@xqyz/xq-cli 0.3.8 → 0.3.10

package/CHANGELOG.md

@@ -10,6 +10,41 @@
 
 ## [Unreleased]
 
+（暂无未发布变更）
+
+## [WorkBuddy Plugin 0.10.24 / SkillHub 1.0.8] - 2026-08-26
+
+### MCP 中文展示名
+
+- MCP 初始化信息的用户可见名称改为“喜鹊标书”，同时保留 `xique-bid` 内部标识、工具命名空间和配置升级键不变。
+
+### CLI 本地登录页视觉升级
+
+- 登录页改为响应式双栏工作台，补充一次登录复用、分阶段工作流和 Key 轮换等接入信息。
+- API Key 说明改为“凭证保存在本机，后续命令无需重复输入”，保留 API Key 登录与浏览器授权两条入口及原有提交接口。
+
+### CLI 登录页支持 API Key
+
+- `xq-cli login` 默认打开本机登录页，普通用户可在页面中选择浏览器授权或输入 API Key。
+- API Key 只通过本机回环地址提交，由 CLI 调用 `/user/info` 验证后保存；不会进入 URL 或日志。
+- 保留 `xq-cli login --browser` 直接打开浏览器授权，以及 `--no-open` 手动复制本机页面地址。
+
+### WorkBuddy Skill 自助更新
+
+- 用户只需说“更新喜鹊标书”或“升级喜鹊标书”，即可授权拉取正式 SkillHub `@org-kkw9656k/xique-ai`，无需重复粘贴完整安装提示。
+- 安装器优先下载并校验 SkillHub 最新包；远端不可用、版本落后或要求更高运行版本时使用兼容的内置/已安装 Skill，不覆盖现有新版本。
+- SkillHub 下载只接受经过身份、版本、路径、文件类型和大小校验的 Skill Markdown 内容；更新仍会备份旧 Skill，并在新会话中生效。
+
+## [0.3.9 / WorkBuddy Plugin 0.10.23 / SkillHub 1.0.6] - 2026-08-26
+
+### WorkBuddy 规划模式自动推进
+
+- 修复规划模式解析已经达到 `success=3`，但后端未在任务详情回显标包和 `planMode` 时被误判为 `TASK_PARSE_NOT_ADVANCED` 的问题。
+- WorkBuddy 检测到 `analysis_ready` 后自动对同一 `cid` 执行 `plan confirm-outline`，不再展示 `analysis-review` 或智能解读确认卡。
+- 已被旧版本误标失败、但错误中已记录解析 `success=3` 的规划任务，在查询同一 `runId` 时会原地恢复并自动确认生成大纲。
+- 保留大纲和目录人工确认闸门；自动推进只覆盖后台智能解读到大纲生成这一段，不会提前生成正文。
+- WorkBuddy Plugin `0.10.22` 发布时依赖范围被 npm 写成 `^0.3.9`，已弃用且未进入 `workbuddy-stable`；`0.10.23` 恢复固定依赖 `0.3.9`。
+
 ## [0.3.8 / WorkBuddy Plugin 0.10.21 / SkillHub 1.0.5] - 2026-08-25
 
 ### 规划模式卡住保护

package/README.md

@@ -76,7 +76,15 @@ xq-cli export --cid <cid> --out D:\output
 
 Fresh installs default to the production API address `https://ai.bidfile.qianlima.com/api`. Use `--base-url` only when you need to target another API endpoint.
 
-`login` now defaults to browser authorization. If you explicitly pass `--name` and `--password`, the CLI falls back to password login. If you pass `--api-key`, it saves the API key locally and uses it for later requests.
+`login` now defaults to a local page with browser and API Key choices. If you explicitly pass `--name` and `--password`, the CLI uses password login. If you pass `--api-key`, it saves the API key locally and uses it for later requests.
+
+When no credential flags are supplied, `xq-cli login` opens a local login page on
+`127.0.0.1` with both choices: browser authorization or an API Key from the
+Xique API Key management page. The page submits the Key only to the local CLI,
+which verifies it with `/user/info` before saving it to the user-scoped config.
+Use `xq-cli login --browser` to skip the local page and open browser
+authorization directly, or `xq-cli login --no-open` to copy the local page URL
+manually. Never paste an API Key into chat or commit it to a repository.
 
