@pippit-dev/cli 1.0.54 → 1.0.55

package/README.md

@@ -77,6 +77,14 @@ pippit-tool-cli get-credit-balance --team-id 0      # 仅本次使用个人
 
 `space list/use TEAM_ID` 依赖 API 部署 `/api/biz/v1/skill/get_lite_team_list` 的 AK 适配入口，业务团队使用还依赖对应 API 团队权限实现；不直连 commerce Web 接口。宿主 Agent 的选择、任务恢复与不回退规则已写入三个 Skill 的 `Space Selection` 章节。
 
+## 查询出口 IP
+
+```bash
+pippit-tool-cli ip
+```
+
+输出 `{"client_ip":"..."}`，返回服务端看到的出口 IP，无需登录或 AK；沿用 `config.toml` 的 API 地址与 PPE 配置。AK 的 IP 白名单仍在网页密钥管理页设置。
+
 ## 账号 AIGC 水印设置
 
 ```bash

package/checksums.txt

@@ -1,6 +1,6 @@
-3027db71d4e1b89ccaaa50f4660fb41a90e578bf7c08f0ea1c28367a597371a1  pippit-tool-cli-1.0.54-darwin-amd64.tar.gz
-b6a932ae33085d565e88c21a39b446dcb21cf148b6fb66d5a5baa040896d98ae  pippit-tool-cli-1.0.54-darwin-arm64.tar.gz
-aabce0e36f96a1dcc29c24a277e85859e938f6eddc4ed74a0536df3e4e4bce23  pippit-tool-cli-1.0.54-linux-amd64.tar.gz
-beb74396a2d82e05f7199b05cdd7850b148748b18483f9ccf24c4ec09d573968  pippit-tool-cli-1.0.54-linux-arm64.tar.gz
-c84ccf75b7c3474f2623f0563c4bf1193a2c84b6f8d0d6ee853ac9c00913ee9c  pippit-tool-cli-1.0.54-windows-amd64.zip
-8bd9e6abcde7060fb8b1fac9cb4ea9729cc88b73b27dc9d775581306738a56ba  pippit-tool-cli-1.0.54-windows-arm64.zip
+99a7ec8c86f332f9a3a8e7538d9eb1c237e0d8eebdacdaeb262f77ea716d3bd7  pippit-tool-cli-1.0.55-darwin-amd64.tar.gz
+8cefadb8e6ac41a7c6ff2f1a1ab89448176734ff449238cbcd3f38bbc0acc8cf  pippit-tool-cli-1.0.55-darwin-arm64.tar.gz
+69d0d83c74c95b46f1eb859ed5a9fe4aaf3b38f25465ff5a4d0c0bf33d815988  pippit-tool-cli-1.0.55-linux-amd64.tar.gz
+086db5207fbe14e15fb97f0a3c970c36de06e67d333cd68373be6a0e5af2626a  pippit-tool-cli-1.0.55-linux-arm64.tar.gz
+14cda14f712ff2c09566fbeb68f39296b200e3d54cdc659e13baf1e9f9b1ed92  pippit-tool-cli-1.0.55-windows-amd64.zip
+86ae993c8b32c1a6a09c81882e21bac7e8368468fe28b1e7be90b68466d8fe23  pippit-tool-cli-1.0.55-windows-arm64.zip

package/cmd/ip.go

@@ -0,0 +1,28 @@
+package cmd
+
+import (
+	"io"
+
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
+	"github.com/Pippit-dev/pippit-cli/internal/commandnames"
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+	"github.com/spf13/cobra"
+)
+
+func newIPCommand(stdout, stderr io.Writer, runner *common.Runner, policy adapter.HTTPAdapter) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   commandnames.IP,
+		Short: "Query the outbound IP observed by the server",
+		Args:  cobra.NoArgs,
+		RunE: withErrorLog(commandnames.IP, nil, func(cmd *cobra.Command, _ []string) error {
+			result, err := common.GetClientIP(cmd.Context(), runner, policy)
+			if err != nil {
+				return err
+			}
+			return common.WriteJSON(stdout, result)
+		}),
+	}
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	return cmd
+}

package/cmd/ip_test.go

@@ -0,0 +1,101 @@
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
+	"github.com/Pippit-dev/pippit-cli/internal/auth"
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+)
+
+type ipCredentialStore struct {
+	auth.CredentialStore
+	loads int
+}
+
+func (store *ipCredentialStore) Load(context.Context) (*auth.Credential, error) {
+	store.loads++
+	return nil, errors.New("corrupt credential fixture")
