@xqyz/xq-cli 0.3.12 → 0.3.13

package/CHANGELOG.md

@@ -10,12 +10,35 @@
 
 ## [Unreleased]
 
+（暂无未发布变更）
+
+## [xq-cli 0.3.13 / WorkBuddy Plugin 0.10.32] - 2026-08-28
+
+### API Key-only 登录
+
+- CLI 本机登录页只保留 API Key 输入，并继续通过 `/user/info` 使用现有校验链路。
+- 移除 CLI 和后端旧的账号密码、浏览器授权及 CLI 一次性授权码流程。
+- WorkBuddy 安装器只在没有 API Key 时打开本机登录页，并同步内置 CLI `0.3.13`。
+- `@xqyz/xq-cli@0.3.13` 与 `@xqyz/workbuddy-plugin-xique@0.10.32` 待本次发布；SkillHub `1.0.14` 仅生成上传包，需发布人手动上传。
+
+## [WorkBuddy Plugin 0.10.31] - 2026-08-28
+
+### 模板 5 自定义编号排版
+
+- 按 Web 页面参考重排模板 5 自定义编号：标题设置、正文序号设置、起始编号和各级排版控件层次更清晰。
+- 宽屏按行横向排列，窄卡片按稳定的 2/3/3 控件分组换行，避免自适应网格造成错位或挤压。
+- 保持 `customNumbering` 字段结构、默认值和导出参数不变。
+- `@xqyz/workbuddy-plugin-xique@0.10.31` 已发布，npm `latest` 和 `workbuddy-stable` 均已指向该版本。
+- 已生成 `output/skillhub-xique-ai-1.0.13.zip`，由发布人手动上传；SkillHub 不由代理自动发布。
+
+## [WorkBuddy Plugin 0.10.30] - 2026-08-27
+
 ### 供应方式确认恢复
 
 - 修复解析完成但 `bidderIdentity_judgement=0` 时 WorkBuddy 直接阻塞的问题，新增“我们自己生产 / 我们采购供应”选择卡。
 - 供应方式提交后沿用同一 `runId/cid/uuid` 继续生成，兼容旧版本已标记为 `blocked` 的历史任务，并防止重复提交。
 - 同步 CLI `bidder-role` 命令、MCP App、Hook 白名单、Connector/Plugin Skill 和回归测试。
-- 计划发布 `@xqyz/xq-cli@0.3.12`、`@xqyz/workbuddy-plugin-xique@0.10.30`，生成 SkillHub `1.0.12` 上传包（待发布人手动上传）。
+- `@xqyz/xq-cli@0.3.12` 与 `@xqyz/workbuddy-plugin-xique@0.10.30` 已发布，npm `latest` 和 `workbuddy-stable` 均已指向对应版本；SkillHub `1.0.12` 上传包由发布人手动上传。
 