 `directory view` reads the complete generated directory tree without triggering outline, directory, or content generation. Add `--json` for the raw API structure, or `--out <file-or-directory>` to save a UTF-8 JSON document.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xqyz/xq-cli",
-  "version": "0.3.8",
+  "version": "0.3.10",
   "description": "CLI for xique bid-book task workflows",
   "type": "module",
   "scripts": {

package/src/cli.mjs

@@ -441,7 +441,7 @@ function printHelp() {
 xq-cli: xique brand task CLI
 
 Commands
-  login         Save xique API key or account token locally
+  login         Open a local login page or save xique credentials locally
   init          Upload files and initialize a task
   parse-status  Query or wait for parse completion
   period-status Query engineering project period confirmation status
@@ -472,6 +472,7 @@ Plan actions
 
 Examples
   xq-cli login
+  xq-cli login --no-open
   xq-cli login --name your-account --password your-password
   xq-cli login --api-key xq_sk_xxx
   xq-cli login --browser
@@ -517,8 +518,9 @@ Common options
   --timeout-sec <n>  Poll timeout in seconds, default 600
   --interval-sec <n> Poll interval in seconds, default 10
   --reference-type <0|1|2>  Outline reference choice: 0=merge, 1=format only, 2=score only
-  --browser          Force browser authorization login; browser is the default when credentials are not provided
+  --browser          Skip the local login page and open browser authorization directly
   --api-key <key>    Save a user API key locally and verify it with /user/info
+  --no-open          Do not open the local login page automatically
   --interactive      Open prompt menus for the current command
   --dry-run          Preview an outline update without saving it
   --yes              Confirm an outline update without an interactive prompt
@@ -610,33 +612,42 @@ async function handleLogin(args, state) {
         }, [
             `login success: ${state.user.username}`,
             'mode: api-key',
+            'authType: api-key',
             `baseUrl: ${baseUrl}`,
             `config: ${CONFIG_FILE}`,
         ]);
         return;
     }
     const loginMode = resolveLoginMode(args);
-    const result = loginMode === 'browser'
-        ? await loginWithBrowser(baseUrl, sourceFrom, args)
-        : await loginWithPassword(baseUrl, sourceFrom, args);
+    const loginResult = loginMode === 'browser'
+        ? { result: await loginWithBrowser(baseUrl, sourceFrom, args), authType: 'token' }
+        : loginMode === 'page'
+            ? await loginWithLoginPage(baseUrl, sourceFrom, args)
+            : { result: await loginWithPassword(baseUrl, sourceFrom, args), authType: 'token' };
+    const result = loginResult.result;
+    const apiKeyFromPage = loginResult.apiKey || '';
 
     saveLoginState(state, {
         baseUrl,
-        name: stringOption(args, 'name', result.data?.user?.username || ''),
+        name: stringOption(args, 'name', result.data?.user?.username || result.data?.username || ''),
         sourceFrom,
         result,
+        apiKey: apiKeyFromPage,
+        authType: loginResult.authType,
     });
 
     outputResult(args, {
         command: 'login',
         mode: loginMode,
-        authType: loginMode === 'browser' ? 'token' : 'token',
+        authType: loginResult.authType,
         baseUrl,
         username: state.user.username,
-        tokenSaved: true,
+        tokenSaved: loginResult.authType === 'token',
+        apiKeySaved: loginResult.authType === 'api-key',
     }, [
         `login success: ${state.user.username}`,
         `mode: ${loginMode}`,
+        `authType: ${loginResult.authType}`,
         `baseUrl: ${baseUrl}`,
         `config: ${CONFIG_FILE}`,
     ]);
@@ -651,7 +662,7 @@ function resolveLoginMode(args) {
     }
     const hasName = stringOption(args, 'name');
     const hasPassword = stringOption(args, 'password');
-    return hasName || hasPassword ? 'password' : 'browser';
+    return hasName || hasPassword ? 'password' : 'page';
 }
 
 async function loginWithApiKey(baseUrl, apiKey) {
@@ -702,6 +713,53 @@ async function loginWithBrowser(baseUrl, sourceFrom, args) {
     }
 }
 
