@pippit-dev/cli 1.0.42 → 1.0.43

package/dist/checksums.txt

@@ -1,6 +1,6 @@
-a27b2392e4a291329599d6ee02dd704fde6eb2bf34f3390b30a973bce0009259  pippit-tool-cli-1.0.42-darwin-amd64.tar.gz
-921fa4fff779f0c7fca7a6176d0aa47c23fe3debd78df29d3bca50ae1eff0e54  pippit-tool-cli-1.0.42-darwin-arm64.tar.gz
-f786c2954c1d537638ef248c420bbf8d9fe8040f6ee6ce7a5467c6fe73689747  pippit-tool-cli-1.0.42-linux-amd64.tar.gz
-a6adb356975c1724e553ec8fdc9aa602a259a081171f41c84680946c1459cea9  pippit-tool-cli-1.0.42-linux-arm64.tar.gz
-9d1385bec216144594b83c42c244ebd9cc6eafe7758f54a1dc636f7ee231aea7  pippit-tool-cli-1.0.42-windows-amd64.zip
-008d4f238b2fd66db3e4ede1425ec6919853889359dd60b379939b7f73452154  pippit-tool-cli-1.0.42-windows-arm64.zip
+e7ee32acef1c0a16912c46500ae7f15c46d920953792d1012886fac7e6424b2e  pippit-tool-cli-1.0.43-darwin-amd64.tar.gz
+57e4df86eaa244cd9845eb966299c8c2e1186f74495da0c16f0b378fb4bc5125  pippit-tool-cli-1.0.43-darwin-arm64.tar.gz
+21823c7a675ebcaadebe2ddbfa0324b9e939220d4dd74d5d5d4546f5e6938060  pippit-tool-cli-1.0.43-linux-amd64.tar.gz
+e387bc8eaeafa430a9a594ed1cc381964953b598875b520a6d009a12aec9d619  pippit-tool-cli-1.0.43-linux-arm64.tar.gz
+4569d389a20c75f0485ecc24ad5034308a818f294886dabdf07b2804e915f3a2  pippit-tool-cli-1.0.43-windows-amd64.zip
+078fb4fb09353a58095e1370668884664aad1760ae065983bb23abfdcd9939d1  pippit-tool-cli-1.0.43-windows-arm64.zip

package/internal/adaptercli/commands_test.go

@@ -12,22 +12,26 @@ func TestConfigureDefaultAllowRootCommands(t *testing.T) {
 	for _, tc := range []struct {
 		name         string
 		defaultAllow bool
+		localAuth    bool
 		allowlist    []string
 		want         []string
 	}{
 		{name: "默认拒绝且 nil 白名单"},
 		{name: "默认拒绝且空白名单", allowlist: []string{}},
 		{name: "默认拒绝且有白名单", allowlist: []string{"canvas"}, want: []string{"canvas"}},
-		{name: "默认放行且 nil 白名单", defaultAllow: true, want: []string{"canvas", "future-command"}},
-		{name: "默认放行且空白名单", defaultAllow: true, allowlist: []string{}, want: []string{"canvas", "future-command"}},
-		{name: "默认放行且有白名单", defaultAllow: true, allowlist: []string{"canvas"}, want: []string{"canvas", "future-command"}},
+		{name: "默认放行且 nil 白名单", defaultAllow: true, want: []string{"canvas", "future-command", "space"}},
+		{name: "默认放行且空白名单", defaultAllow: true, allowlist: []string{}, want: []string{"canvas", "future-command", "space"}},
+		{name: "默认放行且有白名单", defaultAllow: true, allowlist: []string{"canvas"}, want: []string{"canvas", "future-command", "space"}},
+		{name: "启用本地账号", defaultAllow: true, localAuth: true, want: []string{"canvas", "future-command", "login", "logout", "space", "status"}},
+		{name: "启用本地账号仍受白名单限制", localAuth: true, allowlist: []string{"space"}, want: []string{"space"}},
+		{name: "关闭本地登录仍允许空间命令", allowlist: []string{"login", "logout", "space", "status"}, want: []string{"space"}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			root := &cobra.Command{Use: "tool"}
-			for _, name := range []string{"canvas", "future-command", "login", "logout", "status", "update"} {
+			for _, name := range []string{"canvas", "future-command", "login", "logout", "space", "status", "update"} {
 				root.AddCommand(&cobra.Command{Use: name})
 			}
-			Configure(root, adapter.CLIOptions{DefaultAllowRootCommands: tc.defaultAllow, AllowedRootCommands: tc.allowlist})
+			Configure(root, adapter.CLIOptions{DefaultAllowRootCommands: tc.defaultAllow, AllowedRootCommands: tc.allowlist, LocalCredentialsEnabled: tc.localAuth})
 			var got []string
 			for _, child := range root.Commands() {
 				got = append(got, child.Name())

