks per request = %d, want 1", identityChecks)
+	}
+	if err := store.SaveDefault(space.Selection{TeamID: "34", Name: "B"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := client.SendRequest(ctx, config.SubmitRunPath, map[string]any{"asset_ids": []string{"asset"}}, &result); err != nil {
+		t.Fatal(err)
+	}
+	// A new command recovers the original task even after a saved-space switch.
+	queryCtx := WithSpace(context.Background(), &space.Session{Store: store})
+	if err := client.SendRequest(queryCtx, api.URL+config.GetThreadPath, space.References{ThreadID: "thread", RunID: "run"}, &result); err != nil {
+		t.Fatal(err)
+	}
+	if err := client.SendRequestWithHeaders(ctx, config.GetAvailableModelListPath, nil, map[string]string{"X-Team-Id": "999"}, &result); err != nil {
+		t.Fatal(err)
+	}
+	zero := "0"
+	personal := WithSpace(context.Background(), &space.Session{Store: store, Explicit: &zero})
+	if err := client.SendRequest(personal, config.GetCreditBalancePath, struct{}{}, &result); err != nil {
+		t.Fatal(err)
+	}
+	for i, want := range []string{"12", "12", "12", "12", ""} {
+		if headers[i] != want {
+			t.Errorf("request %d team = %q, want %q", i, headers[i], want)
+		}
+	}
+	other := "34"
+	conflict := WithSpace(context.Background(), &space.Session{Store: store, Explicit: &other})
+	if err := client.SendRequest(conflict, config.GetThreadPath, space.References{ThreadID: "thread", RunID: "run"}, &result); err == nil {
+		t.Fatal("conflict sent")
+	}
+	if len(headers) != 5 {
+		t.Fatal("conflict reached API")
+	}
+	// A new API path still receives the selected space without a client allowlist.
+	unlisted := WithSpace(context.Background(), &space.Session{Store: store})
+	if err := client.SendRequest(unlisted, "/api/unlisted", struct{}{}, &result); err != nil {
+		t.Fatal(err)
+	}
+	if headers[len(headers)-1] != "34" {
+		t.Fatal("unlisted API did not receive the saved team")
+	}
+	foreign := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("X-Team-Id") != "" || r.Header.Get("Authorization") != "" {
+			t.Error("foreign origin received sensitive headers")
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	defer foreign.Close()
+	// A matching path on another origin must bypass both scope lookup and headers.
+	if err := client.SendRequestWithHeaders(conflict, foreign.URL+config.GetThreadPath, space.References{ThreadID: "thread", RunID: "run"}, map[string]string{"X-Team-Id": "999"}, &result); err != nil {
+		t.Fatal(err)
+	}
+	// Path rewriting by an adapter must preserve the original operation's scope.
+	rewritten := NewHTTPClientWithAdapter(api.URL, time.Second, NewAccessKeyAuthorizer("test-key"), spaceRewriteAdapter{})
+	if err := rewritten.SendRequest(ctx, config.GetCreditBalancePath, struct{}{}, &result); err != nil {
+		t.Fatal(err)
+	}
+	if headers[len(headers)-1] != "12" {
+		t.Fatal("adapter dropped space")
+	}
+	// Even with a frozen space, a changed account must stop before sending.
+	account = "other-account"
+	before := len(headers)
+	if err := client.SendRequest(ctx, config.GetCreditBalancePath, struct{}{}, &result); err == nil {
+		t.Fatal("account switch accepted")
+	}
+	if len(headers) != before {
+		t.Fatal("account switch reached API")
+	}
+}

package/internal/common/submit_run.go

@@ -15,6 +15,7 @@ const AgentNameVideoPart = "pippit_video_part_agent"
 
 // SubmitRunResult is the shared successful submit_run output.
 type SubmitRunResult struct {
+	TeamID        string `json:"team_id"`
 	ThreadID      string `json:"thread_id"`
 	RunID         string `json:"run_id"`
 	WebThreadLink string `json:"web_thread_link"`
@@ -86,6 +87,7 @@ func submitRun(ctx context.Context, command, path string, body any, runner *Runn
 	}
 
 	return &SubmitRunResult{
+		TeamID:        SpaceTeamID(ctx),
 		ThreadID:      resp.Data.Run.ThreadID,
 		RunID:         resp.Data.Run.RunID,
 		WebThreadLink: resp.Data.WebThreadLink,

package/internal/common/upload_file.go

@@ -20,6 +20,7 @@ type UploadFileOptions struct {
 
 // UploadFileResult is the shared JSON output for media and short-drama uploads.
 type UploadFileResult struct {
+	TeamID  string `json:"team_id"`
 	AssetID string `json:"asset_id"`
 }
 