+async function loginWithLoginPage(baseUrl, sourceFrom, args) {
+    const timeoutMs = secondsToMs(numberOption(args, 'timeoutSec', DEFAULT_LOGIN_TIMEOUT_MS / 1000));
+    const loginState = randomUUID();
+    const server = await startBrowserLoginServer({
+        loginState,
+        onApiKey: async apiKey => ({
+            result: await loginWithApiKey(baseUrl, apiKey),
+            apiKey,
+        }),
+        renderPage: ({ redirectUri }) => renderLoginPage({
+            authorizeUrl: buildBrowserAuthorizeUrl(baseUrl, redirectUri, loginState, sourceFrom),
+        }),
+    });
+    writeNotice(args, `login page url: ${server.pageUrl}`);
+    if (process.env.XQ_CLI_NO_BROWSER !== '1') {
+        if (openBrowser(server.pageUrl)) {
+            writeNotice(args, 'login page: waiting for API key or browser authorization');
+        } else {
+            writeNotice(args, 'login page: automatic open failed, paste the URL above into a browser on this machine');
+        }
+    }
+
+    try {
+        const selected = await withTimeout(
+            server.result,
+            timeoutMs,
+            `Login timed out after ${Math.round(timeoutMs / 1000)} seconds.`,
+        );
+        if (selected.mode === 'api-key') {
+            return {
+                result: selected.result,
+                apiKey: selected.apiKey,
+                authType: 'api-key',
+            };
+        }
+        return {
+            result: await postJson(createClient(baseUrl), '/user/cli/token', {
+                code: selected.code,
+                state: selected.state,
+            }),
+            authType: 'token',
+        };
+    } finally {
+        await server.close();
+    }
+}
+
 function writeNotice(args, message) {
     if (booleanOption(args, 'json')) {
         console.error(message);
@@ -2153,11 +2211,20 @@ async function verifyParserWakeUp(client, state, cid, uuid, params, planningMode
             choiceMultiBiddingId: selectedMultiBidId,
         }));
 
+        const parseAdvanced = [1, 3, 4].includes(parseSuccess);
         const selectionRequired = expectedMultiBidId && expectedMultiBidId !== 'notMultiBid';
         const selectionMatches = !selectionRequired || selectedMultiBidId === expectedMultiBidId;
-        const parseAdvanced = [1, 3, 4].includes(parseSuccess);
-        const planModeMatches = !planningMode || savedPlanMode === 1;
-        if (parseAdvanced && selectionMatches && planModeMatches) {
+        const selectionMetadataMissing = selectionRequired && !selectedMultiBidId;
+        // Planning mode persists the full configuration again when
+        // `plan confirm-outline` is called. Some backend deployments complete
+        // intelligent analysis (success=3) without mirroring planMode or the
+        // selected package onto getTaskDetail. Treat the parse result as the
+        // authority here so WorkBuddy can trigger the explicit outline
+        // confirmation instead of failing before that call.
+        // The same response shape occurs in quick mode: an advanced parse
+        // with an omitted package field is still ahead of the success=2
+        // selection gate. Keep rejecting an explicitly different package.
+        if (parseAdvanced && (planningMode || selectionMatches || selectionMetadataMissing)) {
             return latest;
         }
 
@@ -4111,7 +4178,7 @@ function buildBrowserAuthorizeUrl(baseUrl, redirectUri, state, sourceFrom) {
     return `${baseUrl}/user/cli/authorize?${query.toString()}`;
 }
 