+}
+
+type ipCommandPolicy struct {
+	adapter.Default
+	options adapter.CLIOptions
+}
+
+func (policy ipCommandPolicy) CLIOptions() adapter.CLIOptions { return policy.options }
+
+func TestIPCommandDoesNotReadCredentialsOrInitializeSpace(t *testing.T) {
+	for _, accessKey := range []string{"", "existing-key"} {
+		t.Run("configured_key="+accessKey, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				for _, header := range []string{"Authorization", "Cookie", "X-Team-Id"} {
+					if r.Header.Get(header) != "" {
+						t.Errorf("anonymous command sent %s", header)
+					}
+				}
+				_, _ = io.WriteString(w, `{"ret":"0","data":{"client_ip":"8.8.8.8"}}`)
+			}))
+			defer server.Close()
+			cfg := config.Load()
+			cfg.BaseURL, cfg.AccessKey = server.URL, accessKey
+			cfg.HTTPTimeout = time.Second
+			policy := ipCommandPolicy{options: adapter.CLIOptions{
+				DefaultAllowRootCommands: true,
+				LocalCredentialsEnabled:  true,
+			}}
+			runner := newRootRunnerWithAdapter(cfg, policy)
+			store := &ipCredentialStore{}
+			runner.Auth = auth.NewManager(cfg, auth.WithCredentialStore(store))
+			var stdout, stderr bytes.Buffer
+			root := newRootCommandWithAdapter(&stdout, &stderr, runner, policy)
+			root.SetArgs([]string{"--team-id", "42", "ip"})
+			if err := root.Execute(); err != nil {
+				t.Fatalf("Execute() = %v, stderr = %q", err, stderr.String())
+			}
+			if store.loads != 0 {
+				t.Fatalf("credential loads = %d, want 0 even with corrupt credentials", store.loads)
+			}
+			command, _, err := root.Find([]string{"ip"})
+			if err != nil || command == nil || common.SpaceSession(command.Context()) != nil {
+				t.Fatalf("ip initialized a space session: %v", err)
+			}
+			var output map[string]string
+			if err := json.Unmarshal(stdout.Bytes(), &output); err != nil || len(output) != 1 || output["client_ip"] != "8.8.8.8" {
+				t.Fatalf("stdout = %q, error = %v, want only client_ip", stdout.String(), err)
+			}
+		})
+	}
+}
+
+func TestIPCommandRespectsAdapterFiltering(t *testing.T) {
+	for _, allowed := range []bool{true, false} {
+		options := adapter.CLIOptions{}
+		if allowed {
+			options.AllowedRootCommands = []string{"ip"}
+		}
+		root := NewRootCommandWithAdapter(io.Discard, io.Discard, ipCommandPolicy{options: options})
+		command, _, _ := root.Find([]string{"ip"})
+		if got := command != nil && command.Name() == "ip"; got != allowed {
+			t.Fatalf("ip present = %v, want %v", got, allowed)
+		}
+	}
+}
+
+func TestIPCommandRejectsArguments(t *testing.T) {
+	command := newIPCommand(io.Discard, io.Discard, nil, adapter.Default{})
+	command.SetArgs([]string{"unexpected"})
+	if err := command.Execute(); err == nil || !strings.Contains(err.Error(), "unexpected") {
+		t.Fatalf("Execute() = %v, want positional argument rejection", err)
+	}
+}

package/cmd/root.go

@@ -120,6 +120,7 @@ func newRootCommandWithAdapter(stdout, stderr io.Writer, runner *common.Runner,
 	root.AddCommand(newDownloadResultCommand(stdout, stderr, runner))
 	root.AddCommand(newGetCreditBalanceCommand(stdout, stderr, runner))
