creditdaddy 1.6.2 → 1.6.5

package/src/panel.html

@@ -197,6 +197,8 @@
   html[data-theme="dark"] .badge.prod.trae { color: #6ee7b7; }
   .badge.prod.minimax { color: #e11d48; background: rgba(244,63,94,.14); }
   html[data-theme="dark"] .badge.prod.minimax { color: #fda4af; }
+  .badge.prod.loomy { color: #0284c7; background: rgba(14,165,233,.14); }
+  html[data-theme="dark"] .badge.prod.loomy { color: #38bdf8; }
   .seg-ctl { display: inline-flex; gap: 2px; padding: 2px; border-radius: 9px; background: var(--hover); }
   .seg-ctl button { border: none; background: transparent; color: var(--text-2); font-size: 12px; font-weight: 600; padding: 4px 10px; border-radius: 7px; cursor: pointer; }
   .seg-ctl button.active { background: var(--surface); color: var(--text); box-shadow: 0 1px 3px rgba(0,0,0,.08); }
@@ -341,7 +343,7 @@
   .prod-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
   .prod-name { display: flex; align-items: center; gap: 8px; font-size: 14px; font-weight: 700; }
   .dot { width: 8px; height: 8px; border-radius: 50%; flex-shrink: 0; }
-  .dot.qoder { background: #7c3aed; } .dot.workbuddy { background: #14b8a6; } .dot.zcode { background: #2563eb; } .dot.mirasim { background: #64748b; } .dot.catpaw { background: #f97316; } .dot.trae { background: #10b981; } .dot.minimax { background: #f43f5e; }
+  .dot.qoder { background: #7c3aed; } .dot.workbuddy { background: #14b8a6; } .dot.zcode { background: #2563eb; } .dot.mirasim { background: #64748b; } .dot.catpaw { background: #f97316; } .dot.trae { background: #10b981; } .dot.minimax { background: #f43f5e; } .dot.loomy { background: #0284c7; }
   .prod-go { color: var(--text-3); font-size: 12px; white-space: nowrap; display: inline-flex; align-items: center; gap: 2px; }
   .prod-go svg { width: 12px; height: 12px; transition: transform .15s; }
   .prodcard:hover .prod-go { color: var(--text); }
@@ -555,6 +557,7 @@
     <button data-view="catpaw"><span data-i18n="妙手">妙手</span><span class="cnt" id="cnt-catpaw">0</span></button>
     <button data-view="trae">Trae<span class="cnt" id="cnt-trae">0</span></button>
     <button data-view="minimax">MiniMax<span class="cnt" id="cnt-minimax">0</span></button>
+    <button data-view="loomy">Loomy<span class="cnt" id="cnt-loomy">0</span></button>
     <button data-view="free"><span data-i18n="网页会话">网页会话</span><span class="cnt" id="cnt-free">0</span></button>
     <button data-view="tenrouter">10Router<span class="cnt" id="cnt-tenrouter">–</span></button>
   </nav>
@@ -612,6 +615,9 @@
             <button class="btn" id="mt-gw"></button>
             <button class="btn" id="mt-open" style="display:none"></button>
           </span>
+          <span id="l-actions" style="display:none">
+            <button class="btn" id="lt-open" style="display:none"></button>
+          </span>
           <span id="w-actions" style="display:none">
             <button class="btn" id="wt-act" title="领取临时活动（额外补偿 / 首月赠礼），用已存凭据批量领，免逐个网页点击"></button>
           </span>
@@ -680,6 +686,7 @@
     <div class="modal-title"><span data-i18n="添加账号">添加账号</span><button class="close" data-close>✕</button></div>
     <div class="tabs">
       <button class="tab active" data-tab="local" data-i18n="本机导入">本机导入</button>
+      <button class="tab" data-tab="sms" data-i18n="手机登录" id="tab-sms">手机登录</button>
       <button class="tab" data-tab="device" data-i18n="浏览器登录">浏览器登录</button>
       <button class="tab" data-tab="token" data-i18n="粘贴 Token">粘贴 Token</button>
     </div>
@@ -690,6 +697,24 @@
       <div class="box" id="scan-result"><div class="hint" data-i18n="点击「重新扫描」">点击「重新扫描」</div></div>
     </div>
 
+    <div class="pane" data-pane="sms">
+      <div class="hint" id="sms-hint" style="margin-bottom:10px">讯飞 Loomy 手机号直登：无需打开桌面客户端，输入手机号获取验证码，直接换取 14 天有效 Session 并自动存入账号库。</div>
+      <div class="field">
+        <label>手机号</label>
+        <div style="display:flex;gap:8px">
+          <input class="input" id="loomy-phone" placeholder="请输入 11 位手机号" maxlength="11">
+          <button class="btn" id="btn-loomy-sms" style="white-space:nowrap;width:120px">获取验证码</button>
+        </div>
+      </div>
+      <div class="field" id="loomy-code-field" style="display:none">
+        <label>短信验证码</label>
+        <input class="input" id="loomy-code" placeholder="请输入 6 位短信验证码" maxlength="6">
+      </div>
+      <div class="modal-actions" id="loomy-login-actions" style="display:none">
+        <button class="btn primary" id="btn-loomy-login">登录并导入</button>
+      </div>
+    </div>
+
     <div class="pane" data-pane="device">
       <div class="hint" id="dev-hint" style="margin-bottom:10px"></div>
       <div class="field">
@@ -711,7 +736,7 @@
     <div class="pane" data-pane="token">
       <div class="field">
         <label data-i18n="版本">版本</label>
-        <select class="input" id="f-provider"><option value="qoder">Qoder 国际版</option><option value="qoder-cn">Qoder 国内版</option><option value="workbuddy" data-i18n="WorkBuddy 国内版">WorkBuddy 国内版</option><option value="workbuddy-intl" data-i18n="WorkBuddy 国际版">WorkBuddy 国际版</option><option value="minimax">MiniMax</option></select>
+        <select class="input" id="f-provider"><option value="qoder">Qoder 国际版</option><option value="qoder-cn">Qoder 国内版</option><option value="workbuddy" data-i18n="WorkBuddy 国内版">WorkBuddy 国内版</option><option value="workbuddy-intl" data-i18n="WorkBuddy 国际版">WorkBuddy 国际版</option><option value="minimax">MiniMax</option><option value="loomy">讯飞 Loomy</option></select>
       </div>
       <div class="field"><label data-i18n="备注名（可选）">备注名（可选）</label><input class="input" id="f-name" placeholder="留空则自动读取昵称"></div>
       <div class="field"><label>Token</label><input class="input mono" id="f-token" placeholder="dt-… / jt-… 或 PAT（pt-…，自动兑换）"></div>
@@ -726,7 +751,7 @@
     <div class="modal-title"><span data-i18n="导出账号">导出账号</span><button class="close" data-close>✕</button></div>
     <div class="field">
       <label data-i18n="范围">范围</label>
-      <select class="input" id="ex-provider"><option value="" data-i18n="全部账号">全部账号</option><option value="p:qoder" data-i18n="Qoder（全部）">Qoder（全部）</option><option value="qoder" data-i18n="仅 Qoder 国际版">仅 Qoder 国际版</option><option value="qoder-cn" data-i18n="仅 Qoder 国内版">仅 Qoder 国内版</option><option value="p:workbuddy" data-i18n="WorkBuddy（全部）">WorkBuddy（全部）</option><option value="workbuddy" data-i18n="仅 WorkBuddy 国内版">仅 WorkBuddy 国内版</option><option value="workbuddy-intl" data-i18n="仅 WorkBuddy 国际版">仅 WorkBuddy 国际版</option><option value="zcode">ZCode</option><option value="p:mirasim">mirasim</option><option value="p:catpaw" data-i18n="妙手">妙手</option><option value="p:trae">Trae</option><option value="p:minimax">MiniMax</option></select>
+      <select class="input" id="ex-provider"><option value="" data-i18n="全部账号">全部账号</option><option value="p:qoder" data-i18n="Qoder（全部）">Qoder（全部）</option><option value="qoder" data-i18n="仅 Qoder 国际版">仅 Qoder 国际版</option><option value="qoder-cn" data-i18n="仅 Qoder 国内版">仅 Qoder 国内版</option><option value="p:workbuddy" data-i18n="WorkBuddy（全部）">WorkBuddy（全部）</option><option value="workbuddy" data-i18n="仅 WorkBuddy 国内版">仅 WorkBuddy 国内版</option><option value="workbuddy-intl" data-i18n="仅 WorkBuddy 国际版">仅 WorkBuddy 国际版</option><option value="zcode">ZCode</option><option value="p:mirasim">mirasim</option><option value="p:catpaw" data-i18n="妙手">妙手</option><option value="p:trae">Trae</option><option value="p:minimax">MiniMax</option><option value="p:loomy">Loomy</option></select>
     </div>
     <div class="field">
       <label data-i18n="加密口令（必填）">加密口令（必填）</label>
@@ -1033,7 +1058,7 @@ const I = {
 
