@pippit-dev/cli 1.0.42 → 1.0.44

package/dist/checksums.txt

@@ -1,6 +1,6 @@
-a27b2392e4a291329599d6ee02dd704fde6eb2bf34f3390b30a973bce0009259  pippit-tool-cli-1.0.42-darwin-amd64.tar.gz
-921fa4fff779f0c7fca7a6176d0aa47c23fe3debd78df29d3bca50ae1eff0e54  pippit-tool-cli-1.0.42-darwin-arm64.tar.gz
-f786c2954c1d537638ef248c420bbf8d9fe8040f6ee6ce7a5467c6fe73689747  pippit-tool-cli-1.0.42-linux-amd64.tar.gz
-a6adb356975c1724e553ec8fdc9aa602a259a081171f41c84680946c1459cea9  pippit-tool-cli-1.0.42-linux-arm64.tar.gz
-9d1385bec216144594b83c42c244ebd9cc6eafe7758f54a1dc636f7ee231aea7  pippit-tool-cli-1.0.42-windows-amd64.zip
-008d4f238b2fd66db3e4ede1425ec6919853889359dd60b379939b7f73452154  pippit-tool-cli-1.0.42-windows-arm64.zip
+8bf338b7fc4bb3de289778896059f364f91743e7fe3127380e193f29bb10fecf  pippit-tool-cli-1.0.44-darwin-amd64.tar.gz
+fd7aac74fda167481b76e3a7aa2f30e45271670cad11f0e969080db1b135411a  pippit-tool-cli-1.0.44-darwin-arm64.tar.gz
+526e3641047d7e997fb5c271d795337692b0a47c092622747f6e2b4e9d22e473  pippit-tool-cli-1.0.44-linux-amd64.tar.gz
+6170436a3ec60dc2a2681e6f790c6a52d9daa4248ce8c3eede83136a62ccb4b6  pippit-tool-cli-1.0.44-linux-arm64.tar.gz
+d3c7166314bb52deae5e0caf383ac7e3cdde27c61325d6556de43f8f46aa9963  pippit-tool-cli-1.0.44-windows-amd64.zip
+9cb3d470688cd89a42a2267d9d181159dd624937c9590d3b744db25a66edbac9  pippit-tool-cli-1.0.44-windows-arm64.zip

package/internal/adaptercli/commands_test.go

@@ -12,22 +12,26 @@ func TestConfigureDefaultAllowRootCommands(t *testing.T) {
 	for _, tc := range []struct {
 		name         string
 		defaultAllow bool
+		localAuth    bool
 		allowlist    []string
 		want         []string
 	}{
 		{name: "默认拒绝且 nil 白名单"},
 		{name: "默认拒绝且空白名单", allowlist: []string{}},
 		{name: "默认拒绝且有白名单", allowlist: []string{"canvas"}, want: []string{"canvas"}},
-		{name: "默认放行且 nil 白名单", defaultAllow: true, want: []string{"canvas", "future-command"}},
-		{name: "默认放行且空白名单", defaultAllow: true, allowlist: []string{}, want: []string{"canvas", "future-command"}},
-		{name: "默认放行且有白名单", defaultAllow: true, allowlist: []string{"canvas"}, want: []string{"canvas", "future-command"}},
+		{name: "默认放行且 nil 白名单", defaultAllow: true, want: []string{"canvas", "future-command", "space"}},
+		{name: "默认放行且空白名单", defaultAllow: true, allowlist: []string{}, want: []string{"canvas", "future-command", "space"}},
+		{name: "默认放行且有白名单", defaultAllow: true, allowlist: []string{"canvas"}, want: []string{"canvas", "future-command", "space"}},
+		{name: "启用本地账号", defaultAllow: true, localAuth: true, want: []string{"canvas", "future-command", "login", "logout", "space", "status"}},
+		{name: "启用本地账号仍受白名单限制", localAuth: true, allowlist: []string{"space"}, want: []string{"space"}},
+		{name: "关闭本地登录仍允许空间命令", allowlist: []string{"login", "logout", "space", "status"}, want: []string{"space"}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			root := &cobra.Command{Use: "tool"}
-			for _, name := range []string{"canvas", "future-command", "login", "logout", "status", "update"} {
+			for _, name := range []string{"canvas", "future-command", "login", "logout", "space", "status", "update"} {
 				root.AddCommand(&cobra.Command{Use: name})
 			}
-			Configure(root, adapter.CLIOptions{DefaultAllowRootCommands: tc.defaultAllow, AllowedRootCommands: tc.allowlist})
+			Configure(root, adapter.CLIOptions{DefaultAllowRootCommands: tc.defaultAllow, AllowedRootCommands: tc.allowlist, LocalCredentialsEnabled: tc.localAuth})
 			var got []string
 			for _, child := range root.Commands() {
 				got = append(got, child.Name())