package/internal/auth/space.go

@@ -0,0 +1,26 @@
+package auth
+
+import (
+	"context"
+	"errors"
+
+	"github.com/Pippit-dev/pippit-cli/internal/space"
+)
+
+// SpaceAccount uses the verified browser UID, stable across AK rotation.
+func (m *Manager) SpaceAccount(ctx context.Context) (string, error) {
+	// Re-read at request boundaries so an account switch in another process
+	// cannot keep using this process's cached identity or credential.
+	m.clearCredentialCache()
+	credential, err := m.loadCredential(ctx)
+	if errors.Is(err, ErrCredentialNotFound) {
+		return "", nil
+	}
+	if err != nil {
+		return "", err
+	}
+	if credential.UID == "" || credential.AccessKey == "" {
+		return "", nil
+	}
+	return "user:" + space.Digest(credential.UID), nil
+}

package/internal/auth/space_test.go

@@ -0,0 +1,42 @@
+package auth
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+)
+
+func TestSpaceAccountRefreshesCredentialAndSurvivesAKRotation(t *testing.T) {
+	ctx := context.Background()
+	cfg := config.Load()
+	cfg.AccessKey = ""
+	store := &memoryCredentialStore{credential: &Credential{UID: "user-a", AccessKey: "key-a", ExpiredAt: time.Now().Add(time.Hour).Unix()}}
+	manager := NewManager(cfg, WithCredentialStore(store))
+	a, err := manager.SpaceAccount(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(a, "user-a") || strings.Contains(a, "key-a") {
+		t.Fatal("raw identity leaked")
+	}
+	if err := store.Save(ctx, &Credential{UID: "user-a", AccessKey: "key-rotated", ExpiredAt: time.Now().Add(time.Hour).Unix()}); err != nil {
+		t.Fatal(err)
+	}
+	after, err := manager.SpaceAccount(ctx)
+	if err != nil || after != a {
+		t.Fatalf("rotation changed identity: %s, %v", after, err)
+	}
+	if key, err := manager.ResolveAccessKey(ctx); err != nil || key != "key-rotated" {
+		t.Fatalf("request used stale credential: %v", err)
+	}
+	if err := store.Save(ctx, &Credential{UID: "user-b", AccessKey: "key-b", ExpiredAt: time.Now().Add(time.Hour).Unix()}); err != nil {
+		t.Fatal(err)
+	}
+	b, err := manager.SpaceAccount(ctx)
+	if err != nil || b == a {
+		t.Fatal("new account inherited old identity", err)
+	}
+}

package/internal/canvas/get.go

@@ -14,6 +14,8 @@ type GetOptions struct {
 }
 
 type GetResult struct {
+	TeamID            string            `json:"team_id"`
+	SpaceContext      string            `json:"space_context,omitempty"`
 	RequestedAssetIDs []string          `json:"requested_asset_ids"`
 	Assets            []json.RawMessage `json:"assets"`
 	LogID             string            `json:"log_id,omitempty"`
@@ -77,11 +79,16 @@ func queryAssets(ctx context.Context, assetIDs []string, requireAll bool, runner
 			envelope.LogID,
 		)
 	}
-	return &GetResult{
+	result := &GetResult{
+		TeamID:            common.SpaceTeamID(ctx),
 		RequestedAssetIDs: append([]string(nil), assetIDs...),
 		Assets:            ordered,
 		LogID:             strings.TrimSpace(envelope.LogID),
-	}, nil
+	}
+	if session := common.SpaceSession(ctx); session != nil {
+		result.SpaceContext = session.Token()
+	}
+	return result, nil
 }
 
 func normalizeAssetIDs(values []string) ([]string, error) {

package/internal/commandnames/names.go

@@ -2,8 +2,13 @@
 package commandnames
 
 const (
-	Login  = "login"
-	Logout = "logout"
-	Status = "status"
-	Update = "update"
+	Login          = "login"
+	Logout         = "logout"
+	Status         = "status"
+	Space          = "space"
+	Update         = "update"
+	Completion     = "completion"
+	Help           = "help"
+	Model          = "model"
+	DownloadResult = "download-result"
 )