@@ -102,6 +103,7 @@ func UploadFile(ctx context.Context, opts UploadFileOptions, runner *Runner) (*U
 	}
 
 	return &UploadFileResult{
+		TeamID:  SpaceTeamID(ctx),
 		AssetID: assetID,
 	}, nil
 }

package/internal/config/config.go

@@ -12,18 +12,21 @@ import (
 )
 
 const (
-	DefaultBaseURL              = "https://xyq.jianying.com"
-	DefaultHTTPTimeout          = 30 * time.Minute
-	DefaultAuthTTL              = 30 * time.Second
-	DefaultAuthStoreServiceName = "pippit-cli"
-	SubmitRunPath               = "/api/biz/v1/skill/submit_run"
-	GetCreditBalancePath        = "/api/biz/v1/skill/get_credit_balance"
-	GetAvailableModelListPath   = "/api/biz/v1/skill/get_available_model_list"
-	GetThreadPath               = "/api/biz/v1/skill/get_thread"
-	UploadFilePath              = "/api/biz/v1/skill/upload_file"
-	ListThreadFilePath          = "/api/biz/v1/skill/list_thread_file"
-	EnvXYQAccessKey             = "XYQ_ACCESS_KEY"
-	FileName                    = "config.toml"
+	DefaultBaseURL               = "https://xyq.jianying.com"
+	DefaultHTTPTimeout           = 30 * time.Minute
+	DefaultAuthTTL               = 30 * time.Second
+	DefaultAuthStoreServiceName  = "pippit-cli"
+	SubmitRunPath                = "/api/biz/v1/skill/submit_run"
+	SubmitMarketingRunPath       = "/api/biz/v1/agent/submit_marketing_run"
+	QueryGenerateVideoResultPath = "/api/biz/v1/agent/query_generate_video_result"
+	GetCreditBalancePath         = "/api/biz/v1/skill/get_credit_balance"
+	GetLiteTeamListPath          = "/api/biz/v1/skill/get_lite_team_list"
+	GetAvailableModelListPath    = "/api/biz/v1/skill/get_available_model_list"
+	GetThreadPath                = "/api/biz/v1/skill/get_thread"
+	UploadFilePath               = "/api/biz/v1/skill/upload_file"
+	ListThreadFilePath           = "/api/biz/v1/skill/list_thread_file"
+	EnvXYQAccessKey              = "XYQ_ACCESS_KEY"
+	FileName                     = "config.toml"
 )
 
 // Config holds runtime settings selected by the root command and passed down

package/internal/generate_image/generate_image.go

@@ -42,14 +42,7 @@ type generalAgentSettings struct {
 	GenerateImageCount *int   `json:"generate_image_count,omitempty"`
 }
 
-// Result is the JSON envelope printed by `pippit-tool-cli generate-image`.
-type Result struct {
-	ThreadID      string `json:"thread_id"`
-	RunID         string `json:"run_id"`
-	WebThreadLink string `json:"web_thread_link"`
-}
-
-func Run(ctx context.Context, opts *Options, runner *common.Runner) (*Result, error) {
+func Run(ctx context.Context, opts *Options, runner *common.Runner) (*common.SubmitRunResult, error) {
 	if runner == nil || runner.Client == nil {
 		return nil, fmt.Errorf("generate-image 运行器客户端缺失")
 	}
@@ -89,7 +82,8 @@ func Run(ctx context.Context, opts *Options, runner *common.Runner) (*Result, er
 		return nil, fmt.Errorf("generate-image 响应缺少 data.run.run_id")
 	}
 
-	return &Result{
+	return &common.SubmitRunResult{
+		TeamID:        common.SpaceTeamID(ctx),
 		ThreadID:      resp.Data.Run.ThreadID,
 		RunID:         resp.Data.Run.RunID,
 		WebThreadLink: resp.Data.WebThreadLink,

package/internal/short_drama/submit_run.go

@@ -15,14 +15,7 @@ type SubmitRunOptions struct {
 	AssetIDs []string `json:"asset_ids,omitempty"`
 }
 