package/internal/auth/auth_test.go

@@ -96,7 +96,7 @@ func (s *memoryCredentialStore) Delete(ctx context.Context) error {
 }
 
 func TestBrowserFlowUsesDedicatedPageAndStrictBoundCallback(t *testing.T) {
-	authURL, _ := url.Parse(config.DefaultBaseURL)
+	authURL, _ := url.Parse(config.DefaultAuthBaseURL)
 	deviceID, _ := randomEncoded(bytes.NewReader(bytes.Repeat([]byte{0x21}, deviceIDBytes)), deviceIDBytes)
 	flow, err := startBrowserFlow(
 		authURL, bytes.NewReader(bytes.Repeat([]byte{0x42}, 2*randomBindingBytes)),
@@ -111,7 +111,7 @@ func TestBrowserFlowUsesDedicatedPageAndStrictBoundCallback(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if loginURL.Scheme+"://"+loginURL.Host != config.DefaultBaseURL || loginURL.Path != loginPagePath {
+	if loginURL.Scheme+"://"+loginURL.Host != config.DefaultAuthBaseURL || loginURL.Path != loginPagePath {
 		t.Fatalf("login URL target = %s://%s%s", loginURL.Scheme, loginURL.Host, loginURL.Path)
 	}
 	query := loginURL.Query()
@@ -152,30 +152,30 @@ func TestBrowserFlowUsesDedicatedPageAndStrictBoundCallback(t *testing.T) {
 	}
 	wrongSecret := payload
 	wrongSecret.RandomSecretKey = "wrong-secret"
-	if status := sendCallback(t, callbackURL, config.DefaultBaseURL, wrongSecret); status != http.StatusBadRequest {
+	if status := sendCallback(t, callbackURL, config.DefaultAuthBaseURL, wrongSecret); status != http.StatusBadRequest {
 		t.Fatalf("wrong secret status = %d", status)
 	}
-	if status := postRawCallback(t, callbackURL, config.DefaultBaseURL, `{"type":"access_key","unknown":true}`); status != http.StatusBadRequest {
+	if status := postRawCallback(t, callbackURL, config.DefaultAuthBaseURL, `{"type":"access_key","unknown":true}`); status != http.StatusBadRequest {
 		t.Fatalf("unknown field status = %d", status)
 	}
-	if status := sendCallback(t, callbackURL+"&state=duplicate", config.DefaultBaseURL, payload); status != http.StatusBadRequest {
+	if status := sendCallback(t, callbackURL+"&state=duplicate", config.DefaultAuthBaseURL, payload); status != http.StatusBadRequest {
 		t.Fatalf("duplicate state status = %d", status)
 	}
-	if status := sendCallback(t, callbackURL+"&unexpected=value", config.DefaultBaseURL, payload); status != http.StatusBadRequest {
+	if status := sendCallback(t, callbackURL+"&unexpected=value", config.DefaultAuthBaseURL, payload); status != http.StatusBadRequest {
 		t.Fatalf("unexpected transport query status = %d", status)
 	}
-	if status := sendPreflight(t, callbackURL, config.DefaultBaseURL); status != http.StatusNoContent {
+	if status := sendPreflight(t, callbackURL, config.DefaultAuthBaseURL); status != http.StatusNoContent {
 		t.Fatalf("preflight status = %d", status)
 	}
 	securityRuntimeCallback := callbackURL + "&a_bogus=signed-request&msToken=transport-token"
