tripo-cli 0.2.0 → 0.2.1

package/README.md

@@ -15,7 +15,7 @@ tripo login          # browser approves, key arrives automatically; or --paste /
 tripo make knight.png --for game-mobile --then texture,rig,convert:fbx
 ```
 
-Works with both Tripo regions from the same install — international (`openapi.tripo3d.ai`, console `developers.tripo3d.ai`, email login + Stripe) and China mainland (`openapi.tripo3d.com`, console `developers.tripo3d.com`, SMS login + Alipay). `tripo login` runs an RFC 8628 device flow: the terminal shows a short code, the browser signs in (each console's own method) and approves, and the key lands in the CLI automatically — with graceful fallback to open-the-keys-page-and-paste when the device-auth backend is unavailable. You never pick a region when a key is in hand: the key is probed against both regions and whichever accepts it wins; `tripo topup` then opens the matching billing page (`/billing` on ov, `/billing/recharge` on cn). If a config was moved between machines, `tripo doctor` detects the mismatch and prints the one-line fix.
+Works with both Tripo regions from the same install — international (`openapi.tripo3d.ai`, console `developers.tripo3d.ai`, email login + Stripe) and China mainland (`openapi.tripo3d.com`, console `developers.tripo3d.com`, SMS login + Alipay). `tripo login` runs an RFC 8628 device flow: the terminal shows a short code, the browser signs in (each console's own method) and approves, and the key lands in the CLI automatically — with graceful fallback to open-the-keys-page-and-paste when the device-auth backend is unavailable. The same flow works without a TTY: `tripo login --region ov|cn` from an agent or CI prints the verification URL + code and waits for the browser approval, so an AI agent can start the login and relay the code to its human. You never pick a region when a key is in hand: the key is probed against both regions and whichever accepts it wins; `tripo topup` then opens the matching billing page (`/billing` on ov, `/billing/recharge` on cn). If a config was moved between machines, `tripo doctor` detects the mismatch and prints the one-line fix.
 
 ## Why this CLI
 

package/dist/commands/login.js

@@ -11,7 +11,7 @@
 import * as p from '@clack/prompts';
 import { activeProfileName, DEFAULT_PROFILE, deleteProfile, describeKeySource, isValidProfileName, listProfiles, loadConfig, maskKey, REGION_DEFAULTS, resolveApiKey, resolvePlatformBaseUrl, resolveRegion, setActiveProfile, updateProfile, } from '../config/config.js';
 import { TripoClient } from '../core/client.js';
-import { DeviceAuthUnavailableError, requestDeviceCode, waitForDeviceApproval } from '../core/device-auth.js';
+import { DeviceAuthUnavailableError, requestDeviceCode, waitForDeviceApproval, } from '../core/device-auth.js';
 import { AuthError, CliError, UsageError } from '../core/errors.js';
 import { detectRegionForKey } from '../core/region.js';
 import { emitResult, isInteractive, log, shouldOpen, success, warn } from '../core/output.js';
@@ -26,7 +26,7 @@ export function registerAuthCommands(program) {
         .description('sign in: browser authorizes, the key arrives automatically')
         .option('--paste', 'skip the browser flow; just paste an API key')
         .option('--key <key>', 'provide the API key directly (tsk_...); region is auto-detected')
-        .option('--region <region>', 'ov or cn — only needed for the browser flow; auto-detected once a key exists')
+        .option('--region <region>', 'ov or cn — needed for the browser flow; required for non-interactive login')
         .option('--profile <name>', 'save into a named profile (for a second account); becomes the active profile')
         .action(async (opts) => {
         await runLogin(opts);
@@ -169,10 +169,8 @@ export async function runLogin(opts) {
         return;
     }
     if (!isInteractive()) {
-        throw new UsageError(t({
-            zh: '非交互环境请用 TRIPO_API_KEY 环境变量或 tripo login --key tsk_...',
-            en: 'in non-interactive environments use the TRIPO_API_KEY env var or "tripo login --key tsk_..."',
-        }));
+        await runHeadlessLogin(region, profile, opts.paste);
+        return;
     }
     p.intro('tripo login');
     // The browser/paste flows need a console URL *before* any key exists — the
@@ -204,6 +202,71 @@ export async function runLogin(opts) {
         en: 'logged in! try: tripo make "a cute robot"',
     }));
 }
+/**
+ * Non-interactive login (agents, CI without a provisioned key): the same
+ * device flow, but with the verification URL and one-time code printed as
+ * plain text so the caller can relay them to a human, then a blocking poll
+ * until that human approves in a browser. The prompts of the interactive
+ * path are impossible here, so --region must be explicit (there is no key
+ * yet to probe, and the two regions have different console hosts) and
+ * --paste is rejected outright.
+ */
+async function runHeadlessLogin(region, profile, paste) {
