tripo-cli 0.2.1 → 0.3.1

package/README.md

@@ -101,8 +101,11 @@ tripo batch run assets.yaml --concurrency 2
 | `TRIPO_REGION` | `ov` or `cn` — normally unnecessary: `tripo login` probes both regions with your key and stores the right one automatically |
 | `TRIPO_API_BASE_URL` / `TRIPO_PLATFORM_BASE_URL` | endpoint overrides |
 | `TRIPO_HOME` | config/history directory (default `~/.tripo`) |
+| `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY` | standard proxy variables, honored for all CLI traffic (plain Node fetch ignores them) |
 | `TRIPO_LLM_BASE_URL` / `TRIPO_LLM_API_KEY` / `TRIPO_LLM_MODEL` | optional OpenAI-compatible LLM for `tripo ai` conversation mode |
 
+Setting `TRIPO_API_KEY` per shell — bash/zsh: `export TRIPO_API_KEY=tsk_...` · PowerShell: `$env:TRIPO_API_KEY = "tsk_..."` (persist for future sessions with `setx TRIPO_API_KEY "tsk_..."`) · CMD: `set TRIPO_API_KEY=tsk_...`
+
 ## Development
 
 ```bash

package/dist/cli.js

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
+import { installProxyFromEnv } from './core/proxy.js';
 import { runCli } from './program.js';
 process.on('SIGINT', () => {
     process.stderr.write('\n');
     process.exit(130);
 });
+await installProxyFromEnv();
 void runCli(process.argv);

package/dist/commands/doctor.js

@@ -35,7 +35,10 @@ export function registerDoctorCommand(program) {
                     : 'missing — run "tripo login"',
             critical: true,
         });
-        if (configFileExists()) {
+        // Skipped on Windows: Node fakes POSIX mode bits there (a writable file
+        // always reads 0666), so the comparison can never pass — the file is
+        // protected by the user profile's NTFS ACLs instead.
+        if (configFileExists() && process.platform !== 'win32') {
             try {
                 const mode = statSync(join(tripoHome(), 'config.json')).mode & 0o777;
                 checks.push({
@@ -67,7 +70,7 @@ export function registerDoctorCommand(program) {
                 // simply live in the other region. Probe and hand over the exact fix.
                 if (err instanceof CliError && err.exitCode === EXIT.AUTH && !process.env.TRIPO_API_BASE_URL) {
                     const detected = await detectRegionForKey(key);
-                    if (detected && detected.region !== region) {
+                    if (detected.ok && detected.region !== region) {
                         detail += ` — key belongs to region "${detected.region}"; run: tripo config set region ${detected.region}`;
                     }
                 }

package/dist/commands/login.js

@@ -12,7 +12,7 @@ import * as p from '@clack/prompts';
 import { activeProfileName, DEFAULT_PROFILE, deleteProfile, describeKeySource, isValidProfileName, listProfiles, loadConfig, maskKey, REGION_DEFAULTS, resolveApiKey, resolvePlatformBaseUrl, resolveRegion, setActiveProfile, updateProfile, } from '../config/config.js';
 import { TripoClient } from '../core/client.js';
 import { DeviceAuthUnavailableError, requestDeviceCode, waitForDeviceApproval, } from '../core/device-auth.js';
-import { AuthError, CliError, UsageError } from '../core/errors.js';
+import { AuthError, CliError, NetworkError, UsageError } from '../core/errors.js';
 import { detectRegionForKey } from '../core/region.js';
 import { emitResult, isInteractive, log, shouldOpen, success, warn } from '../core/output.js';
 import { t } from '../i18n.js';
@@ -230,6 +230,12 @@ async function runHeadlessLogin(region, profile, paste) {
     }
     catch (err) {
         if (err instanceof DeviceAuthUnavailableError) {
+            if (err.kind === 'unreachable') {
+                throw new CliError(t({
+                    zh: `连不上授权服务(${err.message})— 请检查本机网络/防火墙,出网走 HTTP 代理时设置 HTTPS_PROXY;或改用 TRIPO_API_KEY / tripo login --key tsk_...`,
+                    en: `cannot reach the authorization service (${err.message}) — check this machine's network/firewall (set HTTPS_PROXY when behind a proxy), or use TRIPO_API_KEY / "tripo login --key tsk_..."`,
+                }), EXIT.NETWORK);
+            }
             // No paste fallback without a TTY — fail with every remaining option spelled out.
             throw new CliError(t({
                 zh: `浏览器授权服务不可用(${err.message});请设置 TRIPO_API_KEY,运行 tripo login --key tsk_...,或在交互终端里运行 tripo login`,
@@ -291,6 +297,14 @@ async function deviceFlowWithFallback(region, profile) {
                     en: `device authorization backend error (${err.message}) — please report this; falling back to paste login`,
                 }));
             }
+            else if (err.kind === 'unreachable') {
+                // The console API could not be reached at all — the same network
+                // problem will likely hit key validation next, so say it loudly now.