 ## [WorkBuddy Plugin 0.10.29] - 2026-08-27
 

package/README.md

@@ -53,9 +53,7 @@ npm install -g .\xqyz-xq-cli-0.2.0.tgz
 
 ```bash
 xq-cli login
-xq-cli login --name your-account --password your-password
 xq-cli login --api-key xq_sk_xxx
-xq-cli login --browser
 xq-cli wizard
 xq-cli wizard --file D:\bids\tender.docx
 xq-cli init --file D:\bids\tender.docx --wait
@@ -77,15 +75,12 @@ xq-cli export --cid <cid> --out D:\output
 
 Fresh installs default to the production API address `https://ai.bidfile.qianlima.com/api`. Use `--base-url` only when you need to target another API endpoint.
 
-`login` now defaults to a local page with browser and API Key choices. If you explicitly pass `--name` and `--password`, the CLI uses password login. If you pass `--api-key`, it saves the API key locally and uses it for later requests.
+`login` now supports API Key authentication only. Without `--api-key`, it opens a local page for entering the API Key; with `--api-key`, it verifies and saves the key directly. The old account/password and browser-authorization options are no longer supported.
 
 When no credential flags are supplied, `xq-cli login` opens a local login page on
-`127.0.0.1` with both choices: browser authorization or an API Key from the
-Xique API Key management page. The page submits the Key only to the local CLI,
+`127.0.0.1` for an API Key from the Xique API Key management page. The page submits the Key only to the local CLI,
 which verifies it with `/user/info` before saving it to the user-scoped config.
-Use `xq-cli login --browser` to skip the local page and open browser
-authorization directly, or `xq-cli login --no-open` to copy the local page URL
-manually. Never paste an API Key into chat or commit it to a repository.
+Use `xq-cli login --no-open` to copy the local page URL manually. Never paste an API Key into chat or commit it to a repository.
 
 `directory view` reads the complete generated directory tree without triggering outline, directory, or content generation. Add `--json` for the raw API structure, or `--out <file-or-directory>` to save a UTF-8 JSON document.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xqyz/xq-cli",
-  "version": "0.3.12",
+  "version": "0.3.13",
   "description": "CLI for xique bid-book task workflows",
   "type": "module",
   "scripts": {

package/src/cli.mjs

@@ -7,7 +7,6 @@ import os from 'os';
 import path from 'path';
 import readline from 'node:readline/promises';
 import { spawn } from 'child_process';
-import { randomUUID } from 'crypto';
 import axios from 'axios';
 import FormData from 'form-data';
 import { templateData } from './templateData.mjs';
@@ -73,7 +72,6 @@ const DIRECTORY_SEQUEL_RETRY_INTERVAL_MS = 60_000;
 const GENERATE_UNFINISHED_RETRY_INTERVAL_MS = 60_000;
 const RETRYABLE_NETWORK_CODES = new Set(['ECONNRESET', 'ECONNABORTED', 'ETIMEDOUT', 'EAI_AGAIN']);
 const SOFT_CONTENT_TRIGGER_CODES = new Set([411, 429]);
-const BROWSER_LOGIN_CALLBACK_PATH = '/callback';
 const HTTP_AGENT = new http.Agent({ keepAlive: true });
 const HTTPS_AGENT = new https.Agent({ keepAlive: true });
 const AUTO_IGNORE_ISSUE_CONFIG = {
@@ -498,9 +496,7 @@ Plan actions
 Examples
   xq-cli login
   xq-cli login --no-open
-  xq-cli login --name your-account --password your-password
   xq-cli login --api-key xq_sk_xxx
-  xq-cli login --browser
   $env:XQ_API_KEY="xq_sk_xxx"
   xq-cli init --file D:\\bids\\tender.docx --wait
   xq-cli parse-status --cid <cid> --uuid <uuid> --wait
@@ -545,7 +541,6 @@ Common options
   --interval-sec <n> Poll interval in seconds, default 10
   --reference-type <0|1|2>  Outline reference choice: 0=merge, 1=format only, 2=score only
   --bidder-role <1|2>      Goods supply method: 1=self production, 2=procured supply
-  --browser          Skip the local login page and open browser authorization directly
   --api-key <key>    Save a user API key locally and verify it with /user/info
   --no-open          Do not open the local login page automatically
   --interactive      Open prompt menus for the current command
@@ -617,6 +612,9 @@ async function handleLogin(args, state) {
     if (!baseUrl) {
         throw new Error('Missing base URL. Pass --base-url <url>.');
     }
+    if (args.browser !== undefined || stringOption(args, 'name') || stringOption(args, 'password')) {
+        throw new Error('当前仅支持 API Key 登录，请使用 xq-cli login --api-key <key> 或打开本机登录页。');
+    }
     const sourceFrom = stringOption(args, 'sourceFrom', DEFAULT_SOURCE_FROM);
     const apiKey = normalizeApiKey(stringOption(args, 'apiKey'));
     if (apiKey) {
@@ -646,12 +644,8 @@ async function handleLogin(args, state) {
         ]);
         return;
     }
