// ==UserScript==
// @name         学习通 章节测验助手（自动识别 / 作答 / 跳章 / 视频倍速）
// @namespace    local.yg.chaoxing.chapter
// @version      2.2.0
// @description  自动识别章节测验题目（含多层 iframe 与字体加密反爬），按可设正确率作答并提交，提交后自动跳转下一章；可自动点开并倍速播放视频任务点；接口地址/模型/API Key 均可在面板自填，支持任意 OpenAI 兼容服务。
// @author       YG
// @license      MIT
// @match        *://*.chaoxing.com/*
// @match        *://*.chaoxing.cn/*
// @match        *://*.edu.cn/*
// @match        *://*.mooc1.com/*
// @match        *://*.mooc2.com/*
// @grant        GM_xmlhttpRequest
// @grant        GM_getValue
// @grant        GM_setValue
// @connect      *
// @run-at       document-idle
// @noframes     false
// 发布提示：托管到 GreasyFork 时它会自动注入 @downloadURL / @updateURL，无需手写。
// 若改用 GitHub raw 直装，把下面两行的注释去掉，并把 USER/REPO 换成你自己的仓库：
// @homepageURL  https://github.com/USER/REPO
// @supportURL   https://github.com/USER/REPO/issues
// ==/UserScript==

(function () {
  'use strict'

  /* ============================================================
   * 0. 常量 / 默认配置
   * ============================================================ */
  const TAG = '[CX2]'
  const VER = '2.2.0'
  const KEY_CFG = 'cx2.cfg.v1'
  const KEY_BANK = 'cx2.bank.v1'
  const KEY_STATE = 'cx2.state.v1'
  const CMD_KEY = 'cx2.cmd'

  const DEFAULT_CFG = {
    // —— 接口（开源版默认留空，首次使用请在面板「接口」里填自己的）——
    endpoint: '',
    model: '',
    apiKey: '',
    accuracy: 100, // 目标正确率 %
    autoSubmit: true, // 自动点提交
    autoNext: true, // 提交后自动跳下一章
    aiEnabled: true, // 题库未命中时用 AI
    batchSize: 6, // 每次 AI 请求打包的题数
    stepDelay: 260, // 每题操作间隔 ms
    submitDelay: 800, // 点提交前的停顿
    nextDelay: 2200, // 跳章前停顿
    openTask: true, // 章节内自动点开「测验」任务点
    autoVideo: true, // 自动点开视频任务点并播放
    videoRate: 2, // 视频倍速
    videoMute: true, // 静音播放（绕过浏览器自动播放限制）
    account: '', // 自动登录用（可选）
    password: '',
    autoLogin: false,
  }

  /* 常用 OpenAI 兼容接口预设，面板里一键填 */
  const API_PRESETS = [
    { name: '千问兼容模式', endpoint: 'https://maas.qianwenaiapi.com/compatible-mode/v1/chat/completions', model: 'qwen3.8-flash' },
    { name: 'DeepSeek', endpoint: 'https://api.deepseek.com/chat/completions', model: 'deepseek-chat' },
    { name: '硅基流动', endpoint: 'https://api.siliconflow.cn/v1/chat/completions', model: 'Qwen/Qwen2.5-7B-Instruct' },
    { name: 'OpenAI', endpoint: 'https://api.openai.com/v1/chat/completions', model: 'gpt-4o-mini' },
    { name: '月之暗面', endpoint: 'https://api.moonshot.cn/v1/chat/completions', model: 'moonshot-v1-8k' },
  ]

  /* 用户可能只填 https://api.deepseek.com 或带尾斜杠，这里补全成可用的 completions 地址 */
  function normEndpoint(u) {
    let s = String(u || '').trim()
    if (!s) return ''
    s = s.replace(/\s+/g, '')
    if (!/^https?:\/\//i.test(s)) s = 'https://' + s
    s = s.replace(/\/+$/, '')
    if (/\/chat\/completions$/i.test(s) || /\/completions$/i.test(s)) return s
    if (/\/v\d+$/i.test(s)) return s + '/chat/completions'
    return s + '/v1/chat/completions'
  }

  const IS_TOP = (() => {
    try {
      return window.top === window.self
    } catch (e) {
      return false
    }
  })()

  /* ============================================================
   * 1. 存储（GM_* 优先，退回 localStorage）
   * ============================================================ */
  const hasGM = typeof GM_getValue === 'function' && typeof GM_setValue === 'function'

  const store = {
    getRaw(k) {
      if (hasGM) {
        try {
          const v = GM_getValue(k, null)
          if (v != null) return typeof v === 'string' ? v : JSON.stringify(v)
        } catch (e) {}
      }
      try {
        return localStorage.getItem(k)
      } catch (e) {
        return null
      }
    },
    setRaw(k, v) {
      if (hasGM) {
        try {
          GM_setValue(k, v)
        } catch (e) {}
      }
      try {
        localStorage.setItem(k, v)
      } catch (e) {}
    },
    get(k, dflt) {
      const raw = this.getRaw(k)
      if (!raw) return dflt
      try {
        return Object.assign({}, dflt, JSON.parse(raw))
      } catch (e) {
        return dflt
      }
    },
    set(k, obj) {
      this.setRaw(k, JSON.stringify(obj))
    },
  }

  let cfg = Object.assign({}, DEFAULT_CFG, store.get(KEY_CFG, DEFAULT_CFG))
  let bank = store.get(KEY_BANK, {})
  let state = store.get(KEY_STATE, { running: false, lastChapter: '', doneList: [], updatedAt: 0 })

  const saveCfg = () => store.set(KEY_CFG, cfg)
  const saveBank = () => store.set(KEY_BANK, bank)
  const saveState = () => {
    state.updatedAt = Date.now()
    store.set(KEY_STATE, state)
  }

  /* 学习通的 iframe 多为跨子域（mooc2-ans / detect / i.mooc…），contentDocument 拿不到，
     只能靠每个框架里各自注入的实例自救。GM 存储是「按脚本全局」的，跨域共享，用它当总线。 */
  const KEY_FRAME = 'cx2.frames'
  let lastSync = 0

  function refreshShared(force) {
    const now = Date.now()
    if (!force && now - lastSync < 1000) return
    lastSync = now
    try {
      const st = store.get(KEY_STATE, null)
      if (st) {
        if (typeof st.running === 'boolean') state.running = st.running
        if (Array.isArray(st.doneKeys)) state.doneKeys = st.doneKeys
      }
    } catch (e) {}
  }

  const KEY_LOCK = 'cx2.lock'
  const INSTANCE = Math.random().toString(36).slice(2, 10)
  const LOCK_TTL = 90000

  function lockHolder() {
    try {
      const j = JSON.parse(store.getRaw(KEY_LOCK) || '{}')
      return j && typeof j === 'object' ? j : {}
    } catch (e) {
      return {}
    }
  }

  /* 同一批题可能被「祖先框架」和「题目所在框架」同时看到（同源时尤其如此），
     用 GM 全局锁互斥，避免两边一起点选项、重复提交。 */
  function acquireLock() {
    const now = Date.now()
    const cur = lockHolder()
    if (cur.owner && cur.owner !== INSTANCE && now - (cur.at || 0) < LOCK_TTL) return false
    store.setRaw(KEY_LOCK, JSON.stringify({ owner: INSTANCE, at: now }))
    return lockHolder().owner === INSTANCE
  }

  function touchLock() {
    if (lockHolder().owner !== INSTANCE) return
    store.setRaw(KEY_LOCK, JSON.stringify({ owner: INSTANCE, at: Date.now() }))
  }

  function releaseLock() {
    if (lockHolder().owner === INSTANCE) store.setRaw(KEY_LOCK, JSON.stringify({ owner: '', at: 0 }))
  }

  function publishSelf(extra) {
    try {
      let reg = {}
      try {
        reg = JSON.parse(store.getRaw(KEY_FRAME) || '{}') || {}
      } catch (e) {
        reg = {}
      }
      let id = location.href.slice(0, 120)
      try {
        id = location.host + location.pathname.slice(0, 60)
      } catch (e) {}
      const base = {
        url: location.href.slice(0, 220),
        at: Date.now(),
        top: IS_TOP,
        ver: VER,
        fs: (() => {
          try {
            return window.frames.length
          } catch (e) {
            return -1
          }
        })(),
        ifr: document.querySelectorAll('iframe').length,
        q: (() => {
          try {
            return scanQuestions(document).length
          } catch (e) {
            return -1
          }
        })(),
      }
      reg[id] = Object.assign(base, extra || {})
      const keys = Object.keys(reg)
        .sort((a, b) => (reg[b].at || 0) - (reg[a].at || 0))
        .slice(0, 24)
      const out = {}
      for (const k of keys) out[k] = reg[k]
      store.setRaw(KEY_FRAME, JSON.stringify(out))
    } catch (e) {}
  }

  /* ============================================================
   * 2. 工具
   * ============================================================ */
  const sleep = (ms) => new Promise((r) => setTimeout(r, ms))

  const LOG_MAX = 400
  const logs = []
  function log(msg, kind) {
    const line = `${new Date().toLocaleTimeString()} ${msg}`
    logs.push({ line, kind: kind || 'info' })
    if (logs.length > LOG_MAX) logs.shift()
    try {
      if (IS_TOP && panel.logBox) {
        const d = document.createElement('div')
        d.className = 'cx2-line cx2-' + (kind || 'info')
        d.textContent = line
        panel.logBox.appendChild(d)
        while (panel.logBox.childNodes.length > LOG_MAX) panel.logBox.removeChild(panel.logBox.firstChild)
        panel.logBox.scrollTop = panel.logBox.scrollHeight
      }
      console.log(TAG, line)
    } catch (e) {}
  }

  function txt(el) {
    if (!el) return ''
    return (el.innerText || el.textContent || '').replace(/\u00a0/g, ' ').replace(/\s+/g, ' ').trim()
  }

  function norm(s) {
    return (s || '')
      .replace(/^\s*\d+[\s.、．)）]*/, '')
      .replace(/【[^】]{0,12}】/g, '')
      .replace(/（\s*\d+\s*分\s*）/g, '')
      .replace(/\(\s*\d+\s*分\s*\)/g, '')
      .replace(/[\s\u3000]+/g, '')
      .replace(/[，。；：、,.;:!?！？"'“”‘’（）()《》〈〉\-—_]/g, '')
      .toLowerCase()
      .slice(0, 160)
  }

  function pickLetterFromText(s) {
    const m = /^\s*([A-Za-z])\s*[.、．)）:：]/.exec(s || '')
    return m ? m[1].toUpperCase() : ''
  }

  function winOf(el) {
    try {
      return el.ownerDocument.defaultView || window
    } catch (e) {
      return window
    }
  }

  function fireInput(el) {
    if (!el) return
    try {
      const setter = Object.getOwnPropertyDescriptor(el.constructor.prototype, 'value')?.set
      if (setter) setter.call(el, el.value)
    } catch (e) {}
    for (const t of ['input', 'change', 'keyup', 'blur']) {
      try {
        el.dispatchEvent(new Event(t, { bubbles: true }))
      } catch (e) {}
    }
  }

  function realClick(el) {
    if (!el) return false
    const w = winOf(el)
    const r = el.getBoundingClientRect ? el.getBoundingClientRect() : { left: 0, top: 0, width: 0, height: 0 }
    const opts = { bubbles: true, cancelable: true, view: w, clientX: r.left + r.width / 2, clientY: r.top + r.height / 2 }
    try {
      el.dispatchEvent(new w.MouseEvent('mousedown', opts))
      el.dispatchEvent(new w.MouseEvent('mouseup', opts))
      el.dispatchEvent(new w.MouseEvent('click', opts))
      return true
    } catch (e) {
      try {
        el.click()
        return true
      } catch (e2) {
        return false
      }
    }
  }

  /* ============================================================
   * 3. 框架遍历（学习通把题目埋在多層 iframe 里，必须钻进去）
   *
   * 注意：脚本猫沙箱里 `window.frames[i].document` 往往拿不到子框架文档
   * （诊断实测 window.frames.length = 7，但遍历只拿到 1 层），
   * 而 DOM 侧的 `iframe.contentDocument` 是好的。所以走 DOM。
   * ============================================================ */
  function collectDocs(rootDoc, maxDepth) {
    const out = []
    const seen = new Set()
    const limit = maxDepth || 4
    function walk(doc, depth) {
      if (!doc || seen.has(doc) || depth > limit) return
      seen.add(doc)
      out.push(doc)
      let list = []
      try {
        list = Array.from(doc.querySelectorAll('iframe, frame'))
      } catch (e) {
        return
      }
      for (const f of list) {
        let cd = null
        try {
          cd = f.contentDocument
        } catch (e) {
          cd = null
        }
        if (!cd) {
          try {
            cd = f.contentWindow && f.contentWindow.document
          } catch (e) {
            cd = null
          }
        }
        if (cd) walk(cd, depth + 1)
      }
    }
    walk(rootDoc || document, 0)
    return out
  }

  function sameOriginWindows(rootWin) {
    let root = document
    try {
      if (rootWin && rootWin.document) root = rootWin.document
    } catch (e) {}
    const wins = []
    const seen = new Set()
    for (const d of collectDocs(root)) {
      let w = null
      try {
        w = d.defaultView
      } catch (e) {
        w = null
      }
      if (w && !seen.has(w)) {
        seen.add(w)
        wins.push(w)
      }
    }
    if (!wins.length) wins.push(window)
    return wins
  }