+                warn(t({
+                    zh: `连不上授权服务(${err.message})— 疑似网络/代理问题(出网走 HTTP 代理时请设置 HTTPS_PROXY);已改用粘贴方式登录`,
+                    en: `cannot reach the authorization service (${err.message}) — likely a network/proxy issue (set HTTPS_PROXY if this machine needs a proxy); falling back to paste login`,
+                }));
+            }
             else {
                 log(t({ zh: '浏览器授权服务暂未开通,改用粘贴方式登录', en: 'device authorization not available yet — falling back to paste login' }));
             }
@@ -375,7 +389,10 @@ function safeTimeZone() {
  * email-first; cn: +86 SMS-first) live entirely on the website either way.
  */
 async function keyFromConsole(region, openBrowser) {
-    const keysUrl = `${platformUrlFor(region)}/keys`;
+    // The console SPA nests every page under a locale segment (/:lang/keys);
+    // a bare /keys is swallowed by the ":lang" route and lands on the home
+    // page. Both regions' backends use /en in their canonical URLs.
+    const keysUrl = `${platformUrlFor(region)}/en/keys`;
     if (openBrowser && shouldOpen()) {
         openExternal(keysUrl);
         log(t({ zh: `已打开控制台 API Keys 页面(未弹出请手动访问):\n  ${keysUrl}`, en: `opened the console API Keys page (visit manually if it didn't open):\n  ${keysUrl}` }));
@@ -429,11 +446,8 @@ async function validateAndSave(key, selectedRegion, profile) {
         }
     }
     const detected = await detectRegionForKey(key);
-    if (!detected) {
-        throw new AuthError(t({
-            zh: 'Key 验证失败:国内(openapi.tripo3d.com)和海外(openapi.tripo3d.ai)都不接受这把 Key — 无效或已被删除',
-            en: 'key validation failed: rejected by both cn (openapi.tripo3d.com) and ov (openapi.tripo3d.ai) — invalid or deleted',
-        }));
+    if (!detected.ok) {
+        throw regionDetectionFailure(detected.failures);
     }
     if (selectedRegion && selectedRegion !== detected.region) {
         warn(t({
@@ -444,14 +458,49 @@ async function validateAndSave(key, selectedRegion, profile) {
     finishSave(key, detected.region, detected.balance.balance, profile);
     return { region: detected.region, balance: detected.balance.balance };
 }
+const REGION_HOSTS = { ov: 'openapi.tripo3d.ai', cn: 'openapi.tripo3d.com' };
+/**
+ * Turn the per-region probe failures into an honest error. "Invalid or
+ * deleted" is only ever claimed when both regions *answered* and rejected
+ * the key; any unreachable side turns the verdict into a network problem —
+ * the classic case being a firewalled/proxy-only server where a perfectly
+ * good key used to be reported as dead.
+ */
+function regionDetectionFailure(failures) {
+    if (failures.ov === 'rejected' && failures.cn === 'rejected') {
+        return new AuthError(t({
+            zh: 'Key 验证失败:国内(openapi.tripo3d.com)和海外(openapi.tripo3d.ai)都不接受这把 Key — 无效或已被删除',
+            en: 'key validation failed: rejected by both cn (openapi.tripo3d.com) and ov (openapi.tripo3d.ai) — invalid or deleted',
+        }));
+    }
+    const networkHint = t({
+        zh: '检查本机网络/防火墙;出网需要 HTTP 代理时,设置 HTTPS_PROXY 环境变量后重试;tripo doctor 可自检',
+        en: 'check this machine\'s network/firewall; if outbound traffic needs an HTTP proxy, set HTTPS_PROXY and retry; "tripo doctor" helps diagnose',
+    });
+    if (failures.ov === 'unreachable' && failures.cn === 'unreachable') {
+        return new NetworkError(t({
+            zh: '无法验证 Key:海外(openapi.tripo3d.ai)和国内(openapi.tripo3d.com)都连接失败 — 这是网络问题,不代表 Key 无效',
+            en: 'could not validate the key: both ov (openapi.tripo3d.ai) and cn (openapi.tripo3d.com) are unreachable — a network problem, not proof of a bad key',
+        }), networkHint);
+    }
+    const down = failures.ov === 'unreachable' ? 'ov' : 'cn';
+    const up = down === 'ov' ? 'cn' : 'ov';
+    return new NetworkError(t({
+        zh: `Key 验证失败:${up === 'cn' ? '国内' : '海外'}站(${REGION_HOSTS[up]})拒绝了这把 Key,而${down === 'cn' ? '国内' : '海外'}站(${REGION_HOSTS[down]})无法连接 — 如果 Key 属于${down === 'cn' ? '国内' : '海外'}站,请先解决网络问题`,
+        en: `key validation failed: ${up} (${REGION_HOSTS[up]}) rejected the key and ${down} (${REGION_HOSTS[down]}) is unreachable — if the key belongs to ${down}, fix the network first`,
+    }), networkHint);
+}
 function finishSave(key, region, balance, profile) {
     // Saving activates the profile: "the account I just logged into is the
     // account I am using" — no second command needed for the common case.