 	root.AddCommand(newWatermarkCommand(stdout, stderr, runner))
+	root.AddCommand(newIPCommand(stdout, stderr, runner, policy))
 	root.AddCommand(newModelCommand(stdout, stderr, runner))
 	root.AddCommand(newMarketingCommand(stdout, stderr, runner, policy))
 	root.AddCommand(newGetThreadCommand(stdout, stderr, runner))

package/cmd/space.go

@@ -30,7 +30,7 @@ func prepareCommandSpace(cmd *cobra.Command, runner *common.Runner, stderr io.Wr
 		top = top.Parent()
 	}
 	switch top.Name() {
-	case commandnames.Space, commandnames.Login, commandnames.Logout, commandnames.Status, commandnames.Update, commandnames.Completion, commandnames.Help, commandnames.DownloadResult, commandnames.Watermark:
+	case commandnames.Space, commandnames.Login, commandnames.Logout, commandnames.Status, commandnames.Update, commandnames.Completion, commandnames.Help, commandnames.DownloadResult, commandnames.Watermark, commandnames.IP:
 		return nil
 	}
 	raw, _ := cmd.Flags().GetString("space-context")

package/dist/checksums.txt

@@ -1,6 +1,6 @@
-3027db71d4e1b89ccaaa50f4660fb41a90e578bf7c08f0ea1c28367a597371a1  pippit-tool-cli-1.0.54-darwin-amd64.tar.gz
-b6a932ae33085d565e88c21a39b446dcb21cf148b6fb66d5a5baa040896d98ae  pippit-tool-cli-1.0.54-darwin-arm64.tar.gz
-aabce0e36f96a1dcc29c24a277e85859e938f6eddc4ed74a0536df3e4e4bce23  pippit-tool-cli-1.0.54-linux-amd64.tar.gz
-beb74396a2d82e05f7199b05cdd7850b148748b18483f9ccf24c4ec09d573968  pippit-tool-cli-1.0.54-linux-arm64.tar.gz
-c84ccf75b7c3474f2623f0563c4bf1193a2c84b6f8d0d6ee853ac9c00913ee9c  pippit-tool-cli-1.0.54-windows-amd64.zip
-8bd9e6abcde7060fb8b1fac9cb4ea9729cc88b73b27dc9d775581306738a56ba  pippit-tool-cli-1.0.54-windows-arm64.zip
+99a7ec8c86f332f9a3a8e7538d9eb1c237e0d8eebdacdaeb262f77ea716d3bd7  pippit-tool-cli-1.0.55-darwin-amd64.tar.gz
+8cefadb8e6ac41a7c6ff2f1a1ab89448176734ff449238cbcd3f38bbc0acc8cf  pippit-tool-cli-1.0.55-darwin-arm64.tar.gz
+69d0d83c74c95b46f1eb859ed5a9fe4aaf3b38f25465ff5a4d0c0bf33d815988  pippit-tool-cli-1.0.55-linux-amd64.tar.gz
+086db5207fbe14e15fb97f0a3c970c36de06e67d333cd68373be6a0e5af2626a  pippit-tool-cli-1.0.55-linux-arm64.tar.gz
+14cda14f712ff2c09566fbeb68f39296b200e3d54cdc659e13baf1e9f9b1ed92  pippit-tool-cli-1.0.55-windows-amd64.zip
+86ae993c8b32c1a6a09c81882e21bac7e8368468fe28b1e7be90b68466d8fe23  pippit-tool-cli-1.0.55-windows-arm64.zip

package/internal/commandnames/names.go

@@ -11,5 +11,6 @@ const (
 	Help           = "help"
 	Model          = "model"
 	Watermark      = "watermark"
+	IP             = "ip"
 	DownloadResult = "download-result"
 )

package/internal/common/client_ip.go

@@ -0,0 +1,58 @@
+package common
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/netip"
+
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+)
+
+type ClientIPResult struct {
+	ClientIP string `json:"client_ip"`
+}
+
+type clientIPRequestPolicy struct {
+	adapter.HTTPAdapter
+}
+
+func (clientIPRequestPolicy) PrepareAPIRequest(context.Context, *http.Request) (adapter.AuthDecision, error) {
+	return adapter.UseDefaultAuth, nil
+}
+
+// GetClientIP keeps the host transport and routing, without resolving account credentials.