-	if status := sendCallback(t, securityRuntimeCallback, config.DefaultBaseURL, payload); status != http.StatusOK {
+	if status := sendCallback(t, securityRuntimeCallback, config.DefaultAuthBaseURL, payload); status != http.StatusOK {
 		t.Fatalf("security-runtime callback status = %d", status)
 	}
 	got, err := flow.wait(context.Background())
 	if err != nil || got.AccessKey != payload.AccessKey || got.UID != payload.UID || got.TokenID != payload.TokenID {
 		t.Fatalf("callback payload = %#v, %v", credentialPayloadWithoutSecret(got), err)
 	}
-	if status := sendCallback(t, callbackURL, config.DefaultBaseURL, payload); status != http.StatusConflict {
+	if status := sendCallback(t, callbackURL, config.DefaultAuthBaseURL, payload); status != http.StatusConflict {
 		t.Fatalf("replayed callback status = %d", status)
 	}
 }
@@ -185,6 +185,7 @@ func TestManagerLoginStoresPageIssuedCredentialWithoutServerExchange(t *testing.
 	store := &memoryCredentialStore{}
 	cfg := config.Load()
 	cfg.AccessKey = ""
+	cfg.BaseURL = "https://untrusted.invalid"
 	manager := NewManager(
 		cfg,
 		WithCredentialStore(store),
@@ -204,6 +205,9 @@ func TestManagerLoginStoresPageIssuedCredentialWithoutServerExchange(t *testing.
 			if parseErr != nil {
 				return parseErr
 			}
+			if loginURL.Scheme != "https" || loginURL.Host != "www.xiaoyunque.com" {
+				t.Errorf("login origin = %s://%s, want https://www.xiaoyunque.com", loginURL.Scheme, loginURL.Host)
+			}
 			if loginURL.Path != loginPagePath || loginURL.Query().Get("force") != "" {
 				return fmt.Errorf("unexpected login URL")
 			}
@@ -218,7 +222,7 @@ func TestManagerLoginStoresPageIssuedCredentialWithoutServerExchange(t *testing.
 				Source:          loginSource,
 				CallbackURL:     loginURL.Query().Get("callback"),
 			}
-			if status := sendCallback(t, payload.CallbackURL, config.DefaultBaseURL, payload); status != http.StatusOK {
+			if status := sendCallback(t, payload.CallbackURL, loginURL.Scheme+"://"+loginURL.Host, payload); status != http.StatusOK {
 				return fmt.Errorf("callback status %d", status)
 			}
 			return nil
@@ -273,7 +277,7 @@ func TestManagerWaitsForCallbackWhenBrowserOpenFails(t *testing.T) {
 				Source:          loginSource,
 				CallbackURL:     loginURL.Query().Get("callback"),
 			}
-			if status := sendCallback(t, payload.CallbackURL, config.DefaultBaseURL, payload); status != http.StatusOK {
+			if status := sendCallback(t, payload.CallbackURL, config.DefaultAuthBaseURL, payload); status != http.StatusOK {
 				return fmt.Errorf("callback status %d", status)
 			}
 			return errors.New("browser opener unavailable")
@@ -347,7 +351,7 @@ func TestManagerReauthenticationPinsAccountAndRequiresRotation(t *testing.T) {
 }
 