+    if (paste) {
+        throw new UsageError(t({
+            zh: '--paste 需要交互终端;非交互环境请用设备码登录(tripo login --region ov|cn)或 TRIPO_API_KEY / --key',
+            en: '--paste needs an interactive terminal — use device login ("tripo login --region ov|cn"), TRIPO_API_KEY, or --key instead',
+        }));
+    }
+    if (!region) {
+        throw new UsageError(t({
+            zh: '非交互登录请指定 --region ov(海外站)或 cn(国内站),例如: tripo login --region ov;或改用 TRIPO_API_KEY / tripo login --key tsk_...',
+            en: 'non-interactive login needs an explicit --region ov (international) or cn (China mainland), e.g. "tripo login --region ov" — or use TRIPO_API_KEY / "tripo login --key tsk_..."',
+        }));
+    }
+    let grant;
+    try {
+        grant = await requestDeviceCode(region, profile === DEFAULT_PROFILE ? undefined : profile);
+    }
+    catch (err) {
+        if (err instanceof DeviceAuthUnavailableError) {
+            // No paste fallback without a TTY — fail with every remaining option spelled out.
+            throw new CliError(t({
+                zh: `浏览器授权服务不可用(${err.message});请设置 TRIPO_API_KEY,运行 tripo login --key tsk_...,或在交互终端里运行 tripo login`,
+                en: `device authorization unavailable (${err.message}) — set TRIPO_API_KEY, run "tripo login --key tsk_...", or run "tripo login" in an interactive terminal`,
+            }), EXIT.AUTH);
+        }
+        throw err;
+    }
+    const minutes = Math.max(1, Math.round(grant.expires_in / 60));
+    log(t({
+        zh: [
+            '需要在浏览器完成授权;本命令会一直等待,直到授权完成或过期。请转告用户:',
+            `  1. 打开: ${grant.verification_url_complete}`,
+            '     (页面如果提示登录,先登录或注册 Tripo 账号 — 新账号有免费额度)',
+            `  2. 在「Verification code」输入框填入终端码: ${grant.user_code}`,
+            '  3. 账号已有多把 API Key 时页面会让用户选择一把;一把没有则自动创建',
+            `  4. 点击「Authorize」。此码 ${minutes} 分钟内有效`,
+        ].join('\n'),
+        en: [
+            'Authorization happens in a browser; this command keeps waiting until approved or expired. Relay these steps:',
+            `  1. Open: ${grant.verification_url_complete}`,
+            '     (if the page asks to sign in, sign in or sign up first — new accounts get free credits)',
+            `  2. Enter this one-time code in the "Verification code" field: ${grant.user_code}`,
+            '  3. An account with several API keys is asked to pick one; with none, a key is created automatically',
+            `  4. Click "Authorize". The code expires in ${minutes} minutes`,
+        ].join('\n'),
+    }));
+    const result = await waitForDeviceApproval(region, grant);
+    if (result.status === 'denied') {
+        throw new CliError(t({ zh: '授权被拒绝;重新运行 tripo login 再试', en: 'authorization denied — run "tripo login" again to retry' }), EXIT.AUTH);
+    }
+    if (result.status !== 'approved') {
+        throw new CliError(t({ zh: '授权超时或已过期;重新运行 tripo login 获取新的终端码', en: 'authorization expired — run "tripo login" again for a fresh code' }), EXIT.AUTH);
+    }
+    const saved = await validateAndSave(result.apikey, region, profile);
+    emitResult({ status: 'logged_in', profile, region: saved.region, key: maskKey(result.apikey), balance: saved.balance }, t({ zh: `登录完成(profile=${profile}, region=${saved.region})`, en: `logged in (profile=${profile}, region=${saved.region})` }));
+}
 /**
  * Preferred path: RFC 8628 device flow — the browser does the sign-in and a
  * one-click approve, the key arrives over the CLI↔console-API channel, and
@@ -357,12 +420,13 @@ async function validateAndSave(key, selectedRegion, profile) {
         const client = new TripoClient({ apiKey: key });
         try {
             const balance = await client.getBalance();
-            finishSave(key, selectedRegion ?? 'ov', balance.balance, profile);
+            const region = selectedRegion ?? 'ov';
+            finishSave(key, region, balance.balance, profile);
+            return { region, balance: balance.balance };
         }
         catch (err) {
             throw asAuthError(err);
         }
-        return;
     }
     const detected = await detectRegionForKey(key);
     if (!detected) {
@@ -378,6 +442,7 @@ async function validateAndSave(key, selectedRegion, profile) {
         }));
     }
     finishSave(key, detected.region, detected.balance.balance, profile);
+    return { region: detected.region, balance: detected.balance.balance };
 }
 function finishSave(key, region, balance, profile) {
     // Saving activates the profile: "the account I just logged into is the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tripo-cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Tripo 3D intelligent CLI — turn a prompt or an image into engine-ready 3D assets from your terminal (Tripo V3 API)",
   "keywords": [
     "tripo",

package/skill/SKILL.md

@@ -11,7 +11,19 @@ export TRIPO_API_KEY=tsk_...    # highest-priority auth; no interaction needed
 tripo doctor                    # verify key, network, balance
 ```
 