-async function startBrowserLoginServer() {
+async function startBrowserLoginServer({ loginState = '', renderPage = null, onApiKey = null } = {}) {
     let settled = false;
     let resolveResult;
     let rejectResult;
@@ -4119,7 +4186,7 @@ async function startBrowserLoginServer() {
         resolveResult = resolve;
         rejectResult = reject;
     });
-    const server = http.createServer((request, response) => {
+    const server = http.createServer(async (request, response) => {
         const origin = server.address();
         const requestUrl = new URL(request.url || '/', `http://127.0.0.1:${origin?.port || 0}`);
         const pathname = requestUrl.pathname;
@@ -4129,6 +4196,33 @@ async function startBrowserLoginServer() {
             response.end();
             return;
         }
+        if (pathname === '/' && typeof renderPage === 'function') {
+            response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            response.end(renderPage({
+                redirectUri: `http://127.0.0.1:${origin?.port || 0}${BROWSER_LOGIN_CALLBACK_PATH}`,
+            }));
+            return;
+        }
+        if (pathname === '/api-key' && request.method === 'POST' && typeof onApiKey === 'function') {
+            try {
+                const body = await readJsonRequestBody(request, 16 * 1024);
+                const apiKey = normalizeApiKey(body?.apiKey);
+                if (!apiKey) {
+                    throw new Error('请输入 API Key。');
+                }
+                const selected = await onApiKey(apiKey);
+                response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                response.end(renderBrowserLoginResultPage('登录成功', 'API Key 已验证，CLI 正在保存登录状态；现在可以关闭此页面。'));
+                if (!settled) {
+                    settled = true;
+                    resolveResult({ mode: 'api-key', ...selected });
+                }
+            } catch (error) {
+                response.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+                response.end(renderBrowserLoginResultPage('登录未完成', error.message || 'API Key 验证失败，请检查后重试。'));
+            }
+            return;
+        }
         if (pathname !== BROWSER_LOGIN_CALLBACK_PATH) {
             response.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
             response.end('Not found');
@@ -4147,11 +4241,20 @@ async function startBrowserLoginServer() {
             return;
         }
 
+        if (loginState && state !== loginState) {
+            response.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+            response.end(renderBrowserLoginResultPage('登录未完成', '授权状态校验失败，请返回 CLI 重新执行登录。'));
+            if (!settled) {
+                settled = true;
+                rejectResult(new Error('Browser login state validation failed.'));
+            }
+            return;
+        }
         response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
         response.end(renderBrowserLoginResultPage('登录成功', '授权已完成，现在可以回到 CLI 继续使用了。'));
         if (!settled) {
             settled = true;
-            resolveResult({ code, state });
+            resolveResult({ mode: 'browser', code, state });
         }
     });
     server.on('error', error => {
@@ -4173,11 +4276,111 @@ async function startBrowserLoginServer() {
     const redirectUri = `http://127.0.0.1:${address.port}${BROWSER_LOGIN_CALLBACK_PATH}`;
     return {
         redirectUri,
+        pageUrl: `http://127.0.0.1:${address.port}/`,
+        loginState,
         result,
         close: () => closeServer(server),
     };
 }
 