-// SubmitRunResult is the JSON envelope printed by `pippit-tool-cli short-drama +submit-run`.
-type SubmitRunResult struct {
-	ThreadID      string `json:"thread_id"`
-	RunID         string `json:"run_id"`
-	WebThreadLink string `json:"web_thread_link"`
-}
-
-func SubmitRun(ctx context.Context, opts *SubmitRunOptions, runner *common.Runner) (*SubmitRunResult, error) {
+func SubmitRun(ctx context.Context, opts *SubmitRunOptions, runner *common.Runner) (*common.SubmitRunResult, error) {
 	if runner == nil || runner.Client == nil {
 		return nil, fmt.Errorf("submit_run 运行器客户端缺失")
 	}
@@ -55,7 +48,8 @@ func SubmitRun(ctx context.Context, opts *SubmitRunOptions, runner *common.Runne
 	if resp.Data.Run.RunID == "" {
 		return nil, fmt.Errorf("short_drama 响应缺少 data.run.run_id")
 	}
-	return &SubmitRunResult{
+	return &common.SubmitRunResult{
+		TeamID:        common.SpaceTeamID(ctx),
 		ThreadID:      resp.Data.Run.ThreadID,
 		RunID:         resp.Data.Run.RunID,
 		WebThreadLink: resp.Data.WebThreadLink,

package/internal/space/session.go

@@ -0,0 +1,153 @@
+package space
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+)
+
+// Session is one command's immutable account/origin/team choice. It is not an
+// authorization grant: every request still uses the current credential.
+// Store is optional when a command explicitly selects its space.
+type Session struct {
+	Store    *Store
+	Explicit *string
+	Expected *Binding
+	Identity func(context.Context) (string, error)
+	Stderr   io.Writer
+	selected *Selection
+}
+
+func DecodeBinding(raw string) (*Binding, error) {
+	data, err := base64.RawURLEncoding.DecodeString(raw)
+	var binding Binding
+	if err != nil || json.Unmarshal(data, &binding) != nil {
+		return nil, fmt.Errorf("space-context 无效")
+	}
+	if _, err := ParseTeamID(binding.TeamID); err != nil {
+		return nil, err
+	}
+	return &binding, nil
+}
+
+func (s *Session) CheckIdentity(ctx context.Context) error {
+	if s.Store == nil || s.Identity == nil {
+		return nil
+	}
+	account, err := s.Identity(ctx)
+	if err != nil {
+		return err
+	}
+	if account != s.Store.Account {
+		return fmt.Errorf("当前账号已改变，已停止原空间的操作；请切回原账号后查询原任务")
+	}
+	return nil
+}
+
+// Resolve selects and freezes the command's space, checking each request's
+// records even after freezing. CheckIdentity belongs at the request boundary.
+func (s *Session) Resolve(ref References) (Selection, error) {
+	explicit := s.Explicit
+	fixed := s.selected
+	if s.Expected != nil {
+		if s.Store == nil {
+			return Selection{}, fmt.Errorf("无法获取当前账号的空间记录，不能校验 --space-context")
+		}
+		if s.Expected.Account != s.Store.Account || s.Expected.Origin != s.Store.Origin {
+			return Selection{}, fmt.Errorf("账号或 API origin 与原任务不一致，已停止操作")
+		}