 const $ = (id) => document.getElementById(id);
 const state = { accounts: [], quotas: {}, status: null, busy: {}, view: 'dash', region: '', addProduct: '', logTab: 'run', logLevel: 'all', locale: 'zh-CN' };
-const VIEWS = ['dash', 'qoder', 'workbuddy', 'zcode', 'mirasim', 'catpaw', 'trae', 'minimax', 'free', 'tenrouter'];
+const VIEWS = ['dash', 'qoder', 'workbuddy', 'zcode', 'mirasim', 'catpaw', 'trae', 'minimax', 'loomy', 'free', 'tenrouter'];
 // 10Router 集成：config 来自 /api/tenrouter，quotas 来自 /api/tenrouter/quotas
 const tr = { config: null, quotas: null, error: null, loading: false, syncing: false, accountsSyncing: false };
 const PRODUCTS = [
@@ -1044,6 +1069,7 @@ const PRODUCTS = [
   { id: 'catpaw', label: '妙手' },
   { id: 'trae', label: 'Trae' },
   { id: 'minimax', label: 'MiniMax' },
+  { id: 'loomy', label: 'Loomy' },
 ];
 const prodLabel = (id) => T((PRODUCTS.find((x) => x.id === id) || { label: id }).label);
 
@@ -1056,6 +1082,7 @@ const COMPONENTS = [
   { id: 'catpaw', label: '妙手' },
   { id: 'trae', label: 'Trae' },
   { id: 'minimax', label: 'MiniMax' },
+  { id: 'loomy', label: 'Loomy' },
   { id: 'free', label: '网页会话' },
   { id: 'tenrouter', label: '10Router' },
 ];
@@ -1182,12 +1209,13 @@ const PROV = {
   catpaw: { prod: 'catpaw', prodLabel: '妙手', region: '', cls: '' },
   trae: { prod: 'trae', prodLabel: 'Trae', region: '', cls: '' },
   minimax: { prod: 'minimax', prodLabel: 'MiniMax', region: '', cls: '' },
+  loomy: { prod: 'loomy', prodLabel: 'Loomy', region: '', cls: '' },
 };
 // 支持每日签到的产品（ZCode / mirasim / 妙手 额度靠套餐或滚动窗口发放，不做签到）
 const CHECKIN_PRODUCTS = new Set(['qoder', 'workbuddy', 'trae', 'minimax']);
-const CLIENT_LABEL = { qoder: 'Qoder', workbuddy: 'WorkBuddy', zcode: 'ZCode', mirasim: 'mirasim', catpaw: '妙手', trae: 'Trae', minimax: 'MiniMax' };
+const CLIENT_LABEL = { qoder: 'Qoder', workbuddy: 'WorkBuddy', zcode: 'ZCode', mirasim: 'mirasim', catpaw: '妙手', trae: 'Trae', minimax: 'MiniMax', loomy: 'Loomy' };
 // 额度单位为 Credits/时长而非「积分」口径的产品（不计入剩余积分合计）
-const CREDIT_VIEWS = new Set(['zcode', 'mirasim', 'catpaw']);
+const CREDIT_VIEWS = new Set(['zcode', 'mirasim', 'catpaw', 'loomy']);
 // 网关调用日志：tag → 所属产品页（无网关的产品不展示日志卡）
 const GW_LOG_TAG = { zcode: 'ZCODE-GW', minimax: 'MINIMAX-GW', trae: 'TRAE-GW' };
 const provOf = (p) => PROV[p] || { prod: 'qoder', prodLabel: p, region: '', cls: '' };
@@ -1260,6 +1288,21 @@ function promptKey(invalid) {
   }
   return keyPrompt;
 }
+// 自动适配反向代理/统一网关子路径（例如 fnOS 统一网关 /app/creditdaddy/）：
+// 当页面在子路径下渲染时，自动给 /api/* 等绝对路径补齐前缀，避免越过前缀直接请求根路径返回 404
+const apiPrefix = (() => {
+  const p = (typeof window !== 'undefined' && window.location && window.location.pathname) || '';
+  const dir = p.replace(/\/[^/]*\.[^/]+$/, '');
+  const clean = dir.replace(/\/+$/, '');
+  return clean && clean !== '/' ? clean : '';
+})();
+function resolveApiPath(url) {
+  if (typeof url !== 'string' || !url.startsWith('/')) return url;
+  if (apiPrefix && !url.startsWith(apiPrefix + '/')) {
+    return apiPrefix + url;
+  }
+  return url;
+}
 async function api(p, opts = {}, attempt = 0) {
   const o = Object.assign({}, opts, { headers: Object.assign({}, opts.headers, { 'x-qd-key': getKey() }) });
   if (opts.json !== undefined) {
@@ -1268,7 +1311,18 @@ async function api(p, opts = {}, attempt = 0) {
     o.body = JSON.stringify(opts.json);
   }
   delete o.json;
-  const res = await fetch(p, o);
+  // 挂钟超时：daemon 卡死 / 休眠唤醒后半开连接时 fetch 永不落定，30s 轮询链会无限堆积。
+  // 慢操作（全量签到、10R 推送/同步的同步长请求）用 opts.timeoutMs 放宽
+  const timeoutMs = Number(opts.timeoutMs) || 120_000;
+  let res;
+  try {
+    res = await fetch(resolveApiPath(p), { ...o, signal: opts.signal || AbortSignal.timeout(timeoutMs) });
+  } catch (e) {
+    if (e && (e.name === 'TimeoutError' || /timeout|timed out/i.test(e.message || ''))) {
+      throw new Error(T('请求超时') + '（' + Math.round(timeoutMs / 1000) + 's）: ' + p);
+    }
+    throw e;
+  }
   const data = await res.json().catch(() => ({}));
   // 密码缺失 / 不正确：弹框要密码，输入后自动重试这次请求（不再只报一句错误）
   if (res.status === 401 && data.code === 'PANEL_KEY' && attempt < 3) {
@@ -1699,6 +1753,7 @@ function cardHtml(a) {
     + (st.text ? '<span class="pill ' + st.cls + '" title="' + esc(a.lastResult ? fmtTime(a.lastResult.at) + ' ' + (a.lastResult.message || a.lastResult.status) : '') + '">' + esc(st.text) + '</span>' : '')
     + '</div><div class="ops">'
     + (a.product === 'zcode' ? T('<button class="icon-btn" data-act="claim" title="活动领取（billing/preview → claim，可能需过一次验证码）">') + I.gift + '</button>' : '')
+    + (a.product === 'loomy' ? T('<button class="icon-btn" data-act="invite" title="填写邀请码（绑定后 +5000 永久积分，每号仅一次）">') + I.gift + '</button>' : '')
     + (canCheckin && a.provider !== 'workbuddy-intl' ? '<button class="icon-btn' + (state.busy[a.id] ? ' busy' : '') + '" data-act="checkin" title="' + T('立即领取') + '">' + (state.busy[a.id] ? I.refresh : I.play) + '</button>' : '')
     + (a.qoderWebDead ? '<button class="icon-btn" data-act="webrenew" title="' + T('网页会话已失效——打开登录窗口重新授权，关闭窗口时自动补 cookie（API token 不受影响）') + '">' + I.swap + '</button>' : '')
     + (a.canSwitch && !isCurrent && st.cls !== 'fail' ? T('<button class="icon-btn" data-act="switch" title="切换 ') + (CLIENT_LABEL[a.product] ? T(CLIENT_LABEL[a.product]) : prodLabel(a.product)) + T(' 客户端到此账号">') + I.swap + '</button>' : '')
@@ -1763,6 +1818,8 @@ function isClientCurrent(a) {
   if (a.product === 'catpaw') return Boolean(a.uid && s.catpawCurrentUid && s.catpawCurrentUid === a.uid);