  /* ============================================================
   * 4. 题目识别（接受任意 document）
   * ============================================================ */
  const TYPE_MARK = [
    [/多\s*选/, 'multi'],
    [/单\s*选/, 'single'],
    [/判\s*断/, 'judge'],
    [/填\s*空/, 'fill'],
    [/简\s*答|论\s*述|名\s*词解释|计\s*算\s*题|案\s*例/, 'text'],
  ]

  const Q_SELECTORS = [
    '.questionLi',
    '.TiMu',
    '.Py_TiMu',
    '[class*="questionLi"]',
    '.timu',
    '.ans-videoquiz',
    '.subject_describe',
    '.mark_item',
  ].join(',')

  const OPT_SELECTORS = [
    '.answerBg',
    '.Zy_ulTop > li',
    '.Zy_ulTop li',
    'ul.Zy_ulTop > li',
    '.optionItem',
    '.ans-option',
    '.option',
    'li.option',
    '.stem_answer',
  ]

  function detectType(container, stem, opts, hasTextInput) {
    const probes = [
      txt(container.querySelector('.mark_name, .Zy_TItle, .questionName, .stem, .fl.after')),
      txt(container),
      container.getAttribute('data-type') || '',
      container.className || '',
      stem,
    ].join(' ')
    for (const [re, t] of TYPE_MARK) if (re.test(probes)) return t

    if (hasTextInput) return 'fill'
    const kindAttr = container.getAttribute('qtype') || container.getAttribute('data-qtype') || ''
    if (/3|multi|checkbox/i.test(kindAttr)) return 'multi'
    if (/1|single|radio/i.test(kindAttr)) return 'single'

    const hasCheckbox = !!container.querySelector('input[type=checkbox]')
    const hasRadio = !!container.querySelector('input[type=radio]')
    if (hasCheckbox && !hasRadio) return 'multi'
    if (hasRadio) return 'single'

    if (opts.length === 2) {
      const t = opts.map((o) => o.text.replace(/[。.\s]/g, ''))
      if (t.every((x) => /^(对|正确|是|√|T|True)$/i.test(x) || /^(错|错误|否|×|F|False)$/i.test(x))) return 'judge'
    }
    return opts.length > 1 ? 'single' : 'fill'
  }

  function parseOptions(container) {
    let nodes = []
    for (const sel of OPT_SELECTORS) {
      nodes = Array.from(container.querySelectorAll(sel))
      nodes = nodes.filter((n) => !nodes.some((m) => m !== n && m.contains(n)))
      if (nodes.length >= 2) break
    }
    if (!nodes.length) {
      nodes = Array.from(container.querySelectorAll('label')).filter((l) => l.querySelector('input[type=radio],input[type=checkbox]'))
    }

    const opts = []
    nodes.forEach((node, i) => {
      let letter = ''
      const idxEl = node.querySelector('.num_option, .optionIndex, .num, .index, .option-letter')
      if (idxEl) letter = pickLetterFromText(txt(idxEl)) || (txt(idxEl).match(/[A-Za-z]/) || [''])[0].toUpperCase()
      const textEl = node.querySelector('.answer_p, .optionText, .option-text, .ans_p, .text')
      let text = textEl ? txt(textEl) : txt(node)
      if (!letter) letter = pickLetterFromText(text)
      if (letter && text) text = text.replace(new RegExp('^\\s*' + letter + '\\s*[.、．)）:：]?\\s*'), '')
      if (!letter) letter = String.fromCharCode(65 + i)
      const input = node.querySelector('input[type=radio], input[type=checkbox]')
      opts.push({ letter: letter.toUpperCase(), text: text || txt(node), node, input })
    })
    return opts
  }

  function parseContainer(container) {
    const stemEl = container.querySelector('.mark_name, .Zy_TItle, .questionName, .stem, .fl.after, .subject_describe .clearfix')
    let stem = txt(stemEl) || txt(container.querySelector('.clearfix')) || ''
    const opts = parseOptions(container)
    const textInputs = Array.from(
      container.querySelectorAll('input[type=text], input:not([type]), textarea, .input-answer input'),
    ).filter((el) => {
      if (el.closest('.answerBg, .Zy_ulTop, li')) return false
      const t = el.getAttribute('type')
      return !t || t === 'text'
    })
    const type = detectType(container, stem, opts, textInputs.length > 0)
    if (!stem) stem = txt(container).slice(0, 200)
    stem = stem.replace(/^\s*\d+[\s.、．)）]*/, '').trim()
    return { el: container, stem, type, options: opts, textInputs }
  }

  function scanQuestions(doc) {
    const d = doc || document
    if (!d || !d.querySelectorAll) return []
    let containers = Array.from(d.querySelectorAll(Q_SELECTORS))
    containers = containers.filter((c) => !containers.some((o) => o !== c && o.contains(c)))
    containers = containers.filter((c) => c.offsetParent !== null || c.getClientRects().length > 0 || d.visibilityState === 'hidden')
    const list = containers.map(parseContainer).filter((q) => q.stem || q.options.length)
    list.forEach((q, i) => (q.idx = i + 1))
    return list
  }

  /* ============================================================
   * 4.5 字体反爬解码
   *
   * 学习通把题干/选项里的一部分汉字换成「乱码码位」（每页随机，如 咈/媋），
   * 再用页面内嵌的私有字体（font-cxsecret，base64 TTF）渲染成正确字形。
   * 所以：
   *   1) 读内嵌字体的 cmap → 得到「被替换过的码位集合」；
   *   2) 用 canvas 把这几个码位按该字体画出来 → 得到真字形；
   *   3) 和常用汉字（U+4E00..U+9FA5）用宋体画出来逐一比对 → 反解真字。
   * 这样 AI 拿到的就是正常题目，题库 key 也才稳定可复用。
   * ============================================================ */
  const FONT_MAP_KEY = 'cx2.fontmap.v1'
  const GLYPH_S = 32
  const GLYPH_N = 20
  const REF_FONTS = [
    { id: 'hei', spec: '"SimHei","黑体","Heiti SC",sans-serif' },
    { id: 'yh', spec: '"Microsoft YaHei","微软雅黑","PingFang SC",sans-serif' },
    { id: 'sun', spec: '"SimSun","宋体","Songti SC",serif' },
  ]
  let refState = { chars: null, fonts: {} }
  let lastDecode = null

  function djb2(s) {
    let h = 5381
    for (let i = 0; i < s.length; i++) h = ((h << 5) + h + s.charCodeAt(i)) & 0x7fffffff
    return h.toString(36)
  }

  function allFontFaceCss(doc) {
    const out = []
    try {
      for (const st of Array.from(doc.styleSheets || [])) {
        let rules = []
        try {
          rules = Array.from(st.cssRules || [])
        } catch (e) {
          continue
        }
        for (const r of rules) {
          const t = String(r.cssText || '')
          if (/@font-face/i.test(t)) out.push(t)
        }
      }
    } catch (e) {}
    try {
      for (const s of Array.from(doc.querySelectorAll('style'))) {
        const t = String(s.textContent || '')
        if (/@font-face/i.test(t)) out.push(t)
      }
    } catch (e) {}
    return out
  }

  function bytesFromFontSrc(src) {
    const m = /^data:([^,]*),(.*)$/s.exec(String(src || '').trim())
    if (!m) return null
    try {
      if (/base64/i.test(m[1])) {
        const bin = atob(m[2].replace(/\\s/g, ''))
        const b = new Uint8Array(bin.length)
        for (let i = 0; i < bin.length; i++) b[i] = bin.charCodeAt(i)
        return b
      }
      const txt = decodeURIComponent(m[2])
      const b = new Uint8Array(txt.length)
      for (let i = 0; i < txt.length; i++) b[i] = txt.charCodeAt(i) & 0xff
      return b
    } catch (e) {
      return null
    }
  }

  /* 解析 TTF/OTF 的 cmap，返回「确实映射到字形」的码位集合 */
  function cmapCodepoints(b) {
    const out = new Set()
    try {
      const dv = new DataView(b.buffer, b.byteOffset, b.byteLength)
      const tagAt = (o) => String.fromCharCode(b[o], b[o + 1], b[o + 2], b[o + 3])
      if (dv.getUint32(0) !== 0x00010000 && tagAt(0) !== 'OTTO' && tagAt(0) !== 'true') return out
      const numTables = dv.getUint16(4)
      let cmapOff = 0
      for (let i = 0; i < numTables; i++) {
        const rec = 12 + i * 16
        if (rec + 16 > b.length) break
        if (tagAt(rec) === 'cmap') {
          cmapOff = dv.getUint32(rec + 8)
          break
        }
      }
      if (!cmapOff || cmapOff + 4 > b.length) return out
      const nSub = dv.getUint16(cmapOff + 2)
      for (let i = 0; i < nSub; i++) {
        const rec = cmapOff + 4 + i * 8
        if (rec + 8 > b.length) break
        const sub = cmapOff + dv.getUint32(rec + 4)
        if (sub + 2 > b.length) continue
        const format = dv.getUint16(sub)
        if (format === 4) {
          const segX2 = dv.getUint16(sub + 6)
          const ends = sub + 14
          const starts = ends + segX2 + 2
          const deltas = starts + segX2
          const ranges = deltas + segX2
          if (ranges + segX2 > b.length) continue
          for (let s = 0; s < segX2; s += 2) {
            const end = dv.getUint16(ends + s)
            const start = dv.getUint16(starts + s)
            const delta = dv.getInt16(deltas + s)
            const ro = dv.getUint16(ranges + s)
            for (let c = start; c <= end && c < 0xffff; c++) {
              let gid = 0
              if (ro === 0) {
                gid = (c + delta) & 0xffff
              } else {
                const gi = ranges + s + ro + (c - start) * 2
                if (gi + 1 >= b.length) continue
                gid = dv.getUint16(gi)
                if (gid) gid = (gid + delta) & 0xffff
              }
              if (gid) out.add(c)
            }
          }
        } else if (format === 12) {
          if (sub + 16 > b.length) continue
          const groups = dv.getUint32(sub + 12)
          for (let g = 0; g < groups; g++) {
            const o = sub + 16 + g * 12
            if (o + 12 > b.length) break
            const sc = dv.getUint32(o)
            const ec = dv.getUint32(o + 4)
            for (let c = sc; c <= ec && c < 0x110000; c++) out.add(c)
          }
        }
      }
    } catch (e) {}
    return out
  }

  function secretFontInfo(doc) {
    const d = doc || document
    const faces = allFontFaceCss(d)
    if (!faces.length) return null
    let family = ''
    try {
      if (d.querySelector('.font-cxsecret, [class*="font-cxsecret"]')) family = 'font-cxsecret'
    } catch (e) {}
    const parsed = []
    for (const css of faces) {
      const fam = (/font-family\s*:\s*([^;{}]+)/i.exec(css) || [])[1]
      if (!fam) continue
      const name = fam.replace(/["']/g, '').split(',')[0].trim()
      if (!name || /^(inherit|serif|sans-serif|arial|monospace|system-ui)$/i.test(name)) continue
      const src = (/url\((["']?)([^)"']+)\1\)/i.exec(css) || [])[2] || ''
      parsed.push({ name, src, css })
    }
    if (!parsed.length) return null
    let pick = family ? parsed.find((p) => p.name === family) : null
    if (!pick) pick = parsed.find((p) => /data:.*base64/i.test(p.src)) || parsed[0]
    const bytes = pick.src ? bytesFromFontSrc(pick.src) : null
    const subset = bytes ? cmapCodepoints(bytes) : new Set()
    return {
      family: pick.name,
      isData: /^data:/i.test(pick.src),
      src: pick.src,
      subset,
      hash: djb2(pick.src ? pick.src.slice(0, 200000) : pick.css),
      faces: parsed.map((p) => p.name),
    }
  }

  function glyphCtx(doc) {
    let cv = doc.__cx2cv
    if (!cv) {
      cv = doc.createElement('canvas')
      cv.width = GLYPH_S
      cv.height = GLYPH_S
      doc.__cx2cv = cv
    }
    return cv.getContext('2d', { willReadFrequently: true })
  }

  function glyphMask(doc, ch, fontSpec) {
    const ctx = glyphCtx(doc)
    ctx.clearRect(0, 0, GLYPH_S, GLYPH_S)
    ctx.font = '29px ' + fontSpec
    ctx.textBaseline = 'alphabetic'
    ctx.fillStyle = '#000'
    ctx.fillText(ch, 1, 30)
    const img = ctx.getImageData(0, 0, GLYPH_S, GLYPH_S).data
    const mask = new Uint8Array(GLYPH_S * GLYPH_S)
    for (let i = 0, p = 3; i < mask.length; i++, p += 4) mask[i] = img[p] > 96 ? 1 : 0
    return mask
  }

