@qcplay/cli 1.0.3 → 1.0.5

package/bin/qcplay.js

@@ -1,14 +1,97 @@
 #!/usr/bin/env node
 
+import { spawn } from "child_process";
 import fs from "fs";
+import http from "http";
+import https from "https";
 import os from "os";
 import path from "path";
-import { spawn } from "child_process";
-import { fileURLToPath } from "url";
+import readline from "readline";
+import { fileURLToPath, pathToFileURL } from "url";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const PACKAGE_JSON = path.resolve(__dirname, "../package.json");
+const AUTH_PAGE = resolveAuthPagePath();
+const DEFAULT_AUTH_BACKEND_URL = "https://cli.qcg.ink";
+const DEFAULT_PUBLISH_BACKEND_URL = "https://cli.qcg.ink";
+const DEFAULT_AUTH_PAGE_URL = "https://cli.qcg.ink/auth.html";
+const DEFAULT_LOCAL_BASE_URL = "http://127.0.0.1:8787";
+const ENV_AUTH_BACKEND_URL = process.env.QCPLAY_BACKEND_URL || process.env.QCPLAY_AUTH_BACKEND_URL;
+const ENV_PUBLISH_BACKEND_URL = process.env.QCPLAY_PUBLISH_BACKEND_URL;
+const ENV_AUTH_PAGE_URL = process.env.QCPLAY_AUTH_PAGE_URL;
+const ENV_LOCAL_BASE_URL = process.env.QCPLAY_LOCAL_BASE_URL;
+
+function resolveAuthPagePath() {
+  const repoAuthPage = path.resolve(__dirname, "../../web/auth.html");
+  if (fs.existsSync(repoAuthPage)) {
+    return repoAuthPage;
+  }
+
+  return path.resolve(__dirname, "../web/auth.html");
+}
+
+const CATEGORY_MAP = {
+  "2": "2",
+  "3": "3",
+  "7": "7",
+  "8": "8",
+  "9": "9",
+  "25": "25",
+  "26": "26",
+  "27": "27",
+  "29": "29",
+  "综合": "2",
+  "活动": "3",
+  "游戏攻略": "7",
+  "视频中心": "8",
+  "萌新入门": "9",
+  "萌新入门-攻略专区": "25",
+  "高手进阶": "26",
+  "活动攻略": "27",
+  "视频攻略": "29"
+};
+
+const AREA_MAP = {
+  "1": "1",
+  "3": "3",
+  "4": "4",
+  pc: "1",
+  PC: "1",
+  "资料站": "3",
+  "公益网站": "4"
+};
+
+const GAME_MAP = {
+  "39": "39",
+  "最强蜗牛": "39"
+};
+
+const STATUS_MAP = {
+  "0": "0",
+  "1": "1",
+  "未发布": "0",
+  "已发布": "1",
+  "发布": "1"
+};
+
+const BOOLEAN_TEXT_MAP = {
+  "0": "0",
+  "1": "1",
+  false: "0",
+  true: "1",
+  no: "0",
+  yes: "1",
+  "非热门": "0",
+  "热门": "1",
+  "不推荐": "0",
+  "推荐": "1"
+};
+
+const QCPLAY_DIR = path.join(os.homedir(), ".qcplay");
+const AGENTS_DIR = path.join(os.homedir(), ".agents");
+const CONFIG_FILE = path.join(QCPLAY_DIR, "config.json");
+const SKILLS_DIR = path.join(AGENTS_DIR, "skills");
 
 function readPackageVersion() {
   try {
@@ -20,13 +103,6 @@ function readPackageVersion() {
 }
 
 const PACKAGE_VERSION = readPackageVersion();
-
-const QCPLAY_DIR = path.join(os.homedir(), ".qcplay");
-const AGENTS_DIR = path.join(os.homedir(), ".agents");
-const AUTH_FILE = path.join(QCPLAY_DIR, "auth.json");
-const CONFIG_FILE = path.join(QCPLAY_DIR, "config.json");
-const SKILLS_DIR = path.join(AGENTS_DIR, "skills");
-
 const colorsEnabled = process.stdout.isTTY && process.env.NO_COLOR !== "1";
 
 const chalk = {
@@ -49,13 +125,13 @@ function printRootHelp() {
   console.log(`QCPlay CLI
 
 Usage:
-  qcplay-cli install
-  qcplay-cli auth [login|status|logout]
-  qcplay-cli auth permissions [--key <key>] [--json]
+  qcplay-cli install [--local]
+  qcplay-cli auth [login|status|logout] [--local] [--backend <url>] [--auth-page <url>]
+  qcplay-cli auth permissions [--local] [--key <key>] [--json]
   qcplay-cli article
   qcplay-cli article init [file]
-  qcplay-cli article publish <file> [--env <env>] [--url <url>] [--dry-run]
-  qcplay-cli www-article-list.store <file> [--env <env>] [--url <url>] [--dry-run]
+  qcplay-cli article publish <file> [--local] [--backend <url>] [--dry-run]
+  qcplay-cli www-article-list.store <file> [--local] [--backend <url>] [--dry-run]
   qcplay-cli features
   qcplay-cli where
 
@@ -67,107 +143,48 @@ Options:
 
 function printAuthHelp() {
   console.log("Usage:");
-  console.log("  qcplay-cli auth");
-  console.log("  qcplay-cli auth status");
-  console.log("  qcplay-cli auth logout");
-  console.log("  qcplay-cli auth permissions [--key <key>] [--json]");
+  console.log("  qcplay-cli auth [login|status|logout] [--local] [--backend <url>] [--auth-page <url>]");
+  console.log("  qcplay-cli auth permissions [--local] [--backend <url>] [--key <key>] [--json]");
 }
 
 function printArticleHelp() {
   console.log(`Usage:
   qcplay-cli article
   qcplay-cli article init [file]
-  qcplay-cli article publish <file> [--env <env>] [--url <url>] [--dry-run]`);
+  qcplay-cli article publish <file> [--local] [--backend <url>] [--dry-run]`);
 }
 