   if (a.product === 'trae') return Boolean(a.uid && s.traeCurrentUid && s.traeCurrentUid === a.uid);
   if (a.product === 'minimax') return Boolean(a.uid && s.minimaxCurrentUid && s.minimaxCurrentUid === a.uid);
+  // Loomy 按 uid 比对：publicAccount 不下发 token（面板侧 a.token 恒为空，按 token 比对徽章永远不亮）
+  if (a.product === 'loomy') return Boolean(a.uid && s.loomyCurrentUid && String(s.loomyCurrentUid) === String(a.uid));
   if (a.product === 'zcode') {
     const id = s.zcodeCurrentIdentity;
     return Boolean(id && ((a.uid && id.uid != null && String(id.uid) === String(a.uid)) || (a.email && id.email && id.email === a.email)));
@@ -1806,6 +1863,7 @@ const EMPTY_TIP = {
   catpaw: '还没有妙手账号。<br>点「添加账号」可读取本机妙手（美团 CatPaw）客户端当前登录的账号（本地解密凭据，token 不出本机）。',
   trae: '还没有 Trae 账号。<br>点「添加账号 → 本机导入」可读取本机 Trae 客户端当前登录的账号（本地解密 storage.json 凭据，token 不出本机）。多个账号需先在 Trae 里分别登录并逐个导入。',
   minimax: '还没有 MiniMax 账号。<br>点「添加账号 → 本机导入」可读取本机 MiniMax Code 客户端当前登录的账号，或用浏览器登录 / 粘贴 Bearer Token 添加。',
+  loomy: '还没有 Loomy 账号。<br>点「添加账号 → 本机导入」可读取本机 Loomy 客户端当前登录的账号（Token 有效期约 14 天，免客户端运行），支持多账号保存切换，并可一键同步给 10Router 网关。',
 };
 
 function renderProd() {
@@ -1838,7 +1896,8 @@ function renderProd() {
   document.querySelectorAll('#region button').forEach((x) => x.classList.toggle('active', x.dataset.r === state.region));
   $('btn-checkin').style.display = canCheckin ? '' : 'none';
   if (!$('btn-checkin').disabled) {
-    $('btn-checkin').innerHTML = I.play + T('领取全部 ') + prodLabel(prod);
+    // 已在对应产品页内，不再重复品牌名（如「领取全部 WorkBuddy」）——直接「领取全部」
+    $('btn-checkin').innerHTML = I.play + T('领取全部');
   }
   // 顶栏产品专属入口：ZCode 设置组、Trae 打开客户端，带状态灯（运行中绿点呼吸）
   const dot = (on, pulse) => '<span class="dot' + (on ? ' on' : '') + (on && pulse ? ' pulse' : '') + '"></span>';
@@ -1884,6 +1943,16 @@ function renderProd() {
       $('mt-open').title = mc.running ? T('MiniMax Code 客户端运行中，点我唤到前台') : T('MiniMax Code 客户端未运行，点我启动');
     }
   }
+  $('l-actions').style.display = prod === 'loomy' ? 'contents' : 'none';
+  if (prod === 'loomy') {
+    const lc = (state.status && state.status.loomyClient) || {};
+    const canOpen = lc.installed && window.creditdaddy && typeof window.creditdaddy.openLoomyClient === 'function';
+    $('lt-open').style.display = canOpen ? '' : 'none';
+    if (canOpen) {
+      $('lt-open').innerHTML = dot(lc.running === true, true) + T('打开客户端');
+      $('lt-open').title = lc.running ? T('Loomy 客户端运行中，点我唤到前台') : T('Loomy 客户端未运行，点我启动');
+    }
+  }
   // WorkBuddy 临时活动（额外补偿 / 首月赠礼）批量领取入口——用已存凭据，免逐个网页点击
   $('w-actions').style.display = prod === 'workbuddy' ? 'contents' : 'none';
   if (prod === 'workbuddy') {
@@ -1956,6 +2025,18 @@ function renderDash() {
       const credits = withPlan.reduce((s, a) => s + (Number(state.quotas[a.id].remaining) || 0), 0);
       rows = T('<span class="lbl">额度体系</span><span class="val dim">Credits 余额 + 套餐版本</span>')
         + (withPlan.length ? T('<span class="lbl">可用额度</span><span class="val">') + fmtNum(credits) + T(' Credits（') + esc(withPlan.map((a) => state.quotas[a.id].plan).join(' / ')) + T('）</span>') : '');
+    } else if (p.id === 'loomy') {
+      // 积分口径产品：聚合各账号剩余积分（永久 + 每日）；没有签到语义的行
+      const planned = list.filter((a) => { const q = state.quotas[a.id]; return q && !q.error && !q.empty; }).length;
+      let sum = 0, known = 0;
+      for (const a of list) {
+        const q = state.quotas[a.id];
+        if (!q || q.error || q.empty) continue;
+        known++;
+        sum += Number(q.remaining) || 0;
+      }
+      rows = T('<span class="lbl">积分合计</span><span class="val">') + (known ? fmtNum(sum) : '-') + '</span>'
+        + T('<span class="lbl">有效套餐</span><span class="val">') + planned + ' / ' + list.length + '</span>';
     } else {
       const planned = list.filter((a) => { const q = state.quotas[a.id]; return q && !q.error && !q.empty; }).length;
       // ZCode 没有每日签到：不展示签到语义的行
@@ -2057,8 +2138,12 @@ function renderStatus() {
   // 产品相关提示只在对应标签页出现
   const hasIntl = state.view === 'qoder' && state.region !== 'cn' && state.accounts.some((a) => a.provider === 'qoder');
   const n = $('notice');
-  n.classList.toggle('info', state.view === 'zcode' || state.view === 'mirasim' || state.view === 'catpaw' || state.view === 'trae' || state.view === 'minimax' || (state.view === 'workbuddy' && s.workbuddyClient && s.workbuddyClient.installed === false) || (hasIntl && Boolean(s.riskIdentity)));
-  if (state.view === 'minimax') {
+  n.classList.toggle('info', state.view === 'zcode' || state.view === 'mirasim' || state.view === 'catpaw' || state.view === 'trae' || state.view === 'minimax' || state.view === 'loomy' || (state.view === 'workbuddy' && s.workbuddyClient && s.workbuddyClient.installed === false) || (hasIntl && Boolean(s.riskIdentity)));
+  if (state.view === 'loomy') {
+    n.style.display = '';
+    n.innerHTML = T('<div class="z-row"><span class="z-label">本机凭据</span><span class="z-text">由本机 Loomy 客户端读取导入，约 14 天有效；支持多账号切换，可一键同步 10Router。</span></div>')
+      + loomyClientChip(s);
+  } else if (state.view === 'minimax') {
     n.style.display = '';
     n.innerHTML = T('<div class="z-row"><span class="z-label">每日签到</span><span class="z-text">每日签到领 800~2000 积分 + 400 连签加成。支持自动检测本机 MiniMax Code 凭据与 Bearer Token 导入，自带标准 Anthropic 本地网关。</span></div>');
   } else if (state.view === 'trae') {
@@ -2123,6 +2208,13 @@ function catpawClientChip(s) {
     + (canOpen ? T(' <button class="btn" id="btn-cpopen" style="margin-left:4px" title="打开本机妙手客户端">打开客户端</button>') : '');
 }
 