package/internal/common/client.go

@@ -90,6 +90,11 @@ func (c *httpClient) SendRequest(ctx context.Context, path string, body any, out
 }
 
 func (c *httpClient) SendRequestWithHeaders(ctx context.Context, path string, body any, headers map[string]string, out any) error {
+	var scopeErr error
+	ctx, scopeErr = c.prepareSpaceRequest(ctx, path, body)
+	if scopeErr != nil {
+		return scopeErr
+	}
 	method := http.MethodPost
 	if body == nil {
 		method = http.MethodGet
@@ -145,6 +150,11 @@ func (c *httpClient) SendRequestWithHeaders(ctx context.Context, path string, bo
 }
 
 func (c *httpClient) SendMultipartRequest(ctx context.Context, path string, fields map[string]string, file MultipartFile, out any) error {
+	var scopeErr error
+	ctx, scopeErr = c.prepareSpaceRequest(ctx, path, nil)
+	if scopeErr != nil {
+		return scopeErr
+	}
 	reqURL, err := c.resolveURL(path, nil)
 	if err != nil {
 		return err
@@ -242,6 +252,7 @@ func (c *httpClient) prepareRequest(ctx context.Context, req *http.Request, head
 	c.injectHeaders(req, headers)
 	// Rebuild the authentication header only for requests to the configured API origin; general request headers cannot override it.
 	req.Header.Del("Authorization")
+	req.Header.Del("X-Team-Id")
 	if !isAPIOrigin {
 		c.adapter.StripSensitiveHeaders(req)
 		return nil
@@ -250,6 +261,16 @@ func (c *httpClient) prepareRequest(ctx context.Context, req *http.Request, head
 	if err != nil {
 		return err
 	}
+	// The selected space, like credentials, is rebuilt only for the API origin.
+	if session := SpaceSession(ctx); session != nil {
+		if err := session.CheckIdentity(ctx); err != nil {
+			return err
+		}
+		req.Header.Del("X-Team-Id")
+		if session.TeamID() != "0" {
+			req.Header.Set("X-Team-Id", session.TeamID())
+		}
+	}
 	switch decision {
 	case adapter.AuthProvided:
 		return nil
@@ -313,6 +334,7 @@ func (c *httpClient) checkRedirect(req *http.Request, via []*http.Request) error
 	}
 	if !trusted {
 		req.Header.Del("Authorization")
+		req.Header.Del("X-Team-Id")
 		c.adapter.StripSensitiveHeaders(req)
 	}
 	return nil
@@ -362,6 +384,7 @@ func (c *httpClient) do(req *http.Request, out any) error {
 	if err := sonic.Unmarshal(data, out); err != nil {
 		return fmt.Errorf("解析响应体失败: %w", err)
 	}
+	rememberSpaceResponse(req.Context(), data)
 	return nil
 }
 

package/internal/common/host_source.go

@@ -22,6 +22,11 @@ func detectHostSource(getenv func(string) string) string {
 		{"CLAUDECODE", "claude_code"},
 		{"CURSOR_AGENT", "cursor"},
 		{"GEMINI_CLI", "gemini_cli"},
+		{"OPENCODE", "opencode"},
+		{"QWEN_CODE", "qwen_code"},
+		{"CLINE_ACTIVE", "cline"},
+		{"COPILOT_CLI", "github_copilot_cli"},
+		{"COPILOT_AGENT_SESSION_ID", "github_copilot_cli"},
 	} {
 		value := strings.ToLower(strings.TrimSpace(getenv(marker.key)))
 		if value == "" || value == "0" || value == "false" {