-function getVendorDir() {
-  if (process.platform === "win32") {
-    return path.resolve(__dirname, "../vendor/win32");
-  }
-
-  if (process.platform === "darwin") {
-    return path.resolve(__dirname, "../vendor/darwin");
-  }
-
-  if (process.platform === "linux") {
-    return path.resolve(__dirname, "../vendor/linux");
-  }
-
-  throw new Error(`Unsupported platform: ${process.platform}`);
-}
-
-function getExeCandidates(name) {
-  if (process.platform === "win32") {
-    return [`${name}.exe`, name];
-  }
-
-  if (process.platform === "darwin") {
-    return [`${name}-darwin-${process.arch}`, name];
-  }
-
-  if (process.platform === "linux") {
-    return [`${name}-linux-${process.arch}`, name];
-  }
-
-  return [name];
+function printFeatures() {
+  console.log("");
+  console.log(chalk.green("你现在可以使用以下功能:"));
+  console.log("");
+  console.log(chalk.cyan("1. 登录认证"));
+  console.log("   qcplay-cli auth");
+  console.log(chalk.gray("   会唤起网页登录页，不再在控制台输入密码。"));
+  console.log("");
+  console.log(chalk.cyan("2. 查看权限"));
+  console.log("   qcplay-cli auth permissions");
+  console.log("   qcplay-cli auth permissions --key www-article-list.store");
+  console.log("");
+  console.log(chalk.cyan("3. 发布官网文章"));
+  console.log("   qcplay-cli www-article-list.store article.md");
+  console.log("");
+  console.log(chalk.cyan("4. 查看本地目录"));
+  console.log("   qcplay-cli where");
+  console.log("");
 }
 
-function getExePath(name) {
-  const vendorDir = getVendorDir();
-  const candidates = getExeCandidates(name);
-
-  for (const candidate of candidates) {
-    const exePath = path.join(vendorDir, candidate);
-    if (fs.existsSync(exePath)) {
-      return exePath;
-    }
-  }
-
-  return path.join(vendorDir, candidates[0]);
+function printWhere() {
+  console.log(QCPLAY_DIR);
 }
 
-function runNative(name, args = []) {
-  return new Promise((resolve, reject) => {
-    const exePath = getExePath(name);
-
-    if (!fs.existsSync(exePath)) {
-      reject(new Error(`执行程序不存在: ${exePath}`));
-      return;
-    }
-
-    const child = spawn(exePath, args, {
-      stdio: "inherit",
-      shell: false
-    });
-
-    child.on("error", err => {
-      reject(err);
-    });
-
-    child.on("exit", code => {
-      if (code === 0) {
-        resolve();
-      } else {
-        reject(new Error(`${name} 执行失败，退出码: ${code}`));
-      }
-    });
+function createReadline() {
+  return readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
   });
 }
 
-async function runAuthLogin() {
-  try {
-    await runNative("qcplay-auth", []);
-  } catch (err) {
-    const message = String(err?.message || err);
-
-    if (!message.includes("退出码")) {
-      throw err;
-    }
-
-    await runNative("qcplay-auth", ["login"]);
-  }
-}
-
 async function pathExists(targetPath) {
   try {
     await fs.promises.access(targetPath);
@@ -199,16 +216,19 @@ async function copyRecursive(sourcePath, targetPath) {
 
 async function writeJson(filePath, value) {
   await ensureDir(path.dirname(filePath));
-  await fs.promises.writeFile(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+  await fs.promises.writeFile(filePath, `${JSON.stringify(value, null, 2)}\n`, {
+    encoding: "utf8",
+    mode: 0o600
+  });
 }
 
 async function readJson(filePath) {
-  const raw = await fs.promises.readFile(filePath, "utf8");
-  return JSON.parse(raw);
-}
-
-async function removeFile(filePath) {
-  await fs.promises.rm(filePath, { force: true });
+  try {
+    const raw = await fs.promises.readFile(filePath, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
 }
 
 async function ensureLocalDirs() {
@@ -227,102 +247,90 @@ async function installSkills() {
   return true;
 }
 
-async function saveConfig() {
+async function saveConfig(authBackendUrl, publishBackendUrl, authPageUrl, localMode = false) {
   await writeJson(CONFIG_FILE, {
     cli: "qcplay-cli",
     version: PACKAGE_VERSION,
-    auth_file: AUTH_FILE,
+    auth_backend_url: authBackendUrl,
+    publish_backend_url: publishBackendUrl,
+    auth_page_url: authPageUrl || "",
+    local_mode: localMode,
     skills_dir: SKILLS_DIR,
     configured_at: Date.now()
   });
 }
 
-async function getLoginStatus() {
-  if (!(await pathExists(AUTH_FILE))) {
-    return {
-      ok: false,
-      reason: `认证文件不存在: ${AUTH_FILE}`
-    };
-  }
+async function loadConfig() {
+  return readJson(CONFIG_FILE);
+}
 
-  let auth;
+function normalizeText(value) {
+  return String(value ?? "").trim();
+}
 
-  try {
-    auth = await readJson(AUTH_FILE);
-  } catch (err) {
-    return {
-      ok: false,
-      reason: `认证文件不是合法 JSON: ${err.message}`
-    };
+function normalizeMappedValue(value, map) {
+  const text = normalizeText(value);
+  if (!text) {
+    return "";
   }
 