+// Loomy 客户端状态芯片
+function loomyClientChip(s) {
+  const c = s.loomyClient || {};
+  if (!c.installed) return T(' <span class="dim">客户端：未安装（本机导入 / 切换需要 Windows Loomy 客户端）</span>');
+  return T(' <span class="dim">客户端：') + (c.running ? T('运行中') : T('未运行')) + (c.signedIn ? '' : T(' · 未登录')) + '</span>';
+}
+
 // Qoder 设备身份组件（Linux / fnOS）
 const umidOffer = (s) => Boolean(s && s.umid && s.umid.supported && !s.umid.installed);
 let umidBusy = false;
@@ -2186,6 +2278,14 @@ document.addEventListener('click', async (e) => {
     } catch (err) { toast(String(err && err.message || err), false); }
     return;
   }
+  if (e.target.closest('#lt-open')) {
+    try {
+      const r = await window.creditdaddy.openLoomyClient();
+      if (r && r.ok) toast(T('已启动 Loomy 客户端'));
+      else toast((r && r.error) || T('无法打开 Loomy 客户端'), false);
+    } catch (err) { toast(String(err && err.message || err), false); }
+    return;
+  }
   if (e.target.closest('#tt-open')) {
     try {
       const r = await window.creditdaddy.openTraeClient();
@@ -2648,6 +2748,9 @@ function renderFreePool() {
     const clearBtn = canCapture
       ? ' <button class="btn" data-clear-session="' + esc(site.id) + '" title="' + T('抹掉本机为该站点留存的登录会话（下次捕获需要重新登录）') + '">' + T('清除已存会话') + '</button>'
       : '';
+    // 站点级红字警示（site.warnHtml，站点配置声明、此处统一渲染）：
+    // 用于「接入该站点有工具之外的代价」这类必须前置告知的情况（如注册新号可能被电话推广）
+    const warn = site.warnHtml ? '<div style="margin:2px 0 6px;font-size:12px;font-weight:600;color:var(--danger,#e5484d)">' + site.warnHtml + '</div>' : '';
     const hint = site.hint ? '<div class="hint" style="margin:2px 0 6px">' + esc(T(site.hint)) + '</div>' : '';
 
     const fmtBalanceText = (acc) => {
@@ -2757,20 +2860,8 @@ function renderFreePool() {
       + accRows
       + '</div>';
   }).join('');
-  bindCardDrag(body, {
-    kind: 'free-site',
-    onReorder: (drag, targetId) => {
-      if (!drag.id) return;
-      const ids = state.freeOrder.slice();
-      const from = ids.indexOf(drag.id);
-      if (from >= 0) ids.splice(from, 1);
-      const ti = ids.indexOf(targetId);
-      ids.splice(ti < 0 ? ids.length : ti, 0, drag.id);
-      state.freeOrder = ids;
-      saveFreeOrder();
-      renderFreePool();
-    },
-  });
+  // 拖拽绑定已上移到启动区（bindCardDrag($('free-pool-body'))）：容器元素持久、
+  // onReorder 闭包在触发时才读 state，渲染函数里重复绑定只会让监听器越积越多
 }
 
 function renderCookieSites() {
@@ -2788,6 +2879,7 @@ function renderCookieSites() {
     const btn = canCapture
       ? '<button class="btn" data-capture-site="' + esc(site.id) + '">' + T('网页版') + '</button>'
       : T('<button class="btn" disabled title="需要桌面版 CreditDaddy(无痕登录窗)">网页版</button>');
+    const warn = site.warnHtml ? '<div style="font-size:12px;font-weight:600;color:var(--danger,#e5484d)">' + site.warnHtml + '</div>' : '';
     const hint = site.hint ? T('<div class="hint">') + esc(site.hint) + '</div>' : '';
     const accRows = rows.map((acc) =>
       '<div style="display:flex;align-items:center;justify-content:space-between;gap:10px;font-size:12px">'
@@ -2796,7 +2888,7 @@ function renderCookieSites() {
     return '<div style="border:1px solid var(--border-subtle);border-radius:10px;padding:10px 12px;display:grid;gap:6px">'
       + '<div style="display:flex;align-items:center;justify-content:space-between;gap:10px">'
       + '<span><b>' + esc(site.label || site.name) + '</b> · ' + stateTxt + '</span>' + btn + '</div>'
-      + hint + accRows + '</div>';
+      + warn + hint + accRows + '</div>';
   }).join('');
 }
 /**
@@ -2821,6 +2913,7 @@ const AM_CHANNELS = [
   { provider: 'qoder-cn', label: 'Qoder 国内版', syncable: true },
   { provider: 'workbuddy', label: 'WorkBuddy 国内版', syncable: true },
   { provider: 'workbuddy-intl', label: 'WorkBuddy 国际版', syncable: true },
+  { provider: 'loomy', label: '讯飞 Loomy', syncable: true },
 ];
 