+async function readJsonRequestBody(request, maxBytes) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of request) {
+        total += chunk.length;
+        if (total > maxBytes) {
+            throw new Error('请求内容过大。');
+        }
+        chunks.push(chunk);
+    }
+    const text = Buffer.concat(chunks).toString('utf8');
+    try {
+        if (String(request.headers['content-type'] || '').includes('application/x-www-form-urlencoded')) {
+            return Object.fromEntries(new URLSearchParams(text));
+        }
+        return JSON.parse(text || '{}');
+    } catch {
+        throw new Error('请求格式无效。');
+    }
+}
+
+function renderLoginPage({ authorizeUrl }) {
+    return `<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>喜鹊标书登录</title>
+  <style>
+    :root{font-family:Inter,Segoe UI,Microsoft YaHei,sans-serif;color:#182238;background:#eef3fb;}
+    *{box-sizing:border-box;} body{min-height:100vh;margin:0;padding:32px;display:grid;place-items:center;background:#eef3fb;}
+    .page-shell{width:min(100%,1080px);display:grid;grid-template-columns:minmax(0,1fr) 448px;gap:24px;align-items:stretch;}
+    .brand-panel{position:relative;overflow:hidden;display:flex;min-height:584px;flex-direction:column;justify-content:space-between;padding:42px 44px;border:1px solid #dce5f4;border-radius:24px;background:linear-gradient(145deg,#f8fbff 0%,#eef4ff 58%,#e9f0fc 100%);box-shadow:0 20px 55px rgba(35,58,105,.10);}
+    .brand-panel:after{content:"";position:absolute;width:310px;height:310px;right:-128px;bottom:-142px;border:1px solid rgba(83,111,179,.20);border-radius:50%;box-shadow:0 0 0 26px rgba(83,111,179,.05),0 0 0 52px rgba(83,111,179,.04);}
+    .brand-top,.brand-footer{position:relative;z-index:1;display:flex;align-items:center;justify-content:space-between;gap:12px;}
+    .brand-kicker{display:flex;align-items:center;gap:10px;color:#536da9;font-size:12px;font-weight:800;letter-spacing:.18em;}
+    .brand-symbol{display:grid;width:30px;height:30px;place-items:center;border-radius:10px;color:#fff;background:#536da9;box-shadow:0 7px 16px rgba(83,109,169,.25);font-size:18px;letter-spacing:0;}
+    .brand-status{display:flex;align-items:center;gap:7px;color:#6b7b99;font-size:12px;}
+    .brand-status i{width:7px;height:7px;border-radius:50%;background:#35a779;box-shadow:0 0 0 4px rgba(53,167,121,.13);}
+    .brand-copy{position:relative;z-index:1;margin:auto 0;max-width:470px;}
+    .brand-copy h1{margin:0;color:#14213b;font-size:clamp(38px,5vw,62px);font-weight:800;letter-spacing:-.055em;line-height:1.08;}
+    .brand-copy h1 em{font-style:normal;color:#536da9;}
+    .brand-copy p{max-width:400px;margin:24px 0 0;color:#637593;font-size:16px;line-height:1.85;}
+    .brand-features{display:grid;grid-template-columns:repeat(3,1fr);gap:10px;margin:34px 0 0;}
+    .brand-feature{padding:14px 13px;border:1px solid rgba(188,204,231,.72);border-radius:12px;background:rgba(255,255,255,.58);}
+    .brand-feature strong,.brand-feature span{display:block;}.brand-feature strong{color:#324a7e;font-size:13px;}.brand-feature span{margin-top:5px;color:#7a89a3;font-size:11px;line-height:1.45;}
+    .brand-footer{justify-content:flex-start;color:#8290a8;font-size:11px;}
+    .card{width:100%;min-height:584px;padding:42px 40px;border:1px solid #e0e7f2;border-radius:24px;background:#fff;box-shadow:0 20px 55px rgba(35,58,105,.13);}
+    .card-heading{display:flex;align-items:center;gap:11px;margin-bottom:24px;}.card-heading-mark{display:grid;width:38px;height:38px;place-items:center;border:1px solid #dce4f4;border-radius:12px;color:#536da9;background:#f2f6ff;font-size:18px;}.card-heading small{display:block;color:#7a89a3;font-size:11px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;}.card-heading h2{margin:3px 0 0;color:#182238;font-size:25px;letter-spacing:-.03em;}
+    .muted{margin:0 0 28px;color:#6e7e99;line-height:1.75;font-size:14px;}
+    .field-label{display:flex;align-items:center;justify-content:space-between;margin:0 0 9px;color:#2c3a55;font-size:13px;font-weight:700;}.field-label span{color:#a4afc0;font-size:11px;font-weight:500;}