-  const accessToken =
-    auth.access_token ||
-    auth.accessToken ||
-    auth.token ||
-    auth.data?.access_token ||
-    auth.data?.accessToken;
+  return map[text] ?? map[text.toLowerCase?.() || ""] ?? text;
+}
 
-  if (!accessToken) {
-    return {
-      ok: false,
-      reason: "认证文件中没有找到 access_token"
-    };
+function normalizeBoolLike(value, defaultValue = "0") {
+  const text = normalizeText(value);
+  if (!text) {
+    return defaultValue;
   }
 
-  let expiresAt =
-    auth.expires_at ||
-    auth.expiresAt ||
-    auth.data?.expires_at ||
-    auth.data?.expiresAt;
-
-  if (expiresAt) {
-    expiresAt = Number(expiresAt);
+  return BOOLEAN_TEXT_MAP[text] ?? BOOLEAN_TEXT_MAP[text.toLowerCase()] ?? text;
+}
 
-    if (expiresAt > 0 && expiresAt < 1000000000000) {
-      expiresAt = expiresAt * 1000;
-    }
+function parseBackendOptions(args) {
+  const options = {
+    backend: undefined,
+    authPage: undefined,
+    local: false
+  };
+  const passthrough = [];
 
-    if (Date.now() >= expiresAt) {
-      return {
-        ok: false,
-        reason: `登录状态已过期: ${new Date(expiresAt).toLocaleString()}`
-      };
-    }
-  }
+  for (let index = 0; index < args.length; index += 1) {
+    const current = args[index];
 
-  return {
-    ok: true,
-    auth
-  };
-}
+    if (current === "--backend") {
+      const next = args[index + 1];
+      if (!next || next.startsWith("--")) {
+        throw new Error("--backend 缺少参数值");
+      }
 
-function printFeatures() {
-  console.log("");
-  console.log(chalk.green("你现在可以使用以下功能:"));
-  console.log("");
+      options.backend = next;
+      index += 1;
+      continue;
+    }
 
-  console.log(chalk.cyan("1. 登录认证"));
-  console.log("   qcplay-cli auth");
-  console.log("");
+    if (current === "--auth-page") {
+      const next = args[index + 1];
+      if (!next || next.startsWith("--")) {
+        throw new Error("--auth-page 缺少参数值");
+      }
 
-  console.log(chalk.cyan("2. 查看权限"));
-  console.log("   qcplay-cli auth permissions");
-  console.log("   qcplay-cli auth permissions --key www-article-list.store");
-  console.log("");
+      options.authPage = next;
+      index += 1;
+      continue;
+    }
 
-  console.log(chalk.cyan("4. 发布官网文章"));
-  console.log("   qcplay-cli www-article-list.store article.md");
-  console.log(chalk.gray("   文章标题、分类、缩略图、标签等信息写在 article.md 顶部 Front Matter 中。"));
-  console.log("");
+    if (current === "--local") {
+      options.local = true;
+      continue;
+    }
 
-  console.log(chalk.cyan("5. 查看本地配置目录"));
-  console.log("   qcplay-cli where");
-  console.log("");
-}
+    passthrough.push(current);
+  }
 
-function printWhere() {
-  console.log(QCPLAY_DIR);
+  return {
+    options,
+    args: passthrough
+  };
 }
 
 function parsePermissionsOptions(args) {
@@ -356,7 +364,324 @@ function parsePermissionsOptions(args) {
   return options;
 }
 