 function openTrAccountManage() {
@@ -2891,7 +2984,7 @@ async function trSyncAccountsFromModal() {
   tr.accountsSyncing = true;
   renderTenrouter();
   try {
-    const r = await api('/api/tenrouter/sync-accounts', { method: 'POST', json: pw ? { adminPassword: pw } : {} });
+    const r = await api('/api/tenrouter/sync-accounts', { method: 'POST', json: pw ? { adminPassword: pw } : {}, timeoutMs: 300_000 });
     msg.textContent = r.summary || '';
     toast(r.summary, !/失败/.test(r.summary || ''));
     if (pw) { await loadTrConfig(); $('am-pw').value = ''; }
@@ -2947,13 +3040,14 @@ $('btn-free-sync-10r')?.addEventListener('click', async () => {
   if (!(tr.config && tr.config.configured)) return toast(T('请先保存 10Router 设置'), false);
   btn.disabled = true;
   try {
-    // 先推账号连接（原 trSyncAccounts 的职责），失败不阻断额度卡推送
-    const sa = await api('/api/tenrouter/sync-accounts', { method: 'POST', json: {} }).catch((e) => ({ summary: e.message, error: true }));
-    if (sa && sa.summary) toast(sa.summary, !sa.error && !/失败/.test(sa.summary));
-    const r = await api('/api/tenrouter/push-quota', { method: 'POST' });
+    // 只推网页会话渠道的额度卡（webSessionOnly）——账号连接同步不在这里做：那是
+    // 10Router 页「账号管理」弹窗的职责（还带渠道开关）；本机凭据线（如 minimax-free）
+    // 也不搭车，本页的「同步」语义就只管网页会话卡。
+    const r = await api('/api/tenrouter/push-quota', { method: 'POST', json: { webSessionOnly: true }, timeoutMs: 300_000 });
     const failed = (r.results || []).filter((x) => x.status === 'failed');
     if (failed.length) toast(T('额度卡部分推送失败：') + failed.map((x) => x.source + '（' + x.error + '）').join('；'), false);
     else if ((r.results || []).length) toast(T('额度卡已推送到 10Router 配额页'), true);
+    else toast(T('没有可推送的额度卡（网页会话账号为空或推送开关已关闭）'), false);
   } catch (e) { toast(e.message, false); }
   btn.disabled = false;
 });
@@ -2991,7 +3085,8 @@ $('free-settings-push-now')?.addEventListener('click', async () => {
   const btn = $('free-settings-push-now');
   btn.disabled = true;
   try {
-    const r = await api('/api/tenrouter/push-quota', { method: 'POST' });
+    // 与本页「同步到 10Router」同口径：只推网页会话渠道的额度卡
+    const r = await api('/api/tenrouter/push-quota', { method: 'POST', json: { webSessionOnly: true }, timeoutMs: 300_000 });
     const failed = (r.results || []).filter((x) => x.status === 'failed');
     if (failed.length) toast(T('额度卡部分推送失败：') + failed.map((x) => x.source + '（' + x.error + '）').join('；'), false);
     else if ((r.results || []).length) toast(T('额度卡已推送到 10Router 配额页'), true);
@@ -3066,6 +3161,21 @@ if (window.creditdaddy && typeof window.creditdaddy.onCookieCaptured === 'functi
       });
   });
 }
+// Qoder 网页会话收割绑定完成（桌面壳在收割上报返回 bound>0 时推送）：
+// 「缺网页会话」徽章即时消失，并按**手动刷新同款口径**重查额度（live 真探上游
+// 重拉逐资源包明细）——网页会话刚绑定，缓存快照里还是旧数据/无明细，只把徽章
+// 藏掉等于没修。此前靠登录成功后的 12s/30s setTimeout 猜收割时机（收割在登录窗
+// 关闭后才走，时机不稳），猜错徽章挂到 30s 周期轮、明细要等手动刷新才出来。
+// 网页面板（npm/CLI 场景无 preload）收不到事件，仍由周期轮兜底。
+if (window.creditdaddy && typeof window.creditdaddy.onQoderWebSessionBound === 'function') {
+  window.creditdaddy.onQoderWebSessionBound(() => {
+    refreshAccountList().then(() => {
+      const qids = (state.accounts || []).filter((a) => String(a.provider).startsWith('qoder')).map((a) => a.id);
+      if (qids.length) loadQuotas(qids, { live: true }).then(render);
+      else render();
+    });
+  });
+}
 