package/internal/common/host_source_test.go

@@ -14,9 +14,17 @@ func TestDetectHostSource(t *testing.T) {
 		{"claude", map[string]string{"CLAUDECODE": "1"}, "claude_code"},
 		{"cursor", map[string]string{"CURSOR_AGENT": "1"}, "cursor"},
 		{"gemini", map[string]string{"GEMINI_CLI": "1"}, "gemini_cli"},
+		{"opencode", map[string]string{"OPENCODE": "1"}, "opencode"},
+		{"qwen", map[string]string{"QWEN_CODE": "1"}, "qwen_code"},
+		{"cline", map[string]string{"CLINE_ACTIVE": " true "}, "cline"},
+		{"copilot cli", map[string]string{"COPILOT_CLI": "1"}, "github_copilot_cli"},
+		{"copilot session", map[string]string{"COPILOT_AGENT_SESSION_ID": "secret"}, "github_copilot_cli"},
+		{"copilot markers agree", map[string]string{"COPILOT_CLI": "1", "COPILOT_AGENT_SESSION_ID": "secret"}, "github_copilot_cli"},
 		{"ambiguous", map[string]string{"CODEX_THREAD_ID": "secret", "CURSOR_AGENT": "1"}, ""},
+		{"new markers conflict", map[string]string{"OPENCODE": "1", "CLINE_ACTIVE": "true"}, ""},
 		{"disabled markers", map[string]string{"CLAUDECODE": "0", "GEMINI_CLI": " false "}, ""},
-		{"configuration is not runtime evidence", map[string]string{"CODEX_HOME": "/home/example", "ANTHROPIC_API_KEY": "secret", "TERM_PROGRAM": "vscode"}, ""},
+		{"new markers disabled", map[string]string{"OPENCODE": "0", "QWEN_CODE": " FALSE ", "CLINE_ACTIVE": "", "COPILOT_CLI": "false", "COPILOT_AGENT_SESSION_ID": " "}, ""},
+		{"configuration is not runtime evidence", map[string]string{"CODEX_HOME": "/home/example", "ANTHROPIC_API_KEY": "secret", "TERM_PROGRAM": "vscode", "AGENT": "1", "OPENCODE_CONFIG": "/example/config.json", "QWEN_API_KEY": "secret", "COPILOT_HOME": "/example/copilot"}, ""},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			if got := detectHostSource(func(key string) string { return tc.env[key] }); got != tc.want {

package/internal/common/runner.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/Pippit-dev/pippit-cli/internal/auth"
 	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/Pippit-dev/pippit-cli/internal/space"
 )
 
 // AuthManager is the credential boundary shared by native CLI commands. It
@@ -20,9 +21,10 @@ type AuthManager interface {
 
 // Runner carries runtime dependencies for command execution.
 type Runner struct {
-	Config *config.Config
-	Client Client
-	Auth   AuthManager
+	Config     *config.Config
+	Client     Client
+	Auth       AuthManager
+	SpaceStore *space.Store
 }
 