 func TestBrowserFlowRequiresExpectedAccountForForceAndNeverUsesRawUID(t *testing.T) {
-	authURL, _ := url.Parse(config.DefaultBaseURL)
+	authURL, _ := url.Parse(config.DefaultAuthBaseURL)
 	deviceID, _ := randomEncoded(bytes.NewReader(bytes.Repeat([]byte{0x22}, deviceIDBytes)), deviceIDBytes)
 	if _, err := startBrowserFlow(
 		authURL, bytes.NewReader(bytes.Repeat([]byte{0x42}, 2*randomBindingBytes)),
@@ -378,7 +382,7 @@ func TestBrowserFlowRequiresExpectedAccountForForceAndNeverUsesRawUID(t *testing
 }
 
 func TestBrowserFlowSendsStoredTokenIDOnNormalLogin(t *testing.T) {
-	authURL, _ := url.Parse(config.DefaultBaseURL)
+	authURL, _ := url.Parse(config.DefaultAuthBaseURL)
 	deviceID, _ := randomEncoded(bytes.NewReader(bytes.Repeat([]byte{0x23}, deviceIDBytes)), deviceIDBytes)
 	flow, err := startBrowserFlow(
 		authURL, bytes.NewReader(bytes.Repeat([]byte{0x44}, 2*randomBindingBytes)),
@@ -398,7 +402,7 @@ func TestBrowserFlowSendsStoredTokenIDOnNormalLogin(t *testing.T) {
 }
 
 func TestBrowserFlowAllowsLogoutIdentityTokenWithoutAccountBinding(t *testing.T) {
-	authURL, _ := url.Parse(config.DefaultBaseURL)
+	authURL, _ := url.Parse(config.DefaultAuthBaseURL)
 	deviceID, _ := randomEncoded(bytes.NewReader(bytes.Repeat([]byte{0x24}, deviceIDBytes)), deviceIDBytes)
 	flow, err := startBrowserFlow(
 		authURL, bytes.NewReader(bytes.Repeat([]byte{0x45}, 2*randomBindingBytes)),
@@ -464,7 +468,7 @@ func TestManagerDerivesExpectedAccountFromDurableScope(t *testing.T) {
 				Source:          loginSource,
 				CallbackURL:     loginURL.Query().Get("callback"),
 			}
-			if status := sendCallback(t, payload.CallbackURL, config.DefaultBaseURL, payload); status != http.StatusOK {
+			if status := sendCallback(t, payload.CallbackURL, config.DefaultAuthBaseURL, payload); status != http.StatusOK {
 				return fmt.Errorf("callback status %d", status)
 			}
 			return nil
@@ -488,7 +492,7 @@ func TestResolveStatusLogoutAndAuthOrigin(t *testing.T) {
 	cfg.AccessKey = " env-ak "
 	cfg.BaseURL = "https://untrusted.invalid"
 	manager := NewManager(cfg, WithCredentialStore(store), withClockForTest(func() time.Time { return fixedNow }))
-	if manager.authBaseURL.String() != config.DefaultBaseURL {
+	if manager.authBaseURL.String() != config.DefaultAuthBaseURL {
 		t.Fatalf("browser login followed runtime business base URL: %q", manager.authBaseURL)
 	}
 	if key, err := manager.ResolveAccessKey(context.Background()); err != nil || key != "env-ak" {
@@ -738,7 +742,7 @@ func callbackOpener(t *testing.T, expiry time.Time, uid, tokenID, accessKey stri
 			Source:          loginSource,
 			CallbackURL:     loginURL.Query().Get("callback"),
 		}
-		if status := sendCallback(t, payload.CallbackURL, config.DefaultBaseURL, payload); status != http.StatusOK {
+		if status := sendCallback(t, payload.CallbackURL, config.DefaultAuthBaseURL, payload); status != http.StatusOK {
 			return fmt.Errorf("callback status %d", status)
 		}
 		return nil

package/internal/auth/loopback_origins_test.go

@@ -16,7 +16,7 @@ import (
 
 func newOriginTestFlow(t *testing.T) (*browserFlow, accessKeyPayload) {
 	t.Helper()
-	authURL, _ := url.Parse(config.DefaultBaseURL)
+	authURL, _ := url.Parse(config.DefaultAuthBaseURL)
 	deviceID, _ := randomEncoded(bytes.NewReader(bytes.Repeat([]byte{0x21}, deviceIDBytes)), deviceIDBytes)
 	flow, err := startBrowserFlow(authURL, bytes.NewReader(bytes.Repeat([]byte{0x42}, 2*randomBindingBytes)), deviceID, "", "", false)
 	if err != nil {

package/internal/auth/manager.go

@@ -46,7 +46,7 @@ func WithCredentialStore(store CredentialStore) ManagerOption {
 // API configuration does not affect the browser identity origin.
 func NewManager(cfg *config.Config, options ...ManagerOption) *Manager {
 	serviceName := config.DefaultAuthStoreServiceName
-	authBaseURL, _ := url.Parse(config.DefaultBaseURL)
+	authBaseURL, _ := url.Parse(config.DefaultAuthBaseURL)
 	manager := &Manager{
 		localCredentialsEnabled: true,
 		cfg:                     cfg,

