@xqyz/xq-cli 0.3.9 → 0.3.11

package/CHANGELOG.md

@@ -10,7 +10,59 @@
 
 ## [Unreleased]
 
-## [0.3.9 / WorkBuddy Plugin 0.10.22 / SkillHub 1.0.6] - 2026-08-26
+（暂无未发布变更）
+
+## [xq-cli 0.3.11 / WorkBuddy Plugin 0.10.27 / SkillHub 1.0.11] - 2026-08-27
+
+### 写作质量与导出设置
+
+- WorkBuddy 配置卡将“写作模式”改为“写作质量”，新增“旗舰智笔”，并保留旧参数兼容映射。
+- 极短篇、超短篇按前端规则禁用专家智笔和旗舰智笔；图片来源选项保持直接展示。
+- 表格、流程图、模板、编号、修改标记、页边距和图片尺寸等低频选项统一收纳到默认收起的“导出格式设置”。
+- 同步 CLI、MCP App、Connector 和 Skill 文档，保持配置提交和规划流程不变。
+- `@xqyz/xq-cli@0.3.11` 与 `@xqyz/workbuddy-plugin-xique@0.10.27` 待发布；SkillHub `1.0.11` 上传包待手动上传。
+
+## [WorkBuddy Plugin 0.10.26 / SkillHub 1.0.10] - 2026-08-27
+
+### MCP 中文显示名
+
+- WorkBuddy MCP 配置键统一写入“喜鹊标书”，安装器会将已有 `xique-bid` 配置迁移为中文键并保留原有运行参数。
+- Connector 清单、安装提示和 MCP 初始化名称同步为“喜鹊标书”；Connector ID、工具命名空间和功能路径保持不变。
+- `@xqyz/workbuddy-plugin-xique@0.10.26` 已发布，`latest` 与 `workbuddy-stable` 均指向该版本；SkillHub `1.0.10` 待手动上传。
+
+## [WorkBuddy Plugin 0.10.25 / SkillHub 1.0.9] - 2026-08-26
+
+### Plugin 发布
+
+- WorkBuddy Plugin 固定依赖 `@xqyz/xq-cli@0.3.10`，MCP 运行时拒绝低于该版本的 CLI。
+- MCP 初始化信息的用户可见名称为“喜鹊标书”，保留 `xique-bid` Connector ID、工具命名空间和功能路径不变。
+- Windows 安装器的临时 npm 缓存改为异步清理，避免升级后残留句柄影响 WorkBuddy 重启。
+- `@xqyz/workbuddy-plugin-xique@0.10.25` 已发布，`latest` 与 `workbuddy-stable` 均指向该版本；SkillHub `1.0.9` 上传包已生成，待手动上传。
+
+## [WorkBuddy Plugin 0.10.24 / SkillHub 1.0.8] - 2026-08-26
+
+### MCP 中文展示名
+
+- MCP 初始化信息的用户可见名称改为“喜鹊标书”，同时保留 `xique-bid` 内部标识、工具命名空间和配置升级键不变。
+
+### CLI 本地登录页视觉升级
+
+- 登录页改为响应式双栏工作台，补充一次登录复用、分阶段工作流和 Key 轮换等接入信息。
+- API Key 说明改为“凭证保存在本机，后续命令无需重复输入”，保留 API Key 登录与浏览器授权两条入口及原有提交接口。
+
+### CLI 登录页支持 API Key
+
+- `xq-cli login` 默认打开本机登录页，普通用户可在页面中选择浏览器授权或输入 API Key。
+- API Key 只通过本机回环地址提交，由 CLI 调用 `/user/info` 验证后保存；不会进入 URL 或日志。
+- 保留 `xq-cli login --browser` 直接打开浏览器授权，以及 `--no-open` 手动复制本机页面地址。
+
+### WorkBuddy Skill 自助更新
+
+- 用户只需说“更新喜鹊标书”或“升级喜鹊标书”，即可授权拉取正式 SkillHub `@org-kkw9656k/xique-ai`，无需重复粘贴完整安装提示。
+- 安装器优先下载并校验 SkillHub 最新包；远端不可用、版本落后或要求更高运行版本时使用兼容的内置/已安装 Skill，不覆盖现有新版本。
+- SkillHub 下载只接受经过身份、版本、路径、文件类型和大小校验的 Skill Markdown 内容；更新仍会备份旧 Skill，并在新会话中生效。
+
+## [0.3.9 / WorkBuddy Plugin 0.10.23 / SkillHub 1.0.6] - 2026-08-26
 