-async function installCommand() {
+function parsePublishOptions(args) {
+  const options = {
+    backend: undefined,
+    local: false,
+    dryRun: false
+  };
+  const positional = [];
+
+  for (let index = 0; index < args.length; index += 1) {
+    const current = args[index];
+
+    if (current === "--dry-run") {
+      options.dryRun = true;
+      continue;
+    }
+
+    if (current === "--backend") {
+      const next = args[index + 1];
+      if (!next || next.startsWith("--")) {
+        throw new Error("--backend 缺少参数值");
+      }
+
+      options.backend = next;
+      index += 1;
+      continue;
+    }
+
+    if (current === "--local") {
+      options.local = true;
+      continue;
+    }
+
+    if (current.startsWith("--")) {
+      throw new Error(`未知参数: ${current}`);
+    }
+
+    positional.push(current);
+  }
+
+  return {
+    file: positional[0],
+    options
+  };
+}
+
+function requestJson(method, baseUrl, pathname, payload) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(pathname, baseUrl);
+    const client = url.protocol === "https:" ? https : http;
+    const body = payload === undefined ? undefined : JSON.stringify(payload);
+
+    const req = client.request(
+      url,
+      {
+        method,
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/json",
+          "User-Agent": `qcplay-cli/${PACKAGE_VERSION}`,
+          ...(body ? { "Content-Length": Buffer.byteLength(body) } : {})
+        }
+      },
+      res => {
+        const chunks = [];
+        res.on("data", chunk => chunks.push(chunk));
+        res.on("end", () => {
+          const text = Buffer.concat(chunks).toString("utf8");
+          let json = {};
+
+          try {
+            json = text ? JSON.parse(text) : {};
+          } catch {
+            reject(new Error(`后端返回了非 JSON 内容: ${text.slice(0, 160)}`));
+            return;
+          }
+
+          if ((res.statusCode || 0) < 200 || (res.statusCode || 0) >= 300) {
+            reject(new Error(json.message || `接口请求失败 (${res.statusCode})`));
+            return;
+          }
+
+          resolve(json);
+        });
+      }
+    );
+
+    req.on("error", err => {
+      reject(new Error(`无法连接后端服务 ${baseUrl}，请检查服务地址或网络连接。原始错误: ${err.message}`));
+    });
+
+    if (body) {
+      req.write(body);
+    }
+
+    req.end();
+  });
+}
+
+function openBrowser(targetUrl) {
+  return new Promise((resolve, reject) => {
+    let command;
+    let args;
+
+    if (process.platform === "win32") {
+      command = "cmd";
+      args = ["/c", "start", "", targetUrl];
+    } else if (process.platform === "darwin") {
+      command = "open";
+      args = [targetUrl];
+    } else {
+      command = "xdg-open";
+      args = [targetUrl];
+    }
+
+    const child = spawn(command, args, {
+      detached: true,
+      stdio: "ignore"
+    });
+
+    child.on("error", reject);
+    child.unref();
+    resolve();
+  });
+}
+
+function delay(ms) {
+  return new Promise(resolve => {
+    setTimeout(resolve, ms);
+  });
+}
+
+function normalizeOptionalUrl(value) {
+  const text = normalizeText(value);
+  return text || "";
+}
+
+function ensureAbsoluteUrl(value, flagName) {
+  try {
+    return new URL(value).toString();
+  } catch {
+    throw new Error(`${flagName} 必须是完整 URL，例如 https://example.com/auth.html`);
+  }
+}
+
+function resolveLocalBaseUrl() {
+  const localBaseUrl = normalizeOptionalUrl(ENV_LOCAL_BASE_URL) || DEFAULT_LOCAL_BASE_URL;
+  return ensureAbsoluteUrl(localBaseUrl, "QCPLAY_LOCAL_BASE_URL");
+}
+
+function isLocalMode(options, config = {}) {
+  return Boolean(options.local || config.local_mode);
+}
+
+function resolveAuthBackendUrl(options, config = {}) {
+  if (!normalizeOptionalUrl(options.backend) && isLocalMode(options, config)) {
+    return resolveLocalBaseUrl();
+  }
+
+  const backendUrl =
+    normalizeOptionalUrl(options.backend) ||
+    normalizeOptionalUrl(ENV_AUTH_BACKEND_URL) ||
+    normalizeOptionalUrl(config.auth_backend_url) ||
+    normalizeOptionalUrl(config.backend_url) ||
+    DEFAULT_AUTH_BACKEND_URL;
+  return ensureAbsoluteUrl(backendUrl, "--backend");
+}
+
+function resolveAuthPageUrl(options, config = {}) {
+  if (!normalizeOptionalUrl(options.authPage) && isLocalMode(options, config)) {
+    return "";
+  }
+
+  const authPageUrl =
+    normalizeOptionalUrl(options.authPage) ||
+    normalizeOptionalUrl(ENV_AUTH_PAGE_URL) ||
+    normalizeOptionalUrl(config.auth_page_url) ||
+    DEFAULT_AUTH_PAGE_URL;
+  return authPageUrl ? ensureAbsoluteUrl(authPageUrl, "--auth-page") : "";
+}
+
+function resolvePublishBackendUrl(options, config = {}) {
+  if (!normalizeOptionalUrl(options.backend) && isLocalMode(options, config)) {
+    return resolveLocalBaseUrl();
+  }
+
+  const backendUrl =
+    normalizeOptionalUrl(options.backend) ||
+    normalizeOptionalUrl(ENV_PUBLISH_BACKEND_URL) ||
+    normalizeOptionalUrl(config.publish_backend_url) ||
+    DEFAULT_PUBLISH_BACKEND_URL;
+  return ensureAbsoluteUrl(backendUrl, "--backend");
+}
+
+async function fetchLoginSuccessSequence(baseUrl) {
+  const response = await requestJson("GET", baseUrl, "/api/auth/login-success");
+  return Number(response.data?.sequence || 0);
+}
+
+function isNonJsonResponseError(error) {
+  return String(error?.message || "").includes("后端返回了非 JSON 内容");
+}
+
+function buildAuthBackendError(baseUrl, error) {
+  if (isNonJsonResponseError(error)) {
+    return new Error(
+      `认证接口 ${baseUrl} 返回了 HTML 页面，不是 JSON。请确认 ${baseUrl}/api/auth/login、${baseUrl}/api/auth/login-success、${baseUrl}/api/auth/status 已正确部署，而不是被站点首页或登录页接管。`
+    );
+  }
+
+  return error;
+}
+
+async function waitForLoginSuccessSequence(baseUrl, previousSequence, intervalMs = 1000, timeoutMs = 60000) {
+  const startedAt = Date.now();
+  let lastError;
+
+  while (true) {
+    try {
+      const nextSequence = await fetchLoginSuccessSequence(baseUrl);
+      if (nextSequence > previousSequence) {
+        return nextSequence;
+      }
+    } catch (error) {
+      lastError = error;
+    }
+
+    if (Date.now() - startedAt >= timeoutMs) {
+      if (lastError) {
+        throw buildAuthBackendError(baseUrl, lastError);
+      }
+
+      throw new Error(`等待登录结果超时，请确认认证接口 ${baseUrl} 可用`);
+    }
+
+    await delay(intervalMs);
+  }
+}
+
+function buildAuthPageUrl(backendUrl, authPageUrl = "") {
+  const targetUrl = authPageUrl ? new URL(authPageUrl) : pathToFileURL(AUTH_PAGE);
+
+  if (shouldAttachBackendQuery(targetUrl, backendUrl)) {
+    targetUrl.searchParams.set("backend", backendUrl);
+  }
+
+  return targetUrl.toString();
+}
+
+function shouldAttachBackendQuery(targetUrl, backendUrl) {
+  if (!backendUrl) {
+    return false;
+  }
+
+  const normalizedBackendUrl = new URL(backendUrl);
+  if (targetUrl.protocol === "file:") {
+    return normalizedBackendUrl.origin !== new URL(DEFAULT_LOCAL_BASE_URL).origin;
+  }
+
+  return normalizedBackendUrl.origin !== targetUrl.origin;
+}
+
+function flattenPermissionTree(items, bucket = []) {
+  for (const item of items) {
+    bucket.push(item);
+    if (Array.isArray(item.children) && item.children.length > 0) {
+      flattenPermissionTree(item.children, bucket);
+    }
+  }
+
+  return bucket;
+}
+
+function printPermissionTree(items) {
+  const flatItems = flattenPermissionTree(items);
+  const indexed = new Map();
+  const children = new Map();
+  const roots = [];
+
+  for (const item of flatItems) {
+    const id = Number(item.id ?? 0);
+    indexed.set(id || item.key, item);
+  }
+
+  for (const item of flatItems) {
+    const parentId = Number(item.menu_id ?? item.parent_id ?? 0);
+    if (parentId && indexed.has(parentId)) {
+      if (!children.has(parentId)) {
+        children.set(parentId, []);
+      }
+
+      children.get(parentId).push(item);
+      continue;
+    }
+
+    roots.push(item);
+  }
+
+  if (roots.length === 0) {
+    console.log(chalk.yellow("未返回任何权限"));
+    return;
+  }
+
+  for (const item of roots) {
+    console.log(item.key);
+    const nested = children.get(Number(item.id ?? 0)) || [];
+    for (const child of nested) {
+      console.log(`  - ${child.key}`);
+    }
+  }
+}
+
+async function installCommand(options) {
+  const config = await loadConfig();
+  const localMode = isLocalMode(options, config);
+  const authBackendUrl = resolveAuthBackendUrl(options, config);
+  const publishBackendUrl = resolvePublishBackendUrl(options, config);
+  const authPageUrl = resolveAuthPageUrl(options, config);
+
   console.log("");
   console.log(chalk.cyan("正在安装 QCPlay CLI..."));
   console.log("");
@@ -372,170 +697,373 @@ async function installCommand() {
     console.log(chalk.yellow("! 未找到 Skills 模板，已跳过"));
   }
 
