tripo-cli 0.7.0 → 0.7.2

package/README.md

@@ -105,7 +105,7 @@ tripo batch run assets.yaml --concurrency 2
 | `TRIPO_API_BASE_URL` / `TRIPO_PLATFORM_BASE_URL` | endpoint overrides |
 | `TRIPO_HOME` | config/history directory (default `~/.tripo`) |
 | `TRIPO_NO_UPDATE_CHECK` | disable the startup "new version available" hint (also off when `CI` is set, headless, or `--json`) |
-| `TRIPO_ANALYTICS_ENABLED` | set to `0` to turn off anonymous usage analytics (see [Telemetry](#telemetry)) |
+| `TRIPO_ANALYTICS_ENABLED` | set to `0` to turn off usage analytics and the account lookup (see [Telemetry](#telemetry)) |
 | `TRIPO_NPM_REGISTRY` | npm registry used by `tripo update` and the version check (default `https://registry.npmjs.org`; e.g. a mirror) |
 | `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY` | standard proxy variables, honored for all CLI traffic (plain Node fetch ignores them) |
 | `TRIPO_LLM_BASE_URL` / `TRIPO_LLM_API_KEY` / `TRIPO_LLM_MODEL` | optional OpenAI-compatible LLM for `tripo ai` conversation mode |
@@ -114,13 +114,13 @@ Setting `TRIPO_API_KEY` per shell — bash/zsh: `export TRIPO_API_KEY=tsk_...`
 
 ## Telemetry
 
-Since 0.7.0 the CLI sends anonymous usage events to Tripo (`https://sshu-api.tripo3d.ai`) for calls to the international API (`openapi.tripo3d.ai`). It is on by default, needs no setup, prints nothing, and never changes stdout, exit codes, or credit behavior.
+Since 0.7.0 the CLI sends usage events to Tripo (`https://sshu-api.tripo3d.ai`) for calls to the international API (`openapi.tripo3d.ai`). It is on by default, needs no setup, prints nothing, and never changes stdout, exit codes, or credit behavior.
 
-- **Sent:** command or MCP tool name and its result, sign-in method and result, error category with HTTP status / API code, task id (and parent task id for chains), task type, model, status, credits consumed, durations, downloaded format and file count, CLI version, and the calling agent with its version — `codex` / `workbuddy` / `zcode` / `kimi` (otherwise `unknown`), from `TRIPO_CLIENT_APP` / `TRIPO_DISTRIBUTION_CHANNEL` (set by agent plugins) or the MCP host's client info.
-- **Identity:** a random installation id (`analytics_distinct_id` in `~/.tripo/config.json`), never your account.
-- **Never sent:** prompts, file paths, input images or models, API keys, download URLs.
-- **Nothing is sent for:** China-region (`cn`) calls, custom API endpoints, `--dry-run`, help/version, `docs`, `completion`, `config`, `update`, `use`, `logout`, and the bare `tripo` home screen.
-- **Opt out:** `TRIPO_ANALYTICS_ENABLED=0`.
+- **Sent:** command or MCP tool name and its result, sign-in method and result, error category with HTTP status / API code, task id (and parent task id for chains), task type, model, status, credits consumed, durations, downloaded format and file count, CLI version, and the calling agent with its version — `codex` / `workbuddy` / `zcode` / `kimi` / `deepseek` (otherwise `unknown`), from `TRIPO_CLIENT_APP` / `TRIPO_DISTRIBUTION_CHANNEL` (set by agent plugins) or the MCP host's client info.
+- **Identity:** a random installation id (`analytics_distinct_id` in `~/.tripo/config.json`) and, since 0.7.1, your Tripo account id (`platform_user_id`) when it can be resolved. It is looked up for the API key actually in use with `POST https://apiplatform.tripo3d.ai/verify`, once per command or MCP tool call, alongside the first API request rather than before it; the lookup gives up after 1 second, is never retried, and the id is never written to disk — on failure events simply go without it. No email or billing details are sent.
+- **Never sent:** prompts, file paths, input images or models, API keys, download URLs (the key itself only goes to `/verify` for the account lookup).
+- **Nothing is sent, and no account lookup is made, for:** China-region (`cn`) calls, custom API endpoints, `--dry-run`, help/version, `docs`, `completion`, `config`, `update`, `use`, `logout`, and the bare `tripo` home screen.
+- **Opt out:** `TRIPO_ANALYTICS_ENABLED=0` (also skips the account lookup).
 