 ### WorkBuddy 规划模式自动推进
 
@@ -18,6 +70,7 @@
 - WorkBuddy 检测到 `analysis_ready` 后自动对同一 `cid` 执行 `plan confirm-outline`，不再展示 `analysis-review` 或智能解读确认卡。
 - 已被旧版本误标失败、但错误中已记录解析 `success=3` 的规划任务，在查询同一 `runId` 时会原地恢复并自动确认生成大纲。
 - 保留大纲和目录人工确认闸门；自动推进只覆盖后台智能解读到大纲生成这一段，不会提前生成正文。
+- WorkBuddy Plugin `0.10.22` 发布时依赖范围被 npm 写成 `^0.3.9`，已弃用且未进入 `workbuddy-stable`；`0.10.23` 恢复固定依赖 `0.3.9`。
 
 ## [0.3.8 / WorkBuddy Plugin 0.10.21 / SkillHub 1.0.5] - 2026-08-25
 

package/README.md

@@ -76,7 +76,15 @@ xq-cli export --cid <cid> --out D:\output
 
 Fresh installs default to the production API address `https://ai.bidfile.qianlima.com/api`. Use `--base-url` only when you need to target another API endpoint.
 
-`login` now defaults to browser authorization. If you explicitly pass `--name` and `--password`, the CLI falls back to password login. If you pass `--api-key`, it saves the API key locally and uses it for later requests.
+`login` now defaults to a local page with browser and API Key choices. If you explicitly pass `--name` and `--password`, the CLI uses password login. If you pass `--api-key`, it saves the API key locally and uses it for later requests.
+
+When no credential flags are supplied, `xq-cli login` opens a local login page on
+`127.0.0.1` with both choices: browser authorization or an API Key from the
+Xique API Key management page. The page submits the Key only to the local CLI,
+which verifies it with `/user/info` before saving it to the user-scoped config.
+Use `xq-cli login --browser` to skip the local page and open browser
+authorization directly, or `xq-cli login --no-open` to copy the local page URL
+manually. Never paste an API Key into chat or commit it to a repository.
 
 `directory view` reads the complete generated directory tree without triggering outline, directory, or content generation. Add `--json` for the raw API structure, or `--out <file-or-directory>` to save a UTF-8 JSON document.
 
@@ -176,7 +184,7 @@ The wizard will prompt for:
 
 - source bid file
 - article length
-- writing mode
+- writing quality (standard writing / expert / flagship)
 - visual style
 - table quantity / color / style
 - planning mode
@@ -254,7 +262,7 @@ xq-cli choices export --json
 Outline generation now supports frontend-backed options such as:
 
 - `--page-scope` / `--page-scope-code`
-- `--base`
+- `--writing-quality` (0=standard writing, 1=expert, 2=flagship; `--base` remains a compatibility alias)
 - `--theme-style`
 - `--table-quantity`
 - `--table-color`
@@ -283,7 +291,7 @@ Export now supports frontend-backed style options such as:
 Example outline config:
 
 ```bash
-xq-cli outline --cid <cid> --page-scope 3 --base expert --theme-style 4 --table-quantity rich --table-color blue --table-style zebra --mermaid-style blue --knowledge-img 1 --scene-img 1 --plan-mode quick --wait
+xq-cli outline --cid <cid> --page-scope 3 --writing-quality flagship --theme-style 4 --table-quantity rich --table-color blue --table-style zebra --mermaid-style blue --knowledge-img 1 --scene-img 1 --plan-mode quick --wait
 ```
 
 Example export config:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xqyz/xq-cli",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "description": "CLI for xique bid-book task workflows",
   "type": "module",
   "scripts": {

package/src/cli.mjs

@@ -183,6 +183,26 @@ const BASE_OPTIONS = [
     { value: '0', label: 'standard', description: 'standard writing', aliases: ['0', 'standard', 'default'] },
     { value: '1', label: 'expert', description: 'expert polish / public knowledge reference', aliases: ['1', 'expert', 'polish'] },
 ];
+const WRITING_QUALITY_OPTIONS = [
+    {
+        value: 0,
+        label: 'standard-writing',
+        description: 'standard writing',
+        aliases: ['0', 'standard', 'standard-writing', '标准', '标准写作'],
+    },
+    {
+        value: 1,
+        label: 'expert',
+        description: 'expert writing',
+        aliases: ['1', 'expert', '专家智笔'],
+    },
+    {
+        value: 2,
+        label: 'flagship',
+        description: 'flagship deep-thinking writing',
+        aliases: ['2', 'flagship', '旗舰', '旗舰智笔'],
+    },
+];
 const THEME_STYLE_OPTIONS = [
     { value: 1, label: 'enhanced', description: 'enhanced image-rich layout', aliases: ['1', 'enhanced'] },
     { value: 2, label: 'table', description: 'table-first layout', aliases: ['2', 'table', 'table-first'] },
@@ -291,6 +311,7 @@ const PAGE_SCOPE_PROMPT_LABELS = {
 const BASE_PROMPT_LABELS = {
     0: '\u6807\u51C6\u5199\u4F5C',
     1: '\u4E13\u5BB6\u667A\u7B14',
+    2: '\u65D7\u8230\u667A\u7B14',
 };
 const THEME_STYLE_PROMPT_LABELS = {
     1: '\u589E\u5F3A\u56FE\u6587',
@@ -441,7 +462,7 @@ function printHelp() {
 xq-cli: xique brand task CLI
 