 func NewRunner(cfg *config.Config, client Client) *Runner {

package/internal/common/space.go

@@ -0,0 +1,185 @@
+package common
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/url"
+
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/Pippit-dev/pippit-cli/internal/space"
+)
+
+type spaceContextKey struct{}
+type spaceRequestKey struct{}
+type spaceRequest struct {
+	operation string
+	refs      space.References
+}
+
+func WithSpace(ctx context.Context, session *space.Session) context.Context {
+	return context.WithValue(ctx, spaceContextKey{}, session)
+}
+
+func SpaceSession(ctx context.Context) *space.Session {
+	session, _ := ctx.Value(spaceContextKey{}).(*space.Session)
+	return session
+}
+
+func SpaceTeamID(ctx context.Context) string { return SpaceSession(ctx).TeamID() }
+
+// spaceOperation classifies successful responses for local records only.
+// It does not decide whether a request carries the selected TeamID.
+func spaceOperation(path string) string {
+	u, err := url.Parse(path)
+	if err != nil {
+		return ""
+	}
+	switch u.Path {
+	case config.SubmitRunPath, config.SubmitMarketingRunPath:
+		return "submit"
+	case config.GetThreadPath, config.QueryGenerateVideoResultPath:
+		return "query"
+	case config.ListThreadFilePath:
+		return "files"
+	case config.UploadFilePath:
+		return "upload"
+	}
+	return ""
+}
+
+func SpaceReferences(body any) (space.References, error) {
+	var ref space.References
+	if body == nil {
+		return ref, nil
+	}
+	data, err := json.Marshal(body)
+	if err != nil {
+		return ref, err
+	}
+	if err := json.Unmarshal(data, &ref); err != nil {
+		return ref, fmt.Errorf("任务或素材 ID 格式无效: %w", err)
+	}
+	return ref, nil
+}
+
+func (c *httpClient) prepareSpaceRequest(ctx context.Context, path string, body any) (context.Context, error) {
+	session := SpaceSession(ctx)
+	if session == nil {
+		return ctx, nil
+	}
+	if target, err := url.Parse(path); err == nil && target.IsAbs() {
+		trusted, err := c.isBaseURLOrigin(target)
+		if err != nil {
+			return ctx, err
+		}
+		if !trusted {
+			return ctx, nil
+		}
+	}
+	ref, err := SpaceReferences(body)
+	if err != nil {
+		return ctx, err
+	}
+	if _, err := session.Resolve(ref); err != nil {
+		return ctx, err
+	}
+	return context.WithValue(ctx, spaceRequestKey{}, spaceRequest{operation: spaceOperation(path), refs: ref}), nil
+}
+
+func rememberSpaceResponse(ctx context.Context, data []byte) {
+	session := SpaceSession(ctx)
+	request, ok := ctx.Value(spaceRequestKey{}).(spaceRequest)
+	if session == nil || !ok || request.operation == "" {
+		return
+	}
+	var response struct {
+		Ret  json.RawMessage `json:"ret"`
+		Data *struct {
+			ThreadID      string `json:"thread_id"`
+			RunID         string `json:"run_id"`
+			PippitAssetID string `json:"pippit_asset_id"`
+			Run           struct {
+				ThreadID string `json:"thread_id"`
+				RunID    string `json:"run_id"`
+			} `json:"run"`
+		} `json:"data"`
+	}
+	if json.Unmarshal(data, &response) != nil || response.Data == nil || (string(response.Ret) != `"0"` && string(response.Ret) != "0") {
+		return
+	}
+	ref := request.refs
+	switch request.operation {
+	case "submit":
+		if response.Data.Run.ThreadID == "" || response.Data.Run.RunID == "" {
+			return
+		}
+		if ref.ThreadID != "" && ref.ThreadID != response.Data.Run.ThreadID {
+			return
+		}
+		ref.ThreadID, ref.RunID = response.Data.Run.ThreadID, response.Data.Run.RunID
+	case "query", "files":
+		if ref.ThreadID == "" {
+			return
+		}
+		if response.Data.ThreadID != "" && response.Data.ThreadID != ref.ThreadID {
+			return
+		}
+		if response.Data.RunID != "" && response.Data.RunID != ref.RunID {
+			return
+		}
+	case "upload":
+		if response.Data.PippitAssetID == "" {
+			return
+		}
+		ref.AssetIDs = []string{response.Data.PippitAssetID}
+	default:
+		return
+	}
+	session.Remember(ref)
+}
+
+func SpaceAccount(ctx context.Context, runner *Runner) (string, error) {
+	// Without an AuthManager, authentication belongs to the adapter. An unused
+	// environment AK must not stand in for the adapter's actual account.
+	if runner.Auth == nil {
+		return "", nil
+	}
+	if provider, ok := runner.Auth.(interface {
+		SpaceAccount(context.Context) (string, error)
+	}); ok {
+		return provider.SpaceAccount(ctx)
+	}
+	status, err := runner.Auth.Status(ctx)
+	if err != nil {
+		return "", err
+	}
+	if status != nil && status.UID != "" {
+		return "user:" + space.Digest(status.UID), nil
+	}
+	return "", nil
+}
+
+// SpaceStoreForRunner returns nil when the current account cannot be identified.
+// Callers can use an explicit space without persisting local records.
+func SpaceStoreForRunner(ctx context.Context, runner *Runner) (*space.Store, error) {
+	account, err := SpaceAccount(ctx, runner)
+	if err != nil {
+		return nil, err
+	}
+	if account == "" {
+		return nil, nil
+	}
+	base := config.DefaultBaseURL
+	if runner.Config != nil && runner.Config.BaseURL != "" {
+		base = runner.Config.BaseURL
+	}
+	store, err := space.NewStore(base, account)
+	if err != nil {
+		return nil, err
+	}
+	if runner.SpaceStore != nil {
+		store.Dir = runner.SpaceStore.Dir
+	}
+	return store, nil
+}