  /* 按字形墨迹外框归一化到 GLYPH_N×GLYPH_N：
     不同字体字号/字面大小不同，直接比像素会输给字号；归一化后只比字形 */
  function normMask(mask) {
    let minX = GLYPH_S
    let minY = GLYPH_S
    let maxX = -1
    let maxY = -1
    for (let y = 0; y < GLYPH_S; y++) {
      const row = y * GLYPH_S
      for (let x = 0; x < GLYPH_S; x++) {
        if (!mask[row + x]) continue
        if (x < minX) minX = x
        if (x > maxX) maxX = x
        if (y < minY) minY = y
        if (y > maxY) maxY = y
      }
    }
    const n = new Uint8Array(GLYPH_N * GLYPH_N)
    if (maxX < 0) return n
    const w = maxX - minX + 1
    const h = maxY - minY + 1
    for (let ty = 0; ty < GLYPH_N; ty++) {
      const sy = minY + Math.min(h - 1, Math.floor(((ty + 0.5) * h) / GLYPH_N))
      const row = sy * GLYPH_S
      const orow = ty * GLYPH_N
      for (let tx = 0; tx < GLYPH_N; tx++) {
        const sx = minX + Math.min(w - 1, Math.floor(((tx + 0.5) * w) / GLYPH_N))
        n[orow + tx] = mask[row + sx]
      }
    }
    return n
  }

  /* 5×5 密度签名，用于从两万个汉字里快速筛出候选 */
  function sigOf(n) {
    const sig = new Uint8Array(25)
    const b = GLYPH_N / 5
    for (let y = 0; y < GLYPH_N; y++) {
      const by = ((y / b) | 0) * 5
      for (let x = 0; x < GLYPH_N; x++) {
        if (n[y * GLYPH_N + x]) sig[by + ((x / b) | 0)]++
      }
    }
    return sig
  }

  function iouOf(a, b) {
    let inter = 0
    let uni = 0
    for (let i = 0; i < a.length; i++) {
      const x = a[i]
      const y = b[i]
      if (x & y) inter++
      if (x | y) uni++
    }
    return uni ? inter / uni : 0
  }

  /* 参照表按字体懒构建：多数字黑体就能定，只有拿不准时才去建雅黑/宋体，
     真机上从 13 秒降到 3~5 秒（越靠后越省） */
  const REF_STOP = 0.72

  function refChars() {
    if (refState.chars) return refState.chars
    const n = 0x9fa5 - 0x4e00 + 1
    const chars = new Int32Array(n)
    for (let i = 0; i < n; i++) chars[i] = 0x4e00 + i
    refState.chars = chars
    refState.fonts = refState.fonts || {}
    return chars
  }

  function ensureRefFont(doc, id) {
    const chars = refChars()
    if (refState.fonts[id]) return refState.fonts[id].sigs
    const f = REF_FONTS.find((x) => x.id === id)
    const t0 = Date.now()
    const sigs = new Uint8Array(chars.length * 25)
    for (let i = 0; i < chars.length; i++) {
      sigs.set(sigOf(normMask(glyphMask(doc, String.fromCharCode(chars[i]), f.spec))), i * 25)
    }
    refState.fonts[id] = { sigs }
    log(`字体参照表：${f.id} ${chars.length} 字，${Date.now() - t0} ms`)
    return sigs
  }

  function buildRefSigs(doc) {
    refChars()
    for (const f of REF_FONTS) ensureRefFont(doc, f.id)
    return refState
  }

  function matchGlyph(doc, ch, family, refs) {
    const chars = refChars()
    const tN = normMask(glyphMask(doc, ch, '"' + family + '"'))
    const tSig = sigOf(tN)
    let best = null
    for (const f of REF_FONTS) {
      if (best && best.score >= REF_STOP) break // 已经够像，不再烧时间
      const sigs = ensureRefFont(doc, f.id)
      const n = chars.length
      const top = []
      for (let i = 0; i < n; i++) {
        const off = i * 25
        let d = 0
        for (let k = 0; k < 25; k++) d += Math.abs(sigs[off + k] - tSig[k])
        if (top.length < 40) {
          top.push({ i, d })
          if (top.length === 40) top.sort((a, b) => a.d - b.d)
        } else if (d < top[39].d) {
          top[39] = { i, d }
          top.sort((a, b) => a.d - b.d)
        }
      }
      for (const c of top) {
        const cand = String.fromCharCode(chars[c.i])
        const cN = normMask(glyphMask(doc, cand, f.spec))
        const score = iouOf(tN, cN)
        if (!best || score > best.score) best = { ch: cand, score, font: f.id }
      }
    }
    return best
  }

  async function decodeQuestions(doc, qs) {
    const d = doc || document
    const info = secretFontInfo(d)
    if (!info) {
      lastDecode = { ok: false, reason: 'no-font-face' }
      return lastDecode
    }
    if (!info.subset.size) {
      lastDecode = { ok: false, reason: 'cmap-empty', family: info.family, isData: info.isData }
      return lastDecode
    }
    try {
      await (d.fonts && d.fonts.load ? d.fonts.load('29px "' + info.family + '"') : Promise.resolve())
    } catch (e) {}

    const all = store.get(FONT_MAP_KEY, {})
    const cached = all[info.hash] || {}
    const map = Object.assign({}, cached)
    const need = new Set()
    const scan = (s) => {
      for (const ch of String(s || '')) {
        const cp = ch.codePointAt(0)
        if (info.subset.has(cp) && !map[ch]) need.add(ch)
      }
    }
    for (const q of qs) {
      scan(q.stem)
      for (const o of q.options) scan(o.text)
    }

    let decoded = 0
    let scoreSum = 0
    let scoreN = 0
    const sample = []
    if (need.size) {
      const t0 = Date.now()
      buildRefSigs(d)
      for (const ch of need) {
        const r = matchGlyph(d, ch, info.family)
        // 只对「确实被替换过的码位」做替换，所以取最像的字总比留着乱码强；
        // 阈值只用来挡住空字形造成的荒谬结果。
        if (r && r.score >= 0.30) {
          map[ch] = r.ch
          decoded++
          scoreSum += r.score
          scoreN++
        }
        if (sample.length < 40) sample.push(ch + '→' + (r ? r.ch : '?') + '(' + (r ? r.score.toFixed(2) : '-') + ')')
      }
      log(
        `字体解码 ${decoded}/${need.size} 字（${Date.now() - t0} ms，均分 ${(scoreSum / Math.max(1, scoreN)).toFixed(2)}）`,
        decoded ? 'ok' : 'warn',
      )
      if (decoded) log('解码样本：' + sample.slice(0, 12).join(' '))
    }

    const fix = (s) =>
      Array.from(String(s || ''))
        .map((ch) => map[ch] || ch)
        .join('')
    for (const q of qs) {
      q.stem = fix(q.stem)
      for (const o of q.options) o.text = fix(o.text)
    }
    if (decoded) {
      all[info.hash] = map
      const keys = Object.keys(all)
      if (keys.length > 24) for (const k of keys.slice(0, keys.length - 24)) delete all[k]
      store.set(FONT_MAP_KEY, all)
    }
    lastDecode = { ok: true, family: info.family, isData: info.isData, subset: info.subset.size, need: need.size, decoded, avgScore: scoreN ? scoreSum / scoreN : 0, sample, keyCount: Object.keys(map).length, decodedStem: String((qs[0] && qs[0].stem) || '').slice(0, 120) }
    return lastDecode
  }

  /* ============================================================
   * 5. 作答
   * ============================================================ */
  function isSelected(opt) {
    try {
      if (opt.input && opt.input.checked) return true
      const n = opt.node
      if (!n) return false
      const cn = typeof n.className === 'string' ? n.className : ''
      if (/active|checked|selected|curr/i.test(cn)) return true
      if (n.getAttribute('aria-checked') === 'true') return true
      if (n.querySelector && n.querySelector('input:checked')) return true
      const inner = n.querySelector && n.querySelector('.answerBg, .option, li')
      if (inner && inner !== n && /active|checked|selected/i.test(inner.className || '')) return true
    } catch (e) {}
    return false
  }

  function selectedLetters(q) {
    return q.options.filter(isSelected).map((o) => o.letter)
  }

  function clickOption(opt) {
    const tries = [
      opt.node,
      opt.node && opt.node.querySelector('label'),
      opt.input,
      opt.node && opt.node.querySelector('.answer_p, .optionText'),
    ]
    for (const t of tries) {
      if (!t) continue
      realClick(t)
      if (isSelected(opt)) return true
    }
    return isSelected(opt)
  }

  async function applyAnswer(q, letters) {
    if (q.type === 'fill' || q.type === 'text') {
      const val = (letters || []).join('\n')
      if (!val || !q.textInputs.length) return false
      for (const el of q.textInputs) {
        el.focus()
        el.value = val
        fireInput(el)
        await sleep(60)
      }
      return q.textInputs.some((el) => (el.value || '').trim())
    }

    const want = new Set(letters)
    for (const o of q.options) {
      if (!want.has(o.letter) && isSelected(o)) {
        clickOption(o)
        await sleep(60)
      }
    }
    for (const o of q.options) {
      if (!want.has(o.letter)) continue
      if (isSelected(o)) continue
      clickOption(o)
      await sleep(90)
    }
    const same = (arr) => arr.length === want.size && arr.every((l) => want.has(l))
    if (same(selectedLetters(q))) return true
    await sleep(220)
    return same(selectedLetters(q))
  }

  /* ============================================================
   * 6. AI 出答案
   * ============================================================ */
  function httpJson({ url, headers, body, timeout }) {
    const budget = timeout || 45000

    const viaGM = () =>
      new Promise((resolve, reject) => {
        let done = false
        const timer = setTimeout(() => {
          if (!done) {
            done = true
            reject(new Error('GM 请求超时'))
          }
        }, budget)
        try {
          GM_xmlhttpRequest({
            method: 'POST',
            url,
            headers,
            data: body,
            timeout: budget,
            onload: (r) => {
              if (done) return
              done = true
              clearTimeout(timer)
              resolve({ status: r.status, text: r.responseText })
            },
            onerror: (e) => {
              if (done) return
              done = true
              clearTimeout(timer)
              reject(new Error('GM 请求失败: ' + (e && e.error)))
            },
            ontimeout: () => {
              if (done) return
              done = true
              clearTimeout(timer)
              reject(new Error('GM 请求超时'))
            },
          })
        } catch (e) {
          done = true
          clearTimeout(timer)
          reject(e)
        }
      })

    const viaFetch = async () => {
      const ac = new AbortController()
      const timer = setTimeout(() => ac.abort(), budget)
      try {
        const r = await fetch(url, { method: 'POST', headers, body, signal: ac.signal })
        return { status: r.status, text: await r.text() }
      } finally {
        clearTimeout(timer)
      }
    }

    return (async () => {
      if (typeof GM_xmlhttpRequest === 'function') {
        try {
          return await viaGM()
        } catch (e) {
          // GM 通道失败（@connect 拦截、扩展异常等）→ 退回 fetch
        }
      }
      return await viaFetch()
    })()
  }

  function extractJsonArray(s) {
    if (!s) return null
    const fenced = s.match(/```(?:json)?\s*([\s\S]*?)```/i)
    const body = fenced ? fenced[1] : s
    const start = body.indexOf('[')
    const end = body.lastIndexOf(']')
    if (start >= 0 && end > start) {
      try {
        return JSON.parse(body.slice(start, end + 1))
      } catch (e) {}
    }
    const os = body.indexOf('{')
    const oe = body.lastIndexOf('}')
    if (os >= 0 && oe > os) {
      try {
        const o = JSON.parse(body.slice(os, oe + 1))
        if (Array.isArray(o)) return o
        if (o && typeof o === 'object') {
          for (const k of ['answers', 'data', 'result', 'items']) if (Array.isArray(o[k])) return o[k]
          return [o]
        }
      } catch (e) {}
    }
    return null
  }

  function buildPrompt(batch) {
    const items = batch.map((q) => ({
      i: q.idx,
      t: q.type,
      q: q.stem,
      o: q.options.map((o) => `${o.letter}. ${o.text}`),
    }))
    return [
      {
        role: 'system',
        content:
          '你是中国高校课程在线测验答题引擎。只输出 JSON 数组，不要任何解释、不要 markdown。' +
          '每项格式 {"i":题号,"a":["字母"]}。单选与判断只给 1 个字母；多选给全部正确字母（按字母序）；填空题给 1 个字符串数组表示各空答案。',
      },
      {
        role: 'user',
        content:
          '作答下列题目。判断题 A=对 B=错。选项字母必须来自题目给出的选项。\n' +
          '注意：题面是从网页里提取的，其中个别汉字被网站做了形近替换（反爬），' +
          '下面给出的文本已经尽力还原，但仍可能残留个别形近字（例如「列/例」「特/恃」「竞/竟」「质/盾」）。' +
          '请先按语义把题面在脑子里纠正通顺，再按纠正后的题意作答，不要因为个别字怪就乱选。\n' +
          JSON.stringify(items),
      },
    ]
  }