-If there is no key, ask the human to run `tripo login` or to provide `TRIPO_API_KEY`.
+If there is no key, run the device login **yourself** — it works without a TTY:
+
+```bash
+tripo login --region ov      # ov = international, cn = China mainland
+```
+
+It prints a verification URL and a one-time code, then blocks until the human
+approves in a browser (up to ~15 minutes — do not kill it early). Relay the URL
+and code to the human and tell them: sign in on that page first if it asks
+(sign-up gives free credits), enter the code, pick an API key if the account has
+several (one is created automatically if there are none), click Authorize. The
+key is then saved locally; never ask the human to paste a key into the chat. If
+the code expires (exit 3), just run the same command again.
 
 Regions (ov = international, cn = China mainland) share one CLI: `tripo login --key tsk_...` auto-detects which region the key belongs to. On exit code 3 (auth), run `tripo doctor` — it diagnoses key-vs-region mismatches and prints the exact fix (`tripo config set region cn|ov`).
 

package/skill/commands/account.md

@@ -3,8 +3,11 @@
 ## Auth
 
 ```bash
-export TRIPO_API_KEY=tsk_...     # best for agents/CI — zero interaction, bypasses profiles
-tripo login                      # humans: browser flow (or --paste / --key tsk_...)
+export TRIPO_API_KEY=tsk_...     # zero interaction when a key is already provisioned
+tripo login                      # humans in a terminal: interactive browser flow
+tripo login --region ov|cn       # agents/CI without a key: headless device flow — prints a
+                                 # verification URL + one-time code on stderr, waits for the
+                                 # human to authorize in a browser (≤15 min), saves the key
 tripo login --key tsk_... --region ov|cn
 tripo whoami                     # masked key + active profile + region + balance
 tripo logout                     # removes the local key of the active profile only