-    const loginMode = resolveLoginMode(args);
-    const loginResult = loginMode === 'browser'
-        ? { result: await loginWithBrowser(baseUrl, sourceFrom, args), authType: 'token' }
-        : loginMode === 'page'
-            ? await loginWithLoginPage(baseUrl, sourceFrom, args)
-            : { result: await loginWithPassword(baseUrl, sourceFrom, args), authType: 'token' };
+    const loginMode = 'page';
+    const loginResult = await loginWithLoginPage(baseUrl, args);
     const result = loginResult.result;
     const apiKeyFromPage = loginResult.apiKey || '';
 
@@ -670,7 +664,6 @@ async function handleLogin(args, state) {
         authType: loginResult.authType,
         baseUrl,
         username: state.user.username,
-        tokenSaved: loginResult.authType === 'token',
         apiKeySaved: loginResult.authType === 'api-key',
     }, [
         `login success: ${state.user.username}`,
@@ -681,83 +674,24 @@ async function handleLogin(args, state) {
     ]);
 }
 
-function resolveLoginMode(args) {
-    if (booleanOption(args, 'browser')) {
-        return 'browser';
-    }
-    if (stringOption(args, 'apiKey')) {
-        return 'api-key';
-    }
-    const hasName = stringOption(args, 'name');
-    const hasPassword = stringOption(args, 'password');
-    return hasName || hasPassword ? 'password' : 'page';
-}
-
 async function loginWithApiKey(baseUrl, apiKey) {
     const client = createClient(baseUrl, apiKey);
     return getJson(client, '/user/info');
 }
 
-async function loginWithPassword(baseUrl, sourceFrom, args) {
-    const name = requiredOption(args, 'name');
-    const password = requiredOption(args, 'password');
-    const client = createClient(baseUrl);
-    return postJson(client, '/user/login', {
-        name,
-        password,
-        sourceFrom,
-    });
-}
-
-async function loginWithBrowser(baseUrl, sourceFrom, args) {
-    const client = createClient(baseUrl);
-    const loginState = randomUUID();
-    const timeoutMs = secondsToMs(numberOption(args, 'timeoutSec', DEFAULT_LOGIN_TIMEOUT_MS / 1000));
-    const callbackServer = await startBrowserLoginServer();
-    const authorizeUrl = buildBrowserAuthorizeUrl(baseUrl, callbackServer.redirectUri, loginState, sourceFrom);
-
-    writeNotice(args, `browser login url: ${authorizeUrl}`);
-    if (openBrowser(authorizeUrl)) {
-        writeNotice(args, 'browser login: waiting for authorization callback');
-    } else {
-        writeNotice(args, 'browser login: automatic open failed, paste the URL above into a browser on this machine');
-    }
-
-    try {
-        const callback = await withTimeout(
-            callbackServer.result,
-            timeoutMs,
-            `Browser login timed out after ${Math.round(timeoutMs / 1000)} seconds.`,
-        );
-        if (callback.state !== loginState) {
-            throw new Error('Browser login state validation failed.');
-        }
-        return await postJson(client, '/user/cli/token', {
-            code: callback.code,
-            state: callback.state,
-        });
-    } finally {
-        await callbackServer.close();
-    }
-}
-
-async function loginWithLoginPage(baseUrl, sourceFrom, args) {
+async function loginWithLoginPage(baseUrl, args) {
     const timeoutMs = secondsToMs(numberOption(args, 'timeoutSec', DEFAULT_LOGIN_TIMEOUT_MS / 1000));
-    const loginState = randomUUID();
-    const server = await startBrowserLoginServer({
-        loginState,
+    const server = await startApiKeyLoginServer({
         onApiKey: async apiKey => ({
             result: await loginWithApiKey(baseUrl, apiKey),
             apiKey,
         }),
-        renderPage: ({ redirectUri }) => renderLoginPage({
-            authorizeUrl: buildBrowserAuthorizeUrl(baseUrl, redirectUri, loginState, sourceFrom),
-        }),
+        renderPage: () => renderLoginPage(),
     });
     writeNotice(args, `login page url: ${server.pageUrl}`);
     if (process.env.XQ_CLI_NO_BROWSER !== '1') {
         if (openBrowser(server.pageUrl)) {
-            writeNotice(args, 'login page: waiting for API key or browser authorization');
+            writeNotice(args, 'login page: waiting for API key');
         } else {
             writeNotice(args, 'login page: automatic open failed, paste the URL above into a browser on this machine');
         }
@@ -769,19 +703,10 @@ async function loginWithLoginPage(baseUrl, sourceFrom, args) {
             timeoutMs,
             `Login timed out after ${Math.round(timeoutMs / 1000)} seconds.`,
         );
-        if (selected.mode === 'api-key') {
-            return {
-                result: selected.result,
-                apiKey: selected.apiKey,
-                authType: 'api-key',
-            };