+func GetClientIP(ctx context.Context, runner *Runner, policy adapter.HTTPAdapter) (*ClientIPResult, error) {
+	if runner == nil || runner.Config == nil {
+		return nil, fmt.Errorf("查询出口 IP 的运行配置缺失")
+	}
+	cfg := runner.Config
+	anonymousPolicy := clientIPRequestPolicy{HTTPAdapter: adapter.HTTPOrDefault(policy)}
+	client := NewHTTPClientWithAdapter(cfg.BaseURL, cfg.HTTPTimeout, NewAccessKeyAuthorizer(""), adapter.WithPPE(anonymousPolicy, cfg.PPEEnv))
+	// This query is anonymous even when the caller's context carries a selected team.
+	ctx = WithSpace(ctx, nil)
+	var resp struct {
+		Ret    string          `json:"ret"`
+		Errmsg string          `json:"errmsg"`
+		LogID  string          `json:"log_id"`
+		Data   *ClientIPResult `json:"data"`
+	}
+	if err := client.SendRequest(ctx, config.GetClientIPPath, nil, &resp); err != nil {
+		return nil, fmt.Errorf("查询出口 IP 请求失败: %w", err)
+	}
+	if resp.Ret != "0" {
+		if resp.Errmsg == "" {
+			resp.Errmsg = "未知错误"
+		}
+		return nil, NewLogIDError(fmt.Sprintf("查询出口 IP 请求返回失败: ret=%s errmsg=%s", resp.Ret, resp.Errmsg), resp.LogID)
+	}
+	if resp.Data == nil || resp.Data.ClientIP == "" {
+		return nil, NewLogIDError("查询出口 IP 响应缺少 data.client_ip", resp.LogID)
+	}
+	ip, err := netip.ParseAddr(resp.Data.ClientIP)
+	if err != nil || ip.Zone() != "" {
+		return nil, NewLogIDError("查询出口 IP 响应的 data.client_ip 无效", resp.LogID)
+	}
+	return &ClientIPResult{ClientIP: ip.Unmap().String()}, nil
+}

package/internal/common/client_ip_test.go

@@ -0,0 +1,135 @@
+package common
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/Pippit-dev/pippit-cli/internal/space"
+)
+
+type clientIPPolicy struct {
+	adapter.Default
+	prepareCalls int
+}
+
+func (p *clientIPPolicy) PrepareAPIRequest(_ context.Context, req *http.Request) (adapter.AuthDecision, error) {
+	p.prepareCalls++
+	req.Header.Set("Authorization", "Bearer adapter-key")
+	req.Header.Set("Cookie", "sessionid=adapter-cookie")
+	req.Header.Set("X-Team-Id", "99")
+	return adapter.AuthProvided, nil
+}
+
+func (*clientIPPolicy) WrapTransport(next http.RoundTripper) http.RoundTripper {
+	if next == nil {
+		next = http.DefaultTransport
+	}
+	return clientIPTransport{next: next}
+}
+
+type clientIPTransport struct{ next http.RoundTripper }
+
+func (transport clientIPTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	request := req.Clone(req.Context())
+	request.Header.Set("X-Test-IP-Transport", "present")
+	return transport.next.RoundTrip(request)
+}
+
+func TestGetClientIPIsAnonymousAndPreservesTransportAndRouting(t *testing.T) {
+	for _, env := range []string{"", "ppe_first", "ppe_second"} {
+		t.Run("env="+env, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.Method != http.MethodGet || r.URL.Path != "/api/biz/v1/skill/get_client_ip" {
+					t.Errorf("request = %s %s, want anonymous client IP GET", r.Method, r.URL.Path)
+				}
+				body, err := io.ReadAll(r.Body)
+				if err != nil || len(body) != 0 || r.Header.Get("Content-Type") != "" {
+					t.Errorf("GET body = %q, Content-Type = %q, error = %v", body, r.Header.Get("Content-Type"), err)
+				}
+				for _, header := range []string{"Authorization", "Cookie", "X-Team-Id"} {
+					if r.Header.Get(header) != "" {
+						t.Errorf("anonymous request retained %s", header)
+					}
+				}
+				if r.Header.Get("X-Test-IP-Transport") != "present" {
+					t.Error("anonymous request bypassed adapter transport")
+				}
+				wantUsePPE := ""
+				if env != "" {
+					wantUsePPE = "1"
+				}
+				if r.Header.Get("x-tt-env") != env || r.Header.Get("x-use-ppe") != wantUsePPE {