 Delivery is best-effort: each send (including the flush on exit) is capped at 2 seconds, the in-memory queue holds at most 100 events, and nothing is retried or written to disk. Maintainers can redirect or tag events with `TRIPO_ANALYTICS_SERVER_URL`, `TRIPO_ANALYTICS_APP_ID`, and `TRIPO_ANALYTICS_ENVIRONMENT=production|pre|development`; tests send nothing unless `TRIPO_ANALYTICS_ENABLED=1` and a local receiver are both set.
 

package/dist/core/analytics.js

@@ -1,7 +1,7 @@
-/** Anonymous Agent analytics. Collection must never change a business result. */
-import { randomUUID } from "node:crypto";
+/** Agent analytics. Collection must never change a business result. */
+import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { loadConfig, updateConfig, resolveApiBaseUrl, resolveRegion } from '../config/config.js';
+import { loadConfig, updateConfig, resolveApiBaseUrl, resolveRegion, REGION_DEFAULTS } from '../config/config.js';
 import { readHistory, updateHistoryStatus } from '../config/history.js';
 import { cliVersion } from '../version.js';
 import { ApiError, AuthError, NetworkError, TaskFailedError, UsageError } from './errors.js';
@@ -19,6 +19,17 @@ export function beginOperation(command, disabled = false, info, regionHint) {
     operations.enterWith(activeOperation);
 }
 export function analyticsContext() { return currentOperation()?.context; }
+/** Resolve only the key actually used by this operation, without delaying its requests; never persist account identities. */
+export function identifyUser(apiKey, region, apiUrl) {
+    const operation = currentOperation();
+    const analytics = collector(region, apiUrl);
+    if (!operation || !analytics?.identityEnabled)
+        return;
+    const consoleApi = process.env.TRIPO_CONSOLE_API_BASE_URL ?? REGION_DEFAULTS[region].consoleApi;
+    const key = createHash('sha256').update(JSON.stringify([region, apiUrl, consoleApi, apiKey])).digest('hex');
+    if (operation.identity?.key !== key)
+        operation.identity = { key, value: analytics.identify(apiKey, consoleApi) };
+}
 function collector(region = currentOperation()?.regionHint ?? resolveRegion(), apiUrl = resolveApiBaseUrl()) {
     const operation = currentOperation();
     if (!operation || operation.disabled)
@@ -65,7 +76,7 @@ export function trackEvent(event, properties = {}, region, apiUrl) {
     const analytics = collector(region, apiUrl);
     const context = analyticsContext();
     if (analytics && context)
-        analytics.track(event, context, properties);
+        analytics.track(event, context, properties, operation?.identity?.value);
 }
 export async function flushAnalytics() {
     const operation = currentOperation();
@@ -116,11 +127,16 @@ export function observeTask(task, region, apiUrl) {
         catch { /* best effort marker */ }
     }
 }
+function platformUserId(value) {
+    if (typeof value === 'number')
+        return Number.isSafeInteger(value) && value > 0 ? String(value) : undefined;
+    return typeof value === 'string' && /^[1-9]\d{0,18}$/.test(value) ? value : undefined;
+}
 export function clientApp(value) {
     if (typeof value !== "string")
         return "unknown";
     const name = value.trim().toLowerCase();
-    for (const app of ["codex", "workbuddy", "zcode", "kimi"]) {
+    for (const app of ["codex", "workbuddy", "zcode", "kimi", "deepseek"]) {
         if (new RegExp(`(^|[\\s_./-])${app}($|[\\s_./-])`).test(name))
             return app;
     }
@@ -131,7 +147,7 @@ export function attribution(explicit, distribution, info, oauthName) {
     const initialized = clientApp(info?.name);
     const oauth = clientApp(oauthName);
     const chosen = tagged !== "unknown" ? tagged : initialized !== "unknown" ? initialized : oauth;
-    const channels = ["codex_plugin", "workbuddy_plugin", "zcode_plugin", "kimi_plugin"];
+    const channels = ["codex_plugin", "workbuddy_plugin", "zcode_plugin", "kimi_plugin", "deepseek_plugin"];
     return {
         client_app: chosen,