 Commands
-  login         Save xique API key or account token locally
+  login         Open a local login page or save xique credentials locally
   init          Upload files and initialize a task
   parse-status  Query or wait for parse completion
   period-status Query engineering project period confirmation status
@@ -472,6 +493,7 @@ Plan actions
 
 Examples
   xq-cli login
+  xq-cli login --no-open
   xq-cli login --name your-account --password your-password
   xq-cli login --api-key xq_sk_xxx
   xq-cli login --browser
@@ -489,7 +511,7 @@ Examples
   xq-cli outline --cid <cid> --wait --ignore-short-requirement
   xq-cli outline --cid <cid> --wait --ignore-missing-bill
   xq-cli outline --cid <cid> --wait --reference-type 0
-  xq-cli outline --cid <cid> --page-scope 3 --base expert --theme-style 4 --table-quantity rich --plan-mode quick --wait
+  xq-cli outline --cid <cid> --page-scope 3 --writing-quality flagship --theme-style 4 --table-quantity rich --plan-mode quick --wait
   xq-cli outline view --cid <cid>
   xq-cli outline view --cid <cid> --out D:\\output\\outline.json
   xq-cli outline update --cid <cid> --file D:\\output\\outline.json --dry-run --json
@@ -517,8 +539,9 @@ Common options
   --timeout-sec <n>  Poll timeout in seconds, default 600
   --interval-sec <n> Poll interval in seconds, default 10
   --reference-type <0|1|2>  Outline reference choice: 0=merge, 1=format only, 2=score only
-  --browser          Force browser authorization login; browser is the default when credentials are not provided
+  --browser          Skip the local login page and open browser authorization directly
   --api-key <key>    Save a user API key locally and verify it with /user/info
+  --no-open          Do not open the local login page automatically
   --interactive      Open prompt menus for the current command
   --dry-run          Preview an outline update without saving it
   --yes              Confirm an outline update without an interactive prompt
@@ -529,7 +552,8 @@ Common options
 Outline config
   --page-scope <code>         Full-length preset. See "xq-cli choices outline"
   --page-scope-code <code>    Alias of --page-scope
-  --base <0|1|standard|expert>
+  --writing-quality <0|1|2|standard|expert|flagship>  0=standard writing, 1=expert, 2=flagship
+  --base <0|1|standard|expert>  Deprecated compatibility alias for writing quality
   --theme-style <1|2|3|4|5|enhanced|table|rich|basic|text>
   --table-quantity <0|1|2|none|few|rich>
   --table-color <black|blue|red|green|purple|cyan|orange>
@@ -610,33 +634,42 @@ async function handleLogin(args, state) {
         }, [
             `login success: ${state.user.username}`,
             'mode: api-key',
+            'authType: api-key',
             `baseUrl: ${baseUrl}`,
             `config: ${CONFIG_FILE}`,
         ]);
         return;
     }
     const loginMode = resolveLoginMode(args);
-    const result = loginMode === 'browser'
-        ? await loginWithBrowser(baseUrl, sourceFrom, args)
-        : await loginWithPassword(baseUrl, sourceFrom, args);
+    const loginResult = loginMode === 'browser'
+        ? { result: await loginWithBrowser(baseUrl, sourceFrom, args), authType: 'token' }
+        : loginMode === 'page'
+            ? await loginWithLoginPage(baseUrl, sourceFrom, args)
+            : { result: await loginWithPassword(baseUrl, sourceFrom, args), authType: 'token' };
+    const result = loginResult.result;
+    const apiKeyFromPage = loginResult.apiKey || '';
 
     saveLoginState(state, {
         baseUrl,
-        name: stringOption(args, 'name', result.data?.user?.username || ''),
+        name: stringOption(args, 'name', result.data?.user?.username || result.data?.username || ''),
         sourceFrom,
         result,
+        apiKey: apiKeyFromPage,
+        authType: loginResult.authType,
     });
 
     outputResult(args, {
         command: 'login',
         mode: loginMode,
-        authType: loginMode === 'browser' ? 'token' : 'token',
+        authType: loginResult.authType,
         baseUrl,
         username: state.user.username,
-        tokenSaved: true,
+        tokenSaved: loginResult.authType === 'token',
+        apiKeySaved: loginResult.authType === 'api-key',
     }, [
         `login success: ${state.user.username}`,
         `mode: ${loginMode}`,
+        `authType: ${loginResult.authType}`,
         `baseUrl: ${baseUrl}`,
         `config: ${CONFIG_FILE}`,
     ]);
@@ -651,7 +684,7 @@ function resolveLoginMode(args) {
     }
     const hasName = stringOption(args, 'name');
     const hasPassword = stringOption(args, 'password');
-    return hasName || hasPassword ? 'password' : 'browser';
+    return hasName || hasPassword ? 'password' : 'page';
 }
 
 async function loginWithApiKey(baseUrl, apiKey) {
@@ -702,6 +735,53 @@ async function loginWithBrowser(baseUrl, sourceFrom, args) {
     }
 }
 