  async function askAI(batch) {
    const url = normEndpoint(cfg.endpoint)
    if (!url) throw new Error('还没填接口地址：面板「接口」里选个预设或粘贴自己的 OpenAI 兼容地址')
    if (!cfg.apiKey) throw new Error('还没填 API Key：面板「接口」里填自己的 Key（只存在本机）')
    if (!cfg.model) throw new Error('还没填模型名：面板「接口」里填，例如 deepseek-chat')
    const headers = { 'content-type': 'application/json', authorization: 'Bearer ' + cfg.apiKey }
    const body = JSON.stringify({
      model: cfg.model,
      messages: buildPrompt(batch),
      temperature: 0,
      max_tokens: 900,
      stream: false,
      response_format: { type: 'json_object' },
    })
    let r
    try {
      r = await httpJson({ url, headers, body })
    } catch (e) {
      const body2 = JSON.stringify({ model: cfg.model, messages: buildPrompt(batch), temperature: 0, max_tokens: 900 })
      r = await httpJson({ url, headers, body: body2 })
    }
    // 有些兼容层不认 response_format，去掉再试一次
    if (r && r.status >= 400 && /response_format|json_object|unsupported|invalid.*parameter/i.test(String(r.text))) {
      const body3 = JSON.stringify({ model: cfg.model, messages: buildPrompt(batch), temperature: 0, max_tokens: 900 })
      r = await httpJson({ url, headers, body: body3 })
    }
    if (!r || r.status < 200 || r.status >= 300) throw new Error(`AI HTTP ${r && r.status}: ${String(r && r.text).slice(0, 180)}`)
    let data
    try {
      data = JSON.parse(r.text)
    } catch (e) {
      throw new Error('AI 响应不是 JSON')
    }
    const content = data?.choices?.[0]?.message?.content || ''
    const arr = extractJsonArray(content)
    if (!arr) throw new Error('AI 未返回可解析的答案数组: ' + String(content).slice(0, 120))
    const map = new Map()
    for (const it of arr) {
      const i = Number(it.i ?? it.index ?? it.id)
      let a = it.a ?? it.answer ?? it.answers
      if (typeof a === 'string') a = a.match(/[A-Za-z]/g) || [a]
      if (Array.isArray(a)) a = a.map((x) => String(x).trim()).filter(Boolean)
      if (Number.isFinite(i) && a && a.length) map.set(i, a)
    }
    return map
  }

  /* ============================================================
   * 7. 正确率控制
   * ============================================================ */
  function degradeAnswer(q, letters) {
    const opts = q.options
    if (!opts.length) return letters
    const right = letters.slice()
    if (q.type === 'judge' || q.type === 'single') {
      const others = opts.map((o) => o.letter).filter((l) => !right.includes(l))
      if (!others.length) return right
      return [others[Math.floor(Math.random() * others.length)]]
    }
    if (q.type === 'multi') {
      if (right.length >= 2) return right.slice(0, right.length - 1)
      const others = opts.map((o) => o.letter).filter((l) => !right.includes(l))
      return others.length ? [others[0]] : right
    }
    return right
  }

  function applyAccuracy(q, letters, forceWrong) {
    if (!letters || !letters.length) return letters
    const acc = Math.max(0, Math.min(100, Number(cfg.accuracy) || 0))
    if (acc >= 100) return letters
    if (q.type === 'fill' || q.type === 'text') return letters // 填空/简答不主动搞错
    if (!forceWrong) return letters
    const wrong = degradeAnswer(q, letters)
    log(`题${q.idx} 按 ${acc}% 正确率策略故意答错（模拟真人）`, 'warn')
    return wrong
  }

  /* ============================================================
   * 8. 题库
   * ============================================================ */
  function bankKey(q) {
    return norm(q.stem) + '|' + q.type
  }
  function bankLookup(q) {
    const k = bankKey(q)
    if (bank[k]) return bank[k].letters
    const base = norm(q.stem).slice(0, 60)
    if (base.length < 8) return null
    for (const kk of Object.keys(bank)) {
      const nk = kk.split('|')[0]
      if (nk.slice(0, 60) === base) return bank[kk].letters
    }
    return null
  }
  function bankSave(q, letters) {
    if (!q.stem || !letters || !letters.length) return
    bank[bankKey(q)] = {
      stem: q.stem.slice(0, 300),
      type: q.type,
      letters: letters.slice(),
      options: q.options.map((o) => `${o.letter}.${o.text}`.slice(0, 160)),
      ts: Date.now(),
    }
    saveBank()
  }

  /* ============================================================
   * 9. 提交（指定 document）
   * ============================================================ */
  /* 提交按钮候选：作业页（doHomeWorkNew）的按钮形态五花八门，
     与其猜一个，不如按分数排序逐个试，直到页面真的变了。 */
  function submitCandidates(doc) {
    const d = doc || document
    const sels = [
      '.completeBtn',
      '#submitBtn',
      '#submit',
      '.btnSubmit',
      '.workSubmit',
      '.tj_btn',
      'a[onclick*="submit"]',
      'a[onclick*="Submit"]',
      '[class*="complete"]',
      '[class*="submit"]',
      'button',
      'input[type=submit]',
      'input[type=button]',
      'a',
      'div[role=button]',
    ]
    const out = []
    const seen = new Set()
    for (const sel of sels) {
      let list = []
      try {
        list = Array.from(d.querySelectorAll(sel))
      } catch (e) {
        continue
      }
      for (const el of list) {
        if (seen.has(el)) continue
        seen.add(el)
        const t = (txt(el) || el.value || '').replace(/\s/g, '')
        if (!t || t.length > 20) continue
        if (!/提交|交卷|交作业|完成测验|立即提交/.test(t)) continue
        if (/保存|草稿|暂存/.test(t) && !/提交/.test(t)) continue
        const visible = el.offsetParent !== null || el.getClientRects().length
        if (!visible) continue
        if (el.disabled || /disabled/i.test(String(el.className || ''))) continue
        const cls = String(el.className || '') + ' ' + String(el.id || '')
        let score = 1
        if (/^提交(答案|作业|试卷|试题)?$|^交卷$/.test(t)) score += 5
        if (/completeBtn|submitBtn|btnSubmit|workSubmit/i.test(cls)) score += 4
        if (/submit/i.test(String(el.getAttribute('onclick') || ''))) score += 3
        let r = { top: 0, width: 0 }
        try {
          r = el.getBoundingClientRect()
        } catch (e) {}
        if (r.width > 0) score += 1
        score += Math.min(2, Math.max(0, r.top || 0) / 2000) // 越靠下越像底部提交
        out.push({ el, score, text: t })
      }
    }
    out.sort((a, b) => b.score - a.score)
    return out
  }

  function findSubmitButton(doc) {
    const c = submitCandidates(doc)
    return c.length ? c[0].el : null
  }

  function findDialogConfirm(doc) {
    const d = doc || document
    const sels = [
      '.layui-layer-btn0',
      '.layui-layer-btn a',
      '#popok',
      '.popBottom .jb_btn',
      '.conform',
      '.wrap .btn-ok',
      '.dialog .confirm',
      '#confirmBtn',
      '.popSetDiv .jb_btn',
      '.bluebtn',
      '.maskDiv a',
    ]
    for (const sel of sels) {
      let els = []
      try {
        els = Array.from(d.querySelectorAll(sel))
      } catch (e) {
        continue
      }
      for (const e of els) {
        if (!(e.offsetParent !== null || e.getClientRects().length)) continue
        if (/确定|确认|是|提交|继续|知道了/.test(txt(e) || '')) return e
      }
    }
    return null
  }

  /* 兜底：任何浮层里的「确定 / 确认 / 提交」都点一下。
     学习通各模块的弹窗类名不统一，靠类名猜不可靠，靠位置猜很可靠。 */
  function findAnyConfirm(doc) {
    const d = doc || document
    let els = []
    try {
      els = Array.from(d.querySelectorAll('a, button, span, div, input[type=button]'))
    } catch (e) {
      return null
    }
    for (const el of els) {
      const t = (txt(el) || el.value || '').replace(/\s/g, '')
      if (!/^(确定|确认|是|提交|提交答案|继续|知道了|好的|同意)$/.test(t)) continue
      let r
      try {
        r = el.getBoundingClientRect()
      } catch (e) {
        continue
      }
      if (!(r.width > 0 && r.height > 0)) continue
      let p = el
      let isFloat = false
      try {
        for (let i = 0; i < 6 && p; i++) {
          const st = d.defaultView.getComputedStyle(p)
          if (/fixed|absolute/.test(st.position)) {
            const zi = Number(st.zIndex || 0)
            if (zi > 0 || /fixed/.test(st.position)) {
              isFloat = true
              break
            }
          }
          p = p.parentElement
        }
      } catch (e) {}
      if (isFloat) return el
    }
    return null
  }

  /* 交卷是否真的完成了 */
  async function submitLooksDone(d) {
    if (!submitCandidates(d).length) return true
    if (pageLooksFinished(d)) return true
    try {
      const t = txt(d.body)
      if (/提交成功|交卷成功|已交卷|本次得分|测评结果|查看解析/.test(t)) return true
    } catch (e) {}
    return false
  }

  function safeCall(w, name, args) {
    try {
      return typeof w[name] === 'function' ? String(w[name].apply(w, args || [])) : ''
    } catch (e) {
      return ''
    }
  }

  function postJson($, url, data) {
    return new Promise((resolve) => {
      try {
        $.ajax({
          type: 'POST',
          url,
          data,
          dataType: 'json',
          timeout: 20000,
          success: (r) => resolve({ ok: true, r }),
          error: (xhr, st) => resolve({ ok: false, why: st + ' ' + (xhr && xhr.status) }),
        })
      } catch (e) {
        resolve({ ok: false, why: String(e && e.message) })
      }
    })
  }

  /* 照页面自己的 saveWork() 抄一份，但 saveStatus=0（正式提交）而不是 tempsave=1（暂存）。
     走 $.ajax 而不是 fetch，为的是原封不动带上页面的 header 与 cookie 语义。 */
  async function directSubmitAjax(d, w) {
    const $ = w.jQuery || w.$
    if (!$ || !$.ajax) return { ok: false, why: '页面没有 jQuery' }
    const g = (sel) => {
      const el = d.querySelector(sel)
      return el && el.value != null ? String(el.value) : ''
    }
    const classId = g('#classId')
    const courseId = g('#courseId')
    const token = g('#enc_work')
    const total = g('#totalQuestionNum')
    if (!classId || !courseId) return { ok: false, why: '拿不到 classId/courseId' }
    if (typeof w.updateAllFillinBlanksData === 'function') {
      try {
        w.updateAllFillinBlanksData()
      } catch (e) {}
    }
    let data = ''
    try {
      data = $('#form1').serialize()
    } catch (e) {
      return { ok: false, why: '#form1 serialize 失败' }
    }
    const host = w._HOST_CP2_ || ''
    const base =
      host +
      '/work/addStudentWorkNew?_classId=' +
      encodeURIComponent(classId) +
      '&courseid=' +
      encodeURIComponent(courseId) +
      '&token=' +
      encodeURIComponent(token) +
      '&totalQuestionNum=' +
      encodeURIComponent(total) +
      '&ua=' +
      encodeURIComponent(safeCall(w, 'clientType')) +
      '&formType=' +
      encodeURIComponent(safeCall(w, 'getformType'))
    log('直接发提交请求：addStudentWorkNew（saveStatus=0）')
    const r = await postJson($, base + '&saveStatus=0&version=1', data)
    if (!r.ok) return { ok: false, why: r.why }
    const res = r.r || {}
    log('提交接口返回：' + JSON.stringify(res).slice(0, 300))
    if (res.status === true || res.status === 'true' || res.status === 1) {
      // 超星提交成功通常会跳转到成绩页
      try {
        if (res.url) {
          log('按接口返回跳转：' + String(res.url).slice(0, 120))
          w.location.href = res.url
        }
      } catch (e) {}
      return { ok: true, res }
    }
    return { ok: false, why: '接口 status 非成功：' + JSON.stringify(res).slice(0, 160) }
  }

  async function doSubmit(doc) {
    const d = doc || document
    let w = window
    try {
      w = d.defaultView || window
    } catch (e) {}

    // 两个框架实例指向同一个题目文档时，靠这里的文档级闸门保证只提交一次
    // （GM 锁是跨实例的软锁，会有时间窗；这个标记挂在文档对象上，同文档必共享）
    const now = Date.now()
    if (d.__cx2SubmittingAt && now - d.__cx2SubmittingAt < 45000) {
      log('本题已在提交流程中，跳过重复提交', 'warn')
      return false
    }
    d.__cx2SubmittingAt = now

    const cands = submitCandidates(d)
    if (!cands.length) {
      log('未找到「提交」按钮（页面结构可能不同），请手动交一次', 'warn')
      return false
    }