 function renderTenrouter() {
   const box = $('tr-panel');
@@ -3170,7 +3280,7 @@ async function loadTrQuotas(force) {
 }
 async function trSync() {
   tr.syncing = true; render();
-  try { const r = await api('/api/tenrouter/sync', { method: 'POST' }); toast(r.summary, !r.results.some((x) => x.status === 'failed')); }
+  try { const r = await api('/api/tenrouter/sync', { method: 'POST', timeoutMs: 300_000 }); toast(r.summary, !r.results.some((x) => x.status === 'failed')); }
   catch (e) { toast(e.message, false); }
   tr.syncing = false;
   await loadTrConfig(); loadLogs();
@@ -3282,22 +3392,23 @@ $('tr-disconnect').onclick = trDisconnect;
 // ── 数据加载 ──
 async function loadStatus() {
   try { state.status = await api('/api/status'); renderStatus(); } catch (e) {}
-  syncAfterZcodeClaims();
+  await syncAfterZcodeClaims();
 }
 // 后台自动领取成功后，立即刷新这些账号的额度与卡片（不必等 2 分钟一轮的余额刷新）
 let seenZcodeTickAt = null;
 async function syncAfterZcodeClaims() {
   const z = state.status && state.status.scheduler && state.status.scheduler.zcode;
   const t = z && z.lastTick;
-  if (!t || t.at === seenZcodeTickAt) return;
-  const first = seenZcodeTickAt === null;
+  if (!t || !t.at || t.at === seenZcodeTickAt) return;
+  const isInit = seenZcodeTickAt === null;
   seenZcodeTickAt = t.at;
-  if (first || !(t.claimedIds && t.claimedIds.length)) return;   // 首次加载已全量拉取
+  // 避免首屏重复重刷：只有当进入页面时该轮领取已是 2 分钟前的陈旧历史才跳过（首屏 boot 已有全量覆盖）；
+  // 若是刚发生不久的领取，无论是否初次判定都必须立即刷新！
+  if (isInit && (Date.now() - new Date(t.at).getTime() > 120_000)) return;
+  if (!t.claimedIds || !t.claimedIds.length) return;
   try { state.accounts = (await api('/api/accounts')).accounts; } catch (e) {}
-  await loadQuotas(t.claimedIds);
-  // 额度拿到后必须重绘：ZCode 活动发的额度常带 effective_at（如 23:00 到账），
-  // 卡片从「无有效套餐」变成「待生效 N Token · HH:MM 到账」，不重绘就一直停在旧样子，
-  // 用户以为「领取成功了却不显示」——只能自己手动点刷新。
+  // 必须带 live: true，与手动点击「刷新积分」动作完全一致，真探上游重算待生效活动权益
+  await loadQuotas(t.claimedIds, { live: true });
   render();
   renderStatus();
   loadZGateway();
@@ -3326,9 +3437,10 @@ async function loadQuotas(ids, opts) {
   const worker = async () => {
     while (queue.length && run === quotaRun) {
       const id = queue.shift();
-      try { state.quotas[id] = (await api('/api/accounts/' + encodeURIComponent(id) + '/quota' + (live ? '?live=1' : ''))).quota; }
-      catch (e) { state.quotas[id] = { error: e.message }; }
-      render();
+      const runAtFetch = run;   // fetch 期间可能有新一轮 loadQuotas 进来（如卡片点「刷新」走 live）
+      try { if (runAtFetch === quotaRun) state.quotas[id] = (await api('/api/accounts/' + encodeURIComponent(id) + '/quota' + (live ? '?live=1' : ''))).quota; }
+      catch (e) { if (runAtFetch === quotaRun) state.quotas[id] = { error: e.message }; }
+      if (runAtFetch === quotaRun) render();
     }
   };
   await Promise.all([worker(), worker(), worker()]);
@@ -3421,7 +3533,7 @@ async function checkinAll(btn, product) {
   const label = btn.innerHTML;
   btn.disabled = true; btn.innerHTML = I.refresh + T('领取中…');
   try {
-    const d = await api('/api/checkin', { json: { skipIfCheckedToday: false, product } });
+    const d = await api('/api/checkin', { json: { skipIfCheckedToday: false, product }, timeoutMs: 600_000 });
     toast(d.summary);
   } catch (e) { toast(e.message, false); }
   btn.disabled = false; btn.innerHTML = label;
@@ -3432,7 +3544,7 @@ async function claimWbActivities(btn) {
   const label = btn.innerHTML;
   btn.disabled = true; btn.innerHTML = I.refresh + T('领取中…');
   try {
-    const d = await api('/api/workbuddy/claim-activities', { method: 'POST', json: {} });
+    const d = await api('/api/workbuddy/claim-activities', { method: 'POST', json: {}, timeoutMs: 300_000 });
     const s = d.summary || {};
     const claimed = (d.results || []).flatMap((r) => r.claimed || []).filter((x) => x.status === 'checked-in');
     const amount = claimed.reduce((sum, x) => sum + (Number(x.claimedAmount) || 0), 0);
@@ -3443,6 +3555,22 @@ async function claimWbActivities(btn) {
   btn.disabled = false; btn.innerHTML = label;
   await loadStatus(); await loadAccounts(); loadLogs();
 }
+async function loomyInvite(id) {
+  const a = state.accounts.find((x) => x.id === id);
+  if (!a) return;
+  const code = await uiPrompt(T('为 {name} 填写邀请码', { name: a.name || id }), '', {
+    placeholder: T('输入邀请码，如 8YZCH5（绑定后 +5000 永久积分，每号仅一次）'),
+    okText: T('绑定'),
+  });
+  const clean = String(code || '').trim();
+  if (!clean) return;
+  try {
+    const r = await api('/api/accounts/' + encodeURIComponent(id) + '/loomy/invite', { json: { code: clean } });
+    const act = r && r.activation;
+    toast(act && act.activated ? T('邀请码已绑定:{code}', { code: act.appliedInvitationCode || clean }) : T('邀请码已提交'), true);
+    loadQuotas([id], { live: true }).then(render);   // 绑定后永久积分 +5000，立即刷新卡片
+  } catch (e) { toast(e.message, false); }
+}
 async function onCardClick(e) {
   const btn = e.target.closest('[data-act]');
   if (!btn) return;
@@ -3460,6 +3588,7 @@ async function onCardClick(e) {
     return deviceLogin();
   }
   if (act === 'quota') { loadQuotas([id], { live: true }).then(render); return; }
+  if (act === 'invite') return loomyInvite(id);
   if (act === 'claim') return openClaim(id);
   if (act === 'switch') {
     const a = state.accounts.find((x) => x.id === id);
@@ -3475,7 +3604,9 @@ async function onCardClick(e) {
         ? T('\n需先退出 Mirasim；切换后重新打开即为新账号。当前登录会先保存到 CreditDaddy，不会丢号。')
         : a && a.product === 'catpaw'
           ? T('\n需先退出妙手；切换后重新打开妙手即为新账号。当前登录会先保存到 CreditDaddy，不会丢号。')
-          : a && a.product === 'trae'
+          : a && a.product === 'loomy'
+            ? T('\n切换会先关闭并重新打开 Loomy 客户端。注意：客户端界面的登录态存在其内部存储，若重开后仍显示旧账号，需在客户端内「退出登录」后重新登录。')
+            : a && a.product === 'trae'
             ? T('\n需先退出 Trae；切换后重新打开 Trae 即为新账号。当前登录会先自动快照保存到 CreditDaddy，不会丢号。')
             : a && a.product === 'qoder'
               ? T('\n需先退出 Qoder；切换后重新打开 Qoder 即为新账号。运行中的 Qoder 退出时会把旧登录写回去，可选「关闭并强制切换」代为关进程。')
@@ -3486,7 +3617,7 @@ async function onCardClick(e) {
       let r;
       try { r = await doSwitch(false); }
       catch (err) {
-        if (err.code !== 'ZCODE_RUNNING' && err.code !== 'MIRASIM_RUNNING' && err.code !== 'CATPAW_RUNNING' && err.code !== 'TRAE_RUNNING' && err.code !== 'QODER_RUNNING') throw err;
+        if (err.code !== 'ZCODE_RUNNING' && err.code !== 'MIRASIM_RUNNING' && err.code !== 'CATPAW_RUNNING' && err.code !== 'TRAE_RUNNING' && err.code !== 'QODER_RUNNING' && err.code !== 'LOOMY_RUNNING') throw err;
         if (!(await uiConfirm(err.message + T('\n\n仍要强制切换吗？强制切换会先关闭客户端再写入登录，重新打开客户端即为新账号。'), client + T(' 正在运行'), T('关闭并强制切换')))) return;
         r = await doSwitch(true);
       }
@@ -3538,6 +3669,17 @@ async function onCardClick(e) {
           } catch (e) {}
         }, 800);
       }
+      if (a && a.product === 'loomy' && r && !r.alreadyActive && window.creditdaddy && typeof window.creditdaddy.openLoomyClient === 'function') {
+        // 只要真切换了就自动拉起客户端（此前只在客户端原本运行时才拉，客户端没跑时切完毫无动静）
+        setTimeout(async () => {
+          try {
+            const re = await window.creditdaddy.openLoomyClient();
+            if (re && re.ok) {
+              toast(T('已重新打开 Loomy 客户端。注意：Loomy 的界面登录态存在客户端内部存储——若仍显示旧账号，请在客户端「退出登录」后重新登录目标账号'), false);
+            } else toast((re && re.error) || T('无法打开 Loomy 客户端（桌面版才能自动拉起）'), false);
+          } catch (e) {}
+        }, 800);
+      }
     } catch (err) { toast(err.message, false); }
     return;
   }
@@ -3636,7 +3778,34 @@ async function openClaim(id) {
 