+async function loginWithLoginPage(baseUrl, sourceFrom, args) {
+    const timeoutMs = secondsToMs(numberOption(args, 'timeoutSec', DEFAULT_LOGIN_TIMEOUT_MS / 1000));
+    const loginState = randomUUID();
+    const server = await startBrowserLoginServer({
+        loginState,
+        onApiKey: async apiKey => ({
+            result: await loginWithApiKey(baseUrl, apiKey),
+            apiKey,
+        }),
+        renderPage: ({ redirectUri }) => renderLoginPage({
+            authorizeUrl: buildBrowserAuthorizeUrl(baseUrl, redirectUri, loginState, sourceFrom),
+        }),
+    });
+    writeNotice(args, `login page url: ${server.pageUrl}`);
+    if (process.env.XQ_CLI_NO_BROWSER !== '1') {
+        if (openBrowser(server.pageUrl)) {
+            writeNotice(args, 'login page: waiting for API key or browser authorization');
+        } else {
+            writeNotice(args, 'login page: automatic open failed, paste the URL above into a browser on this machine');
+        }
+    }
+
+    try {
+        const selected = await withTimeout(
+            server.result,
+            timeoutMs,
+            `Login timed out after ${Math.round(timeoutMs / 1000)} seconds.`,
+        );
+        if (selected.mode === 'api-key') {
+            return {
+                result: selected.result,
+                apiKey: selected.apiKey,
+                authType: 'api-key',
+            };
+        }
+        return {
+            result: await postJson(createClient(baseUrl), '/user/cli/token', {
+                code: selected.code,
+                state: selected.state,
+            }),
+            authType: 'token',
+        };
+    } finally {
+        await server.close();
+    }
+}
+
 function writeNotice(args, message) {
     if (booleanOption(args, 'json')) {
         console.error(message);
@@ -2005,7 +2085,13 @@ async function fetchAuthoritativeTaskState(client, cid, options = {}) {
 
 function buildOutlineParams(snapshot, args) {
     const pageScopeCode = enumOption(args, ['pageScope', 'pageScopeCode'], PAGE_SCOPE_OPTIONS, snapshot.pageScopeCode ?? DEFAULT_PAGE_SCOPE_CODE);
-    const base = enumOption(args, 'base', BASE_OPTIONS, snapshot.base ?? DEFAULT_BASE);
+    const writingQuality = enumOption(
+        args,
+        ['writingQuality', 'writingMode', 'base'],
+        WRITING_QUALITY_OPTIONS,
+        snapshot.writingQuality ?? (String(snapshot.base ?? DEFAULT_BASE) === '1' ? 1 : 0),
+    );
+    const base = pageScopeCode <= 0 ? '0' : writingQuality === 1 ? '1' : '0';
     const uuid = snapshot.uuid;
     const title = stringOption(args, 'title', snapshot.projectName || snapshot.title);
     const plan = stringOption(args, 'plan', snapshot.plan || '');
@@ -2034,7 +2120,9 @@ function buildOutlineParams(snapshot, args) {
         tableStyle: enumOption(args, 'tableStyle', TABLE_STYLE_OPTIONS, snapshot.tableStyle),
         annexIds: snapshot.annexIds || [],
         knowledgeProductIds: snapshot.knowledgeProductIds || [],
-        base: pageScopeCode <= 0 ? '0' : base,
+        base,
+        writingQuality,
+        deepThinkingFlowVersion: writingQuality === 2 ? 1 : null,
         bidFileIds: [uuid],
         directoryNodes: [],
         generateType: 1,
@@ -2156,13 +2244,17 @@ async function verifyParserWakeUp(client, state, cid, uuid, params, planningMode
         const parseAdvanced = [1, 3, 4].includes(parseSuccess);
         const selectionRequired = expectedMultiBidId && expectedMultiBidId !== 'notMultiBid';
         const selectionMatches = !selectionRequired || selectedMultiBidId === expectedMultiBidId;
+        const selectionMetadataMissing = selectionRequired && !selectedMultiBidId;
         // Planning mode persists the full configuration again when
         // `plan confirm-outline` is called. Some backend deployments complete
         // intelligent analysis (success=3) without mirroring planMode or the
         // selected package onto getTaskDetail. Treat the parse result as the
         // authority here so WorkBuddy can trigger the explicit outline
         // confirmation instead of failing before that call.
-        if (parseAdvanced && (planningMode || selectionMatches)) {
+        // The same response shape occurs in quick mode: an advanced parse
+        // with an omitted package field is still ahead of the success=2
+        // selection gate. Keep rejecting an explicitly different package.
+        if (parseAdvanced && (planningMode || selectionMatches || selectionMetadataMissing)) {
             return latest;
         }
 