         distribution_channel: typeof distribution === "string" && channels.includes(distribution) ? distribution : "unknown",
@@ -150,6 +166,8 @@ export class Analytics {
     app;
     version;
     enabled;
+    identityEnabled;
+    testing;
     url;
     appId;
     environment;
@@ -166,21 +184,48 @@ export class Analytics {
         this.environment = ["production", "pre", "development"].includes(environment) ? environment : "development";
         this.url = "";
         let officialApi = false;
+        let localApi = false;
         let testReceiver = false;
         try {
             const url = new URL(receiver);
             this.url = new URL("sync_json", url.href.endsWith("/") ? url : `${url.href}/`).href;
-            officialApi = new URL(apiUrl).hostname === "openapi.tripo3d.ai";
+            const api = new URL(apiUrl);
+            officialApi = api.protocol === "https:" && api.hostname === "openapi.tripo3d.ai";
+            localApi = ["localhost", "127.0.0.1", "[::1]"].includes(api.hostname);
             testReceiver = (url.protocol === "http:" || url.protocol === "https:") && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
             if (url.username || url.password || url.search || url.hash || !["http:", "https:"].includes(url.protocol))
                 this.url = "";
         }
         catch { /* invalid analytics configuration is disabled, never fatal */ }
-        const testing = env.NODE_ENV === "test" || Boolean(env.VITEST);
+        const testing = this.testing = env.NODE_ENV === "test" || Boolean(env.VITEST);
         this.enabled = region === "ov" && Boolean(this.url && this.appId) && env.TRIPO_ANALYTICS_ENABLED !== "0"
             && (testing ? env.TRIPO_ANALYTICS_ENABLED === "1" && testReceiver : officialApi || testReceiver);
+        this.identityEnabled = this.enabled && (testing ? localApi : officialApi);
+    }
+    async identify(apiKey, consoleApi) {
+        if (!this.identityEnabled)
+            return undefined;
+        try {
+            const url = new URL(`${consoleApi.replace(/\/$/, '')}/verify`);
+            const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+            if (url.username || url.password || url.search || url.hash || !["http:", "https:"].includes(url.protocol)
+                || (this.testing ? !local : url.protocol !== "https:" || url.hostname !== "apiplatform.tripo3d.ai"))
+                return undefined;
+            const response = await fetch(url, {
+                method: "POST", headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ apikey: apiKey, with_detail: true }),
+                redirect: "error", signal: AbortSignal.timeout(1000),
+            });
+            if (!response.ok)
+                return undefined;
+            const body = await response.json();
+            return body?.code === 0 && body.data?.valid === true ? platformUserId(body.data.detail?.owner) : undefined;
+        }
+        catch {
+            return undefined;
+        }
     }
-    track(event, context, properties = {}) {
+    track(event, context, properties = {}, identity) {
         if (!this.enabled || !/^agent_[a-z_]+$/.test(event))
             return;
         if (this.queue.length >= 100) {
@@ -196,18 +241,18 @@ export class Analytics {
             else if (typeof value === "string" && /^[a-zA-Z0-9_.:-]{1,128}$/.test(value) && !/tsk_|bearer|token/i.test(value))
                 safe[key] = value;
         }
-        this.queue.push({ appid: this.appId, data: {
-                "#type": "track", "#event_name": event, "#distinct_id": context.distinctId,
-                "#time": new Date().toISOString().replace("T", " ").replace("Z", ""),
-                properties: {
-                    ...safe, ...attribution(context.client_app, context.distribution_channel, { version: context.client_version }),
-                    attribution_method: context.attribution_method, attribution_conflict: context.attribution_conflict ?? false,