-  await saveConfig();
+  await saveConfig(authBackendUrl, publishBackendUrl, authPageUrl, localMode);
   console.log(chalk.green("✔ 配置文件已生成"));
-
-  console.log("");
-  console.log(chalk.cyan("正在打开登录窗口..."));
-  console.log(chalk.gray("请在浏览器中完成账号密码登录。"));
+  console.log(chalk.gray(`认证后端: ${authBackendUrl}`));
+  console.log(chalk.gray(`发布后端: ${publishBackendUrl}`));
+  console.log(chalk.gray(`登录页地址: ${authPageUrl || "本地内置页面"}`));
   console.log("");
-
-  await runAuthLogin();
-
-  const loginStatus = await getLoginStatus();
-  if (!loginStatus.ok) {
-    throw new Error(`登录流程结束，但未检测到有效认证文件。\n原因: ${loginStatus.reason}`);
-  }
-
+  console.log("安装完成后可直接执行:");
+  console.log("  qcplay-cli auth");
   console.log("");
-  console.log(chalk.green("✔ QCPlay CLI 安装完成"));
-
-  printFeatures();
 }
 
-async function authCommand(action, args = []) {
-  if (!action || action === "login") {
-    console.log("");
-    console.log(chalk.cyan("正在打开 QCPlay 登录窗口..."));
-    console.log("");
-
-    await runAuthLogin();
+async function authCommand(rawArgs = []) {
+  const parsed = parseBackendOptions(rawArgs);
+  const options = parsed.options;
+  const args = parsed.args;
+  const action = args[0];
+  const config = await loadConfig();
+  const backendUrl = resolveAuthBackendUrl(options, config);
+  const authPageUrl = resolveAuthPageUrl(options, config);
 
-    const loginStatus = await getLoginStatus();
-    if (!loginStatus.ok) {
-      throw new Error(`登录失败。\n原因: ${loginStatus.reason}`);
+  if (!action || action === "login") {
+    const loginPageUrl = buildAuthPageUrl(backendUrl, authPageUrl);
+    let previousSequence = 0;
+
+    console.log(chalk.cyan("正在登录中"));
+    try {
+      await openBrowser(loginPageUrl);
+    } catch {
+      console.log(chalk.yellow("自动打开浏览器失败，请手动打开下面地址："));
+      console.log(chalk.gray(loginPageUrl));
     }
 
+    try {
+      previousSequence = await fetchLoginSuccessSequence(backendUrl);
+    } catch {}
+
+    await waitForLoginSuccessSequence(backendUrl, previousSequence);
+    console.log(chalk.green("登录成功"));
     return;
   }
 
   if (action === "status") {
-    const loginStatus = await getLoginStatus();
-
-    if (!loginStatus.ok) {
-      console.log(chalk.yellow("未登录或登录无效"));
-      console.log(`原因: ${loginStatus.reason}`);
-      console.log("");
-      console.log("请执行:");
-      console.log("  qcplay-cli auth");
+    const response = await requestJson("GET", backendUrl, "/api/auth/status");
+    if (response.data?.logged_in) {
+      console.log(chalk.green("已登录"));
       return;
     }
 