package/internal/common/space_test.go

@@ -0,0 +1,132 @@
+package common
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/Pippit-dev/pippit-cli/internal/space"
+)
+
+type spaceRewriteAdapter struct{ adapter.Default }
+
+func (spaceRewriteAdapter) PrepareAPIRequest(_ context.Context, r *http.Request) (adapter.AuthDecision, error) {
+	r.URL.Path = "/rewritten" + r.URL.Path
+	return adapter.UseDefaultAuth, nil
+}
+
+func TestSpaceHeadersAndTaskRecoveryThroughHTTP(t *testing.T) {
+	var headers []string
+	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		headers = append(headers, r.Header.Get("X-Team-Id"))
+		if r.Header.Get("Authorization") != "Bearer test-key" {
+			t.Error("missing authorization")
+		}
+		_, _ = io.Copy(io.Discard, r.Body)
+		switch r.URL.Path {
+		case config.UploadFilePath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"pippit_asset_id":"asset"}}`))
+		case config.SubmitRunPath:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{"run":{"thread_id":"thread","run_id":"run"}}}`))
+		default:
+			_, _ = w.Write([]byte(`{"ret":"0","data":{}}`))
+		}
+	}))
+	defer api.Close()
+	store := &space.Store{Dir: t.TempDir(), Account: "account", Origin: api.URL}
+	if err := store.SaveDefault(space.Selection{TeamID: "12", Name: "A"}); err != nil {
+		t.Fatal(err)
+	}
+	account, identityChecks := store.Account, 0
+	ctx := WithSpace(context.Background(), &space.Session{Store: store, Identity: func(context.Context) (string, error) {
+		identityChecks++
+		return account, nil
+	}})
+	client := NewHTTPClient(api.URL, time.Second, NewAccessKeyAuthorizer("test-key"))
+	file := filepath.Join(t.TempDir(), "image.png")
+	if err := os.WriteFile(file, []byte("image"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	var result map[string]any
+	if err := client.SendMultipartRequest(ctx, config.UploadFilePath, nil, MultipartFile{FieldName: "file", Path: file}, &result); err != nil {
+		t.Fatal(err)
+	}
+	if identityChecks != 1 {
+		t.Fatalf("identity checks per request = %d, want 1", identityChecks)
+	}
+	if err := store.SaveDefault(space.Selection{TeamID: "34", Name: "B"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := client.SendRequest(ctx, config.SubmitRunPath, map[string]any{"asset_ids": []string{"asset"}}, &result); err != nil {
+		t.Fatal(err)
+	}
+	// A new command recovers the original task even after a saved-space switch.
+	queryCtx := WithSpace(context.Background(), &space.Session{Store: store})
+	if err := client.SendRequest(queryCtx, api.URL+config.GetThreadPath, space.References{ThreadID: "thread", RunID: "run"}, &result); err != nil {
+		t.Fatal(err)
+	}
+	if err := client.SendRequestWithHeaders(ctx, config.GetAvailableModelListPath, nil, map[string]string{"X-Team-Id": "999"}, &result); err != nil {
+		t.Fatal(err)
+	}
+	zero := "0"
+	personal := WithSpace(context.Background(), &space.Session{Store: store, Explicit: &zero})
+	if err := client.SendRequest(personal, config.GetCreditBalancePath, struct{}{}, &result); err != nil {
+		t.Fatal(err)
+	}
+	for i, want := range []string{"12", "12", "12", "12", ""} {
+		if headers[i] != want {
+			t.Errorf("request %d team = %q, want %q", i, headers[i], want)
+		}
+	}
+	other := "34"
+	conflict := WithSpace(context.Background(), &space.Session{Store: store, Explicit: &other})
+	if err := client.SendRequest(conflict, config.GetThreadPath, space.References{ThreadID: "thread", RunID: "run"}, &result); err == nil {
+		t.Fatal("conflict sent")
+	}
+	if len(headers) != 5 {
+		t.Fatal("conflict reached API")
+	}
+	// A new API path still receives the selected space without a client allowlist.
+	unlisted := WithSpace(context.Background(), &space.Session{Store: store})
+	if err := client.SendRequest(unlisted, "/api/unlisted", struct{}{}, &result); err != nil {
+		t.Fatal(err)
+	}
+	if headers[len(headers)-1] != "34" {
+		t.Fatal("unlisted API did not receive the saved team")
+	}
+	foreign := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("X-Team-Id") != "" || r.Header.Get("Authorization") != "" {
+			t.Error("foreign origin received sensitive headers")
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	defer foreign.Close()
+	// A matching path on another origin must bypass both scope lookup and headers.
+	if err := client.SendRequestWithHeaders(conflict, foreign.URL+config.GetThreadPath, space.References{ThreadID: "thread", RunID: "run"}, map[string]string{"X-Team-Id": "999"}, &result); err != nil {
+		t.Fatal(err)
+	}
+	// Path rewriting by an adapter must preserve the original operation's scope.
+	rewritten := NewHTTPClientWithAdapter(api.URL, time.Second, NewAccessKeyAuthorizer("test-key"), spaceRewriteAdapter{})
+	if err := rewritten.SendRequest(ctx, config.GetCreditBalancePath, struct{}{}, &result); err != nil {
+		t.Fatal(err)
+	}
+	if headers[len(headers)-1] != "12" {
+		t.Fatal("adapter dropped space")
+	}
+	// Even with a frozen space, a changed account must stop before sending.
+	account = "other-account"
+	before := len(headers)
+	if err := client.SendRequest(ctx, config.GetCreditBalancePath, struct{}{}, &result); err == nil {
+		t.Fatal("account switch accepted")
+	}
+	if len(headers) != before {
+		t.Fatal("account switch reached API")
+	}
+}

