@xqyz/xq-cli 0.3.11 → 0.3.13

package/CHANGELOG.md

@@ -12,6 +12,49 @@
 
 （暂无未发布变更）
 
+## [xq-cli 0.3.13 / WorkBuddy Plugin 0.10.32] - 2026-08-28
+
+### API Key-only 登录
+
+- CLI 本机登录页只保留 API Key 输入，并继续通过 `/user/info` 使用现有校验链路。
+- 移除 CLI 和后端旧的账号密码、浏览器授权及 CLI 一次性授权码流程。
+- WorkBuddy 安装器只在没有 API Key 时打开本机登录页，并同步内置 CLI `0.3.13`。
+- `@xqyz/xq-cli@0.3.13` 与 `@xqyz/workbuddy-plugin-xique@0.10.32` 待本次发布；SkillHub `1.0.14` 仅生成上传包，需发布人手动上传。
+
+## [WorkBuddy Plugin 0.10.31] - 2026-08-28
+
+### 模板 5 自定义编号排版
+
+- 按 Web 页面参考重排模板 5 自定义编号：标题设置、正文序号设置、起始编号和各级排版控件层次更清晰。
+- 宽屏按行横向排列，窄卡片按稳定的 2/3/3 控件分组换行，避免自适应网格造成错位或挤压。
+- 保持 `customNumbering` 字段结构、默认值和导出参数不变。
+- `@xqyz/workbuddy-plugin-xique@0.10.31` 已发布，npm `latest` 和 `workbuddy-stable` 均已指向该版本。
+- 已生成 `output/skillhub-xique-ai-1.0.13.zip`，由发布人手动上传；SkillHub 不由代理自动发布。
+
+## [WorkBuddy Plugin 0.10.30] - 2026-08-27
+
+### 供应方式确认恢复
+
+- 修复解析完成但 `bidderIdentity_judgement=0` 时 WorkBuddy 直接阻塞的问题，新增“我们自己生产 / 我们采购供应”选择卡。
+- 供应方式提交后沿用同一 `runId/cid/uuid` 继续生成，兼容旧版本已标记为 `blocked` 的历史任务，并防止重复提交。
+- 同步 CLI `bidder-role` 命令、MCP App、Hook 白名单、Connector/Plugin Skill 和回归测试。
+- `@xqyz/xq-cli@0.3.12` 与 `@xqyz/workbuddy-plugin-xique@0.10.30` 已发布，npm `latest` 和 `workbuddy-stable` 均已指向对应版本；SkillHub `1.0.12` 上传包由发布人手动上传。
+
+## [WorkBuddy Plugin 0.10.29] - 2026-08-27
+
+### 模板5表格顺序
+
+- 保持模板5紧凑编号表格位于“导出模板”之后，避免展开“导出格式设置”时顺序错乱。
+- `@xqyz/workbuddy-plugin-xique@0.10.29` 已发布，`latest` 和 `workbuddy-stable` 均已指向该版本；SkillHub 无需新增版本。
+
+## [WorkBuddy Plugin 0.10.28] - 2026-08-27
+
+### 模板5自定义编号表格
+
+- 修复模板5自定义编号在并入“导出格式设置”后误用通用单选卡的问题。
+- 恢复标题级、正文级编号设置的紧凑表格下拉布局；数据结构和导出参数保持不变。
+- `@xqyz/workbuddy-plugin-xique@0.10.28` 已发布，`latest` 和 `workbuddy-stable` 均已指向该版本；SkillHub 无需新增版本。
+
 ## [xq-cli 0.3.11 / WorkBuddy Plugin 0.10.27 / SkillHub 1.0.11] - 2026-08-27
 
 ### 写作质量与导出设置
@@ -20,7 +63,7 @@
 - 极短篇、超短篇按前端规则禁用专家智笔和旗舰智笔；图片来源选项保持直接展示。
 - 表格、流程图、模板、编号、修改标记、页边距和图片尺寸等低频选项统一收纳到默认收起的“导出格式设置”。
 - 同步 CLI、MCP App、Connector 和 Skill 文档，保持配置提交和规划流程不变。
-- `@xqyz/xq-cli@0.3.11` 与 `@xqyz/workbuddy-plugin-xique@0.10.27` 待发布；SkillHub `1.0.11` 上传包待手动上传。
+- `@xqyz/xq-cli@0.3.11` 与 `@xqyz/workbuddy-plugin-xique@0.10.27` 已发布；`latest` 和 `workbuddy-stable` 均已指向对应版本。SkillHub `1.0.11` 上传包待手动上传。
 
 ## [WorkBuddy Plugin 0.10.26 / SkillHub 1.0.10] - 2026-08-27
 

package/README.md

@@ -53,12 +53,11 @@ npm install -g .\xqyz-xq-cli-0.2.0.tgz
 
 ```bash
 xq-cli login
-xq-cli login --name your-account --password your-password
 xq-cli login --api-key xq_sk_xxx
-xq-cli login --browser
 xq-cli wizard
 xq-cli wizard --file D:\bids\tender.docx
 xq-cli init --file D:\bids\tender.docx --wait
+xq-cli bidder-role --cid <cid> --uuid <uuid> --bidder-role <1|2>
 xq-cli outline --cid <cid> --interactive --wait
 xq-cli outline --cid <cid> --wait
 xq-cli outline view --cid <cid>
@@ -76,15 +75,12 @@ xq-cli export --cid <cid> --out D:\output
 
 Fresh installs default to the production API address `https://ai.bidfile.qianlima.com/api`. Use `--base-url` only when you need to target another API endpoint.