     updateProfile(profile, { api_key: key, region });
     const where = profile === DEFAULT_PROFILE ? '~/.tripo/config.json' : `~/.tripo/config.json · profile "${profile}"`;
+    // "mode 0600" is only true where POSIX modes exist; on Windows the file
+    // relies on the user profile's NTFS ACLs, so the claim would be wrong.
+    const mode = process.platform === 'win32' ? '' : t({ zh: ',权限 0600', en: ', mode 0600' });
     success(t({
-        zh: `Key 验证通过(region=${region}),当前余额 ${balance} 积分(已保存到 ${where},权限 0600)`,
-        en: `key verified (region=${region}); balance ${balance} credits (saved to ${where}, mode 0600)`,
+        zh: `Key 验证通过(region=${region}),当前余额 ${balance} 积分(已保存到 ${where}${mode})`,
+        en: `key verified (region=${region}); balance ${balance} credits (saved to ${where}${mode})`,
     }));
     if (Number(balance) === 0) {
         warn(t({

package/dist/core/device-auth.js

@@ -19,11 +19,14 @@ export const DEVICE_CODE_DENIED = 4292;
 const REQUEST_TIMEOUT_MS = 15_000;
 /**
  * Thrown when the device-auth endpoints are missing or unusable — callers
- * fall back to paste. `kind` separates the two very different situations:
+ * fall back to paste. `kind` separates three very different situations:
  * 'not_deployed' (404 — feature flag off, a normal rollout state, fall back
- * quietly) vs 'backend_error' (5xx — the feature is deployed but broken;
- * fall back too, but surface the backend's message + request_id loudly so
- * the failure is reportable instead of silently masked).
+ * quietly), 'backend_error' (5xx — the feature is deployed but broken; fall
+ * back too, but surface the backend's message + request_id loudly so the
+ * failure is reportable instead of silently masked), and 'unreachable'
+ * (fetch itself failed — firewall/DNS/proxy; the same network problem will
+ * hit key validation next, so callers must warn about the network, not
+ * pretend the feature simply is not rolled out yet).
  */
 export class DeviceAuthUnavailableError extends Error {
     kind;
@@ -149,7 +152,7 @@ async function post(url, payload) {
         });
     }
     catch {
-        throw new DeviceAuthUnavailableError('not_deployed', `cannot reach ${url}`);
+        throw new DeviceAuthUnavailableError('unreachable', `cannot reach ${url}`);
     }
     if (response.status === 404 || response.status === 405) {
         throw new DeviceAuthUnavailableError('not_deployed', 'device auth endpoints not deployed');

package/dist/core/errors.js

@@ -39,8 +39,8 @@ export class ApiError extends CliError {
     }
 }
 export class NetworkError extends CliError {
-    constructor(message) {
-        super(message, EXIT.NETWORK);
+    constructor(message, suggestion) {
+        super(message, EXIT.NETWORK, suggestion);
     }
 }
 export class TaskFailedError extends CliError {

package/dist/core/proxy.js

@@ -0,0 +1,30 @@
+/**
+ * Node's built-in fetch (undici) ignores the HTTP_PROXY / HTTPS_PROXY /
+ * NO_PROXY environment variables, so on proxy-only networks (a common
+ * server setup) every CLI request fails with a network error while curl on
+ * the same machine works fine. When a proxy is configured in the
+ * environment, swap global fetch for undici's, driven by an
+ * EnvHttpProxyAgent — it routes through HTTP(S)_PROXY and honors NO_PROXY
+ * exclusions. Without proxy env vars this is a no-op, so the zero-config
+ * path stays on the built-in fetch.
+ */
+export async function installProxyFromEnv() {
+    const { env } = process;
+    if (!(env.HTTPS_PROXY || env.https_proxy || env.HTTP_PROXY || env.http_proxy))
+        return false;
+    // Imported lazily so undici only loads when a proxy is actually configured.