    // 确认弹窗可能弹在任何一层同源框架里（题目 iframe / cards 页 / 顶层），逐个找
    const clickConfirm = async () => {
      for (let round = 0; round < 2; round++) {
        let hit = null
        const docs = (() => {
          try {
            const list = collectDocs()
            return list.length ? list : [d]
          } catch (e) {
            return [d]
          }
        })()
        for (const dd of docs) {
          const el = (() => {
            try {
              return findDialogConfirm(dd) || findAnyConfirm(dd)
            } catch (e) {
              return null
            }
          })()
          if (el) {
            hit = { el, dd }
            break
          }
        }
        if (!hit) return
        log('确认弹窗：' + (txt(hit.el) || '确定'))
        realClick(hit.el)
        await sleep(1100)
      }
    }

    for (const c of cands.slice(0, 3)) {
      const tag = c.el.tagName.toLowerCase()
      const idc = c.el.id ? '#' + c.el.id : ''
      const clsc = c.el.className ? '.' + String(c.el.className).split(' ')[0] : ''
      log(`点击提交：${c.text}（${tag}${idc}${clsc}）`)
      realClick(c.el)
      await sleep(900)
      await clickConfirm()
      await sleep(1200)
      if (await submitLooksDone(d)) {
        log('提交成功（按钮已消失 / 页面显示已提交）', 'ok')
        return true
      }

      const oc = String(c.el.getAttribute('onclick') || '')
      const fn = (/^\s*([A-Za-z_$][\w$]*)\s*\(/.exec(oc) || [])[1]
      if (!fn || typeof w[fn] !== 'function') continue

      // 学习通的 btnBlueSubmit 有次数守卫：reqLimit < 0 就静默 return（只弹一句“请刷新页面后重试”）
      try {
        if (/reqLimit/.test(String(w[fn]))) {
          w.reqLimit = 5
          log('提交次数守卫 reqLimit 已重置为 5，再调用一次 ' + fn + '()')
        }
        w[fn]()
        await sleep(1400)
        await clickConfirm()
        await sleep(1400)
        if (await submitLooksDone(d)) {
          log('提交成功（页面函数 ' + fn + ' 生效）', 'ok')
          return true
        }
      } catch (e) {
        log('提交函数报错：' + (e && e.message), 'err')
      }

      // 还不行就绕过守卫：扒出页面自己写的 validateTimeNew(班级,课程,作业, cb) 参数直接调
      try {
        const src = String(w[fn])
        const call = (src.match(/validateTimeNew\s*\(([^)]*)\)/) || [])[1]
        if (call && typeof w.validateTimeNew === 'function') {
          const nums = call
            .split(',')
            .map((s) => s.trim())
            .filter((s) => /^\d+$/.test(s))
          if (nums.length >= 3) {
            log('绕过守卫：validateTimeNew(' + nums.slice(0, 3).join(',') + ') → toadd')
            // 给 toadd 套一层，看它到底有没有被调用
            let fired = false
            if (typeof w.toadd === 'function' && !w.toadd.__cx2wrap) {
              const orig = w.toadd
              const wrapped = function () {
                fired = true
                log('toadd 被调用（参数 ' + Array.prototype.map.call(arguments, (a) => JSON.stringify(a).slice(0, 80)).join(', ') + '）')
                return orig.apply(this, arguments)
              }
              wrapped.__cx2wrap = true
              try {
                w.toadd = wrapped
              } catch (e) {}
            }
            const args = nums.slice(0, 3).map(Number)
            args.push(function () {
              try {
                if (typeof w.toadd === 'function') w.toadd(arguments)
                else log('页面没有 toadd 函数', 'warn')
              } catch (e) {
                log('toadd 出错：' + (e && e.message), 'err')
              }
            })
            w.validateTimeNew.apply(w, args)
            await sleep(2000)
            await clickConfirm()
            await sleep(2000)
            if (!fired) log('validateTimeNew 的回调没被触发（多半是它的时间/状态校验没过）', 'warn')
            if (await submitLooksDone(d)) {
              log('提交成功（走 validateTimeNew → toadd）', 'ok')
              return true
            }
          }
        }
      } catch (e) {
        log('绕过提交失败：' + (e && e.message), 'warn')
      }
    }

    // 最后一层：不依赖页面 JS，照 saveWork() 抄一份请求，把 saveStatus 换成 0 直接提交
    if (await submitLooksDone(d)) {
      log('提交成功（前面的方式已生效）', 'ok')
      return true
    }
    if (!d.__cx2directTried) {
      d.__cx2directTried = true
      const r = await directSubmitAjax(d, w)
      if (r.ok) {
        log('提交成功（直接调用 addStudentWorkNew 接口）', 'ok')
        return true
      }
      log('直接提交接口失败：' + r.why, 'warn')
      await clickConfirm()
      await sleep(1500)
      if (await submitLooksDone(d)) {
        log('提交成功（接口已回执，页面已变化）', 'ok')
        return true
      }
    }
    log('四种提交方式都没让页面变化。点「导出诊断」，我按页面真实逻辑补', 'warn')
    return false
  }

  function pageLooksFinished(doc) {
    const d = doc || document
    const t = txt(d.body)
    if (!/已完成|已提交|提交成功|成绩|得分|查看详情|请勿重复/.test(t)) return false
    // 关键：不能只看正文有没有「提交」二字——提交后页面照样有“提交成功/提交时间”。
    // 判据是「提交按钮是否还在」。
    return !findSubmitButton(d)
  }

  /* 已提交记录（跨框架共享，防止同一份测验被不同实例重复提交） */
  function quizKeyFor(doc) {
    try {
      const u = new URL(doc.location.href)
      const cid =
        u.searchParams.get('chapterId') ||
        u.searchParams.get('knowledgeid') ||
        u.searchParams.get('workId') ||
        u.searchParams.get('jobid') ||
        ''
      const base = u.host + u.pathname
      if (base && base.length > 3) return (base + '|' + cid).slice(0, 200)
    } catch (e) {}
    try {
      const qs = scanQuestions(doc)
      if (qs.length) return norm(qs[0].stem).slice(0, 80)
    } catch (e) {}
    return ''
  }

  /* ============================================================
   * 10. 视频：点开任务点 + 播放 + 倍速
   * ============================================================ */
  let videoStat = { lastLog: 0, lastRate: 0, playBtns: 0, videos: 0 }

  /* 播放器的「大播放按钮」各家不一，全都试一遍 */
  const PLAY_BTN_SEL = [
    '.vjs-big-play-button',
    '.vjs-play-control.vjs-paused',
    '.prism-big-play-btn',
    '.xgplayer-start',
    '.xgplayer-play[data-state="paused"]',
    '.pv-play',
    '.play-btn',
    '.video-play',
    '[class*="big-play"]',
  ].join(',')

  function videoDocs() {
    const out = []
    try {
      for (const d of collectDocs()) out.push(d)
    } catch (e) {
      out.push(document)
    }
    return out
  }

  /* 把可达框架里的 <video> 全部设成目标倍速并播放 */
  function boostVideos(quiet) {
    const rate = Math.max(1, Math.min(16, Number(cfg.videoRate) || 1))
    let count = 0
    let acted = 0
    for (const d of videoDocs()) {
      let vids = []
      try {
        vids = Array.from(d.querySelectorAll('video'))
      } catch (e) {
        continue
      }
      for (const v of vids) {
        count++
        try {
          if (Math.abs((Number(v.playbackRate) || 1) - rate) > 0.01) {
            v.playbackRate = rate
            acted++
          }
          if (cfg.videoMute && !v.muted) v.muted = true
          if (v.paused && cfg.autoVideo) {
            const p = v.play()
            if (p && p.catch) p.catch(() => {})
            acted++
          }
        } catch (e) {}
      }
      // 有些播放器把倍速藏在全局对象里（超星老版 player / ckplayer / dplayer）
      try {
        const w = d.defaultView || window
        for (const holder of [w.player, w.ckplayer, w.dp, w.videoPlayer]) {
          if (!holder) continue
          if (typeof holder.setPlaybackRate === 'function') holder.setPlaybackRate(rate)
          else if (typeof holder.playbackRate === 'number') holder.playbackRate = rate
          else if (holder.video && typeof holder.video.playbackRate === 'number') holder.video.playbackRate = rate
        }
      } catch (e) {}
      // 还在暂停就看有没有大播放按钮可点
      if (cfg.autoVideo) {
        let paused = false
        try {
          paused = vids.some((v) => v.paused)
        } catch (e) {}
        if (paused) {
          let btn = null
          try {
            btn = d.querySelector(PLAY_BTN_SEL)
          } catch (e) {}
          if (btn) {
            realClick(btn)
            acted++
            videoStat.playBtns++
          }
        }
      }
    }
    videoStat.videos = count
    if (acted && (quiet !== true || Date.now() - videoStat.lastLog > 15000)) {
      videoStat.lastLog = Date.now()
      log(`视频：${count} 个播放器已设为 ${rate}×${cfg.autoVideo ? ' 并保持播放' : ''}`)
    }
    return { count, acted }
  }

  /* 章节里未完成的「视频」任务点（任务点通常在 cards 页/内层框架里，所以逐框架找） */
  function unfinishedVideoAttach() {
    const hits = []
    for (const doc of videoDocs()) {
      let items = []
      try {
        items = Array.from(
          doc.querySelectorAll('.ans-attach-ct, .ans-attach, .ans-job-name, .ans-job-icon, [class*="attach"][onclick], .ans-job-wrap li'),
        )
      } catch (e) {
        continue
      }
      for (const el of items) {
        let html = ''
        try {
          html = String(el.outerHTML || '').toLowerCase()
        } catch (e) {
          continue
        }
        const isVideo = /icon-video|iconvideo|视频|mp4|video/.test(html)
        if (!isVideo) continue
        const done = /ans-job-icon-finish|icon-finish|已完成/.test(html)
        const visible = (() => {
          try {
            const r = el.getBoundingClientRect()
            return r.width > 0 && r.height > 0
          } catch (e) {
            return false
          }
        })()
        if (!visible) continue
        hits.push({ el, doc, done })
      }
    }
    // 尽量只留最外层，避免点重复
    return hits.filter((h, i) => !hits.some((o, j) => j !== i && o.el !== h.el && o.doc === h.doc && o.el.contains(h.el)))
  }

  function tryOpenVideoTask() {
    if (!cfg.autoVideo) return false
    const list = unfinishedVideoAttach()
    const target = list.find((x) => !x.done)
    if (!target) return false
    log('点开视频任务点：' + (txt(target.el) || '视频').slice(0, 30))
    realClick(target.el)
    return true
  }

  /* ============================================================
   * 10.5 章节导航（顶层帧）
   * ============================================================ */
  function currentChapterId() {
    const m = /[?&]chapterId=(\d+)/.exec(location.href)
    if (m) return m[1]
    try {
      const el = document.querySelector('#curChapterId, #chapterId')
      if (el && el.value) return el.value
    } catch (e) {}
    return ''
  }

  function catalogNodes() {
    const sets = ['.posCatalog_select', '.posCatalog_level > li', '.posCatalog_level li', '.chapter_item', '.catalog_level > li', '[onclick*="getTeacherAjax"]', '.prev_ul li']
    for (const sel of sets) {
      let nodes = Array.from(document.querySelectorAll(sel))
      nodes = nodes.filter((n) => !nodes.some((m) => m !== n && m.contains(n)))
      nodes = nodes.filter((n) => txt(n).length > 0)
      if (nodes.length >= 2) return nodes
    }
    return []
  }

  function findCatalogNext() {
    const nodes = catalogNodes()
    if (!nodes.length) return { next: null, reason: '已经是最后一章，或左侧章节目录未展开' }
    let curIdx = -1
    const cid = currentChapterId()
    for (let i = 0; i < nodes.length; i++) {
      const n = nodes[i]
      if (/active|current|cur\b/i.test(n.className || '')) {
        curIdx = i
        break
      }
      const onclick = n.getAttribute('onclick') || ''
      if (cid && (onclick.includes(cid) || n.getAttribute('data-id') === cid || n.getAttribute('chapterid') === cid)) curIdx = i
    }
    if (curIdx < 0) return { next: null, reason: '未能定位当前章节', total: nodes.length }
    const next = nodes[curIdx + 1]
    if (!next) return { next: null, reason: '已经是最后一章', total: nodes.length, curIdx }
    return { next, total: nodes.length, curIdx, name: txt(next) }
  }