-    console.log(chalk.green("已登录"));
+    console.log(chalk.yellow("未登录"));
     return;
   }
 
   if (action === "logout") {
-    await removeFile(AUTH_FILE);
-    console.log(chalk.green("已退出登录"));
+    const response = await requestJson("POST", backendUrl, "/api/auth/logout", {});
+    console.log(chalk.green(response.message || "已退出登录"));
     return;
   }
 
   if (action === "permissions") {
-    const loginStatus = await getLoginStatus();
+    const flags = parsePermissionsOptions(args.slice(1));
+    const response = await requestJson("GET", backendUrl, "/api/permissions");
+    let permissions = response.data || [];
 
-    if (!loginStatus.ok) {
-      throw new Error(`未检测到有效登录状态。\n原因: ${loginStatus.reason}\n请先执行：qcplay-cli auth`);
+    if (flags.key) {
+      permissions = permissions.filter(item => item.key === flags.key || item.key.startsWith(`${flags.key}.`));
     }
 
-    const options = parsePermissionsOptions(args);
-    const nativeArgs = ["permissions"];
-
-    if (options.key) {
-      nativeArgs.push("--key", options.key);
-    }
-
-    if (options.json) {
-      nativeArgs.push("--json");
+    if (flags.json) {
+      console.log(JSON.stringify(permissions, null, 2));
+      return;
     }
 
-    await runNative("qcplay-auth", nativeArgs);
+    printPermissionTree(permissions);
     return;
   }
 
   printAuthHelp();
 }
 
-function parsePublishOptions(args) {
-  const options = {
-    env: undefined,
-    url: undefined,
-    dryRun: false
-  };
-  const positional = [];
+function unquoteValue(input) {
+  const trimmed = String(input).trim();
+  if (
+    (trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+    (trimmed.startsWith("'") && trimmed.endsWith("'"))
+  ) {
+    return trimmed.slice(1, -1);
+  }
 
-  for (let index = 0; index < args.length; index += 1) {
-    const current = args[index];
+  return trimmed;
+}
 
-    if (current === "--dry-run") {
-      options.dryRun = true;
-      continue;
+function stripBom(input) {
+  return input.charCodeAt(0) === 0xfeff ? input.slice(1) : input;
+}
+
+function escapeHtml(value) {
+  return String(value)
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&#39;");
+}
+
+function applyInlineMarkdown(text) {
+  const tokens = [];
+  let output = String(text);
+
+  function storeToken(value) {
+    const token = `@@MDTOKEN${tokens.length}@@`;
+    tokens.push(value);
+    return token;
+  }
+
+  output = output.replace(/`([^`]+)`/g, (_, code) => {
+    return storeToken(`<code>${escapeHtml(code)}</code>`);
+  });
+
+  output = output.replace(/!\[([^\]]*)\]\(([^)]+)\)/g, (_, alt, url) => {
+    return storeToken(`<img src="${escapeHtml(url.trim())}" alt="${escapeHtml(alt.trim())}" />`);
+  });
+
+  output = output.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, label, url) => {
+    return storeToken(`<a href="${escapeHtml(url.trim())}" target="_blank" rel="noreferrer">${escapeHtml(label.trim())}</a>`);
+  });
+
+  output = escapeHtml(output);
+
+  output = output.replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>");
+  output = output.replace(/__([^_]+)__/g, "<strong>$1</strong>");
+  output = output.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g, "<em>$1</em>");
+  output = output.replace(/(?<!_)_([^_]+)_(?!_)/g, "<em>$1</em>");
+
+  for (let index = 0; index < tokens.length; index += 1) {
+    output = output.replace(`@@MDTOKEN${index}@@`, tokens[index]);
+  }
+
+  return output;
+}
+
+function markdownToHtml(markdown) {
+  const lines = stripBom(markdown).replace(/\r\n/g, "\n").split("\n");
+  const html = [];
+  let paragraph = [];
+  let quote = [];
+  let listType = "";
+  let listItems = [];
+  let inCodeBlock = false;
+  let codeLines = [];
+
+  function flushParagraph() {
+    if (paragraph.length === 0) {
+      return;
     }
 
-    if (current === "--env" || current === "--url") {
-      const next = args[index + 1];
-      if (!next || next.startsWith("--")) {
-        throw new Error(`${current} 缺少参数值`);
-      }
+    html.push(`<p>${paragraph.map(line => applyInlineMarkdown(line)).join("<br />")}</p>`);
+    paragraph = [];
+  }
+
+  function flushQuote() {
+    if (quote.length === 0) {
+      return;
+    }
+
+    html.push(`<blockquote><p>${quote.map(line => applyInlineMarkdown(line)).join("<br />")}</p></blockquote>`);
+    quote = [];
+  }
 
-      if (current === "--env") {
-        options.env = next;
+  function flushList() {
+    if (!listType || listItems.length === 0) {
+      listType = "";
+      listItems = [];
+      return;
+    }
+
+    html.push(`<${listType}>${listItems.map(item => `<li>${applyInlineMarkdown(item)}</li>`).join("")}</${listType}>`);
+    listType = "";
+    listItems = [];
+  }
+
+  function flushCodeBlock() {
+    if (!inCodeBlock) {
+      return;
+    }
+
+    html.push(`<pre><code>${escapeHtml(codeLines.join("\n"))}</code></pre>`);
+    inCodeBlock = false;
+    codeLines = [];
+  }
+
+  function flushAll() {
+    flushParagraph();
+    flushQuote();
+    flushList();
+  }
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+
+    if (trimmed.startsWith("```")) {
+      if (inCodeBlock) {
+        flushCodeBlock();
       } else {
-        options.url = next;
+        flushAll();
+        inCodeBlock = true;
+        codeLines = [];
       }
+      continue;
+    }
 
