@huoye/app-ship 0.2.1 → 0.3.0

package/browser-extension/capture-fields.js

@@ -0,0 +1,195 @@
+// 采集当前可见的已有凭据；华为开发者级客户端与蒲公英 API Key 使用已核对的页面边界，秘密不进入描述结果。
+/**
+ * 检查页面可采集的公开选项，或读取用户明确选择的一行已有凭据；不能创建、显露或重置密钥。
+ * @param platform - 当前任务的商店标识；华为/鸿蒙与蒲公英启用已核对的新版凭据结构。
+ * @param options - 可选采集参数；inspectOnly 为 true 时仅返回公开选项；新版采集要求 choiceKey 与 choiceLabel 同时匹配。
+ * @returns 检查模式返回公开 choices/requiresSelection；采集模式仅向本机管道返回认证字段。
+ */
+export function visibleFields(platform, options = {}) {
+  /**
+   * 检查节点及其祖先是否可见；密码输入框、隐藏内容不参与采集。
+   * @param node - 当前文档或已核对同源框架中的节点；缺失节点返回 false。
+   */
+  const visible = (node) => {
+    if (!node || node.getClientRects().length === 0 || node.type === 'password') return false
+    for (let current = node; current; current = current.parentElement) {
+      const style = getComputedStyle(current)
+      if (style.visibility === 'hidden' || style.display === 'none' || style.opacity === '0')
+        return false
+    }
+    return true
+  }
+  /**
+   * 将可见字段标签规范化为匹配键，不处理字段值。
+   * @param value - 标签或列标题；缺省值视为空标签。
+   */
+  const normalize = (value) =>
+    String(value ?? '')
+      .toLowerCase()
+      .replace(/[\s_:\-：]/gu, '')
+  const modernHuawei =
+    ['huawei', 'harmony'].includes(platform) &&
+    /^\/consumer\/(?:cn|en)\/hdc-console\/(?:index\.html)?$/u.test(
+      globalThis.location?.pathname || '',
+    )
+  if (modernHuawei) {
+    const documents = [document]
+    // 真实新版页面把表格放在此同源框架中；不读取其它框架、登录表单或跨域内容。
+    for (const frame of document.querySelectorAll('iframe')) {
+      if (!visible(frame)) continue
+      const url = new URL(frame.src, location.href)
+      if (
+        url.origin !== location.origin ||
+        !/^\/consumer\/(?:cn|en)\/consoleIframe\/api\/credentials\/1$/u.test(url.pathname)
+      )
+        continue
+      try {
+        if (frame.contentDocument) documents.push(frame.contentDocument)
+      } catch {
+        /* 跨域或不可访问框架不参与采集。 */
+      }
+    }
+    const scoped = documents.filter((root) =>
+      Array.from(root.querySelectorAll('[role="tab"][aria-selected="true"]')).some(
+        (tab) => visible(tab) && normalize(tab.textContent) === '开发者级凭证',
+      ),
+    )
+    if (!scoped.length) throw new Error('huawei_developer_credentials_required')
+    const rows = []
+    const visited = new Set()
+    for (const root of scoped) {
+      for (const table of root.querySelectorAll('table')) {
+        if (!visible(table)) continue
+        // Ant Design 将表头和正文分为两个 table；nz-table 是同一业务表格的共同边界。
+        const container = table.closest('nz-table') || table
+        if (visited.has(container)) continue
+        visited.add(container)
+        const headers = Array.from(container.querySelectorAll('thead th')).map((node) =>
+          normalize(node.textContent),
+        )
+        const nameIndex = headers.indexOf('凭证名称')
+        const idIndex = headers.indexOf('凭证id')
+        const secretIndex = headers.indexOf('密钥')
+        const createdIndex = headers.indexOf('创建时间')
+        if (nameIndex < 0 || idIndex < 0 || secretIndex < 0 || !headers.includes('角色')) continue
+        for (const row of container.querySelectorAll('tbody tr')) {
+          if (!visible(row) || row.cells.length !== headers.length) continue
+          const name = row.cells[nameIndex].textContent.trim()
+          if (!name) continue