package/internal/auth/space.go

@@ -0,0 +1,26 @@
+package auth
+
+import (
+	"context"
+	"errors"
+
+	"github.com/Pippit-dev/pippit-cli/internal/space"
+)
+
+// SpaceAccount uses the verified browser UID, stable across AK rotation.
+func (m *Manager) SpaceAccount(ctx context.Context) (string, error) {
+	// Re-read at request boundaries so an account switch in another process
+	// cannot keep using this process's cached identity or credential.
+	m.clearCredentialCache()
+	credential, err := m.loadCredential(ctx)
+	if errors.Is(err, ErrCredentialNotFound) {
+		return "", nil
+	}
+	if err != nil {
+		return "", err
+	}
+	if credential.UID == "" || credential.AccessKey == "" {
+		return "", nil
+	}
+	return "user:" + space.Digest(credential.UID), nil
+}

package/internal/auth/space_test.go

@@ -0,0 +1,42 @@
+package auth
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+)
+
+func TestSpaceAccountRefreshesCredentialAndSurvivesAKRotation(t *testing.T) {
+	ctx := context.Background()
+	cfg := config.Load()
+	cfg.AccessKey = ""
+	store := &memoryCredentialStore{credential: &Credential{UID: "user-a", AccessKey: "key-a", ExpiredAt: time.Now().Add(time.Hour).Unix()}}
+	manager := NewManager(cfg, WithCredentialStore(store))
+	a, err := manager.SpaceAccount(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(a, "user-a") || strings.Contains(a, "key-a") {
+		t.Fatal("raw identity leaked")
+	}
+	if err := store.Save(ctx, &Credential{UID: "user-a", AccessKey: "key-rotated", ExpiredAt: time.Now().Add(time.Hour).Unix()}); err != nil {
+		t.Fatal(err)
+	}
+	after, err := manager.SpaceAccount(ctx)
+	if err != nil || after != a {
+		t.Fatalf("rotation changed identity: %s, %v", after, err)
+	}
+	if key, err := manager.ResolveAccessKey(ctx); err != nil || key != "key-rotated" {
+		t.Fatalf("request used stale credential: %v", err)
+	}
+	if err := store.Save(ctx, &Credential{UID: "user-b", AccessKey: "key-b", ExpiredAt: time.Now().Add(time.Hour).Unix()}); err != nil {
+		t.Fatal(err)
+	}
+	b, err := manager.SpaceAccount(ctx)
+	if err != nil || b == a {
+		t.Fatal("new account inherited old identity", err)
+	}
+}

package/internal/canvas/get.go

@@ -14,6 +14,8 @@ type GetOptions struct {
 }
 
 type GetResult struct {
+	TeamID            string            `json:"team_id"`
+	SpaceContext      string            `json:"space_context,omitempty"`
 	RequestedAssetIDs []string          `json:"requested_asset_ids"`
 	Assets            []json.RawMessage `json:"assets"`
 	LogID             string            `json:"log_id,omitempty"`
@@ -77,11 +79,16 @@ func queryAssets(ctx context.Context, assetIDs []string, requireAll bool, runner
 			envelope.LogID,
 		)
 	}
-	return &GetResult{
+	result := &GetResult{
+		TeamID:            common.SpaceTeamID(ctx),
 		RequestedAssetIDs: append([]string(nil), assetIDs...),
 		Assets:            ordered,
 		LogID:             strings.TrimSpace(envelope.LogID),
-	}, nil
+	}
+	if session := common.SpaceSession(ctx); session != nil {
+		result.SpaceContext = session.Token()
+	}
+	return result, nil
 }
 
 func normalizeAssetIDs(values []string) ([]string, error) {

package/internal/commandnames/names.go

@@ -2,8 +2,13 @@
 package commandnames
 
 const (
-	Login  = "login"
-	Logout = "logout"
-	Status = "status"
-	Update = "update"
+	Login          = "login"
+	Logout         = "logout"
+	Status         = "status"
+	Space          = "space"
+	Update         = "update"
+	Completion     = "completion"
+	Help           = "help"
+	Model          = "model"
+	DownloadResult = "download-result"
 )