  /* 学习通新版自带「下一章」按钮 + PCount.next 全局函数，优先用它们 */
  function findNextButton() {
    const sels = ['#prevNextFocusNext', '[onclick*="PCount.next"]', '.nextChapter', '#nextChapter', 'a[onclick*="nextChapter"]']
    for (const sel of sels) {
      try {
        const el = document.querySelector(sel)
        if (el) return { el, how: sel }
      } catch (e) {}
    }
    return null
  }

  function pageSignature() {
    const cid = currentChapterId()
    try {
      const el = document.querySelector('#curChapterId, #chapterId')
      return [location.href, cid, el ? el.value : ''].join('|')
    } catch (e) {
      return location.href
    }
  }

  async function goNextChapter() {
    const before = pageSignature()

    const btn = findNextButton()
    if (!btn && !catalogNodes().length) {
      log('本页看不到章节目录或「下一章」按钮（可能是独立测验页/弹窗），请回到章节页继续', 'warn')
      return false
    }
    if (btn) {
      log(`使用页面「下一章」按钮（${btn.how}）`)
      realClick(btn.el)
      await sleep(2600)
      if (pageSignature() !== before) return true
      log('点击后页面未变化，改用目录跳转', 'warn')
    }

    const r = findCatalogNext()
    if (!r.next) {
      log('停止：' + r.reason, 'warn')
      state.running = false
      saveState()
      return false
    }
    log(`跳转下一章：${r.name || '(未命名)'}（第 ${r.curIdx + 2}/${r.total} 个节点）`, 'ok')
    realClick(r.next)
    const inner = r.next.querySelector('.posCatalog_name, a, span')
    if (inner) realClick(inner)
    await sleep(2400)
    if (pageSignature() !== before) return true
    log('目录跳转后页面仍未变化，可能被拦截', 'err')
    return false
  }

  /* ============================================================
   * 11. 章内任务点（尽量把「测验」点开）
   * ============================================================ */
  const openedTasks = new Set()

  function tryOpenQuizTask() {
    if (!cfg.openTask) return false
    for (const w of sameOriginWindows(window)) {
      let doc = null
      try {
        doc = w.document
      } catch (e) {
        continue
      }
      if (!doc || !doc.querySelectorAll) continue
      if (scanQuestions(doc).length) return false // 已经有题目，不需要再点
      const HOST_SEL = '.ans-attach-ct, .ans-job-name, .ans-job-icon, .ans-job, .card, .job, dd, .chapter-item'
      const cands = Array.from(doc.querySelectorAll('div,li,span,a,p,dd,dt')).filter((el) => {
        const t = txt(el)
        if (!t || t.length > 24) return false
        if (!/测验|测试|作业|练习/.test(t)) return false
        if (el.querySelector('div,li,iframe')) return false // 取最内层
        if (!el.closest(HOST_SEL)) return false // 必须是任务点区域，别去点章节目录
        if (el.closest('.posCatalog_level, .posCatalog_select, .prev_ul, #prevNextFocus, .subNav')) return false
        return el.offsetParent !== null || el.getClientRects().length
      })
      for (const el of cands) {
        const key = (doc.location ? doc.location.pathname : '') + '|' + txt(el)
        if (openedTasks.has(key)) continue
        openedTasks.add(key)
        log('点开任务点：' + txt(el).slice(0, 20))
        realClick(el)
        const holder = el.closest('.ans-attach-ct, .ans-job-name, li, dd') || el.parentElement
        if (holder && holder !== el) realClick(holder)
        return true
      }
    }
    return false
  }

  /* ============================================================
   * 12. 主流程
   * ============================================================ */
  let busy = false
  const doneDocs = new WeakSet()

  function scanAll(rootWin) {
    const out = []
    for (const w of sameOriginWindows(rootWin || window)) {
      let doc = null
      try {
        doc = w.document
      } catch (e) {
        continue
      }
      if (!doc || !doc.querySelectorAll) continue
      let qs = []
      try {
        qs = scanQuestions(doc)
      } catch (e) {
        continue
      }
      if (qs.length) out.push({ win: w, doc, qs })
    }
    out.sort((a, b) => b.qs.length - a.qs.length)
    return out
  }

  function pickTarget(rootWin) {
    const all = scanAll(rootWin)
    // 谁拥有题目谁优先作答：避免祖先框架抢答后自己那份又跑一遍
    all.sort((a, b) => (b.doc === document ? 1 : 0) - (a.doc === document ? 1 : 0) || b.qs.length - a.qs.length)
    for (const t of all) {
      if (doneDocs.has(t.doc)) continue
      if (pageLooksFinished(t.doc)) {
        doneDocs.add(t.doc)
        continue
      }
      return t
    }
    return null
  }

  async function runQuizPage(force) {
    if (busy) return { ok: false, reason: 'busy' }
    busy = true
    const self = this
    try {
      const target = pickTarget(window)
      if (!target) {
        const frames = sameOriginWindows(window).length
        log(`未发现待答题（已扫描 ${frames} 个框架（含内嵌））`, 'warn')
        tryOpenQuizTask()
        return { ok: false, reason: 'no-question' }
      }
      const doc = target.doc
      const qs = target.qs
      try {
        await decodeQuestions(doc, qs)
      } catch (e) {
        log('字体解码异常：' + (e && e.message), 'warn')
      }
      const qk = quizKeyFor(doc)
      if (qk && (state.doneKeys || []).indexOf(qk) >= 0) {
        doneDocs.add(doc)
        log('本次测验已提交过，跳过', 'info')
        return { ok: false, reason: 'already-done' }
      }
      if (!acquireLock()) {
        log('另一个框架实例正在作答，本轮跳过', 'info')
        busy = false
        return { ok: false, reason: 'locked' }
      }
      const where = (() => {
        try {
          return doc.location.pathname.slice(0, 46)
        } catch (e) {
          return '(frame)'
        }
      })()
      log(`在框架 ${where} 识别到 ${qs.length} 道题：` + qs.map((q) => q.type[0].toUpperCase()).join(''))
      if (qs.some((q) => q.type === 'text')) log('含简答题，脚本不代写，请自行作答', 'warn')

      const result = []
      const needAI = []
      for (const q of qs) {
        const hit = bankLookup(q)
        if (hit && hit.length) result.push({ q, letters: hit, src: 'bank' })
        else needAI.push(q)
      }
      if (result.length) log(`题库命中 ${result.length} 题`)

      if (needAI.length) {
        if (!cfg.aiEnabled) {
          log(`题库未命中 ${needAI.length} 题，AI 已关闭`, 'warn')
        } else {
          const bs = Math.max(1, Math.min(12, Number(cfg.batchSize) || 6))
          for (let i = 0; i < needAI.length; i += bs) {
            const batch = needAI.slice(i, i + bs)
            let map = null
            for (let attempt = 0; attempt < 2 && !map; attempt++) {
              try {
                const t0 = Date.now()
                touchLock()
                map = await askAI(batch)
                log(`AI 返回 ${map.size}/${batch.length} 题（${Date.now() - t0} ms）`)
              } catch (e) {
                log('AI 失败(' + (attempt + 1) + '/2)：' + e.message, 'err')
                await sleep(600)
              }
            }
            if (!map) continue
            for (const q of batch) {
              const letters = map.get(q.idx)
              if (letters && letters.length) result.push({ q, letters, src: 'ai' })
              else log(`题${q.idx} AI 未给答案`, 'warn')
            }
          }
        }
      }

      result.sort((a, b) => a.q.idx - b.q.idx)
      log(`共 ${result.length} 题待作答，目标正确率 ${cfg.accuracy}%`)

      // 按整份试卷确定性地安排「刻意答错」的题数，比逐题抛骰子可预期
      const accNow = Math.max(0, Math.min(100, Number(cfg.accuracy) || 0))
      const degradable = result.filter((it) => it.q.options.length && it.q.type !== 'fill' && it.q.type !== 'text')
      const needWrong =
        accNow >= 100 ? 0 : Math.min(degradable.length, Math.round((degradable.length * (100 - accNow)) / 100))
      const degradeSet = new Set()
      if (needWrong > 0) {
        const shuffled = degradable.slice()
        for (let i = shuffled.length - 1; i > 0; i--) {
          const j = Math.floor(Math.random() * (i + 1))
          const t = shuffled[i]
          shuffled[i] = shuffled[j]
          shuffled[j] = t
        }
        for (const it of shuffled.slice(0, needWrong)) degradeSet.add(it.q.idx)
        log(`安排 ${needWrong}/${degradable.length} 题刻意答错（目标 ${accNow}%）`, 'warn')
      } else if (accNow < 100 && degradable.length) {
        log(`本份只有 ${degradable.length} 道可降级题，${accNow}% 换算下来不足 1 题，按全对提交`, 'info')
      }

      let filled = 0
      for (const item of result) {
        if (!state.running && !force) {
          log('已被用户停止，中断本题组', 'warn')
          break
        }
        const letters = applyAccuracy(item.q, item.letters, degradeSet.has(item.q.idx))
        const ok = await applyAnswer(item.q, letters)
        if (ok) {
          filled++
          bankSave(item.q, item.letters)
          log(`题${item.q.idx} [${item.q.type}] ${letters.join('')} <- ${item.src === 'ai' ? 'AI' : '题库'}`, 'ok')
        } else {
          log(`题${item.q.idx} 作答未生效（可能被页面拦截）`, 'err')
        }
        await sleep(cfg.stepDelay)
      }
      log(`已作答 ${filled}/${result.length}`)

      if (cfg.autoSubmit && filled > 0) {
        await sleep(cfg.submitDelay)
        const ok = await doSubmit(doc)
        log(ok ? '提交完成' : '提交后仍检测到提交按钮，可能未成功', ok ? 'ok' : 'warn')
        if (ok) {
          doneDocs.add(doc)
          state.doneList = (state.doneList || []).concat([{ chapterId: currentChapterId(), at: Date.now(), n: filled }]).slice(-200)
          state.doneKeys = (state.doneKeys || []).concat([qk || currentChapterId() || Date.now()]).slice(-100)
          saveState()
          try {
            localStorage.setItem('cx2:lastdone', JSON.stringify({ chapterId: currentChapterId(), at: Date.now() }))
          } catch (e) {}
          try {
            window.top.postMessage({ src: 'cx2', type: 'chapter-done', chapterId: currentChapterId() }, '*')
          } catch (e) {}
          publishSelf({ submitted: true, n: filled })
        }
      }
      return { ok: true, filled, total: result.length }
    } finally {
      busy = false
      releaseLock()
    }
  }

  /* ============================================================
   * 13. 自动登录
   * ============================================================ */
  function isLoginPage() {
    const h = location.href
    if (/passport2?\.chaoxing\.com\/(login|protal)/i.test(h)) return true
    return !!(document.querySelector('#phone') && document.querySelector('#pwd') && document.querySelector('#loginBtn, .btn-big-blue'))
  }

  async function autoLogin() {
    if (!cfg.autoLogin || !cfg.account || !cfg.password) return false
    log('检测到登录页，尝试自动登录', 'warn')
    const tabs = Array.from(document.querySelectorAll('a,div,span')).filter((e) => /密码登录|账号密码|其他方式/.test(txt(e)))
    if (tabs.length) {
      realClick(tabs[0])
      await sleep(700)
    }
    const u = document.querySelector('#phone, input[name=uname], input[name=phone], #uname')
    const p = document.querySelector('#pwd, input[name=password], input[type=password]')
    if (!u || !p) {
      log('登录页未找到账号/密码输入框', 'err')
      return false
    }
    u.focus()
    u.value = cfg.account
    fireInput(u)
    await sleep(200)
    p.focus()
    p.value = cfg.password
    fireInput(p)
    await sleep(300)
    const btn =
      document.querySelector('#loginBtn') ||
      Array.from(document.querySelectorAll('a,button,input[type=submit],.btn-big-blue')).find((e) => /登录|登陆/.test(txt(e) || e.value || ''))
    if (!btn) {
      log('未找到登录按钮', 'err')
      return false
    }
    realClick(btn)
    log('已提交登录表单（如出现滑块请手动完成）', 'warn')
    await sleep(2500)
    return !isLoginPage()
  }