+          const created = createdIndex < 0 ? '' : row.cells[createdIndex].textContent.trim()
+          const label = [name, created]
+            .filter(Boolean)
+            .join(' · ')
+            .replace(/[\r\n\t]/gu, ' ')
+            .slice(0, 200)
+          rows.push({
+            key: String(rows.length),
+            label,
+            id: row.cells[idIndex],
+            secret: row.cells[secretIndex],
+          })
+        }
+      }
+    }
+    if (!rows.length) throw new Error('huawei_api_client_missing')
+    if (options.inspectOnly)
+      return {
+        requiresSelection: true,
+        choices: rows.map((row) => ({ key: row.key, label: row.label })),
+      }
+    const selected = rows.find(
+      (row) => row.key === options.choiceKey && row.label === options.choiceLabel,
+    )
+    if (!selected) throw new Error('credential_selection_changed')
+    /**
+     * 只读取选定单元格的明确可见值，拒绝遮盖文本、操作文案及多个候选。
+     * @param cell - 已按官方列标题定位的凭证 ID 或密钥单元格。
+     * @param id - 读取凭证 ID 时为 true，要求数字 ID；密钥只接受单个完整的令牌文本。
+     */
+    const scalar = (cell, id) => {
+      const nodes = Array.from(cell.querySelectorAll('input,textarea,code,.key-id-text')).filter(
+        visible,
+      )
+      const values = (nodes.length ? nodes : [cell])
+        .filter(visible)
+        .map((node) => String(node.value ?? node.textContent).trim())
+      const valid = [
+        ...new Set(
+          values.filter((value) =>
+            id ? /^\d{5,128}$/u.test(value) : /^[A-Za-z0-9._~+/=-]{8,8192}$/u.test(value),
+          ),
+        ),
+      ]
+      if (valid.length !== 1) throw new Error('credentials_not_visible')
+      return valid[0]
+    }
+    return { clientId: scalar(selected.id, true), clientSecret: scalar(selected.secret, false) }
+  }
+  if (platform === 'pgyer' && /^\/dashboard\/?$/u.test(globalThis.location?.pathname || '')) {
+    // 新版 API Key 与 User Key 分属独立卡片；只定位 API Key 的复制按钮及同级可见 code，不触发复制或重置。
+    const cards = Array.from(document.querySelectorAll('button[aria-label="复制API Key"]'))
+      .filter(visible)
+      .map((button) => button.parentElement)
+      .filter(
+        (card) =>
+          visible(card) &&
+          card.children[0]?.tagName === 'DIV' &&
+          visible(card.children[0]) &&
+          normalize(card.children[0].textContent) === 'apikey',
+      )
+    if (cards.length !== 1) throw new Error('pgyer_api_key_required')
+    const values = Array.from(cards[0].children).filter(
+      (node) => node.tagName === 'CODE' && visible(node) && node.children.length === 0,
+    )
+    if (values.length !== 1) throw new Error('pgyer_api_key_required')
+    if (options.inspectOnly) return { requiresSelection: false, choices: [] }
+    const apiKey = values[0].textContent.trim()
+    if (!/^[A-Za-z0-9._~+/=-]{8,8192}$/u.test(apiKey)) throw new Error('credentials_not_visible')
+    return { apiKey }
+  }
+  if (['app_store', 'google_play'].includes(platform)) throw new Error('credential_file_required')
+  if (options.inspectOnly) return { requiresSelection: false, choices: [] }
+  const names =
+    platform === 'samsung'
+      ? { serviceAccountId: ['serviceaccountid', '服务账号id', '服务帐户id'] }
+      : platform === 'xiaomi'
+        ? {
+            userName: ['username', '开发者邮箱'],
+            privateKey: ['privatekey', 'api访问密码', '私钥'],
+          }
+        : platform === 'vivo'