+					t.Error("anonymous request did not follow the configured PPE environment")
+				}
+				_, _ = io.WriteString(w, `{"ret":"0","data":{"client_ip":"8.8.8.8"}}`)
+			}))
+			defer server.Close()
+
+			cfg := config.Load()
+			cfg.BaseURL, cfg.PPEEnv, cfg.AccessKey = server.URL, env, "existing-key"
+			cfg.HTTPTimeout = time.Second
+			policy := &clientIPPolicy{}
+			runner := NewRunner(cfg, NewHTTPClientWithAdapter(server.URL, time.Second, NewAccessKeyAuthorizer(cfg.AccessKey), policy))
+			teamID := "42"
+			ctx := WithSpace(context.Background(), &space.Session{Explicit: &teamID})
+			result, err := GetClientIP(ctx, runner, policy)
+			if err != nil || result == nil || result.ClientIP != "8.8.8.8" {
+				t.Fatalf("GetClientIP() = %#v, %v", result, err)
+			}
+			if policy.prepareCalls != 0 {
+				t.Fatalf("adapter authentication calls = %d, want 0", policy.prepareCalls)
+			}
+		})
+	}
+}
+
+func TestGetClientIPRejectsUnusableResponses(t *testing.T) {
+	for _, tc := range []struct {
+		name, response, wantError string
+		status                    int
+	}{
+		{"unavailable_source", `{"ret":"53001","errmsg":"暂时无法识别当前来源 IP","log_id":"log_ip"}`, "53001", http.StatusOK},
+		{"unavailable_source_http503", `{"ret":"53001","errmsg":"暂时无法识别当前来源 IP","log_id":"log_ip"}`, "53001", http.StatusServiceUnavailable},
+		{"missing_data", `{"ret":"0","log_id":"log_ip"}`, "data", http.StatusOK},
+		{"missing_ip", `{"ret":"0","log_id":"log_ip","data":{}}`, "client_ip", http.StatusOK},
+		{"invalid_ip", `{"ret":"0","log_id":"log_ip","data":{"client_ip":"not-an-ip"}}`, "client_ip", http.StatusOK},
+		{"zoned_ip", `{"ret":"0","log_id":"log_ip","data":{"client_ip":"fe80::1%eth0"}}`, "client_ip", http.StatusOK},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(tc.status)
+				_, _ = io.WriteString(w, tc.response)
+			}))
+			defer server.Close()
+			cfg := config.Load()
+			cfg.BaseURL = server.URL
+			cfg.HTTPTimeout = time.Second
+			_, err := GetClientIP(context.Background(), NewRunner(cfg, nil), adapter.Default{})
+			if err == nil || !strings.Contains(err.Error(), tc.wantError) || !strings.Contains(err.Error(), "log_ip") {
+				t.Fatalf("GetClientIP() error = %v, want %q and log ID", err, tc.wantError)
+			}
+		})
+	}
+}
+
+func TestGetClientIPSupportsIPv6(t *testing.T) {
+	const ip = "2001:4860:4860::8888"
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, `{"ret":"0","data":{"client_ip":"`+ip+`"}}`)
+	}))
+	defer server.Close()
+	cfg := config.Load()
+	cfg.BaseURL = server.URL
+	cfg.HTTPTimeout = time.Second
+	result, err := GetClientIP(context.Background(), NewRunner(cfg, nil), adapter.Default{})
+	if err != nil || result == nil || result.ClientIP != ip {
+		t.Fatalf("GetClientIP() = %#v, %v, want IPv6 %s", result, err, ip)
+	}
+}

package/internal/config/config.go

@@ -21,6 +21,7 @@ const (
 	SubmitMarketingRunPath       = "/api/biz/v1/agent/submit_marketing_run"
 	QueryGenerateVideoResultPath = "/api/biz/v1/agent/query_generate_video_result"
 	GetCreditBalancePath         = "/api/biz/v1/skill/get_credit_balance"
+	GetClientIPPath              = "/api/biz/v1/skill/get_client_ip"
 	GetWatermarkSettingPath      = "/api/biz/v1/skill/mget_user_setting"
 	UpdateWatermarkSettingPath   = "/api/biz/v1/skill/update_user_setting"
 	GetLiteTeamListPath          = "/api/biz/v1/skill/get_lite_team_list"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pippit-dev/cli",
-  "version": "1.0.54",
+  "version": "1.0.55",
   "description": "Pippit CLI",
   "bin": {
     "pippit-tool-cli": "scripts/run.js"