 
-`login` now defaults to a local page with browser and API Key choices. If you explicitly pass `--name` and `--password`, the CLI uses password login. If you pass `--api-key`, it saves the API key locally and uses it for later requests.
+`login` now supports API Key authentication only. Without `--api-key`, it opens a local page for entering the API Key; with `--api-key`, it verifies and saves the key directly. The old account/password and browser-authorization options are no longer supported.
 
 When no credential flags are supplied, `xq-cli login` opens a local login page on
-`127.0.0.1` with both choices: browser authorization or an API Key from the
-Xique API Key management page. The page submits the Key only to the local CLI,
+`127.0.0.1` for an API Key from the Xique API Key management page. The page submits the Key only to the local CLI,
 which verifies it with `/user/info` before saving it to the user-scoped config.
-Use `xq-cli login --browser` to skip the local page and open browser
-authorization directly, or `xq-cli login --no-open` to copy the local page URL
-manually. Never paste an API Key into chat or commit it to a repository.
+Use `xq-cli login --no-open` to copy the local page URL manually. Never paste an API Key into chat or commit it to a repository.
 
 `directory view` reads the complete generated directory tree without triggering outline, directory, or content generation. Add `--json` for the raw API structure, or `--out <file-or-directory>` to save a UTF-8 JSON document.
 
@@ -95,6 +91,11 @@ uploads an image in the Xique frontend.
 
 When `outline --wait` or `write --wait` hits a required response-basis step, the CLI will pause and ask you to choose `0/1/2` before continuing. It no longer auto-selects a default when you just press Enter.
 
+For goods procurement tasks paused on the bidder supply method, use
+`xq-cli bidder-role --cid <cid> --uuid <uuid> --bidder-role 1|2` (`1` means
+self production, `2` means procured supply). The command only submits the
+choice for the existing parsed task; it does not upload or create a task.
+
 `write --wait` now also retries `sequelForOutline` when the directory phase stalls at the outline-complete step, and auto-calls `generateAllUnfinished` if the backend reports `100%` but still leaves unfinished chapters behind.
 
 `write` follows the frontend flow:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xqyz/xq-cli",
-  "version": "0.3.11",
+  "version": "0.3.13",
   "description": "CLI for xique bid-book task workflows",
   "type": "module",
   "scripts": {

package/src/cli.mjs

@@ -7,7 +7,6 @@ import os from 'os';
 import path from 'path';
 import readline from 'node:readline/promises';
 import { spawn } from 'child_process';
-import { randomUUID } from 'crypto';
 import axios from 'axios';
 import FormData from 'form-data';
 import { templateData } from './templateData.mjs';
@@ -73,7 +72,6 @@ const DIRECTORY_SEQUEL_RETRY_INTERVAL_MS = 60_000;
 const GENERATE_UNFINISHED_RETRY_INTERVAL_MS = 60_000;
 const RETRYABLE_NETWORK_CODES = new Set(['ECONNRESET', 'ECONNABORTED', 'ETIMEDOUT', 'EAI_AGAIN']);
 const SOFT_CONTENT_TRIGGER_CODES = new Set([411, 429]);
-const BROWSER_LOGIN_CALLBACK_PATH = '/callback';
 const HTTP_AGENT = new http.Agent({ keepAlive: true });
 const HTTPS_AGENT = new https.Agent({ keepAlive: true });
 const AUTO_IGNORE_ISSUE_CONFIG = {
@@ -398,6 +396,9 @@ async function main() {
         case 'period-confirm':
             await handlePeriodConfirm(parsed, state);
             return;
+        case 'bidder-role':
+            await handleBidderRole(parsed, state);
+            return;
         case 'outline':
             if (isOutlineAction(parsed, ['view', 'show'])) {
                 await handleOutlineView(parsed, state);
@@ -467,6 +468,7 @@ Commands
   parse-status  Query or wait for parse completion
   period-status Query engineering project period confirmation status
   period-confirm Save confirmed engineering project period
+  bidder-role  Save the bidder's goods supply method for the current task
   outline       Pre-set task params and trigger outline generation
   outline view  View the current outline without triggering generation
   outline update Update the current outline from an edited JSON file
@@ -494,12 +496,11 @@ Plan actions
 Examples