@@ -3285,6 +3377,7 @@ function buildChoicesPayload(scope) {
         payload.outline = {
             pageScope: PAGE_SCOPE_OPTIONS,
             base: BASE_OPTIONS,
+            writingQuality: WRITING_QUALITY_OPTIONS,
             themeStyle: THEME_STYLE_OPTIONS,
             tableQuantity: TABLE_QUANTITY_OPTIONS,
             tableColor: TABLE_COLOR_OPTIONS,
@@ -3329,6 +3422,7 @@ function renderChoicesLines(payload) {
         lines.push('outline:');
         lines.push(`  page-scope: ${formatChoiceOptions(PAGE_SCOPE_OPTIONS)}`);
         lines.push(`  base: ${formatChoiceOptions(BASE_OPTIONS)}`);
+        lines.push(`  writing-quality: ${formatChoiceOptions(WRITING_QUALITY_OPTIONS)}`);
         lines.push(`  theme-style: ${formatChoiceOptions(THEME_STYLE_OPTIONS)}`);
         lines.push(`  table-quantity: ${formatChoiceOptions(TABLE_QUANTITY_OPTIONS)}`);
         lines.push(`  table-color: ${formatChoiceOptions(TABLE_COLOR_OPTIONS)}`);
@@ -3443,18 +3537,20 @@ async function collectOutlineInteractiveArgs(args, snapshot, context = null, opt
         nextArgs.pageScope = pageScopeCode;
 
         if (pageScopeCode <= 0) {
-            promptContext.promptStream.write('\u5DF2\u9009\u62E9\u77ED\u7BC7\u6A21\u5F0F\uFF0C\u5199\u4F5C\u6A21\u5F0F\u5C06\u56FA\u5B9A\u4E3A\u201C\u6807\u51C6\u5199\u4F5C\u201D\u3002\n');
+            promptContext.promptStream.write('\u5DF2\u9009\u62E9\u77ED\u7BC7\u6A21\u5F0F\uFF0C\u5199\u4F5C\u8D28\u91CF\u5C06\u56FA\u5B9A\u4E3A\u201C\u6807\u51C6\u5199\u4F5C\u201D\u3002\n');
+            nextArgs.writingQuality = 0;
             nextArgs.base = '0';
         } else {
-            nextArgs.base = await promptChoice(promptContext, {
-                title: '\u5199\u4F5C\u6A21\u5F0F',
-                question: '\u8BF7\u9009\u62E9\u5199\u4F5C\u6A21\u5F0F',
-                options: BASE_OPTIONS.map(option => ({
+            nextArgs.writingQuality = await promptChoice(promptContext, {
+                title: '\u5199\u4F5C\u8D28\u91CF',
+                question: '\u8BF7\u9009\u62E9\u5199\u4F5C\u8D28\u91CF',
+                options: WRITING_QUALITY_OPTIONS.map(option => ({
                     ...option,
                     promptLabel: BASE_PROMPT_LABELS[option.value] || option.label,
                 })),
-                defaultValue: enumOption(args, 'base', BASE_OPTIONS, defaults.base),
+                defaultValue: enumOption(args, ['writingQuality', 'writingMode', 'base'], WRITING_QUALITY_OPTIONS, defaults.writingQuality),
             });
+            nextArgs.base = nextArgs.writingQuality === 1 ? '1' : '0';
         }
 
         nextArgs.themeStyle = await promptChoice(promptContext, {
@@ -3677,9 +3773,11 @@ async function collectExportInteractiveArgs(args, snapshot, context = null, opti
 }
 
 function buildInteractiveSnapshotDefaults(source = {}) {
+    const writingQuality = source.writingQuality ?? (String(source.base ?? DEFAULT_BASE) === '1' ? 1 : 0);
     return {
         pageScopeCode: source.pageScopeCode ?? DEFAULT_PAGE_SCOPE_CODE,
         base: source.base ?? DEFAULT_BASE,
+        writingQuality,
         themeStyle: source.themeStyle ?? DEFAULT_THEME_STYLE,
         tableQuantity: source.tableQuantity ?? DEFAULT_TABLE_QUANTITY,
         tableColor: source.tableColor ?? DEFAULT_TABLE_COLOR,
@@ -4116,7 +4214,7 @@ function buildBrowserAuthorizeUrl(baseUrl, redirectUri, state, sourceFrom) {
     return `${baseUrl}/user/cli/authorize?${query.toString()}`;
 }
 