+		if explicit != nil && *explicit != s.Expected.TeamID {
+			return Selection{}, fmt.Errorf("--team-id 与固定任务空间冲突")
+		}
+		if fixed == nil {
+			fixed = &s.Expected.Selection
+		}
+	}
+	var records []record
+	var unreadable error
+	if s.Store != nil {
+		records, unreadable = s.Store.loadReferences(ref)
+	}
+	var task *Selection
+	for i := range records {
+		r := &records[i]
+		if r.Kind == "asset" {
+			continue
+		}
+		if task != nil && task.TeamID != r.TeamID {
+			return Selection{}, fmt.Errorf("thread/run 空间记录冲突；请先核实并修复本地记录")
+		}
+		task = &r.Selection
+	}
+	// Only explicit input permits recovery; a frozen choice does not.
+	if unreadable != nil && explicit == nil {
+		return Selection{}, fmt.Errorf("%w；核实原空间后用 --team-id <ID> 查询恢复，不要重新提交生成", unreadable)
+	}
+
+	// Keep selection priority in one place, whether or not a Store is available.
+	selected := Personal()
+	if fixed != nil {
+		selected = *fixed
+	} else if explicit != nil {
+		teamID, err := ParseTeamID(*explicit)
+		if err != nil {
+			return Selection{}, err
+		}
+		if teamID != "0" {
+			selected = Selection{TeamID: teamID, Name: "团队空间"}
+		}
+	} else if task != nil {
+		selected = *task
+	} else if s.Store != nil {
+		var err error
+		selected, err = s.Store.Current()
+		if err != nil {
+			return Selection{}, err
+		}
+	}
+	if task != nil && task.TeamID != selected.TeamID {
+		return Selection{}, fmt.Errorf("任务属于空间 %s，与本次空间 %s 冲突；请使用 --team-id %s 查询", task.TeamID, selected.TeamID, task.TeamID)
+	}
+	for _, r := range records {
+		if r.Kind == "asset" && r.TeamID != selected.TeamID {
+			return Selection{}, fmt.Errorf("素材属于空间 %s，与本次空间 %s 冲突；请使用相同空间的素材", r.TeamID, selected.TeamID)
+		}
+	}
+	if s.selected == nil {
+		s.selected = &selected
+		if s.Stderr != nil {
+			account := "个人"
+			if selected.TeamID != "0" {
+				account = "团队"
+			}
+			fmt.Fprintf(s.Stderr, "本次空间：%s（team_id=%s）；积分账户：%s\n", selected.Name, selected.TeamID, account)
+		}
+	}
+	return *s.selected, nil
+}
+
+func (s *Session) TeamID() string {
+	if s == nil || s.selected == nil {
+		return "0"
+	}
+	return s.selected.TeamID
+}
+
+func (s *Session) Token() string {
+	if s == nil || s.selected == nil || s.Store == nil {
+		return ""
+	}
+	data, _ := json.Marshal(Binding{Selection: Selection{TeamID: s.TeamID()}, Account: s.Store.Account, Origin: s.Store.Origin})
+	return base64.RawURLEncoding.EncodeToString(data)
+}
+
+func (s *Session) Remember(ref References) {
+	if s == nil || s.selected == nil || s.Store == nil || s.Store.Account == "" {
+		return
+	}
+	if err := s.Store.Remember(ref, *s.selected); err != nil && s.Stderr != nil {
+		fmt.Fprintf(s.Stderr, "请求已成功，但空间记录保存失败：%v；保留 thread_id=%s run_id=%s asset_ids=%v，后续使用 --team-id %s 查询，不要重复提交。\n", err, ref.ThreadID, ref.RunID, ref.AssetIDs, s.TeamID())
+	}
+}