+          ? { accessKey: ['accesskey'], accessSecret: ['accesssecret'] }
+          : platform === 'tencent'
+            ? { userId: ['userid'], appId: ['appid'], accessSecret: ['accesssecret'] }
+            : platform !== 'pgyer'
+              ? { clientId: ['clientid', '客户端id'], clientSecret: ['clientsecret', '客户端密钥'] }
+              : { apiKey: ['apikey', 'api密钥'] }
+  const fields = {}
+  for (const [field, aliases] of Object.entries(names)) {
+    const values = new Set()
+    for (const node of document.querySelectorAll('input,textarea,[data-field]')) {
+      if (!visible(node)) continue
+      const labels = [
+        node.id,
+        node.getAttribute('name'),
+        node.getAttribute('data-field'),
+        node.getAttribute('aria-label'),
+        ...Array.from(node.labels ?? []).map((label) => label.textContent),
+      ]
+      if (labels.some((label) => aliases.includes(normalize(label))))
+        values.add(String(node.value ?? node.textContent).trim())
+    }
+    for (const label of document.querySelectorAll('label,td,dt')) {
+      if (!visible(label) || !aliases.includes(normalize(label.textContent))) continue
+      const region = label.closest('tr,.form-group,.el-form-item,.ant-form-item')
+      const value = region?.querySelector('input,textarea,code') ?? label.nextElementSibling
+      if (visible(value)) values.add(String(value.value ?? value.textContent).trim())
+    }
+    const candidates = [...values].filter(
+      (value) => value && value.length <= 8192 && !/[\r\n\0*•●]/u.test(value),
+    )
+    if (candidates.length !== 1) throw new Error('credentials_not_visible')
+    fields[field] = candidates[0]
+  }
+  return fields
+}

package/browser-extension/manifest.json

@@ -0,0 +1,8 @@
+{
+  "manifest_version": 3,
+  "name": "Flu 发布凭据助手",
+  "version": "0.1.0",
+  "description": "为已发起的本机 Flu 配置任务采集商店页面中的已有凭据。",
+  "permissions": ["activeTab", "scripting", "nativeMessaging"],
+  "action": { "default_title": "为当前 Flu 任务配置已有凭据", "default_popup": "popup.html" }
+}

package/browser-extension/popup.html

@@ -0,0 +1,152 @@
+<!doctype html>
+<html lang="zh-CN">
+  <meta charset="utf-8" />
+  <meta
+    name="viewport"
+    content="width=device-width, initial-scale=1"
+  />
+  <title>Flu 发布凭据助手</title>
+  <style>
+    :root {
+      color-scheme: light dark;
+      font: 14px/1.5 system-ui;
+    }
+    body {
+      min-width: 300px;
+      max-width: 360px;
+      padding: 16px;
+      margin: 0;
+    }
+    h1 {
+      font-size: 16px;
+      margin: 0 0 12px;
+    }
+    button,
+    select,
+    input {
+      font: inherit;
+      max-width: 100%;
+    }
+    button {
+      padding: 7px 10px;
+    }
+    label,
+    select {
+      display: block;
+      margin: 8px 0;
+    }
+    select {
+      width: 100%;
+    }
+    [hidden] {
+      display: none;
+    }
+    p {
+      margin: 12px 0 0;
+    }
+  </style>
+  <h1>Flu 发布凭据助手</h1>
+  <label for="task">当前 Flu 配置任务</label>
+  <select
+    id="task"
+    disabled
+  >
+    <option>正在读取本机任务…</option>
+  </select>
+  <button
+    id="read"
+    disabled
+  >
+    读取当前账号页的已有凭据
+  </button>
+  <label
+    id="credential-label"
+    for="credential"
+    hidden
+    >开发者级 API 客户端</label
+  >
+  <select
+    id="credential"
+    hidden
+  ></select>
+  <label
+    id="account-label"
+    for="account"