-async function startBrowserLoginServer() {
+async function startBrowserLoginServer({ loginState = '', renderPage = null, onApiKey = null } = {}) {
     let settled = false;
     let resolveResult;
     let rejectResult;
@@ -4124,7 +4222,7 @@ async function startBrowserLoginServer() {
         resolveResult = resolve;
         rejectResult = reject;
     });
-    const server = http.createServer((request, response) => {
+    const server = http.createServer(async (request, response) => {
         const origin = server.address();
         const requestUrl = new URL(request.url || '/', `http://127.0.0.1:${origin?.port || 0}`);
         const pathname = requestUrl.pathname;
@@ -4134,6 +4232,33 @@ async function startBrowserLoginServer() {
             response.end();
             return;
         }
+        if (pathname === '/' && typeof renderPage === 'function') {
+            response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            response.end(renderPage({
+                redirectUri: `http://127.0.0.1:${origin?.port || 0}${BROWSER_LOGIN_CALLBACK_PATH}`,
+            }));
+            return;
+        }
+        if (pathname === '/api-key' && request.method === 'POST' && typeof onApiKey === 'function') {
+            try {
+                const body = await readJsonRequestBody(request, 16 * 1024);
+                const apiKey = normalizeApiKey(body?.apiKey);
+                if (!apiKey) {
+                    throw new Error('请输入 API Key。');
+                }
+                const selected = await onApiKey(apiKey);
+                response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                response.end(renderBrowserLoginResultPage('登录成功', 'API Key 已验证，CLI 正在保存登录状态；现在可以关闭此页面。'));
+                if (!settled) {
+                    settled = true;
+                    resolveResult({ mode: 'api-key', ...selected });
+                }
+            } catch (error) {
+                response.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+                response.end(renderBrowserLoginResultPage('登录未完成', error.message || 'API Key 验证失败，请检查后重试。'));
+            }
+            return;
+        }
         if (pathname !== BROWSER_LOGIN_CALLBACK_PATH) {
             response.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
             response.end('Not found');
@@ -4152,11 +4277,20 @@ async function startBrowserLoginServer() {
             return;
         }
 
+        if (loginState && state !== loginState) {
+            response.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+            response.end(renderBrowserLoginResultPage('登录未完成', '授权状态校验失败，请返回 CLI 重新执行登录。'));
+            if (!settled) {
+                settled = true;
+                rejectResult(new Error('Browser login state validation failed.'));
+            }
+            return;
+        }
         response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
         response.end(renderBrowserLoginResultPage('登录成功', '授权已完成，现在可以回到 CLI 继续使用了。'));
         if (!settled) {
             settled = true;
-            resolveResult({ code, state });
+            resolveResult({ mode: 'browser', code, state });
         }
     });
     server.on('error', error => {
@@ -4178,11 +4312,111 @@ async function startBrowserLoginServer() {
     const redirectUri = `http://127.0.0.1:${address.port}${BROWSER_LOGIN_CALLBACK_PATH}`;
     return {
         redirectUri,
+        pageUrl: `http://127.0.0.1:${address.port}/`,
+        loginState,
         result,
         close: () => closeServer(server),
     };
 }
 