package/internal/common/submit_run.go

@@ -15,6 +15,7 @@ const AgentNameVideoPart = "pippit_video_part_agent"
 
 // SubmitRunResult is the shared successful submit_run output.
 type SubmitRunResult struct {
+	TeamID        string `json:"team_id"`
 	ThreadID      string `json:"thread_id"`
 	RunID         string `json:"run_id"`
 	WebThreadLink string `json:"web_thread_link"`
@@ -86,6 +87,7 @@ func submitRun(ctx context.Context, command, path string, body any, runner *Runn
 	}
 
 	return &SubmitRunResult{
+		TeamID:        SpaceTeamID(ctx),
 		ThreadID:      resp.Data.Run.ThreadID,
 		RunID:         resp.Data.Run.RunID,
 		WebThreadLink: resp.Data.WebThreadLink,

package/internal/common/upload_file.go

@@ -20,6 +20,7 @@ type UploadFileOptions struct {
 
 // UploadFileResult is the shared JSON output for media and short-drama uploads.
 type UploadFileResult struct {
+	TeamID  string `json:"team_id"`
 	AssetID string `json:"asset_id"`
 }
 
@@ -102,6 +103,7 @@ func UploadFile(ctx context.Context, opts UploadFileOptions, runner *Runner) (*U
 	}
 
 	return &UploadFileResult{
+		TeamID:  SpaceTeamID(ctx),
 		AssetID: assetID,
 	}, nil
 }

package/internal/config/config.go

@@ -12,18 +12,21 @@ import (
 )
 
 const (
-	DefaultBaseURL              = "https://xyq.jianying.com"
-	DefaultHTTPTimeout          = 30 * time.Minute
-	DefaultAuthTTL              = 30 * time.Second
-	DefaultAuthStoreServiceName = "pippit-cli"
-	SubmitRunPath               = "/api/biz/v1/skill/submit_run"
-	GetCreditBalancePath        = "/api/biz/v1/skill/get_credit_balance"
-	GetAvailableModelListPath   = "/api/biz/v1/skill/get_available_model_list"
-	GetThreadPath               = "/api/biz/v1/skill/get_thread"
-	UploadFilePath              = "/api/biz/v1/skill/upload_file"
-	ListThreadFilePath          = "/api/biz/v1/skill/list_thread_file"
-	EnvXYQAccessKey             = "XYQ_ACCESS_KEY"
-	FileName                    = "config.toml"
+	DefaultBaseURL               = "https://xyq.jianying.com"
+	DefaultHTTPTimeout           = 30 * time.Minute
+	DefaultAuthTTL               = 30 * time.Second
+	DefaultAuthStoreServiceName  = "pippit-cli"
+	SubmitRunPath                = "/api/biz/v1/skill/submit_run"
+	SubmitMarketingRunPath       = "/api/biz/v1/agent/submit_marketing_run"
+	QueryGenerateVideoResultPath = "/api/biz/v1/agent/query_generate_video_result"
+	GetCreditBalancePath         = "/api/biz/v1/skill/get_credit_balance"
+	GetLiteTeamListPath          = "/api/biz/v1/skill/get_lite_team_list"
+	GetAvailableModelListPath    = "/api/biz/v1/skill/get_available_model_list"
+	GetThreadPath                = "/api/biz/v1/skill/get_thread"
+	UploadFilePath               = "/api/biz/v1/skill/upload_file"
+	ListThreadFilePath           = "/api/biz/v1/skill/list_thread_file"
+	EnvXYQAccessKey              = "XYQ_ACCESS_KEY"
+	FileName                     = "config.toml"
 )
 
 // Config holds runtime settings selected by the root command and passed down