+    >文件配对账号：三星 Service Account ID / 小米开发者邮箱 / Apple Issuer ID</label
+  >
+  <input
+    id="account"
+    type="text"
+    autocomplete="off"
+    disabled
+  />
+  <label
+    id="file-secret-label"
+    for="file-secret"
+    >小米 API 访问密码（不是登录密码）</label
+  >
+  <input
+    id="file-secret"
+    type="password"
+    autocomplete="off"
+    disabled
+  />
+  <label
+    id="key-id-label"
+    for="key-id"
+    >Apple 团队 API Key ID</label
+  >
+  <input
+    id="key-id"
+    type="text"
+    autocomplete="off"
+    disabled
+  />
+  <label
+    id="apple-id-label"
+    for="apple-id"
+    >Apple ID（当前 CLI 上传所需）</label
+  >
+  <input
+    id="apple-id"
+    type="text"
+    autocomplete="off"
+    disabled
+  />
+  <label
+    id="app-password-label"
+    for="app-password"
+    >已有 App 专用密码（不能使用登录密码）</label
+  >
+  <input
+    id="app-password"
+    type="password"
+    autocomplete="off"
+    disabled
+  />
+  <p id="file-help">
+    私钥只能下载一次，助手不能恢复丢失文件。请导入已经下载的文件，不要创建或重置密钥。
+  </p>
+  <label
+    id="file-label"
+    for="file"
+    >导入已有文件：华为/鸿蒙/Google JSON；三星 PEM；Apple P8；小米公钥/证书</label
+  >
+  <input
+    id="file"
+    type="file"
+    accept=".json,.pem,.key,.p8,.cer,application/json,application/x-pem-file"
+    disabled
+  />
+  <p
+    id="status"
+    role="status"
+    aria-live="polite"
+  >
+    凭据仅保存到本机，不进入 AI 对话。
+  </p>
+  <script
+    src="popup.js"
+    type="module"
+  ></script>
+</html>

package/browser-extension/popup.js

@@ -0,0 +1,312 @@
+// 本文件在扩展自身页面采集或导入已有凭据；只把脱敏状态显示给用户。
+import { visibleFields } from './capture-fields.js'
+
+const HOST = 'cn.huoye.app_ship.credentials'
+const select = document.getElementById('task')
+const read = document.getElementById('read')
+const file = document.getElementById('file')
+const status = document.getElementById('status')
+const account = document.getElementById('account')
+const fileSecret = document.getElementById('file-secret')
+const keyId = document.getElementById('key-id')
+const appleId = document.getElementById('apple-id')
+const appPassword = document.getElementById('app-password')
+const fileHelp = document.getElementById('file-help')
+const credential = document.getElementById('credential')
+const credentialLabel = document.getElementById('credential-label')
+const tasks = new Map()
+let tab
+let busy = false
+let choices = []
+let requiresSelection = false
+let pageReady = false
+
+/**
+ * 向已注册的本机连接发送当前用户动作，返回脱敏状态。
+ * @param message - 扩展自身构造的任务消息；秘密只经本机管道传输。
+ */
+async function native(message) {
+  const value = await chrome.runtime.sendNativeMessage(HOST, message)
+  if (!value?.ok) throw new Error(value?.error || 'connector_unavailable')
+  return value.result
+}
+/** 按当前任务与忙碌状态启用控件，不读取或保存凭据。 */
+function update() {
+  const task = tasks.get(select.value)
+  select.disabled = busy || !tasks.size
+  read.disabled =
+    busy || !task || !task.fromPage || !pageReady || (requiresSelection && !credential.value)
+  credential.disabled = busy
+  const filePlatform = [
+    'huawei',
+    'harmony',
+    'samsung',
+    'xiaomi',
+    'app_store',
+    'google_play',
+  ].includes(task?.platform)
+  for (const [id, shown] of [
+    ['account', ['samsung', 'xiaomi', 'app_store'].includes(task?.platform)],
+    ['file-secret', task?.platform === 'xiaomi'],
+    ['key-id', task?.platform === 'app_store'],
