fix: v2.3.1 Phase 4 统一调用 change-key.js

- Win auto-setup.ps1: 优先管道到 change-key.js, 回退 Test-ApiKey
- Mac Bookworm-Setup.sh: 凭证 printf 管道传 change-key.js, 不再重复 export
- 统一验证逻辑, 避免双实现漂移

Bookworm-OneClick-Mac.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 # ============================================================
-# Bookworm Smart Assistant - macOS 全自动安装 v2.3.0
+# Bookworm Smart Assistant - macOS 全自动安装 v2.3.1
 #
 # 用法 (任选一种):
 #   方式1: 下载后运行
@@ -39,7 +39,7 @@ echo "   |  _ \\ / _ \\ / _ \\| |/ /\\ \\ /\\ / / _ \\| '__| '\`_ \` _ \\"
 echo "   | |_) | (_) | (_) |   <  \\ V  V / (_) | |  | | | | | |"
 echo "   |____/ \\___/ \\___/|_|\\_\\  \\_/\\_/ \\___/|_|  |_| |_| |_|"
 echo ""
-echo -e "   ${BOLD}全自动安装 v2.3.0 — macOS${NC}"
+echo -e "   ${BOLD}全自动安装 v2.3.1 — macOS${NC}"
 echo -e "   ${BLUE}92 Skills | 18 Agents | 34 Hooks${NC}"
 echo -e "${NC}"
 

Bookworm-Setup.sh

@@ -35,7 +35,7 @@ banner() {
   echo " | |_) | (_) | (_) |   <  \\ V  V / (_) | |  | | | | | |"
   echo " |____/ \\___/ \\___/|_|\\_\\  \\_/\\_/ \\___/|_|  |_| |_| |_|"
   echo ""
-  echo -e " ${BOLD}Portable macOS Setup v2.3.0${NC}"
+  echo -e " ${BOLD}Portable macOS Setup v2.3.1${NC}"
   echo -e " ${BLUE}92 Skills | 18 Agents | 34 Hooks${NC}"
   echo -e "${NC}"
 }
@@ -322,24 +322,24 @@ parse_authcode() {
 if load_cached_secrets 2>/dev/null; then
   : # 缓存加载成功
 else
-  # 优先级 3: 调用 change-key.js 让用户直接输入中转站凭证 (v2.3)
+  # 优先级 3: 调用 change-key.js 验证+持久化 (stdin 管道, 无 argv 泄露)
   CHANGE_KEY_JS="$CLAUDE_DIR/change-key.js"
   if [ -f "$CHANGE_KEY_JS" ] && command -v node &>/dev/null; then
     echo ""
-    info "配置中转站凭证 (中转站: https://bww.letcareme.com)"
+    info "配置中转站凭证 (https://bww.letcareme.com)"
     for attempt in 1 2 3; do
       echo ""
-      read -rs -p "  粘贴凭证 (第 $attempt/3 次, 留空跳过): " UCRED
+      read -rs -p "  粘贴凭证 (第 $attempt/3 次, 输入不显示, 留空跳过): " UCRED
       echo ""
       [ -z "$UCRED" ] && { warn "已跳过"; break; }
-      if node "$CHANGE_KEY_JS" "$UCRED" 2>&1; then
+      if printf '%s' "$UCRED" | node "$CHANGE_KEY_JS"; then
-        export ANTHROPIC_API_KEY="$UCRED"
-        export ANTHROPIC_BASE_URL="https://bww.letcareme.com"
         UCRED=""
-        save_secrets_to_cache
+        success "凭证已验证并持久化"
-        success "凭证已写入并缓存"
         echo ""
-        info "换凭证方式: 重跑安装器 / bash ~/.claude/change-key.sh / Claude Code 里 /change-key"
+        info "换凭证方式:"
+        info "  1. 重跑安装器"
+        info "  2. bash ~/.claude/change-key.sh"
+        info "  3. Claude Code 里: /change-key"
         break
       else
         UCRED=""

auto-setup.ps1

@@ -16,7 +16,7 @@ param(
 $ErrorActionPreference = "Stop"
 
 # ─── 版本号 (每次更新递增, build.ps1 自动读取) ──────
-$BWVersion = "2.3.0"
+$BWVersion = "2.3.1"
 
 # ─── B4: 单实例保护 (防止双击两次导致竞态) ─────────
 $mutexCreated = $false
@@ -1134,14 +1134,27 @@ if (-not $secretsDecrypted) {
             Show-MsgBox "API Key 格式错误 (长度过短)。`n请检查后重试。" "格式错误" "OK" "Warning"
             continue
         }
-        Log-Info "正在验证 API Key..."
+        Log-Info "正在验证..."
-        if (Test-ApiKey $apiKey) {
+        # P1-2: 统一调用 change-key.js (stdin 管道, 无 argv 泄露)
-            # 验证通过, 写入环境变量 + 缓存
+        $injectJs = Join-Path $ClaudeDir "change-key.js"
-            [System.Environment]::SetEnvironmentVariable("ANTHROPIC_API_KEY", $apiKey, "Process")
+        $ckOk = $false
+        if ((Test-Path $injectJs) -and (Test-Cmd "node")) {
+            try {
+                $apiKey | & node $injectJs 2>&1 | Out-Null
+                $ckOk = ($LASTEXITCODE -eq 0)
+            } catch { $ckOk = $false }
+        } else {
+            # 回退: 内置验证 + .NET API (change-key.js 不存在时)
+            $ckOk = Test-ApiKey $apiKey
+            if ($ckOk) {
                 [System.Environment]::SetEnvironmentVariable("ANTHROPIC_API_KEY", $apiKey, "User")
-            [System.Environment]::SetEnvironmentVariable("ANTHROPIC_BASE_URL", "https://bww.letcareme.com", "Process")
                 [System.Environment]::SetEnvironmentVariable("ANTHROPIC_BASE_URL", "https://bww.letcareme.com", "User")
-            Log-OK "API Key 已验证并写入环境变量 (永久生效)"
+            }
+        }
+        if ($ckOk) {
+            $env:ANTHROPIC_API_KEY = $apiKey
+            $env:ANTHROPIC_BASE_URL = "https://bww.letcareme.com"
+            Log-OK "凭证已验证并持久化"
             $secretsDecrypted = $true
             Save-SecretsToCache
             Show-MsgBox "API Key 验证成功！`n`n已写入系统环境变量, 任何终端输入 claude 即可启动。`n`n以后想换 Key, 可以:`n1. 双击桌面 '更换Key.bat'`n2. 或 Claude Code 里输入 /change-key`n3. 或重跑安装器" "验证成功" "OK" "Information"