 function renderClaimBody() {
   if (!claimState.plans.length) {
-    $('claim-body').innerHTML = T('<div class="muted-empty">当前没有可领取的活动</div>');
+    $('claim-body').innerHTML = T('<div class="muted-empty">当前没有可领取的活动</div>')
+      + '<div class="row" style="margin-top:10px;justify-content:flex-end"><button class="btn" id="btn-claim-known">' + T('尝试已知活动') + '</button><span class="hint" id="claim-known-msg"></span></div>';
+    $('btn-claim-known')?.addEventListener('click', async () => {
+      const btn = $('btn-claim-known');
+      const msg = $('claim-known-msg');
+      btn.disabled = true;
+      btn.textContent = T('尝试中…');
+      try {
+        const r = await api('/api/accounts/' + encodeURIComponent(claimState.accountId) + '/zcode/claim-known', { method: 'POST', json: {}, timeoutMs: 60_000 });
+        const bits = [];
+        if (r.claimed.length) bits.push(T('领取成功：') + r.claimed.join(T('、')));
+        if (r.already.length) bits.push(T('已领过：') + r.already.join(T('、')));
+        if (r.skipped.length) bits.push(T('暂不可领：') + r.skipped.length + T(' 个'));
+        msg.textContent = bits.join(T('；')) || T('没有可领取的活动');
+        if (r.claimed.length) {
+          toast(T('已领取：') + r.claimed.join(T('、')), true);
+          closeModal('m-claim');
+          await loadStatus();
+          await loadAccounts();
+          await loadQuotas([claimState.accountId], { live: true });
+          render();
+        }
+      } catch (e) {
+        msg.textContent = e.message;
+      }
+      btn.disabled = false;
+      btn.textContent = T('尝试已知活动');
+    });
     return;
   }
   $('claim-body').innerHTML = claimState.plans.map((pl, i) =>
@@ -3797,7 +3966,7 @@ async function restartCreditDaddy() {
   const poll = setInterval(async () => {
     attempts++;
     try {
-      const res = await fetch('/api/status', { cache: 'no-store' });
+      const res = await fetch(resolveApiPath('/api/status'), { cache: 'no-store' });
       if (res.ok) {
         clearInterval(poll);
         location.reload();
@@ -4066,11 +4235,18 @@ const LOCAL_HINT = {
   catpaw: '读取本机妙手（美团 CatPaw）客户端当前登录的账号（本地解密 %APPDATA%\\catpaw-moon\\catx-credential.json），token 不出本机。',
   trae: '读取本机 Trae 客户端当前登录的账号（本地解密 <客户端数据目录>\\User\\globalStorage\\storage.json 的 tc 信封），token 不出本机。',
   minimax: '读取本机 MiniMax Code 客户端当前登录的账号（~/.minimax/auth/.../auth.json），token 不出本机。',
+  loomy: '读取本机 Loomy 客户端当前登录的账号（自动读取 Windows 本机 Public\\Loomy 用户凭据），Session 有效期约 14 天，支持一键同步至 10Router。',
 };
 function openAdd(product) {
   state.addProduct = product || '';
-  // 各产品支持的添加方式：MiniMax 三种都支持（浏览器登录 = 官方设备码授权，独立凭据链不与本机客户端互斥）
-  const tabShown = { local: true, device: product !== 'mirasim' && product !== 'catpaw' && product !== 'trae', token: product !== 'zcode' && product !== 'mirasim' && product !== 'catpaw' && product !== 'trae' };
+  const isLoomy = product === 'loomy';
+  // 各产品支持的添加方式
+  const tabShown = {
+    local: true,
+    device: product !== 'mirasim' && product !== 'catpaw' && product !== 'trae' && product !== 'loomy',
+    token: product !== 'zcode' && product !== 'mirasim' && product !== 'catpaw' && product !== 'trae',
+    sms: isLoomy || !product,
+  };
   document.querySelectorAll('#m-add .tab').forEach((t) => { t.style.display = tabShown[t.dataset.tab] ? '' : 'none'; });
   $('local-hint').textContent = T(LOCAL_HINT[state.addProduct]);
   let first = null;
@@ -4091,8 +4267,8 @@ function openAdd(product) {
   $('dev-hint').textContent = (hasIncognito() ? T('在内置隐私窗口里登录（不带出系统浏览器已登录的账号），') : T('在浏览器里登录并授权，'))
     + T('完成后账号自动添加。') + (product === 'qoder' ? '' : T('WorkBuddy / ZCode 用浏览器登录的账号同样可以一键切换客户端。'));
   openModal('m-add');
-  switchTab('local');
-  localScan();
+  switchTab(isLoomy ? 'sms' : 'local');
+  if (!isLoomy) localScan();
 }
 
 // 本机导入
@@ -4170,10 +4346,12 @@ async function deviceLogin() {
     pollDevice(flow.sessionId, 0, ++devGen);
   } catch (e) { toast(T('发起授权失败：') + e.message, false); }
 }
+let pollFails = 0;   // 连续轮询失败计数（成功清零；连续 5 次才终止登录流程）
 async function pollDevice(sessionId, n, gen) {
   if (gen !== devGen) return;
   try {
     const r = await api('/api/auth/device/poll', { json: { sessionId } });
+    pollFails = 0;
     if (gen !== devGen) return;
     if (r.status === 'pending') {
       if (n > 450) return deviceStop(T('授权超时，请重试'));
@@ -4184,8 +4362,9 @@ async function pollDevice(sessionId, n, gen) {
       toast(r.already ? T('已更新「') + (r.account.name || r.account.id) + T('」的登录凭据') : T('已添加：') + (r.account.name || r.account.id));
       if (r.account.id) delete state.quotas[r.account.id];   // 旧 token 的积分查询结果（可能是失败）作废，马上重查
       await loadStatus(); await loadAccounts();
-      // 网页会话 Cookie 是登录窗「关闭」时才收割绑定的（比这里的成功提示晚好几秒）——
-      // 补两轮轻量刷新，「缺网页会话」徽章随绑定落地即时消失，不必等 30s 周期轮。
+      // 网页会话 Cookie 在登录窗「关闭」后才收割绑定（晚于本提示数秒且时机不稳）——
+      // 到位时桌面壳推 qoder-web-session:bound 事件刷新（onQoderWebSessionBound），
+      // 这里只保留两轮轻量补拉兜住非桌面场景（网页面板无 preload 收不到事件）。
       setTimeout(refreshAccountList, 12000);
       setTimeout(refreshAccountList, 30000);
     } else if (r.status === 'expired') {
@@ -4193,10 +4372,19 @@ async function pollDevice(sessionId, n, gen) {
     } else {
       deviceStop(T('授权失败：') + (r.error || r.status));
     }
-  } catch (e) { if (gen === devGen) deviceStop(T('轮询异常：') + e.message); }
+  } catch (e) {
+    // 单次轮询失败（daemon 忙时瞬时 502/超时）不该终止整个登录：服务端会话仍然有效，
+    // 下一个 2s tick 就可能成功。连续多次失败才放弃（上限 5 次 ≈ 10s+超时重试）。
+    if (gen !== devGen) return;
+    pollFails++;
+    if (pollFails >= 5) { pollFails = 0; return deviceStop(T('轮询异常：') + e.message); }
+    $('dev-status').textContent = T('轮询异常，正在重试…（') + pollFails + '/5）';
+    devTimer = setTimeout(() => pollDevice(sessionId, n + 1, gen), 2000);
+  }
 }
 function deviceStop(msg) {
   devGen++;
+  pollFails = 0;
   if (devTimer) { clearTimeout(devTimer); devTimer = null; }
   $('dev-cancel').style.display = 'none';
   if (msg) $('dev-status').textContent = msg;
@@ -4217,6 +4405,75 @@ async function addToken() {
   b.disabled = false;
 }
 