-                    app: this.app, event_source: this.app === "tripo-mcp" ? "server" : "cli", site_region: "global",
-                    environment: this.environment, schema_version: 2, agent_schema_version: 1, app_version: this.version,
-                    integration_mode: context.integration_mode, operation_id: context.operation_id, event_id: randomUUID(),
-                    identity_type: this.app === "tripo-mcp" ? "authorization" : "installation", observation_source: "client", "#zone_offset": 0,
-                },
-            } });
+        this.queue.push({ identity, event: { appid: this.appId, data: {
+                    "#type": "track", "#event_name": event, "#distinct_id": context.distinctId,
+                    "#time": new Date().toISOString().replace("T", " ").replace("Z", ""),
+                    properties: {
+                        ...safe, ...attribution(context.client_app, context.distribution_channel, { version: context.client_version }),
+                        attribution_method: context.attribution_method, attribution_conflict: context.attribution_conflict ?? false,
+                        app: this.app, event_source: this.app === "tripo-mcp" ? "server" : "cli", site_region: "global",
+                        environment: this.environment, schema_version: 2, agent_schema_version: 1, app_version: this.version,
+                        integration_mode: context.integration_mode, operation_id: context.operation_id, event_id: randomUUID(),
+                        identity_type: this.app === "tripo-mcp" ? "authorization" : "installation", observation_source: "client", "#zone_offset": 0,
+                    },
+                } } });
         if (!this.scheduled) {
             this.scheduled = true;
             queueMicrotask(() => { this.scheduled = false; void this.flush(); });
@@ -223,9 +268,15 @@ export class Analytics {
             const deadline = Date.now() + 2000;
             while (this.queue.length && Date.now() < deadline) {
                 const batch = this.queue.splice(0, 100);
+                // Each lookup began before its event and gives up after 1 s, so this wait leaves the send at least 1 s of the budget.
+                await Promise.all(batch.map(async ({ event, identity }) => {
+                    const userId = await identity;
+                    if (userId)
+                        event.data.properties.platform_user_id = userId;
+                }));
                 try {
                     const response = await fetch(this.url, {
-                        method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(batch),
+                        method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(batch.map(({ event }) => event)),
                         signal: AbortSignal.timeout(Math.max(1, deadline - Date.now())),
                     });
                     const body = await response.json();

package/dist/core/client.js

@@ -8,7 +8,7 @@ import { activeProfileName, DEFAULT_PROFILE, listProfiles, loadConfig, resolveAp
 import { t } from '../i18n.js';
 import { EXIT } from '../knowledge/error-catalog.js';
 import { ApiError, AuthError, NetworkError } from './errors.js';
-import { observeTask, trackEvent, taskOrigin } from './analytics.js';
+import { identifyUser, observeTask, trackEvent, taskOrigin } from './analytics.js';
 import { resolveRegion } from '../config/config.js';
 export class TripoClient {
     region = resolveRegion();
@@ -55,6 +55,7 @@ export class TripoClient {
         return this.send('POST', '/v3/files', { body: form });
     }
     async send(method, path, init) {
+        identifyUser(this.apiKey, this.region, this.baseUrl);
         let lastError;
         for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
             if (attempt > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tripo-cli",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Tripo 3D intelligent CLI — turn a prompt or an image into engine-ready 3D assets from your terminal (Tripo V3 API)",
   "keywords": [
     "tripo",