-      index += 1;
+    if (inCodeBlock) {
+      codeLines.push(line);
       continue;
     }
 
-    if (current.startsWith("--")) {
-      throw new Error(`未知参数: ${current}`);
+    if (!trimmed) {
+      flushAll();
+      continue;
     }
 
-    positional.push(current);
+    const headingMatch = trimmed.match(/^(#{1,6})\s+(.+)$/);
+    if (headingMatch) {
+      flushAll();
+      const level = headingMatch[1].length;
+      html.push(`<h${level}>${applyInlineMarkdown(headingMatch[2].trim())}</h${level}>`);
+      continue;
+    }
+
+    if (/^(-{3,}|\*{3,}|_{3,})$/.test(trimmed)) {
+      flushAll();
+      html.push("<hr />");
+      continue;
+    }
+
+    const quoteMatch = line.match(/^\s*>\s?(.*)$/);
+    if (quoteMatch) {
+      flushParagraph();
+      flushList();
+      quote.push(quoteMatch[1]);
+      continue;
+    }
+
+    const unorderedMatch = line.match(/^\s*[-*+]\s+(.+)$/);
+    if (unorderedMatch) {
+      flushParagraph();
+      flushQuote();
+      if (listType && listType !== "ul") {
+        flushList();
+      }
+      listType = "ul";
+      listItems.push(unorderedMatch[1].trim());
+      continue;
+    }
+
+    const orderedMatch = line.match(/^\s*\d+\.\s+(.+)$/);
+    if (orderedMatch) {
+      flushParagraph();
+      flushQuote();
+      if (listType && listType !== "ol") {
+        flushList();
+      }
+      listType = "ol";
+      listItems.push(orderedMatch[1].trim());
+      continue;
+    }
+
+    flushQuote();
+    flushList();
+    paragraph.push(trimmed);
   }
 
-  return {
-    file: positional[0],
-    options
-  };
+  flushCodeBlock();
+  flushAll();
+  return html.join("\n");
 }
 
-async function publishArticleCommand(file, options) {
-  if (!file) {
-    throw new Error("缺少文章文件，例如：qcplay-cli www-article-list.store article.md");
+function parseFrontMatter(raw) {
+  const normalized = stripBom(raw).replace(/\r\n/g, "\n");
+  const lines = normalized.split("\n");
+
+  if (lines[0]?.trim() !== "---") {
+    throw new Error("文章文件缺少 Front Matter，首行必须是 ---");
   }
 
-  const articleFile = path.resolve(process.cwd(), file);
-  if (!(await pathExists(articleFile))) {
-    throw new Error(`文章文件不存在: ${articleFile}`);
+  let dividerIndex = -1;
+  for (let index = 1; index < lines.length; index += 1) {
+    if (lines[index].trim() === "---") {
+      dividerIndex = index;
+      break;
+    }
   }
 
-  const loginStatus = await getLoginStatus();
-  if (!loginStatus.ok) {
-    throw new Error(`未检测到有效登录状态。\n原因: ${loginStatus.reason}\n请先执行：qcplay-cli auth`);
+  if (dividerIndex === -1) {
+    throw new Error("文章文件缺少 Front Matter 结束标记 ---");
   }
 
-  const args = ["--content-file", articleFile];
+  const meta = {};
+  for (const line of lines.slice(1, dividerIndex)) {
+    if (!line.trim()) {
+      continue;
+    }
+
+    const separatorIndex = line.indexOf(":");
+    if (separatorIndex === -1) {
+      throw new Error(`Front Matter 格式错误: ${line}`);
+    }
 
-  if (options.env) {
-    args.push("--env", options.env);
+    meta[line.slice(0, separatorIndex).trim()] = unquoteValue(line.slice(separatorIndex + 1));
   }
 
-  if (options.url) {
-    args.push("--url", options.url);
+  return {
+    meta,
+    content: lines.slice(dividerIndex + 1).join("\n").trim()
+  };
+}
+
+function normalizeArticlePayload(meta, content) {
+  const payload = {
+    article_title: normalizeText(meta.article_title),
+    thumbnail: normalizeText(meta.thumbnail),
+    move_thumbnail: normalizeText(meta.move_thumbnail),
+    article_content: markdownToHtml(content),
+    article_excerpt: normalizeText(meta.article_excerpt),
+    article_url: normalizeText(meta.article_url),
+    origin: normalizeText(meta.origin),
+    status: normalizeMappedValue(meta.status, STATUS_MAP) || "0",
+    cate_id: normalizeMappedValue(meta.cate_id, CATEGORY_MAP),
+    video_link: normalizeText(meta.video_link),
+    is_hot: normalizeBoolLike(meta.is_hot, "0"),
+    is_index: normalizeBoolLike(meta.is_index, "0"),
+    release_time: normalizeText(meta.release_time),
+    area: normalizeMappedValue(meta.area, AREA_MAP) || "1",
+    sort: normalizeText(meta.sort) || "1",
+    game_id: normalizeMappedValue(meta.game_id, GAME_MAP) || "39",
+    is_index2: "0",
+    index_pc_img: normalizeText(meta.index_pc_img),
+    index_move_img: normalizeText(meta.index_move_img),
+    type: "1"
+  };
+
+  if (!payload.article_title) {
+    throw new Error("article_title 不能为空");
   }
 
-  if (options.dryRun) {
-    args.push("--dry-run");
+  if (!payload.thumbnail) {
+    throw new Error("thumbnail 不能为空");
   }
 