+    ['apple-id', task?.platform === 'app_store'],
+    ['app-password', task?.platform === 'app_store'],
+    ['file', filePlatform],
+  ]) {
+    document.getElementById(id).hidden = document.getElementById(id + '-label').hidden = !shown
+  }
+  fileHelp.hidden = !filePlatform
+  document.getElementById('account-label').textContent =
+    task?.platform === 'xiaomi'
+      ? '小米开发者邮箱'
+      : task?.platform === 'app_store'
+        ? 'Apple 团队 Issuer ID'
+        : '三星 Service Account ID（可从当前页读取）'
+  file.disabled =
+    busy ||
+    !task ||
+    !['huawei', 'harmony', 'samsung', 'xiaomi', 'app_store', 'google_play'].includes(task.platform)
+  account.disabled = busy || !['samsung', 'xiaomi', 'app_store'].includes(task?.platform)
+  fileSecret.disabled = busy || task?.platform !== 'xiaomi'
+  keyId.disabled = busy || task?.platform !== 'app_store'
+  appleId.disabled = appPassword.disabled = busy || task?.platform !== 'app_store'
+  fileHelp.textContent =
+    task?.platform === 'xiaomi'
+      ? '填写开发者邮箱与已有 API 访问密码，再导入平台公钥或证书；不要填写小米账号登录密码。'
+      : task?.platform === 'app_store'
+        ? '填写团队 Key 的 Issuer ID / Key ID 并导入 .p8；当前 CLI 上传还需已有 Apple ID 与 App 专用密码。私钥不能从网页恢复；只读核验只证明 API Key 与应用匹配。'
+        : task?.platform === 'google_play'
+          ? '导入已有服务账号 JSON；私钥仅在创建时可下载，不能从 Cloud 或 Play 页面恢复。只读查询需要目标应用查看权限。'
+          : '导入当前账号已经下载的文件；助手不会创建、重置密钥或扩大权限。'
+}
+/**
+ * 将已知采集错误转为可操作的提示，不显示浏览器原文、认证字段或异常堆栈。
+ * @param error - 本机连接或页面采集抛出的错误，仅匹配固定错误代码。
+ * @param platform - 当前任务的商店标识，用于说明对应凭据页的处理方式。
+ */
+function captureMessage(error, platform) {
+  const code = String(error?.message || '')
+  if (code.includes('invalid_import_fields'))
+    return '请补齐当前文件的配对账号字段。Apple 还需已有 Apple ID 与 App 专用密码；小米需邮箱与 API 访问密码。'
+  if (code.includes('invalid_apple_key'))
+    return '请导入已有团队 API Key 的 P-256 .p8，并核对对应的 Issuer ID 与 Key ID；不支持个人 API Key。'
+  if (code.includes('invalid_service_account'))
+    return '请导入已有 Google 服务账号 JSON（含 RSA 私钥），不支持 OAuth 客户端或自定义 token 地址。'
+  if (code.includes('invalid_public_key'))
+    return '请导入小米平台分配的已有 RSA 公钥或证书，不要导入 RSA 私钥。'
+  if (code.includes('invalid_credential_file'))
+    return '文件类型或大小不符合当前平台要求，请选择已经下载且不超过 64 KB 的配对文件。'
+  if (code.includes('credential_setup_not_pending'))
+    return '任务已完成、取消或过期；请回到 Flu 核对状态，必要时重新发起采集。'
+  if (code.includes('pgyer_api_key_required'))
+    return '请在蒲公英账号的“API 信息”页确认已有 API Key 卡片可见，再重新打开助手。'
+  if (code.includes('huawei_developer_credentials_required'))
+    return '请在华为“凭证”页面选择“开发者级凭证”，再重新打开助手。'
+  if (code.includes('huawei_api_client_missing'))
+    return '当前开发者级 API 客户端列表没有可见记录；可导入已有服务账号 JSON。'
+  if (code.includes('credentials_not_visible'))
+    return platform === 'pgyer'
+      ? '蒲公英 API Key 被遮盖或无法完整读取，请核对 API 信息页后重新打开助手。'
+      : '当前账号页的凭据被遮盖、标签不明确或存在多个候选。请核对当前平台 API 凭据页；文件凭据从助手导入。'
+  if (code.includes('credential_selection_changed'))
+    return '所选凭证行已变化，请重新打开助手并选择对应 API 客户端。'
+  if (code.includes('credential_file_required'))
+    return '此平台使用已下载的文件凭据，请在助手下方导入；无法恢复丢失的私钥。'
+  if (code.includes('page_changed')) return '商店页面已变化，请回到凭据页后重新打开助手。'
+  return '未完成。请核对任务期限、本机连接及已有凭据；不会创建或重置商店密钥。'
+}
+/**
+ * 在用户当前标签页执行可见页面读取；页面变化时停止，不访问网页存储或网络。
+ * @param task - 当前本机任务的公开平台与关联信息。
+ * @param options - 仅检查公开选择项，或携带用户选中的公开行标识。
+ */
+async function readPage(task, options) {
+  const current = (await chrome.tabs.query({ active: true, currentWindow: true }))[0]