+async function readJsonRequestBody(request, maxBytes) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of request) {
+        total += chunk.length;
+        if (total > maxBytes) {
+            throw new Error('请求内容过大。');
+        }
+        chunks.push(chunk);
+    }
+    const text = Buffer.concat(chunks).toString('utf8');
+    try {
+        if (String(request.headers['content-type'] || '').includes('application/x-www-form-urlencoded')) {
+            return Object.fromEntries(new URLSearchParams(text));
+        }
+        return JSON.parse(text || '{}');
+    } catch {
+        throw new Error('请求格式无效。');
+    }
+}
+
+function renderLoginPage({ authorizeUrl }) {
+    return `<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>喜鹊标书登录</title>
+  <style>
+    :root{font-family:Inter,Segoe UI,Microsoft YaHei,sans-serif;color:#182238;background:#eef3fb;}
+    *{box-sizing:border-box;} body{min-height:100vh;margin:0;padding:32px;display:grid;place-items:center;background:#eef3fb;}
+    .page-shell{width:min(100%,1080px);display:grid;grid-template-columns:minmax(0,1fr) 448px;gap:24px;align-items:stretch;}
+    .brand-panel{position:relative;overflow:hidden;display:flex;min-height:584px;flex-direction:column;justify-content:space-between;padding:42px 44px;border:1px solid #dce5f4;border-radius:24px;background:linear-gradient(145deg,#f8fbff 0%,#eef4ff 58%,#e9f0fc 100%);box-shadow:0 20px 55px rgba(35,58,105,.10);}
+    .brand-panel:after{content:"";position:absolute;width:310px;height:310px;right:-128px;bottom:-142px;border:1px solid rgba(83,111,179,.20);border-radius:50%;box-shadow:0 0 0 26px rgba(83,111,179,.05),0 0 0 52px rgba(83,111,179,.04);}
+    .brand-top,.brand-footer{position:relative;z-index:1;display:flex;align-items:center;justify-content:space-between;gap:12px;}
+    .brand-kicker{display:flex;align-items:center;gap:10px;color:#536da9;font-size:12px;font-weight:800;letter-spacing:.18em;}
+    .brand-symbol{display:grid;width:30px;height:30px;place-items:center;border-radius:10px;color:#fff;background:#536da9;box-shadow:0 7px 16px rgba(83,109,169,.25);font-size:18px;letter-spacing:0;}
+    .brand-status{display:flex;align-items:center;gap:7px;color:#6b7b99;font-size:12px;}
+    .brand-status i{width:7px;height:7px;border-radius:50%;background:#35a779;box-shadow:0 0 0 4px rgba(53,167,121,.13);}
+    .brand-copy{position:relative;z-index:1;margin:auto 0;max-width:470px;}
+    .brand-copy h1{margin:0;color:#14213b;font-size:clamp(38px,5vw,62px);font-weight:800;letter-spacing:-.055em;line-height:1.08;}
+    .brand-copy h1 em{font-style:normal;color:#536da9;}
+    .brand-copy p{max-width:400px;margin:24px 0 0;color:#637593;font-size:16px;line-height:1.85;}
+    .brand-features{display:grid;grid-template-columns:repeat(3,1fr);gap:10px;margin:34px 0 0;}
+    .brand-feature{padding:14px 13px;border:1px solid rgba(188,204,231,.72);border-radius:12px;background:rgba(255,255,255,.58);}
+    .brand-feature strong,.brand-feature span{display:block;}.brand-feature strong{color:#324a7e;font-size:13px;}.brand-feature span{margin-top:5px;color:#7a89a3;font-size:11px;line-height:1.45;}
+    .brand-footer{justify-content:flex-start;color:#8290a8;font-size:11px;}
+    .card{width:100%;min-height:584px;padding:42px 40px;border:1px solid #e0e7f2;border-radius:24px;background:#fff;box-shadow:0 20px 55px rgba(35,58,105,.13);}
+    .card-heading{display:flex;align-items:center;gap:11px;margin-bottom:24px;}.card-heading-mark{display:grid;width:38px;height:38px;place-items:center;border:1px solid #dce4f4;border-radius:12px;color:#536da9;background:#f2f6ff;font-size:18px;}.card-heading small{display:block;color:#7a89a3;font-size:11px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;}.card-heading h2{margin:3px 0 0;color:#182238;font-size:25px;letter-spacing:-.03em;}
+    .muted{margin:0 0 28px;color:#6e7e99;line-height:1.75;font-size:14px;}
+    .field-label{display:flex;align-items:center;justify-content:space-between;margin:0 0 9px;color:#2c3a55;font-size:13px;font-weight:700;}.field-label span{color:#a4afc0;font-size:11px;font-weight:500;}
+    .input-wrap{position:relative;}.field-icon{position:absolute;top:50%;left:15px;width:18px;height:18px;transform:translateY(-50%);}.field-icon:before{content:"";position:absolute;top:1px;left:5px;width:7px;height:7px;border:1.5px solid #7183a5;border-radius:50%;}.field-icon:after{content:"";position:absolute;top:8px;left:8px;width:1.5px;height:9px;background:#7183a5;box-shadow:3px 5px 0 -0.25px #7183a5;}
+    input{display:block;width:100%;height:50px;padding:0 14px 0 47px;border:1px solid #d4deec;border-radius:12px;outline:0;color:#1c2b46;background:#fbfcfe;font:inherit;font-size:14px;transition:border-color .18s,box-shadow .18s,background .18s;} input::placeholder{color:#aeb9c9;} input:focus{border-color:#6d86bc;background:#fff;box-shadow:0 0 0 4px rgba(83,109,169,.12);}
+    button,a{display:flex;width:100%;min-height:50px;box-sizing:border-box;align-items:center;justify-content:center;gap:8px;padding:12px 14px;border-radius:12px;font:inherit;font-size:14px;font-weight:700;text-align:center;text-decoration:none;cursor:pointer;transition:transform .18s,box-shadow .18s,border-color .18s,background .18s;}