package/internal/space/store.go

@@ -0,0 +1,211 @@
+package space
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+const Version = 1
+
+type Selection struct {
+	TeamID string `json:"team_id"`
+	Name   string `json:"name"`
+}
+
+type Binding struct {
+	Selection
+	Account string `json:"account_scope"`
+	Origin  string `json:"api_origin"`
+}
+
+type References struct {
+	ThreadID string   `json:"thread_id"`
+	RunID    string   `json:"run_id"`
+	AssetIDs []string `json:"asset_ids"`
+}
+
+type record struct {
+	Version int `json:"version"`
+	Binding
+	Kind     string `json:"kind"`
+	ID       string `json:"id"`
+	ThreadID string `json:"thread_id,omitempty"`
+}
+
+type Store struct {
+	Dir     string
+	Account string
+	Origin  string
+}
+
+func Digest(value string) string {
+	sum := sha256.Sum256([]byte(value))
+	return hex.EncodeToString(sum[:])
+}
+
+func ParseTeamID(raw string) (string, error) {
+	if raw == "" || strings.IndexFunc(raw, func(r rune) bool { return r < '0' || r > '9' }) >= 0 {
+		return "", fmt.Errorf("team-id 必须为 0 或正整数团队 ID")
+	}
+	n, err := strconv.ParseInt(raw, 10, 64)
+	if err != nil {
+		return "", fmt.Errorf("team-id 超出 int64 范围")
+	}
+	return strconv.FormatInt(n, 10), nil
+}
+
+func NormalizeOrigin(raw string) (string, error) {
+	u, err := url.Parse(raw)
+	if err != nil || u.Host == "" || (u.Scheme != "http" && u.Scheme != "https") || u.User != nil {
+		return "", fmt.Errorf("API origin 无效")
+	}
+	u.Scheme, u.Host = strings.ToLower(u.Scheme), strings.ToLower(u.Host)
+	if (u.Scheme == "https" && u.Port() == "443") || (u.Scheme == "http" && u.Port() == "80") {
+		u.Host = u.Hostname()
+		if strings.Contains(u.Host, ":") {
+			u.Host = "[" + u.Host + "]"
+		}
+	}
+	return u.Scheme + "://" + u.Host, nil
+}
+
+func NewStore(baseURL, account string) (*Store, error) {
+	origin, err := NormalizeOrigin(baseURL)
+	if err != nil {
+		return nil, err
+	}
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		return nil, err
+	}
+	return &Store{Dir: filepath.Join(dir, "pippit-cli", "spaces", Digest(origin+"\n"+account)), Account: account, Origin: origin}, nil
+}
+
+func Personal() Selection { return Selection{TeamID: "0", Name: "个人空间"} }
+
+func (s *Store) file(kind, id string) string {
+	return filepath.Join(s.Dir, kind+"-"+Digest(id)+".json")
+}
+
+func (s *Store) load(kind, id, thread string) (*record, error) {
+	data, err := os.ReadFile(s.file(kind, id))
+	if os.IsNotExist(err) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("无法读取%s空间记录: %w", kind, err)
+	}
+	var r record
+	if json.Unmarshal(data, &r) != nil || r.Version != Version || r.Account != s.Account || r.Origin != s.Origin || r.Kind != kind || r.ID != id || r.ThreadID != thread {
+		return nil, fmt.Errorf("%s空间记录损坏、身份不符或版本不支持", kind)
+	}
+	teamID, err := ParseTeamID(r.TeamID)
+	if err != nil || teamID != r.TeamID {
+		return nil, fmt.Errorf("%s空间记录的 team_id 无效", kind)
+	}
+	return &r, nil
+}
+
+func (s *Store) Current() (Selection, error) {
+	r, err := s.load("default", "", "")
+	if err != nil {
+		return Selection{}, fmt.Errorf("%w；可用 --team-id 指定本次空间", err)
+	}
+	if r == nil {
+		return Personal(), nil
+	}
+	return r.Selection, nil
+}
+
+func (s *Store) SaveDefault(selection Selection) error {
+	if s.Account == "" {
+		return fmt.Errorf("请先登录，再保存默认空间")
+	}
+	return s.save("default", "", "", selection)
+}
+
+func (s *Store) save(kind, id, thread string, selection Selection) error {
+	teamID, err := ParseTeamID(selection.TeamID)
+	if err != nil {
+		return err
+	}
+	selection.TeamID = teamID
+	data, err := json.Marshal(record{Version: Version, Binding: Binding{Selection: selection, Account: s.Account, Origin: s.Origin}, Kind: kind, ID: id, ThreadID: thread})
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(s.Dir, 0700); err != nil {
+		return err
+	}
+	f, err := os.CreateTemp(s.Dir, ".space-*.tmp")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(f.Name())
+	if _, err = f.Write(data); err != nil {
+		f.Close()
+		return err
+	}
+	if err = f.Sync(); err != nil {
+		f.Close()
+		return err
+	}
+	if err = f.Close(); err != nil {
+		return err
+	}
+	return os.Rename(f.Name(), s.file(kind, id))
+}
+
+// loadReferences returns readable records together with any read error, so a
+// caller recovering an unreadable record can still check the remaining records.
+func (s *Store) loadReferences(ref References) ([]record, error) {
+	var records []record
+	var unreadable error
+	for _, key := range referenceKeys(ref) {
+		r, err := s.load(key.kind, key.id, key.thread)
+		if err != nil {
+			unreadable = err
+		} else if r != nil {
+			records = append(records, *r)
+		}
+	}
+	return records, unreadable
+}
+
+type referenceKey struct{ kind, id, thread string }
+
+func referenceKeys(ref References) []referenceKey {
+	var keys []referenceKey
+	if ref.ThreadID != "" {
+		keys = append(keys, referenceKey{"thread", ref.ThreadID, ""})
+	}
+	if ref.RunID != "" {
+		keys = append(keys, referenceKey{"run", ref.RunID, ref.ThreadID})
+	}
+	for _, id := range ref.AssetIDs {
+		if id != "" {
+			keys = append(keys, referenceKey{"asset", id, ""})
+		}
+	}
+	return keys
+}
+
+func (s *Store) Remember(ref References, selected Selection) error {
+	for _, key := range referenceKeys(ref) {
+		old, err := s.load(key.kind, key.id, key.thread)
+		if err == nil && old != nil && old.TeamID != selected.TeamID {
+			return fmt.Errorf("拒绝覆盖归属不同的%s记录", key.kind)
+		}
+		if err := s.save(key.kind, key.id, key.thread, selected); err != nil {
+			return err
+		}
+	}
+	return nil
+}