   xq-cli login
   xq-cli login --no-open
-  xq-cli login --name your-account --password your-password
   xq-cli login --api-key xq_sk_xxx
-  xq-cli login --browser
   $env:XQ_API_KEY="xq_sk_xxx"
   xq-cli init --file D:\\bids\\tender.docx --wait
   xq-cli parse-status --cid <cid> --uuid <uuid> --wait
+  xq-cli bidder-role --cid <cid> --uuid <uuid> --bidder-role <1|2>
   xq-cli choices
   xq-cli choices outline --json
   xq-cli gallery-status --json
@@ -539,7 +540,7 @@ Common options
   --timeout-sec <n>  Poll timeout in seconds, default 600
   --interval-sec <n> Poll interval in seconds, default 10
   --reference-type <0|1|2>  Outline reference choice: 0=merge, 1=format only, 2=score only
-  --browser          Skip the local login page and open browser authorization directly
+  --bidder-role <1|2>      Goods supply method: 1=self production, 2=procured supply
   --api-key <key>    Save a user API key locally and verify it with /user/info
   --no-open          Do not open the local login page automatically
   --interactive      Open prompt menus for the current command
@@ -611,6 +612,9 @@ async function handleLogin(args, state) {
     if (!baseUrl) {
         throw new Error('Missing base URL. Pass --base-url <url>.');
     }
+    if (args.browser !== undefined || stringOption(args, 'name') || stringOption(args, 'password')) {
+        throw new Error('当前仅支持 API Key 登录，请使用 xq-cli login --api-key <key> 或打开本机登录页。');
+    }
     const sourceFrom = stringOption(args, 'sourceFrom', DEFAULT_SOURCE_FROM);
     const apiKey = normalizeApiKey(stringOption(args, 'apiKey'));
     if (apiKey) {
@@ -640,12 +644,8 @@ async function handleLogin(args, state) {
         ]);
         return;
     }
-    const loginMode = resolveLoginMode(args);
-    const loginResult = loginMode === 'browser'
-        ? { result: await loginWithBrowser(baseUrl, sourceFrom, args), authType: 'token' }
-        : loginMode === 'page'
-            ? await loginWithLoginPage(baseUrl, sourceFrom, args)
-            : { result: await loginWithPassword(baseUrl, sourceFrom, args), authType: 'token' };
+    const loginMode = 'page';
+    const loginResult = await loginWithLoginPage(baseUrl, args);
     const result = loginResult.result;
     const apiKeyFromPage = loginResult.apiKey || '';
 
@@ -664,7 +664,6 @@ async function handleLogin(args, state) {
         authType: loginResult.authType,
         baseUrl,
         username: state.user.username,
-        tokenSaved: loginResult.authType === 'token',
         apiKeySaved: loginResult.authType === 'api-key',
     }, [
         `login success: ${state.user.username}`,
@@ -675,83 +674,24 @@ async function handleLogin(args, state) {
     ]);
 }
 
-function resolveLoginMode(args) {
-    if (booleanOption(args, 'browser')) {
-        return 'browser';
-    }
-    if (stringOption(args, 'apiKey')) {
-        return 'api-key';
-    }
-    const hasName = stringOption(args, 'name');
-    const hasPassword = stringOption(args, 'password');
-    return hasName || hasPassword ? 'password' : 'page';
-}
-
 async function loginWithApiKey(baseUrl, apiKey) {
     const client = createClient(baseUrl, apiKey);
     return getJson(client, '/user/info');
 }
 
-async function loginWithPassword(baseUrl, sourceFrom, args) {
-    const name = requiredOption(args, 'name');
-    const password = requiredOption(args, 'password');
-    const client = createClient(baseUrl);
-    return postJson(client, '/user/login', {
-        name,
-        password,
-        sourceFrom,
-    });
-}
-
-async function loginWithBrowser(baseUrl, sourceFrom, args) {
-    const client = createClient(baseUrl);
-    const loginState = randomUUID();
-    const timeoutMs = secondsToMs(numberOption(args, 'timeoutSec', DEFAULT_LOGIN_TIMEOUT_MS / 1000));
-    const callbackServer = await startBrowserLoginServer();
-    const authorizeUrl = buildBrowserAuthorizeUrl(baseUrl, callbackServer.redirectUri, loginState, sourceFrom);
-
-    writeNotice(args, `browser login url: ${authorizeUrl}`);
-    if (openBrowser(authorizeUrl)) {
-        writeNotice(args, 'browser login: waiting for authorization callback');
-    } else {
-        writeNotice(args, 'browser login: automatic open failed, paste the URL above into a browser on this machine');
-    }
-
-    try {
-        const callback = await withTimeout(