+    .input-wrap{position:relative;}.field-icon{position:absolute;top:50%;left:15px;width:18px;height:18px;transform:translateY(-50%);}.field-icon:before{content:"";position:absolute;top:1px;left:5px;width:7px;height:7px;border:1.5px solid #7183a5;border-radius:50%;}.field-icon:after{content:"";position:absolute;top:8px;left:8px;width:1.5px;height:9px;background:#7183a5;box-shadow:3px 5px 0 -0.25px #7183a5;}
+    input{display:block;width:100%;height:50px;padding:0 14px 0 47px;border:1px solid #d4deec;border-radius:12px;outline:0;color:#1c2b46;background:#fbfcfe;font:inherit;font-size:14px;transition:border-color .18s,box-shadow .18s,background .18s;} input::placeholder{color:#aeb9c9;} input:focus{border-color:#6d86bc;background:#fff;box-shadow:0 0 0 4px rgba(83,109,169,.12);}
+    button,a{display:flex;width:100%;min-height:50px;box-sizing:border-box;align-items:center;justify-content:center;gap:8px;padding:12px 14px;border-radius:12px;font:inherit;font-size:14px;font-weight:700;text-align:center;text-decoration:none;cursor:pointer;transition:transform .18s,box-shadow .18s,border-color .18s,background .18s;}
+    button{margin-top:13px;border:0;background:#536da9;color:#fff;box-shadow:0 10px 22px rgba(83,109,169,.23);} button:hover{background:#47619b;box-shadow:0 13px 26px rgba(83,109,169,.28);transform:translateY(-1px);} button:disabled{cursor:wait;opacity:.72;transform:none;}
+    .button-arrow{font-size:18px;line-height:1;}.divider{display:flex;align-items:center;gap:12px;color:#a1aec2;margin:23px 0 13px;font-size:12px;}.divider:before,.divider:after{content:"";height:1px;background:#e8edf4;flex:1;}
+    a{border:1px solid #d5dfed;color:#304364;background:#fff;} a:hover{border-color:#91a6cc;background:#f7f9fd;transform:translateY(-1px);}
+    .hint{margin:16px 0 0;color:#8390a6;font-size:12px;line-height:1.7;}.hint strong{color:#536da9;font-weight:700;}.secure-note{display:flex;align-items:center;gap:8px;margin-top:30px;padding-top:17px;border-top:1px solid #edf0f5;color:#9aa6b7;font-size:11px;}.secure-note span{width:7px;height:7px;border-radius:50%;background:#35a779;box-shadow:0 0 0 4px rgba(53,167,121,.10);}
+    @media (max-width:820px){body{padding:18px;}.page-shell{grid-template-columns:1fr;max-width:520px;}.brand-panel{display:none;}.card{min-height:0;padding:32px 26px;border-radius:20px;}}
+    @media (max-width:420px){body{padding:12px;}.card{padding:27px 20px;}.card-heading h2{font-size:22px;}}
+  </style>
+</head>
+<body>
+  <div class="page-shell">
+    <section class="brand-panel" aria-label="喜鹊标书 CLI">
+      <div class="brand-top">
+        <div class="brand-kicker"><span class="brand-symbol">↗</span> XIQUE CLI</div>
+        <div class="brand-status"><i></i> 本机安全接入</div>
+      </div>
+      <div class="brand-copy">
+        <h1>把喜鹊标书<br /><em>带到终端</em></h1>
+        <p>一次登录，连接初始化、大纲、正文与 Word 导出。把重复操作交给 CLI，把精力留给标书本身。</p>
+        <div class="brand-features">
+          <div class="brand-feature"><strong>一次登录</strong><span>后续命令自动复用</span></div>
+          <div class="brand-feature"><strong>分阶段工作流</strong><span>从大纲到正文可控推进</span></div>
+          <div class="brand-feature"><strong>随时可轮换</strong><span>账号中心独立管理 Key</span></div>
+        </div>
+      </div>
+      <div class="brand-footer">喜鹊标书 AI · 命令行工作台</div>
+    </section>
+    <main class="card">
+      <div class="card-heading"><span class="card-heading-mark">⌁</span><div><small>LOCAL ACCESS</small><h2>登录喜鹊标书</h2></div></div>
+    <p class="muted">使用 API Key 登录后，xq-cli 会在本机保存凭证，后续命令无需重复输入。</p>
+    <form method="post" action="/api-key" onsubmit="this.querySelector('button').disabled=true">
+      <label class="field-label" for="api-key">API Key <span>xq_sk_ 开头</span></label>
+      <div class="input-wrap"><span class="field-icon" aria-hidden="true"></span><input id="api-key" name="apiKey" type="password" autocomplete="off" placeholder="xq_sk_..." required /></div>
+      <button type="submit"><span>使用 API Key 登录</span><span class="button-arrow">→</span></button>
+    </form>
+    <div class="divider">或</div>
+    <a href="${escapeHtml(authorizeUrl)}"><span>使用浏览器授权登录</span><span class="button-arrow">↗</span></a>
+    <p class="hint">API Key 可在喜鹊的 API Key 管理页创建。验证成功后即可关闭页面。</p>
+    <div class="secure-note"><span></span>登录状态仅用于当前 CLI 工作流</div>
+    </main>
+  </div>
+</body>
+</html>`;
+}
+
 function renderBrowserLoginResultPage(title, message) {
     return `<!doctype html>
 <html lang="zh-CN">