+  if (!tab?.id || current?.id !== tab.id || current.url !== tab.url) throw new Error('page_changed')
+  const result = await chrome.scripting.executeScript({
+    target: { tabId: tab.id },
+    func: visibleFields,
+    args: [task.platform, options],
+  })
+  return result[0]?.result
+}
+/** 检查当前任务可见的凭据结构及公开选择项；检查阶段不读取 ID 或密钥。 */
+async function refreshPageChoices() {
+  const task = tasks.get(select.value)
+  pageReady = false
+  choices = []
+  requiresSelection = false
+  credential.hidden = credentialLabel.hidden = true
+  if (!task?.fromPage) {
+    status.textContent = '请按下方平台说明导入当前任务已有的文件凭据。'
+    update()
+    return
+  }
+  busy = true
+  update()
+  try {
+    const result = await readPage(task, { inspectOnly: true })
+    requiresSelection = result.requiresSelection
+    choices = result.choices
+    credential.replaceChildren(
+      ...[
+        ...(choices.length > 1 ? [{ key: '', label: '请选择本次使用的 API 客户端' }] : []),
+        ...choices,
+      ].map((choice) => {
+        const option = document.createElement('option')
+        option.value = choice.key
+        option.textContent = choice.label
+        return option
+      }),
+    )
+    credential.hidden = credentialLabel.hidden = !requiresSelection
+    pageReady = true
+    status.textContent = requiresSelection
+      ? '已识别开发者级 API 客户端。读取后由 Flu 只读核验应用匹配；不会上传安装包。'
+      : task.platform === 'pgyer'
+        ? '已识别蒲公英 API 信息页。点击读取已有 API Key 后由 Flu 只读鉴权；不会上传安装包。'
+        : '选择任务后读取已有凭据，或导入已下载的服务账号 JSON。'
+  } catch (error) {
+    status.textContent = captureMessage(error, task.platform)
+  } finally {
+    busy = false
+    update()
+  }
+}
+/**
+ * 执行用户点选的采集或文件导入，结束后清空文件输入并显示脱敏结果。
+ * @param operation - 接收当前已选任务的异步采集回调，必须返回明确的采集状态。
+ */
+async function execute(operation) {
+  if (busy || !tasks.has(select.value)) return
+  busy = true
+  update()
+  status.textContent = '正在保存到本机安全库…'
+  try {
+    const result = await operation(tasks.get(select.value))
+    if (result.status === 'account_read') {
+      account.value = result.serviceAccountId || result.userName
+      fileSecret.value = result.privateKey || ''
+      status.textContent = result.userName
+        ? '已读取小米 API 账号，请选择平台分配的公钥或证书。'
+        : '已读取账号 ID，请选择该账号已下载的私钥文件。'
+      return
+    }
+    if (result.status !== 'captured') throw new Error('capture_not_completed')
+    tasks.delete(result.setupId)
+    select.querySelector(`option[value="${result.setupId}"]`)?.remove()
+    status.textContent =
+      '已有凭据已保存到本机。Flu 插件会自动跟进并核验；从 CLI 发起的任务请执行 complete。'
+    account.value = fileSecret.value = keyId.value = appleId.value = appPassword.value = ''
+  } catch (error) {
+    status.textContent = captureMessage(error, tasks.get(select.value)?.platform)
+  } finally {
+    busy = false
+    file.value = ''
+    update()
+  }
+}
+
+read.addEventListener('click', () =>
+  execute(async (task) => {
+    const choice = choices.find((entry) => entry.key === credential.value)
+    const fields = await readPage(
+      task,
+      choice ? { choiceKey: choice.key, choiceLabel: choice.label } : {},
+    )
+    try {
+      if (task.platform === 'xiaomi' && fields?.userName)
+        return { status: 'account_read', userName: fields.userName, privateKey: fields.privateKey }
+      if (task.platform === 'samsung' && fields?.serviceAccountId)