package/internal/common/client.go

@@ -90,6 +90,11 @@ func (c *httpClient) SendRequest(ctx context.Context, path string, body any, out
 }
 
 func (c *httpClient) SendRequestWithHeaders(ctx context.Context, path string, body any, headers map[string]string, out any) error {
+	var scopeErr error
+	ctx, scopeErr = c.prepareSpaceRequest(ctx, path, body)
+	if scopeErr != nil {
+		return scopeErr
+	}
 	method := http.MethodPost
 	if body == nil {
 		method = http.MethodGet
@@ -145,6 +150,11 @@ func (c *httpClient) SendRequestWithHeaders(ctx context.Context, path string, bo
 }
 
 func (c *httpClient) SendMultipartRequest(ctx context.Context, path string, fields map[string]string, file MultipartFile, out any) error {
+	var scopeErr error
+	ctx, scopeErr = c.prepareSpaceRequest(ctx, path, nil)
+	if scopeErr != nil {
+		return scopeErr
+	}
 	reqURL, err := c.resolveURL(path, nil)
 	if err != nil {
 		return err
@@ -242,6 +252,7 @@ func (c *httpClient) prepareRequest(ctx context.Context, req *http.Request, head
 	c.injectHeaders(req, headers)
 	// Rebuild the authentication header only for requests to the configured API origin; general request headers cannot override it.
 	req.Header.Del("Authorization")
+	req.Header.Del("X-Team-Id")
 	if !isAPIOrigin {
 		c.adapter.StripSensitiveHeaders(req)
 		return nil
@@ -250,6 +261,16 @@ func (c *httpClient) prepareRequest(ctx context.Context, req *http.Request, head
 	if err != nil {
 		return err
 	}
+	// The selected space, like credentials, is rebuilt only for the API origin.
+	if session := SpaceSession(ctx); session != nil {
+		if err := session.CheckIdentity(ctx); err != nil {
+			return err
+		}
+		req.Header.Del("X-Team-Id")
+		if session.TeamID() != "0" {
+			req.Header.Set("X-Team-Id", session.TeamID())
+		}
+	}
 	switch decision {
 	case adapter.AuthProvided:
 		return nil
@@ -313,6 +334,7 @@ func (c *httpClient) checkRedirect(req *http.Request, via []*http.Request) error
 	}
 	if !trusted {
 		req.Header.Del("Authorization")
+		req.Header.Del("X-Team-Id")
 		c.adapter.StripSensitiveHeaders(req)
 	}
 	return nil
@@ -362,6 +384,7 @@ func (c *httpClient) do(req *http.Request, out any) error {
 	if err := sonic.Unmarshal(data, out); err != nil {
 		return fmt.Errorf("解析响应体失败: %w", err)
 	}
+	rememberSpaceResponse(req.Context(), data)
 	return nil
 }
 

package/internal/common/host_source.go

@@ -22,6 +22,11 @@ func detectHostSource(getenv func(string) string) string {
 		{"CLAUDECODE", "claude_code"},
 		{"CURSOR_AGENT", "cursor"},
 		{"GEMINI_CLI", "gemini_cli"},
+		{"OPENCODE", "opencode"},
+		{"QWEN_CODE", "qwen_code"},
+		{"CLINE_ACTIVE", "cline"},
+		{"COPILOT_CLI", "github_copilot_cli"},
+		{"COPILOT_AGENT_SESSION_ID", "github_copilot_cli"},
 	} {
 		value := strings.ToLower(strings.TrimSpace(getenv(marker.key)))
 		if value == "" || value == "0" || value == "false" {