  /* ============================================================
   * 14. 面板
   * ============================================================ */
  const panel = { box: null, logBox: null }

  function buildPanel() {
    if (!IS_TOP || document.getElementById('cx2-panel')) return
    const css = `
      #cx2-panel{position:fixed;right:14px;bottom:14px;width:322px;z-index:2147483000;font:12px/1.55 -apple-system,"Segoe UI",system-ui,"Microsoft YaHei",sans-serif;
        background:#fff;border:1px solid #d8dee6;border-radius:12px;box-shadow:0 10px 30px rgba(16,24,40,.16);overflow:hidden;color:#1f2937}
      #cx2-panel.cx2-min #cx2-body{display:none}
      #cx2-head{display:flex;align-items:center;gap:8px;padding:9px 11px;background:linear-gradient(135deg,#2563eb,#3b82f6);color:#fff;cursor:move;user-select:none}
      #cx2-head b{font-size:12.5px;font-weight:600;flex:1;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
      #cx2-head .cx2-ico{width:16px;height:16px;border-radius:4px;background:#fff;color:#2563eb;display:grid;place-items:center;font-weight:700;font-size:11px}
      #cx2-head button{background:rgba(255,255,255,.18);border:0;color:#fff;width:20px;height:20px;border-radius:5px;cursor:pointer;font-size:12px;line-height:1}
      #cx2-body{padding:10px 11px 11px}
      .cx2-row{display:flex;align-items:center;gap:7px;margin:6px 0}
      .cx2-row label{color:#475467;white-space:nowrap}
      .cx2-row select,.cx2-row input[type=text],.cx2-row input[type=password]{flex:1;min-width:0;border:1px solid #d0d5dd;border-radius:7px;padding:4px 6px;font-size:12px;background:#fff;color:#1f2937}
      .cx2-btns{display:flex;gap:6px;margin-top:8px;flex-wrap:wrap}
      .cx2-btns button{flex:1 1 auto;min-width:66px;border:1px solid #d0d5dd;background:#f9fafb;border-radius:7px;padding:6px 4px;font-size:12px;cursor:pointer;color:#344054}
      .cx2-btns button:hover{background:#eef2ff;border-color:#c7d2fe}
      .cx2-btns button.primary{background:#2563eb;border-color:#2563eb;color:#fff}
      .cx2-btns button.danger{background:#fee2e2;border-color:#fecaca;color:#b42318}
      #cx2-log{margin-top:8px;max-height:168px;overflow:auto;background:#0b1020;color:#cbd5e1;border-radius:8px;padding:7px 8px;font:11px/1.5 ui-monospace,Consolas,monospace}
      #cx2-log .cx2-line{white-space:pre-wrap;word-break:break-all}
      #cx2-log .cx2-ok{color:#4ade80}#cx2-log .cx2-warn{color:#fbbf24}#cx2-log .cx2-err{color:#f87171}
      #cx2-tip{margin-top:6px;color:#98a2b3;font-size:11px}
    `
    const style = document.createElement('style')
    style.textContent = css
    document.documentElement.appendChild(style)

    const box = document.createElement('div')
    box.id = 'cx2-panel'
    box.innerHTML = `
      <div id="cx2-head">
        <span class="cx2-ico">答</span><b>章节测验助手 v${VER}</b>
        <button title="收起" data-act="min">—</button>
      </div>
      <div id="cx2-body">
        <div class="cx2-row"><label>正确率</label>
          <select data-f="accuracy">
            ${[100, 95, 90, 85, 80, 70, 60].map((v) => `<option value="${v}">${v}%</option>`).join('')}
          </select>
          <label><input type="checkbox" data-f="autoSubmit" /> 提交</label>
        </div>
        <div class="cx2-row">
          <label><input type="checkbox" data-f="autoNext" /> 跳章</label>
          <label><input type="checkbox" data-f="openTask" /> 点开测验</label>
          <label><input type="checkbox" data-f="autoLogin" /> 掉线重登</label>
        </div>
        <div class="cx2-row">
          <label><input type="checkbox" data-f="autoVideo" /> 自动播视频</label>
          <label>倍速</label>
          <select data-f="videoRate">
            ${[1, 1.25, 1.5, 2, 2.5, 3, 4, 8].map((v) => `<option value="${v}">${v}×</option>`).join('')}
          </select>
          <label><input type="checkbox" data-f="videoMute" /> 静音</label>
        </div>

        <details id="cx2-api-box">
          <summary style="cursor:pointer;color:#2563eb;margin:6px 0 2px">接口配置（填自己的 Key）</summary>
          <div class="cx2-row"><label>预设</label>
            <select data-preset="1">
              <option value="">— 选一个自动填 —</option>
              ${API_PRESETS.map((p, i) => `<option value="${i}">${p.name}</option>`).join('')}
            </select>
          </div>
          <div class="cx2-row"><label>地址</label><input type="text" data-f="endpoint" placeholder="https://api.deepseek.com 或完整地址" /></div>
          <div class="cx2-row"><label>模型</label><input type="text" data-f="model" placeholder="deepseek-chat" /></div>
          <div class="cx2-row"><label>Key</label><input type="password" data-f="apiKey" placeholder="sk-… 只存本机" /></div>
          <div class="cx2-row"><label>账号</label><input type="text" data-f="account" placeholder="手机号/学号（选填）" /></div>
          <div class="cx2-row"><label>密码</label><input type="password" data-f="password" placeholder="仅存本机，掉线重登用" /></div>
        </details>

        <div class="cx2-btns">
          <button class="primary" data-act="run">开始作答</button>
          <button class="danger" data-act="stop">停止</button>
          <button data-act="scan">仅识别</button>
          <button data-act="test">测 API</button>
          <button data-act="video">加速视频</button>
          <button data-act="next">下一章</button>
          <button data-act="export">导出诊断</button>
          <button data-act="clearbank">清空题库</button>
        </div>
        <div id="cx2-log"></div>
        <div id="cx2-tip">低于 100% 会按比例故意答错。视频倍速是直接设给播放器的，页面上显示的可能仍是 1×。</div>
      </div>`
    document.documentElement.appendChild(box)
    panel.box = box
    panel.logBox = box.querySelector('#cx2-log')

    box.querySelectorAll('[data-f]').forEach((el) => {
      const f = el.getAttribute('data-f')
      if (el.type === 'checkbox') el.checked = !!cfg[f]
      else el.value = cfg[f]
      el.addEventListener('change', () => {
        if (el.type === 'checkbox') cfg[f] = el.checked
        else if (f === 'accuracy' || f === 'videoRate') cfg[f] = Number(el.value)
        else if (f === 'apiKey') cfg[f] = String(el.value).trim()
        else cfg[f] = el.value
        saveCfg()
        // Key 不回显内容，只报长度
        if (f === 'apiKey') log(`API Key 已保存（${String(cfg.apiKey).length} 字符，仅存本机）`, 'ok')
        else if (f === 'endpoint') log('接口地址已保存：' + normEndpoint(cfg.endpoint))
        else log(`配置已保存：${f}${f === 'videoRate' ? ' = ' + cfg[f] + '×' : ''}`)
        if (f === 'endpoint' && el.value && el.value !== normEndpoint(el.value)) el.value = normEndpoint(el.value)
      })
    })

    // 预设：一键填好地址与模型
    const pre = box.querySelector('[data-preset]')
    if (pre) {
      pre.addEventListener('change', () => {
        const p = API_PRESETS[Number(pre.value)]
        if (!p) return
        cfg.endpoint = p.endpoint
        cfg.model = p.model
        saveCfg()
        const e1 = box.querySelector('[data-f="endpoint"]')
        const e2 = box.querySelector('[data-f="model"]')
        if (e1) e1.value = cfg.endpoint
        if (e2) e2.value = cfg.model
        log(`已填入预设 ${p.name}，把你的 Key 填进下一行就行`, 'ok')
      })
    }

    // 首次使用：没 Key 就把接口配置展开并提示
    if (!cfg.apiKey || !cfg.endpoint || !cfg.model) {
      const d = box.querySelector('#cx2-api-box')
      if (d) d.open = true
      log('还没配置接口：展开「接口配置」选预设 + 填自己的 API Key', 'warn')
    }

    box.addEventListener('click', async (ev) => {
      const btn = ev.target.closest('[data-act]')
      if (!btn) return
      const act = btn.getAttribute('data-act')
      if (act === 'min') {
        box.classList.toggle('cx2-min')
      } else if (act === 'run') {
        if (!cfg.apiKey || !cfg.endpoint || !cfg.model) {
          const d = box.querySelector('#cx2-api-box')
          if (d) d.open = true
          log('先配置接口：展开「接口配置」选个预设，再填你自己的 API Key', 'warn')
          return
        }
        state.running = true
        saveState()
        log('▶ 开始作答')
        sendCmd('run')
        await runQuizPage(true)
      } else if (act === 'stop') {
        state.running = false
        saveState()
        log('■ 已停止（已作答内容不撤销）', 'warn')
      } else if (act === 'scan') {
        const all = scanAll(window)
        if (!all.length) {
          log(`未识别到题目（扫描 ${sameOriginWindows(window).length} 个框架（含内嵌））`, 'warn')
          log('已尝试点开章内测验任务点，等它加载后再点「仅识别」', 'warn')
          tryOpenQuizTask()
        }
        for (const t of all) {
          try {
            await decodeQuestions(t.doc, t.qs)
          } catch (e) {}
          let p = '(frame)'
          try {
            p = t.doc.location.pathname.slice(0, 40)
          } catch (e) {}
          log(`[${p}] ${t.qs.length} 题`)
          t.qs.forEach((q) => log(`  ${q.idx}. [${q.type}] ${q.stem.slice(0, 36)} | ${q.options.map((o) => o.letter).join('')}`))
        }
      } else if (act === 'test') {
        log('测试接口…')
        try {
          const t0 = Date.now()
          const map = await askAI([
            { idx: 1, type: 'single', stem: '下列哪个是质数？', options: [{ letter: 'A', text: '4' }, { letter: 'B', text: '7' }, { letter: 'C', text: '9' }] },
          ])
          log(`接口正常，${Date.now() - t0} ms，答案 ${JSON.stringify(Array.from(map.entries()))}`, 'ok')
        } catch (e) {
          log('接口异常：' + e.message, 'err')
        }
      } else if (act === 'next') {
        await goNextChapter()
      } else if (act === 'video') {
        const r = boostVideos()
        if (!r.count) {
          log('当前页面没找到播放器，先把视频任务点点开（或直接点开视频章节）', 'warn')
          if (!tryOpenVideoTask()) log('也没找到未完成的视频任务点', 'warn')
        } else {
          log(`已处理 ${r.count} 个播放器：${cfg.videoRate}×${cfg.videoMute ? '、静音' : ''}`, 'ok')
        }
      } else if (act === 'api') {
        const d = box.querySelector('#cx2-api-box')
        if (d) d.open = true
      } else if (act === 'export') {
        log('正在收集诊断（含提交按钮与字体探针）…')
        await exportDiag()
      } else if (act === 'clearbank') {
        const n = Object.keys(bank).length
        if (!n) {
          log('题库本来就是空的', 'info')
        } else {
          bank = {}
          saveBank()
          log(`已清空题库（${n} 条）。题面被字体加密过的错误答案一并清掉`, 'ok')
        }
      }
    })

    const head = box.querySelector('#cx2-head')
    // 面板位置记忆（拖动后下次打开还在原地）
    try {
      const pos = store.get('cx2.panelpos.v1', null)
      if (pos && Number.isFinite(pos.left) && Number.isFinite(pos.top)) {
        box.style.left = pos.left + 'px'
        box.style.top = pos.top + 'px'
        box.style.right = 'auto'
        box.style.bottom = 'auto'
      }
    } catch (e) {}
    let drag = null
    head.addEventListener('mousedown', (e) => {
      if (e.target.tagName === 'BUTTON') return
      drag = { x: e.clientX, y: e.clientY, r: box.getBoundingClientRect() }
      e.preventDefault()
    })
    document.addEventListener('mousemove', (e) => {
      if (!drag) return
      box.style.left = drag.r.left + (e.clientX - drag.x) + 'px'
      box.style.top = drag.r.top + (e.clientY - drag.y) + 'px'
      box.style.right = 'auto'
      box.style.bottom = 'auto'
    })
    document.addEventListener('mouseup', () => {
      if (!drag) return
      drag = null
      try {
        const r = box.getBoundingClientRect()
        store.set('cx2.panelpos.v1', { left: Math.round(r.left), top: Math.round(r.top) })
      } catch (e) {}
    })
  }

  /* ============================================================
   * 15. 诊断（多框架 + 全字段脱敏）
   * ============================================================ */
  const REDACT_KEYS = ['apiKey', 'password', 'account']

  function redactCfg() {
    const c = JSON.parse(JSON.stringify(cfg))
    for (const k of REDACT_KEYS) {
      if (c[k]) c[k] = String(c[k]).slice(0, 2) + `***(${String(c[k]).length}位已隐去)`
    }
    return c
  }

  function frameDigest() {
    const out = []
    for (const w of sameOriginWindows(window)) {
      let d = null
      try {
        d = w.document
      } catch (e) {
        continue
      }
      if (!d) continue
      let qs = []
      try {
        qs = scanQuestions(d)
      } catch (e) {}
      out.push({
        url: (() => {
          try {
            return d.location.href.slice(0, 220)
          } catch (e) {
            return '(cross)'
          }
        })(),
        title: d.title,
        counts: {
          questionLi: d.querySelectorAll('.questionLi').length,
          TiMu: d.querySelectorAll('.TiMu').length,
          answerBg: d.querySelectorAll('.answerBg').length,
          radio: d.querySelectorAll('input[type=radio]').length,
          checkbox: d.querySelectorAll('input[type=checkbox]').length,
          iframes: d.querySelectorAll('iframe').length,
        },
        questions: qs.map((q) => ({ idx: q.idx, type: q.type, stem: q.stem.slice(0, 200), options: q.options.map((o) => ({ l: o.letter, t: o.text.slice(0, 120) })) })),
        htmlSample: d.body ? d.body.innerHTML.slice(0, 6000) : '',
      })
    }
    return out
  }

  function frameDebug() {
    const out = []
    for (const d of collectDocs(document)) {
      let qs = []
      try {
        qs = scanQuestions(d)
      } catch (e) {
        continue
      }
      if (!qs.length) continue
      let where = '(frame)'
      try {
        where = d.location.pathname + d.location.search.slice(0, 60)
      } catch (e) {}

      const cands = submitCandidates(d)
        .slice(0, 8)
        .map((c) => {
          let rect = null
          try {
            const r = c.el.getBoundingClientRect()
            rect = { t: Math.round(r.top), w: Math.round(r.width), h: Math.round(r.height) }
          } catch (e) {}
          return {
            text: c.text,
            score: Math.round(c.score * 10) / 10,
            tag: c.el.tagName,
            id: c.el.id,
            cls: String(c.el.className || '').slice(0, 60),
            onclick: String(c.el.getAttribute('onclick') || '').slice(0, 140),
            href: String(c.el.getAttribute('href') || '').slice(0, 80),
            finalClick: !!(c.el.onclick || c.el.tagName === 'BUTTON' || c.el.tagName === 'INPUT'),
            html: String(c.el.outerHTML || '').slice(0, 320),
            rect,
          }
        })

      let qHtml = ''
      try {
        const q0 = qs[0] && qs[0].el
        qHtml = String(q0 && q0.parentElement ? q0.parentElement.outerHTML : q0 ? q0.outerHTML : '').slice(0, 2000)
      } catch (e) {}

      const fonts = []
      try {
        for (const st of Array.from(d.styleSheets || [])) {
          let rules = []
          try {
            rules = Array.from(st.cssRules || [])
          } catch (e) {
            continue
          }
          for (const r of rules) {
            const s = String(r.cssText || '')
            if (/font-face/i.test(s)) fonts.push(s.slice(0, 500))
          }
        }
      } catch (e) {}
      try {
        for (const st of Array.from(d.querySelectorAll('style'))) {
          const s = String(st.textContent || '')
          if (/font-face/i.test(s)) fonts.push('[inline] ' + s.slice(0, 900))
        }
      } catch (e) {}