-  console.log("");
-  console.log(chalk.cyan("正在发布官网文章..."));
-  console.log(chalk.gray(`文章文件: ${articleFile}`));
-  console.log("");
+  if (!payload.article_content) {
+    throw new Error("文章正文不能为空");
+  }
+
+  return payload;
+}
+
+async function parseArticleFile(file) {
+  const articleFile = path.resolve(process.cwd(), file);
+  if (!(await pathExists(articleFile))) {
+    throw new Error(`文章文件不存在: ${articleFile}`);
+  }
 
-  await runNative("publish-article", args);
+  const raw = await fs.promises.readFile(articleFile, "utf8");
+  const parsed = parseFrontMatter(raw);
+  return {
+    articleFile,
+    payload: normalizeArticlePayload(parsed.meta, parsed.content)
+  };
 }
 
 async function initArticleTemplate(file = "article.md") {
@@ -579,15 +1107,15 @@ move_thumbnail: https://example.com/mobile-thumbnail.png
 article_excerpt: 文章描述，可以为空
 article_url: article-url-slug
 origin: QCPlay
-status: "1"
-cate_id: "2"
+status: 未发布
+cate_id: 综合
 video_link: ""
-is_hot: "0"
-is_index: "0"
-release_time: "2026-07-09"
-area: "1"
-sort: "100"
-game_id: "39"
+is_hot: 非热门
+is_index: 不推荐
+release_time: 2026-07-16
+area: pc
+sort: 100
+game_id: 最强蜗牛
 index_pc_img: ""
 index_move_img: ""
 ---
@@ -595,77 +1123,39 @@ index_move_img: ""
 # 文章标题
 
 这里填写文章正文内容。
-
-## 一、文章小标题
-
-这里填写正文内容。
-
-## 二、内容说明
-
-这里继续填写正文。
-
-## 三、总结
-
-这里填写文章结尾内容。
 ${chalk.gray("--------------------------------------------------")}
 
 ${chalk.cyan("发布命令：")}
 
   qcplay-cli www-article-list.store article.md
+`);
+}
 
-${chalk.cyan("参数说明：")}
-
-  article_title      文章标题，必填
-  thumbnail          缩略图，必填
-  move_thumbnail     移动端缩略图，可为空
-  article_excerpt    文章描述，可为空
-  article_url        文章链接，建议英文 slug
-  origin             作者来源
-  status             1 发布，0 未发布
-  cate_id            分类 ID
-  video_link         视频链接，可为空
-  is_hot             1 热门，0 非热门
-  is_index           1 推荐，0 不推荐
-  release_time       发布时间，格式：年-月-日
-  area               所属区域
-  sort               排序，数字
-  game_id            游戏 ID，最强蜗牛是 39
-  index_pc_img       推荐 PC 端缩略图，可为空
-  index_move_img     推荐移动端缩略图，可为空
-
-${chalk.cyan("分类 ID：")}
-
-  综合                 2
-  视频中心             8
-  活动                 3
-  游戏攻略             7
-  萌新入门             9
-  萌新入门-攻略专区    25
-  高手进阶             26
-  活动攻略             27
-  视频攻略             29
-
-${chalk.cyan("区域 ID：")}
-
-  PC                  1
-  资料站              3
-  公益网站            4
-
-${chalk.cyan("游戏 ID：")}
-
-  最强蜗牛            39
-
-${chalk.yellow("注意：")}
-
-  1. article_content 不需要写在 Front Matter 中。
-  2. Markdown 正文会自动作为 article_content。
-  3. is_index2 默认 0，不需要填写。
-  4. type 默认 1，不需要填写。
-  5. 发布前请先登录：
-
-     qcplay-cli auth
+async function publishArticleCommand(file, options) {
+  if (!file) {
+    throw new Error("缺少文章文件，例如：qcplay-cli www-article-list.store article.md");
+  }
 
-`);
+  const { articleFile, payload } = await parseArticleFile(file);
+  const config = await loadConfig();
+  const backendUrl = resolvePublishBackendUrl(options, config);
+
+  if (options.dryRun) {
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+
+  console.log("");
+  console.log(chalk.cyan("正在发布官网文章..."));
+  console.log(chalk.gray(`文章文件: ${articleFile}`));
+  console.log("");
+
+  const response = await requestJson("POST", backendUrl, "/api/articles/publish", payload);
+  console.log(chalk.green(response.message || "发布成功"));
+  const articleId = response.data?.id ?? response.data?.article_id ?? response.data?.articleId;
+  if (articleId !== undefined) {
+    console.log(`文章 ID: ${articleId}`);
+  }
 }
 
 async function runWithErrorBanner(title, action) {
@@ -694,7 +1184,8 @@ async function main() {
   }
 
   if (command === "install") {
-    await runWithErrorBanner("安装失败", installCommand);
+    const parsed = parseBackendOptions([subcommand, ...rest].filter(Boolean));
+    await runWithErrorBanner("安装失败", () => installCommand(parsed.options));
     return;
   }
 
@@ -704,7 +1195,7 @@ async function main() {
       return;
     }
 
-    await runWithErrorBanner("认证失败", () => authCommand(subcommand, rest));
+    await runWithErrorBanner("认证失败", () => authCommand([subcommand, ...rest].filter(Boolean)));
     return;
   }
 
@@ -725,8 +1216,8 @@ async function main() {
     }
 
     if (subcommand === "publish") {
-      const { file, options } = parsePublishOptions(rest);
-      await runWithErrorBanner("发布失败", () => publishArticleCommand(file, options));
+      const parsed = parsePublishOptions(rest);
+      await runWithErrorBanner("发布失败", () => publishArticleCommand(parsed.file, parsed.options));
       return;
     }