-        }
         return {
-            result: await postJson(createClient(baseUrl), '/user/cli/token', {
-                code: selected.code,
-                state: selected.state,
-            }),
-            authType: 'token',
+            result: selected.result,
+            apiKey: selected.apiKey,
+            authType: 'api-key',
         };
     } finally {
         await server.close();
@@ -4246,16 +4171,7 @@ function saveLoginState(state, options) {
     writeState(state);
 }
 
-function buildBrowserAuthorizeUrl(baseUrl, redirectUri, state, sourceFrom) {
-    const query = new URLSearchParams({
-        redirect_uri: redirectUri,
-        state,
-        sourceFrom,
-    });
-    return `${baseUrl}/user/cli/authorize?${query.toString()}`;
-}
-
-async function startBrowserLoginServer({ loginState = '', renderPage = null, onApiKey = null } = {}) {
+async function startApiKeyLoginServer({ renderPage = null, onApiKey = null } = {}) {
     let settled = false;
     let resolveResult;
     let rejectResult;
@@ -4275,9 +4191,7 @@ async function startBrowserLoginServer({ loginState = '', renderPage = null, onA
         }
         if (pathname === '/' && typeof renderPage === 'function') {
             response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            response.end(renderPage({
-                redirectUri: `http://127.0.0.1:${origin?.port || 0}${BROWSER_LOGIN_CALLBACK_PATH}`,
-            }));
+            response.end(renderPage());
             return;
         }
         if (pathname === '/api-key' && request.method === 'POST' && typeof onApiKey === 'function') {
@@ -4300,39 +4214,8 @@ async function startBrowserLoginServer({ loginState = '', renderPage = null, onA
             }
             return;
         }
-        if (pathname !== BROWSER_LOGIN_CALLBACK_PATH) {
-            response.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
-            response.end('Not found');
-            return;
-        }
-
-        const code = requestUrl.searchParams.get('code');
-        const state = requestUrl.searchParams.get('state');
-        if (!code || !state) {
-            response.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-            response.end(renderBrowserLoginResultPage('登录未完成', '缺少 code 或 state，返回 CLI 重新执行登录即可。'));
-            if (!settled) {
-                settled = true;
-                rejectResult(new Error('Browser login callback missing code or state.'));
-            }
-            return;
-        }
-
-        if (loginState && state !== loginState) {
-            response.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-            response.end(renderBrowserLoginResultPage('登录未完成', '授权状态校验失败，请返回 CLI 重新执行登录。'));
-            if (!settled) {
-                settled = true;
-                rejectResult(new Error('Browser login state validation failed.'));
-            }
-            return;
-        }
-        response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-        response.end(renderBrowserLoginResultPage('登录成功', '授权已完成，现在可以回到 CLI 继续使用了。'));
-        if (!settled) {
-            settled = true;
-            resolveResult({ mode: 'browser', code, state });
-        }
+        response.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+        response.end('Not found');
     });
     server.on('error', error => {
         if (!settled) {
@@ -4350,11 +4233,8 @@ async function startBrowserLoginServer({ loginState = '', renderPage = null, onA
     });
 
     const address = server.address();
-    const redirectUri = `http://127.0.0.1:${address.port}${BROWSER_LOGIN_CALLBACK_PATH}`;
     return {
-        redirectUri,
         pageUrl: `http://127.0.0.1:${address.port}/`,
-        loginState,
         result,
         close: () => closeServer(server),
     };
@@ -4381,7 +4261,7 @@ async function readJsonRequestBody(request, maxBytes) {
     }
 }
 
-function renderLoginPage({ authorizeUrl }) {
+function renderLoginPage() {
     return `<!doctype html>
 <html lang="zh-CN">
 <head>
@@ -4448,8 +4328,6 @@ function renderLoginPage({ authorizeUrl }) {
       <div class="input-wrap"><span class="field-icon" aria-hidden="true"></span><input id="api-key" name="apiKey" type="password" autocomplete="off" placeholder="xq_sk_..." required /></div>
       <button type="submit"><span>使用 API Key 登录</span><span class="button-arrow">→</span></button>
     </form>
-    <div class="divider">或</div>
-    <a href="${escapeHtml(authorizeUrl)}"><span>使用浏览器授权登录</span><span class="button-arrow">↗</span></a>
     <p class="hint">API Key 可在喜鹊的 API Key 管理页创建。验证成功后即可关闭页面。</p>
     <div class="secure-note"><span></span>登录状态仅用于当前 CLI 工作流</div>
     </main>