-            callbackServer.result,
-            timeoutMs,
-            `Browser login timed out after ${Math.round(timeoutMs / 1000)} seconds.`,
-        );
-        if (callback.state !== loginState) {
-            throw new Error('Browser login state validation failed.');
-        }
-        return await postJson(client, '/user/cli/token', {
-            code: callback.code,
-            state: callback.state,
-        });
-    } finally {
-        await callbackServer.close();
-    }
-}
-
-async function loginWithLoginPage(baseUrl, sourceFrom, args) {
+async function loginWithLoginPage(baseUrl, args) {
     const timeoutMs = secondsToMs(numberOption(args, 'timeoutSec', DEFAULT_LOGIN_TIMEOUT_MS / 1000));
-    const loginState = randomUUID();
-    const server = await startBrowserLoginServer({
-        loginState,
+    const server = await startApiKeyLoginServer({
         onApiKey: async apiKey => ({
             result: await loginWithApiKey(baseUrl, apiKey),
             apiKey,
         }),
-        renderPage: ({ redirectUri }) => renderLoginPage({
-            authorizeUrl: buildBrowserAuthorizeUrl(baseUrl, redirectUri, loginState, sourceFrom),
-        }),
+        renderPage: () => renderLoginPage(),
     });
     writeNotice(args, `login page url: ${server.pageUrl}`);
     if (process.env.XQ_CLI_NO_BROWSER !== '1') {
         if (openBrowser(server.pageUrl)) {
-            writeNotice(args, 'login page: waiting for API key or browser authorization');
+            writeNotice(args, 'login page: waiting for API key');
         } else {
             writeNotice(args, 'login page: automatic open failed, paste the URL above into a browser on this machine');
         }
@@ -763,19 +703,10 @@ async function loginWithLoginPage(baseUrl, sourceFrom, args) {
             timeoutMs,
             `Login timed out after ${Math.round(timeoutMs / 1000)} seconds.`,
         );
-        if (selected.mode === 'api-key') {
-            return {
-                result: selected.result,
-                apiKey: selected.apiKey,
-                authType: 'api-key',
-            };
-        }
         return {
-            result: await postJson(createClient(baseUrl), '/user/cli/token', {
-                code: selected.code,
-                state: selected.state,
-            }),
-            authType: 'token',
+            result: selected.result,
+            apiKey: selected.apiKey,
+            authType: 'api-key',
         };
     } finally {
         await server.close();
@@ -948,6 +879,41 @@ async function handlePeriodConfirm(args, state) {
     return payload;
 }
 
+async function handleBidderRole(args, state) {
+    const client = createAuthorizedClient(args, state);
+    const cid = resolveCid(args, state);
+    const snapshot = await hydrateTaskSnapshot(client, state, cid);
+    const uuid = stringOption(args, 'uuid', snapshot.uuid);
+    if (!uuid) {
+        throw new Error(`No uuid found for task ${cid}. Pass --uuid explicitly or run init first.`);
+    }
+    const bidderRole = numberOption(args, 'bidderRole');
+    if (![1, 2].includes(bidderRole)) {
+        throw new Error('Option --bidder-role expects 1 (self production) or 2 (procured supply).');
+    }
+    const response = await getJson(client, '/proxy/savebidderRole', {
+        uuid,
+        bidderRole,
+    });
+    saveTaskSnapshot(state, cid, {
+        uuid,
+        bidderRole,
+    });
+    const payload = {
+        command: 'bidder-role',
+        cid,
+        uuid,
+        bidderRole,
+        response,
+    };
+    outputResult(args, payload, [
+        `bidder role saved: cid=${cid}`,
+        `uuid: ${uuid}`,
+        `bidder role: ${bidderRole === 1 ? 'self production' : 'procured supply'}`,
+    ]);
+    return payload;
+}
+
 function handleChoices(args) {
     const scope = normalizeChoicesScope(args._[1] || 'all');
     const payload = buildChoicesPayload(scope);
@@ -4205,16 +4171,7 @@ function saveLoginState(state, options) {
     writeState(state);
 }
 
-function buildBrowserAuthorizeUrl(baseUrl, redirectUri, state, sourceFrom) {
-    const query = new URLSearchParams({
-        redirect_uri: redirectUri,
-        state,
-        sourceFrom,
-    });
-    return `${baseUrl}/user/cli/authorize?${query.toString()}`;
-}
-