      // 加密字体本体（本体是内联 base64，直接带出去便于离线核对阈值）
      const fontProbe = (() => {
        try {
          const info = secretFontInfo(d)
          if (!info) return null
          const src = String(info.src || '')
          return {
            family: info.family,
            isData: info.isData,
            faces: info.faces,
            hash: info.hash,
            subsetSize: info.subset.size,
            subsetChars: Array.from(info.subset).slice(0, 400).map((c) => String.fromCodePoint(c)).join(''),
            srcLen: src.length,
            dataUrl: src.length > 0 && src.length <= 900000 ? src : '(len ' + src.length + ', 未内联)',
          }
        } catch (e) {
          return { error: String(e && e.message) }
        }
      })()

      const answerState = {
        radioChecked: d.querySelectorAll('input[type=radio]:checked').length,
        cbChecked: d.querySelectorAll('input[type=checkbox]:checked').length,
        activeLike: d.querySelectorAll('[class*=active],[class*=checked],[class*=selected]').length,
        answerInputs: Array.from(d.querySelectorAll('input[type=hidden]'))
          .filter((i) => /answer/i.test(i.name || i.id || ''))
          .map((i) => ({ n: i.name || i.id, v: String(i.value).slice(0, 80) }))
          .slice(0, 8),
        globals: ['answerObject', 'workAnswerObject', 'answerArray']
          .filter((k) => {
            try {
              return typeof d.defaultView[k] !== 'undefined'
            } catch (e) {
              return false
            }
          })
          .slice(0, 5),
      }

      // 提交区 HTML（含兄弟按钮、内联确认层）
      let submitArea = ''
      try {
        const c0 = cands[0]
        if (c0) submitArea = String(c0.el.parentElement ? c0.el.parentElement.outerHTML : c0.el.outerHTML).slice(0, 1400)
      } catch (e) {}

      // 页面自己的提交函数源码 + 内部作答状态变量
      const fnSrc = {}
      const winKeys = []
      try {
        const w = d.defaultView
        const names = new Set()
        for (const c of submitCandidates(d)) {
          const mm = /^\s*([A-Za-z_$][\w$]*)\s*\(/.exec(String(c.el.getAttribute('onclick') || ''))
          if (mm) names.add(mm[1])
        }
        ;['btnBlueSubmit', 'submitWork', 'checkAnswer', 'addChoice', 'addMultipleChoice', 'saveWork', 'validateTimeNew', 'toadd', 'clientType', 'getformType'].forEach((n) => names.add(n))
        for (const n of names) {
          try {
            if (typeof w[n] === 'function') fnSrc[n] = String(w[n]).slice(0, 1500)
          } catch (e) {}
        }
        let cnt = 0
        for (const k of Object.getOwnPropertyNames(w)) {
          if (cnt > 40) break
          if (!/submit|work|answer|choice|complete/i.test(k)) continue
          let t = ''
          try {
            t = typeof w[k]
          } catch (e) {
            continue
          }
          if (t === 'function') continue
          let prev = ''
          try {
            prev = JSON.stringify(w[k]).slice(0, 120)
          } catch (e) {
            prev = '(unserializable)'
          }
          winKeys.push(k + ':' + t + (prev ? '=' + prev : ''))
          cnt++
        }
      } catch (e) {}

      out.push({ where, n: qs.length, submitCandidates: cands, submitArea, qHtml, fonts: fonts.slice(0, 6), fontProbe, fnSrc, winKeys, answerState })
    }
    return out
  }

  async function exportDiag() {
    const frames = frameDigest()
    let debug = []
    try {
      debug = frameDebug()
    } catch (e) {
      debug = [{ error: String(e && e.message) }]
    }

    // 顶层看不到跨域子框架，所以靠各框架自己上报的登记表补全
    let registry = {}
    try {
      registry = JSON.parse(store.getRaw(KEY_FRAME) || '{}') || {}
    } catch (e) {
      registry = {}
    }

    const iframeList = (() => {
      const out = []
      for (const w of sameOriginWindows(window)) {
        let d = null
        try {
          d = w.document
        } catch (e) {
          continue
        }
        if (!d) continue
        for (const f of Array.from(d.querySelectorAll('iframe'))) {
          let same = false
          try {
            same = !!(f.contentDocument || (f.contentWindow && f.contentWindow.document))
          } catch (e) {
            same = false
          }
          out.push({ src: (f.getAttribute('src') || '').slice(0, 220), id: f.id, sameOrigin: same, w: f.clientWidth, h: f.clientHeight })
        }
      }
      return out
    })()

    const probe = {
      href: location.href.slice(0, 220),
      isTop: IS_TOP,
      windowFramesLen: (() => {
        try {
          return window.frames.length
        } catch (e) {
          return 'THROW:' + e.message
        }
      })(),
      iframeCount: document.querySelectorAll('iframe').length,
      sameOriginWindows: frames.length,
      hasGM: hasGM,
      hasUnsafeWindow: typeof unsafeWindow !== 'undefined',
      gmInfo: typeof GM_info !== 'undefined' ? { script: GM_info.script && GM_info.script.name, version: GM_info.script && GM_info.script.version, handler: GM_info.scriptHandler } : null,
      running: state.running,
    }

    const dump = {
      ver: VER,
      url: location.href,
      isTop: IS_TOP,
      title: document.title,
      cfg: redactCfg(),
      probe,
      catalog: (() => {
        try {
          return catalogNodes().map((n) => ({ text: txt(n).slice(0, 40), cls: n.className }))
        } catch (e) {
          return []
        }
      })(),
      nextButton: (() => {
        const b = findNextButton()
        return b ? b.how : null
      })(),
      sameOriginFrameCount: frames.length,
      frames,
      iframeList,
      frameDebug: debug,
      decode: lastDecode,
      crossOriginRegistry: registry,
      logs: logs.map((l) => l.line),
    }
    const blob = new Blob([JSON.stringify(dump, null, 2)], { type: 'application/json' })
    const a = document.createElement('a')
    a.href = URL.createObjectURL(blob)
    a.download = `cx2-diag-${Date.now()}.json`
    a.click()
    log('诊断已导出（账号密码已脱敏）', 'ok')
  }

  /* ============================================================
   * 16. 命令通道 / 巡航 / 引导
   * ============================================================ */
  let lastCmdId = ''

  function handleCmd(cmd) {
    if (!cmd || !cmd.id || cmd.id === lastCmdId) return
    lastCmdId = cmd.id
    if (cmd.type === 'run') {
      if (scanAll(window).length) {
        log('收到作答命令')
        runQuizPage(true)
      }
    }
  }

  function sendCmd(type) {
    const cmd = { type, id: Math.random().toString(36).slice(2), at: Date.now() }
    try {
      localStorage.setItem(CMD_KEY, JSON.stringify(cmd))
    } catch (e) {}
    handleCmd(cmd)
  }

  function watchCommands() {
    window.addEventListener('storage', (ev) => {
      if (ev.key !== CMD_KEY || !ev.newValue) return
      try {
        handleCmd(JSON.parse(ev.newValue))
      } catch (e) {}
    })
    let seen = ''
    setInterval(() => {
      let raw = null
      try {
        raw = localStorage.getItem(CMD_KEY)
      } catch (e) {}
      if (!raw || raw === seen) return
      seen = raw
      try {
        handleCmd(JSON.parse(raw))
      } catch (e) {}
    }, 800)
  }

  function watchTopForDone() {
    if (!IS_TOP) return
    let navigating = false
    let lastAt = 0
    window.addEventListener('message', async (ev) => {
      const d = ev.data
      if (!d || d.src !== 'cx2' || d.type !== 'chapter-done') return
      if (!cfg.autoNext) return
      const now = Date.now()
      if (navigating || now - lastAt < 2500) return
      lastAt = now
      navigating = true
      try {
        log('本章测验已完成，准备跳章', 'ok')
        await sleep(cfg.nextDelay)
        await goNextChapter()
      } finally {
        setTimeout(() => (navigating = false), 2500)
      }
    })
  }

  /* 顶层驱动：跨框架找题；子框架只在顶层没脚本时兜底 */
  function topAlive() {
    if (IS_TOP) return false
    try {
      return !!window.top.__cx2Alive
    } catch (e) {
      return false
    }
  }

  function startAutoPilot() {
    let lastPub = 0
    let idleFail = 0
    let lastVideoTry = 0
    setInterval(async () => {
      refreshShared()
      if (Date.now() - lastPub > 3000) {
        lastPub = Date.now()
        publishSelf()
      }
      if (busy) return
      if (/passport2?\.chaoxing\.com/i.test(location.href)) return
      if (state.running && cfg.autoVideo) {
        try {
          boostVideos(true)
        } catch (e) {}
      }
      if (!state.running) return
      if (!IS_TOP && topAlive()) return // 同源情况下顶层已经在管，别抢

      const target = pickTarget(window)
      if (!target) {
        if (cfg.openTask) tryOpenQuizTask()
        // 没有题目但章节里有视频任务点：点开它，并把它播起来
        if (cfg.autoVideo && Date.now() - lastVideoTry > 6000) {
          lastVideoTry = Date.now()
          try {
            if (!boostVideos(true).count) tryOpenVideoTask()
          } catch (e) {}
        }
        idleFail++
        return
      }
      log(`巡航发现 ${target.qs.length} 题`)
      const r = await runQuizPage()
      if (r && r.filled > 0) {
        idleFail = 0
      } else {
        idleFail++
        // 连续无进展就退避，别每 2 秒硬撞一次（AI 挂了/页面异常时尤其要紧）
        if (idleFail > 3) await sleep(Math.min(15000, 1800 * (idleFail - 2)))
      }
    }, 1900)
  }

  async function boot() {
    if (document.documentElement.getAttribute('data-cx2')) return

    const relevant =
      /chaoxing|mooc1|mooc2|mooc-ans|passport2?/i.test(location.href) ||
      !!document.querySelector(
        '#iframe, .posCatalog_select, .questionLi, .TiMu, .mark_name, #courseId, #chapterId, a[href*="chaoxing"], .ans-attach-ct, .ans-job-name, .ans-job-icon',
      )
    if (!relevant) return

    document.documentElement.setAttribute('data-cx2', VER)
    refreshShared(true)
    publishSelf({ boot: true })

    if (IS_TOP) {
      window.__cx2Alive = true
      buildPanel()
      watchTopForDone()
      log(`已加载 v${VER}（${hasGM ? 'GM' : 'localStorage'}，${state.running ? '自动模式' : '待命'}）`)
    }
    watchCommands()
    startAutoPilot()

    if (isLoginPage()) {
      await autoLogin()
      return
    }
  }

  window.__cx2 = {
    ver: VER,
    scan: () => scanAll(window),
    run: (f) => runQuizPage(f !== false),
    next: goNextChapter,
    openTask: tryOpenQuizTask,
    video: (quiet) => boostVideos(quiet !== false),
    openVideo: tryOpenVideoTask,
    normEndpoint,
    getCfg: () => cfg,
    setCfg: (o) => {
      Object.assign(cfg, o)
      saveCfg()
    },
    getBank: () => bank,
    clearBank: () => {
      bank = {}
      saveBank()
    },
    getState: () => state,
    setState: (o) => {
      Object.assign(state, o)
      saveState()
    },
    logs: () => logs,
    askAI,
    frames: () => sameOriginWindows(window).map((w) => {
      try {
        return w.location.href.slice(0, 120)
      } catch (e) {
        return '(cross)'
      }
    }),
  }

  boot()
})()