package/internal/common/host_source_test.go

@@ -14,9 +14,17 @@ func TestDetectHostSource(t *testing.T) {
 		{"claude", map[string]string{"CLAUDECODE": "1"}, "claude_code"},
 		{"cursor", map[string]string{"CURSOR_AGENT": "1"}, "cursor"},
 		{"gemini", map[string]string{"GEMINI_CLI": "1"}, "gemini_cli"},
+		{"opencode", map[string]string{"OPENCODE": "1"}, "opencode"},
+		{"qwen", map[string]string{"QWEN_CODE": "1"}, "qwen_code"},
+		{"cline", map[string]string{"CLINE_ACTIVE": " true "}, "cline"},
+		{"copilot cli", map[string]string{"COPILOT_CLI": "1"}, "github_copilot_cli"},
+		{"copilot session", map[string]string{"COPILOT_AGENT_SESSION_ID": "secret"}, "github_copilot_cli"},
+		{"copilot markers agree", map[string]string{"COPILOT_CLI": "1", "COPILOT_AGENT_SESSION_ID": "secret"}, "github_copilot_cli"},
 		{"ambiguous", map[string]string{"CODEX_THREAD_ID": "secret", "CURSOR_AGENT": "1"}, ""},
+		{"new markers conflict", map[string]string{"OPENCODE": "1", "CLINE_ACTIVE": "true"}, ""},
 		{"disabled markers", map[string]string{"CLAUDECODE": "0", "GEMINI_CLI": " false "}, ""},
-		{"configuration is not runtime evidence", map[string]string{"CODEX_HOME": "/home/example", "ANTHROPIC_API_KEY": "secret", "TERM_PROGRAM": "vscode"}, ""},
+		{"new markers disabled", map[string]string{"OPENCODE": "0", "QWEN_CODE": " FALSE ", "CLINE_ACTIVE": "", "COPILOT_CLI": "false", "COPILOT_AGENT_SESSION_ID": " "}, ""},
+		{"configuration is not runtime evidence", map[string]string{"CODEX_HOME": "/home/example", "ANTHROPIC_API_KEY": "secret", "TERM_PROGRAM": "vscode", "AGENT": "1", "OPENCODE_CONFIG": "/example/config.json", "QWEN_API_KEY": "secret", "COPILOT_HOME": "/example/copilot"}, ""},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			if got := detectHostSource(func(key string) string { return tc.env[key] }); got != tc.want {

package/internal/common/runner.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/Pippit-dev/pippit-cli/internal/auth"
 	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/Pippit-dev/pippit-cli/internal/space"
 )
 
 // AuthManager is the credential boundary shared by native CLI commands. It
@@ -20,9 +21,10 @@ type AuthManager interface {
 
 // Runner carries runtime dependencies for command execution.
 type Runner struct {
-	Config *config.Config
-	Client Client
-	Auth   AuthManager
+	Config     *config.Config
+	Client     Client
+	Auth       AuthManager
+	SpaceStore *space.Store
 }
 