+    button{margin-top:13px;border:0;background:#536da9;color:#fff;box-shadow:0 10px 22px rgba(83,109,169,.23);} button:hover{background:#47619b;box-shadow:0 13px 26px rgba(83,109,169,.28);transform:translateY(-1px);} button:disabled{cursor:wait;opacity:.72;transform:none;}
+    .button-arrow{font-size:18px;line-height:1;}.divider{display:flex;align-items:center;gap:12px;color:#a1aec2;margin:23px 0 13px;font-size:12px;}.divider:before,.divider:after{content:"";height:1px;background:#e8edf4;flex:1;}
+    a{border:1px solid #d5dfed;color:#304364;background:#fff;} a:hover{border-color:#91a6cc;background:#f7f9fd;transform:translateY(-1px);}
+    .hint{margin:16px 0 0;color:#8390a6;font-size:12px;line-height:1.7;}.hint strong{color:#536da9;font-weight:700;}.secure-note{display:flex;align-items:center;gap:8px;margin-top:30px;padding-top:17px;border-top:1px solid #edf0f5;color:#9aa6b7;font-size:11px;}.secure-note span{width:7px;height:7px;border-radius:50%;background:#35a779;box-shadow:0 0 0 4px rgba(53,167,121,.10);}
+    @media (max-width:820px){body{padding:18px;}.page-shell{grid-template-columns:1fr;max-width:520px;}.brand-panel{display:none;}.card{min-height:0;padding:32px 26px;border-radius:20px;}}
+    @media (max-width:420px){body{padding:12px;}.card{padding:27px 20px;}.card-heading h2{font-size:22px;}}
+  </style>
+</head>
+<body>
+  <div class="page-shell">
+    <section class="brand-panel" aria-label="喜鹊标书 CLI">
+      <div class="brand-top">
+        <div class="brand-kicker"><span class="brand-symbol">↗</span> XIQUE CLI</div>
+        <div class="brand-status"><i></i> 本机安全接入</div>
+      </div>
+      <div class="brand-copy">
+        <h1>把喜鹊标书<br /><em>带到终端</em></h1>
+        <p>一次登录，连接初始化、大纲、正文与 Word 导出。把重复操作交给 CLI，把精力留给标书本身。</p>
+        <div class="brand-features">
+          <div class="brand-feature"><strong>一次登录</strong><span>后续命令自动复用</span></div>
+          <div class="brand-feature"><strong>分阶段工作流</strong><span>从大纲到正文可控推进</span></div>
+          <div class="brand-feature"><strong>随时可轮换</strong><span>账号中心独立管理 Key</span></div>
+        </div>
+      </div>
+      <div class="brand-footer">喜鹊标书 AI · 命令行工作台</div>
+    </section>
+    <main class="card">
+      <div class="card-heading"><span class="card-heading-mark">⌁</span><div><small>LOCAL ACCESS</small><h2>登录喜鹊标书</h2></div></div>
+    <p class="muted">使用 API Key 登录后，xq-cli 会在本机保存凭证，后续命令无需重复输入。</p>
+    <form method="post" action="/api-key" onsubmit="this.querySelector('button').disabled=true">
+      <label class="field-label" for="api-key">API Key <span>xq_sk_ 开头</span></label>
+      <div class="input-wrap"><span class="field-icon" aria-hidden="true"></span><input id="api-key" name="apiKey" type="password" autocomplete="off" placeholder="xq_sk_..." required /></div>
+      <button type="submit"><span>使用 API Key 登录</span><span class="button-arrow">→</span></button>
+    </form>
+    <div class="divider">或</div>
+    <a href="${escapeHtml(authorizeUrl)}"><span>使用浏览器授权登录</span><span class="button-arrow">↗</span></a>
+    <p class="hint">API Key 可在喜鹊的 API Key 管理页创建。验证成功后即可关闭页面。</p>
+    <div class="secure-note"><span></span>登录状态仅用于当前 CLI 工作流</div>
+    </main>
+  </div>
+</body>
+</html>`;
+}
+
 function renderBrowserLoginResultPage(title, message) {
     return `<!doctype html>
 <html lang="zh-CN">
@@ -4765,6 +4999,8 @@ function pickOutlineConfig(params) {
     return compactObject({
         pageScopeCode: params.pageScopeCode,
         base: params.base,
+        writingQuality: params.writingQuality,
+        deepThinkingFlowVersion: params.deepThinkingFlowVersion,
         themeStyle: params.themeStyle,
         tableQuantity: params.tableQuantity,
         tableColor: params.tableColor,
@@ -4787,6 +5023,9 @@ function buildOutlineConfigSummary(params) {
     return [
         `pageScope=${describeEnumValue(PAGE_SCOPE_OPTIONS, params.pageScopeCode)}`,
         `base=${describeEnumValue(BASE_OPTIONS, params.base)}`,
+        params.writingQuality !== undefined
+            ? `writingQuality=${describeEnumValue(WRITING_QUALITY_OPTIONS, params.writingQuality)}`
+            : null,
         params.themeStyle !== undefined ? `themeStyle=${describeEnumValue(THEME_STYLE_OPTIONS, params.themeStyle)}` : null,
         params.tableQuantity !== undefined ? `tableQuantity=${describeEnumValue(TABLE_QUANTITY_OPTIONS, params.tableQuantity)}` : null,
         params.tableColor !== undefined ? `tableColor=${describeEnumValue(TABLE_COLOR_OPTIONS, params.tableColor)}` : null,
@@ -4982,6 +5221,8 @@ function pickTaskSnapshot(source) {
         rating: source.rating,
         plan: source.plan,
         base: source.base,
+        writingQuality: source.writingQuality,
+        deepThinkingFlowVersion: source.deepThinkingFlowVersion,
         pageScopeCode: source.pageScopeCode,
         task_status: source.task_status,
         plan_mode_phase: source.plan_mode_phase,