+    const { EnvHttpProxyAgent, fetch: undiciFetch } = await import('undici');
+    // The constructor emits an "EnvHttpProxyAgent is experimental" warning on
+    // stderr — noise on every command for proxy users; swallow just that.
+    const emitWarning = process.emitWarning;
+    process.emitWarning = () => { };
+    let dispatcher;
+    try {
+        dispatcher = new EnvHttpProxyAgent();
+    }
+    finally {
+        process.emitWarning = emitWarning;
+    }
+    globalThis.fetch = ((input, init) => undiciFetch(input, { ...init, dispatcher }));
+    return true;
+}

package/dist/core/region.js

@@ -2,10 +2,15 @@
  * Region auto-detection: a Tripo API key is valid in exactly one region
  * (ov = openapi.tripo3d.ai, cn = openapi.tripo3d.com), so instead of asking
  * the user "which region?" we probe both with the key and let the facts
- * decide. First successful probe wins; both failing means the key is dead.
+ * decide. First successful probe wins. When neither succeeds, the failure
+ * kind is reported per region: only an explicit auth rejection from a
+ * server that answered proves anything about the key — an unreachable host
+ * (firewall, DNS, missing proxy) must never be blamed on the key.
  */
 import { REGION_DEFAULTS } from '../config/config.js';
 import { TripoClient } from './client.js';
+import { CliError } from './errors.js';
+import { EXIT } from '../knowledge/error-catalog.js';
 const PROBE_TIMEOUT_MS = 12_000;
 export function defaultProbeBases() {
     return { ov: REGION_DEFAULTS.ov.api, cn: REGION_DEFAULTS.cn.api };
@@ -14,7 +19,6 @@ export function defaultProbeBases() {
  * Probe both regions concurrently; resolve as soon as one accepts the key
  * (the other side may be slow/unreachable from this network — e.g. the
  * overseas host from mainland China — and must not delay the answer).
- * Returns undefined when both regions reject or are unreachable.
  */
 export async function detectRegionForKey(key, bases = defaultProbeBases()) {
     const probe = async (region) => {
@@ -27,18 +31,25 @@ export async function detectRegionForKey(key, bases = defaultProbeBases()) {
             });
             return { region, balance: await client.getBalance() };
         }
-        catch {
-            return undefined;
+        catch (err) {
+            // Only an authentication error is a verdict on the key; everything
+            // else (NetworkError, 5xx, malformed response) means "no answer".
+            return err instanceof CliError && err.exitCode === EXIT.AUTH ? 'rejected' : 'unreachable';
         }
     };
     return new Promise((resolve) => {
+        const failures = {};
         let pending = 2;
         for (const region of ['ov', 'cn']) {
-            void probe(region).then((hit) => {
-                if (hit)
-                    resolve(hit);
-                else if (--pending === 0)
-                    resolve(undefined);
+            void probe(region).then((outcome) => {
+                if (typeof outcome === 'string') {
+                    failures[region] = outcome;
+                    if (--pending === 0)
+                        resolve({ ok: false, failures });
+                }
+                else {
+                    resolve({ ok: true, ...outcome });
+                }
             });
         }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tripo-cli",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "Tripo 3D intelligent CLI — turn a prompt or an image into engine-ready 3D assets from your terminal (Tripo V3 API)",
   "keywords": [
     "tripo",
@@ -48,6 +48,7 @@
     "@clack/prompts": "^1.7.0",
     "commander": "^15.0.0",
     "picocolors": "^1.1.1",
+    "undici": "^6.28.0",
     "yaml": "^2.9.0"
   },
   "devDependencies": {

package/skill/SKILL.md

@@ -8,6 +8,7 @@ One command turns a text prompt or an image into local files: a 3D model (glb/fb
 ```bash
 npm install -g tripo-cli        # or: npx tripo-cli ...
 export TRIPO_API_KEY=tsk_...    # highest-priority auth; no interaction needed
+                                # (PowerShell: $env:TRIPO_API_KEY = "tsk_...")
 tripo doctor                    # verify key, network, balance
 ```
 

package/skill/commands/account.md

@@ -4,6 +4,7 @@
 
 ```bash
 export TRIPO_API_KEY=tsk_...     # zero interaction when a key is already provisioned
+                                 # (PowerShell: $env:TRIPO_API_KEY = "tsk_...")
 tripo login                      # humans in a terminal: interactive browser flow
 tripo login --region ov|cn       # agents/CI without a key: headless device flow — prints a
                                  # verification URL + one-time code on stderr, waits for the