+        return { status: 'account_read', serviceAccountId: fields.serviceAccountId }
+      return await native({ operation: 'capture', setupId: task.setupId, pageUrl: tab.url, fields })
+    } finally {
+      if (fields) for (const key of Object.keys(fields)) fields[key] = ''
+    }
+  }),
+)
+file.addEventListener('change', () =>
+  execute(async (task) => {
+    const selected = file.files?.[0]
+    if (
+      !selected ||
+      selected.size > 65_000 ||
+      !(
+        task.platform === 'samsung'
+          ? /\.(?:pem|key)$/iu
+          : task.platform === 'app_store'
+            ? /\.p8$/iu
+            : task.platform === 'xiaomi'
+              ? /\.(?:pem|cer|key)$/iu
+              : /\.json$/iu
+      ).test(selected.name)
+    )
+      throw new Error('invalid_credential_file')
+    let content = await selected.text()
+    if (task.platform === 'xiaomi' && !content.includes('-----BEGIN')) {
+      const bytes = new Uint8Array(await selected.arrayBuffer())
+      content = `-----BEGIN CERTIFICATE-----\n${btoa(String.fromCharCode(...bytes))}\n-----END CERTIFICATE-----`
+    }
+    try {
+      return await native({
+        operation: 'import_file',
+        setupId: task.setupId,
+        content,
+        ...(task.platform === 'samsung'
+          ? { serviceAccountId: account.value.trim() }
+          : ['xiaomi', 'app_store', 'google_play'].includes(task.platform)
+            ? {
+                fields:
+                  task.platform === 'xiaomi'
+                    ? { userName: account.value.trim(), privateKey: fileSecret.value }
+                    : task.platform === 'app_store'
+                      ? {
+                          apiIssuerId: account.value.trim(),
+                          apiKeyId: keyId.value.trim(),
+                          appleId: appleId.value.trim(),
+                          appPassword: appPassword.value,
+                        }
+                      : {},
+              }
+            : {}),
+      })
+    } finally {
+      content = ''
+    }
+  }),
+)
+select.addEventListener('change', () => {
+  account.value = fileSecret.value = keyId.value = appleId.value = appPassword.value = ''
+  refreshPageChoices()
+})
+credential.addEventListener('change', update)
+
+try {
+  tab = (await chrome.tabs.query({ active: true, currentWindow: true }))[0]
+  const imported = await native({ operation: 'pending_imports' })
+  for (const task of imported.requests) tasks.set(task.setupId, task)
+  if (tab?.url) {
+    // 当前网页不受支持时仍允许用户从扩展内导入本地 JSON，不把文件交给网页。
+    try {
+      const pending = await native({ operation: 'pending', pageUrl: tab.url })
+      for (const task of pending.requests) tasks.set(task.setupId, { ...task, fromPage: true })
+    } catch {
+      /* 网页采集范围由本机边界决定。 */
+    }
+  }
+  select.replaceChildren(
+    ...[...tasks.values()].map((task) => {
+      const option = document.createElement('option')
+      option.value = task.setupId
+      option.textContent = `${task.platform} · ${task.packageName} · ${task.setupId.slice(0, 8)}`
+      return option
+    }),
+  )
+  status.textContent = tasks.size
+    ? '选择任务后读取已有凭据，或导入已下载的服务账号 JSON。'
+    : '没有待采集任务。请先从 Flu 为明确项目开始凭据配置。'
+  if (tasks.size) await refreshPageChoices()
+} catch {
+  status.textContent = '本机连接不可用。请在 IDE 的“准备浏览器助手”中选择“连接到 Flu”。'
+}
+update()