-async function startBrowserLoginServer({ loginState = '', renderPage = null, onApiKey = null } = {}) {
+async function startApiKeyLoginServer({ renderPage = null, onApiKey = null } = {}) {
     let settled = false;
     let resolveResult;
     let rejectResult;
@@ -4234,9 +4191,7 @@ async function startBrowserLoginServer({ loginState = '', renderPage = null, onA
         }
         if (pathname === '/' && typeof renderPage === 'function') {
             response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            response.end(renderPage({
-                redirectUri: `http://127.0.0.1:${origin?.port || 0}${BROWSER_LOGIN_CALLBACK_PATH}`,
-            }));
+            response.end(renderPage());
             return;
         }
         if (pathname === '/api-key' && request.method === 'POST' && typeof onApiKey === 'function') {
@@ -4259,39 +4214,8 @@ async function startBrowserLoginServer({ loginState = '', renderPage = null, onA
             }
             return;
         }
-        if (pathname !== BROWSER_LOGIN_CALLBACK_PATH) {
-            response.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
-            response.end('Not found');
-            return;
-        }
-
-        const code = requestUrl.searchParams.get('code');
-        const state = requestUrl.searchParams.get('state');
-        if (!code || !state) {
-            response.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-            response.end(renderBrowserLoginResultPage('登录未完成', '缺少 code 或 state，返回 CLI 重新执行登录即可。'));
-            if (!settled) {
-                settled = true;
-                rejectResult(new Error('Browser login callback missing code or state.'));
-            }
-            return;
-        }
-
-        if (loginState && state !== loginState) {
-            response.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-            response.end(renderBrowserLoginResultPage('登录未完成', '授权状态校验失败，请返回 CLI 重新执行登录。'));
-            if (!settled) {
-                settled = true;
-                rejectResult(new Error('Browser login state validation failed.'));
-            }
-            return;
-        }
-        response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-        response.end(renderBrowserLoginResultPage('登录成功', '授权已完成，现在可以回到 CLI 继续使用了。'));
-        if (!settled) {
-            settled = true;
-            resolveResult({ mode: 'browser', code, state });
-        }
+        response.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+        response.end('Not found');
     });
     server.on('error', error => {
         if (!settled) {
@@ -4309,11 +4233,8 @@ async function startBrowserLoginServer({ loginState = '', renderPage = null, onA
     });
 
     const address = server.address();
-    const redirectUri = `http://127.0.0.1:${address.port}${BROWSER_LOGIN_CALLBACK_PATH}`;
     return {
-        redirectUri,
         pageUrl: `http://127.0.0.1:${address.port}/`,
-        loginState,
         result,
         close: () => closeServer(server),
     };
@@ -4340,7 +4261,7 @@ async function readJsonRequestBody(request, maxBytes) {
     }
 }
 
-function renderLoginPage({ authorizeUrl }) {
+function renderLoginPage() {
     return `<!doctype html>
 <html lang="zh-CN">
 <head>
@@ -4407,8 +4328,6 @@ function renderLoginPage({ authorizeUrl }) {
       <div class="input-wrap"><span class="field-icon" aria-hidden="true"></span><input id="api-key" name="apiKey" type="password" autocomplete="off" placeholder="xq_sk_..." required /></div>
       <button type="submit"><span>使用 API Key 登录</span><span class="button-arrow">→</span></button>
     </form>
-    <div class="divider">或</div>
-    <a href="${escapeHtml(authorizeUrl)}"><span>使用浏览器授权登录</span><span class="button-arrow">↗</span></a>
     <p class="hint">API Key 可在喜鹊的 API Key 管理页创建。验证成功后即可关闭页面。</p>
     <div class="secure-note"><span></span>登录状态仅用于当前 CLI 工作流</div>
     </main>
@@ -5254,6 +5173,7 @@ function pickTaskSnapshot(source) {
         multiBidType: source.multiBidType,
         choiceMultiBiddingId: source.choiceMultiBiddingId,
         epcEngineerType: source.epcEngineerType,
+        bidderRole: source.bidderRole,
         outlineReferenceType: source.outlineReferenceType,
         referenceStatus: source.referenceStatus,
         themeStyleSetting: source.themeStyleSetting,