 func NewRunner(cfg *config.Config, client Client) *Runner {

package/internal/common/space.go

@@ -0,0 +1,185 @@
+package common
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/url"
+
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/Pippit-dev/pippit-cli/internal/space"
+)
+
+type spaceContextKey struct{}
+type spaceRequestKey struct{}
+type spaceRequest struct {
+	operation string
+	refs      space.References
+}
+
+func WithSpace(ctx context.Context, session *space.Session) context.Context {
+	return context.WithValue(ctx, spaceContextKey{}, session)
+}
+
+func SpaceSession(ctx context.Context) *space.Session {
+	session, _ := ctx.Value(spaceContextKey{}).(*space.Session)
+	return session
+}
+
+func SpaceTeamID(ctx context.Context) string { return SpaceSession(ctx).TeamID() }
+
+// spaceOperation classifies successful responses for local records only.
+// It does not decide whether a request carries the selected TeamID.
+func spaceOperation(path string) string {
+	u, err := url.Parse(path)
+	if err != nil {
+		return ""
+	}
+	switch u.Path {
+	case config.SubmitRunPath, config.SubmitMarketingRunPath:
+		return "submit"
+	case config.GetThreadPath, config.QueryGenerateVideoResultPath:
+		return "query"
+	case config.ListThreadFilePath:
+		return "files"
+	case config.UploadFilePath:
+		return "upload"
+	}
+	return ""
+}
+
+func SpaceReferences(body any) (space.References, error) {
+	var ref space.References
+	if body == nil {
+		return ref, nil
+	}
+	data, err := json.Marshal(body)
+	if err != nil {
+		return ref, err
+	}
+	if err := json.Unmarshal(data, &ref); err != nil {
+		return ref, fmt.Errorf("任务或素材 ID 格式无效: %w", err)
+	}
+	return ref, nil
+}
+
+func (c *httpClient) prepareSpaceRequest(ctx context.Context, path string, body any) (context.Context, error) {
+	session := SpaceSession(ctx)
+	if session == nil {
+		return ctx, nil
+	}
+	if target, err := url.Parse(path); err == nil && target.IsAbs() {
+		trusted, err := c.isBaseURLOrigin(target)
+		if err != nil {
+			return ctx, err
+		}
+		if !trusted {
+			return ctx, nil
+		}
+	}
+	ref, err := SpaceReferences(body)
+	if err != nil {
+		return ctx, err
+	}
+	if _, err := session.Resolve(ref); err != nil {
+		return ctx, err
+	}
+	return context.WithValue(ctx, spaceRequestKey{}, spaceRequest{operation: spaceOperation(path), refs: ref}), nil
+}
+
+func rememberSpaceResponse(ctx context.Context, data []byte) {
+	session := SpaceSession(ctx)
+	request, ok := ctx.Value(spaceRequestKey{}).(spaceRequest)
+	if session == nil || !ok || request.operation == "" {
+		return
+	}
+	var response struct {
+		Ret  json.RawMessage `json:"ret"`
+		Data *struct {
+			ThreadID      string `json:"thread_id"`
+			RunID         string `json:"run_id"`
+			PippitAssetID string `json:"pippit_asset_id"`
+			Run           struct {
+				ThreadID string `json:"thread_id"`
+				RunID    string `json:"run_id"`
+			} `json:"run"`
+		} `json:"data"`
+	}
+	if json.Unmarshal(data, &response) != nil || response.Data == nil || (string(response.Ret) != `"0"` && string(response.Ret) != "0") {
+		return
+	}
+	ref := request.refs
+	switch request.operation {
+	case "submit":
+		if response.Data.Run.ThreadID == "" || response.Data.Run.RunID == "" {
+			return
+		}
+		if ref.ThreadID != "" && ref.ThreadID != response.Data.Run.ThreadID {
+			return
+		}
+		ref.ThreadID, ref.RunID = response.Data.Run.ThreadID, response.Data.Run.RunID
+	case "query", "files":
+		if ref.ThreadID == "" {
+			return
+		}
+		if response.Data.ThreadID != "" && response.Data.ThreadID != ref.ThreadID {
+			return
+		}
+		if response.Data.RunID != "" && response.Data.RunID != ref.RunID {
+			return
+		}
+	case "upload":
+		if response.Data.PippitAssetID == "" {
+			return
+		}
+		ref.AssetIDs = []string{response.Data.PippitAssetID}
+	default:
+		return
+	}
+	session.Remember(ref)
+}
+
+func SpaceAccount(ctx context.Context, runner *Runner) (string, error) {
+	// Without an AuthManager, authentication belongs to the adapter. An unused
+	// environment AK must not stand in for the adapter's actual account.
+	if runner.Auth == nil {
+		return "", nil
+	}
+	if provider, ok := runner.Auth.(interface {
+		SpaceAccount(context.Context) (string, error)
+	}); ok {
+		return provider.SpaceAccount(ctx)
+	}
+	status, err := runner.Auth.Status(ctx)
+	if err != nil {
+		return "", err
+	}
+	if status != nil && status.UID != "" {
+		return "user:" + space.Digest(status.UID), nil
+	}
+	return "", nil
+}
+
+// SpaceStoreForRunner returns nil when the current account cannot be identified.
+// Callers can use an explicit space without persisting local records.
+func SpaceStoreForRunner(ctx context.Context, runner *Runner) (*space.Store, error) {
+	account, err := SpaceAccount(ctx, runner)
+	if err != nil {
+		return nil, err
+	}
+	if account == "" {
+		return nil, nil
+	}
+	base := config.DefaultBaseURL
+	if runner.Config != nil && runner.Config.BaseURL != "" {
+		base = runner.Config.BaseURL
+	}
+	store, err := space.NewStore(base, account)
+	if err != nil {
+		return nil, err
+	}
+	if runner.SpaceStore != nil {
+		store.Dir = runner.SpaceStore.Dir
+	}
+	return store, nil
+}