+// ── 讯飞 Loomy 手机号直登 ──
+let loomyMsgId = '';
+let loomyCountdown = 0;
+let loomyTimer = null;
+
+$('btn-loomy-sms').addEventListener('click', async () => {
+  const phone = $('loomy-phone').value.trim();
+  if (!/^1[3-9]\d{9}$/.test(phone)) {
+    return toast(T('请输入正确的 11 位手机号'), false);
+  }
+  const btn = $('btn-loomy-sms');
+  btn.disabled = true;
+  btn.textContent = T('发送中…');
+  try {
+    const r = await api('/api/loomy/sms/send', { json: { phone }, timeoutMs: 45_000 });
+    loomyMsgId = r.msgid;
+    toast(T('验证码已发送至手机，请查收短信'));
+    $('loomy-code-field').style.display = '';
+    $('loomy-login-actions').style.display = '';
+    loomyCountdown = 60;
+    btn.textContent = '60s';
+    if (loomyTimer) clearInterval(loomyTimer);
+    loomyTimer = setInterval(() => {
+      loomyCountdown--;
+      if (loomyCountdown <= 0) {
+        clearInterval(loomyTimer);
+        loomyTimer = null;
+        btn.disabled = false;
+        btn.textContent = T('重新获取');
+      } else {
+        btn.textContent = `${loomyCountdown}s`;
+      }
+    }, 1000);
+  } catch (e) {
+    btn.disabled = false;
+    btn.textContent = T('获取验证码');
+    toast(e.message, false);
+  }
+});
+
+$('btn-loomy-login').addEventListener('click', async () => {
+  const phone = $('loomy-phone').value.trim();
+  const code = $('loomy-code').value.trim();
+  if (!phone || !code || !loomyMsgId) {
+    return toast(T('请输入手机号并完成验证码验证'), false);
+  }
+  const btn = $('btn-loomy-login');
+  btn.disabled = true;
+  btn.textContent = T('登录中…');
+  try {
+    const r = await api('/api/loomy/sms/login', { json: { phone, code, msgid: loomyMsgId }, timeoutMs: 45_000 });
+    toast(r.duplicate ? T('账号已存在，登录凭据已更新') : T('Loomy 账号登录成功！已存入账号库'));
+    closeModal('m-add');
+    $('loomy-phone').value = '';
+    $('loomy-code').value = '';
+    $('loomy-code-field').style.display = 'none';
+    $('loomy-login-actions').style.display = 'none';
+    if (loomyTimer) { clearInterval(loomyTimer); loomyTimer = null; }
+    $('btn-loomy-sms').disabled = false;
+    $('btn-loomy-sms').textContent = T('获取验证码');
+    await loadAccounts();
+    render();
+  } catch (e) {
+    btn.disabled = false;
+    btn.textContent = T('登录并导入');
+    toast(e.message, false);
+  }
+});
+
 // Qoder 卡片徽章：网页会话（Cookie）缺失或超 7 天时点名提醒——
 // 10Router 的「套餐内 Credits」逐资源包明细依赖它（同 qoderWebSessionNote 口径）。
 // 正常状态不出徽章，只在需要「浏览器登录」补 cookie 时出橙色警示，避免噪音。
@@ -4422,6 +4679,22 @@ bindCardDrag($('tr-panel'), {
     renderTenrouter();
   },
 });
+// 免费额度页站点卡拖拽：与其他两处一样只在启动时绑一次。此前在 renderFreePool 里绑定，
+// 而 render() 每次刷新都调它——监听器按渲染次数无限累积，一次 drop 触发 N 次重排
+bindCardDrag($('free-pool-body'), {
+  kind: 'free-site',
+  onReorder: (drag, targetId) => {
+    if (!drag.id) return;
+    const ids = state.freeOrder.slice();
+    const from = ids.indexOf(drag.id);
+    if (from >= 0) ids.splice(from, 1);
+    const ti = ids.indexOf(targetId);
+    ids.splice(ti < 0 ? ids.length : ti, 0, drag.id);
+    state.freeOrder = ids;
+    saveFreeOrder();
+    renderFreePool();
+  },
+});
 
 function syncCompMenu() { renderCompMenu(); }
 function applyComponents() {
@@ -4822,15 +5095,33 @@ function hideBootBusy() { const b = $('boot-busy'); if (!b) return; clearTimeout
     loadMGateway();
     loadTGateway();
     loadTrConfig().then(() => loadTrQuotas());
-    setInterval(() => loadTrQuotas(), 5 * 60 * 1000);
+    let trBusy = false;
+    setInterval(async () => {
+      if (trBusy || document.hidden) return;
+      trBusy = true;
+      try { await loadTrQuotas(); } finally { trBusy = false; }
+    }, 5 * 60 * 1000);
     // 账号余额（ZCode 剩余 token 等）自动刷新：可见时每 2 分钟一轮；从托盘/后台切回时若超过 1 分钟没刷过立即补一轮
     setInterval(() => { if (!document.hidden) loadQuotas(); }, 2 * 60 * 1000);
     document.addEventListener('visibilitychange', () => {
       if (!document.hidden && Date.now() - quotaLoadedAt > 60 * 1000) loadQuotas();
     });
     loadLogs();
-    setInterval(loadLogs, 10000);
-    setInterval(async () => { await loadStatus(); await loadZNet(); await loadZGateway(); await loadMGateway(); await loadTGateway(); await refreshAccountList(); render(); }, 30000);
+    // 轮询单飞：上一轮没结束就跳过本轮。没有这个守卫 + api() 挂钟超时，daemon 卡住
+    // 时每 10s/30s 的轮询会无限堆积，恢复后一次性齐发还互相踩状态
+    let logsBusy = false;
+    setInterval(async () => {
+      if (logsBusy || document.hidden) return;
+      logsBusy = true;
+      try { await loadLogs(); } finally { logsBusy = false; }
+    }, 10000);
+    let statusBusy = false;
+    setInterval(async () => {
+      if (statusBusy || document.hidden) return;
+      statusBusy = true;
+      try { await loadStatus(); await loadZNet(); await loadZGateway(); await loadMGateway(); await loadTGateway(); await refreshAccountList(); render(); }
+      finally { statusBusy = false; }
+    }, 30000);
     });
   }
   // 先直接请求（本机模式无需密码）；需要密码时 api() 会弹框并重试