deepseek-harness-wallet 0.2.4 → 0.2.6

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project are documented in this file.
 
+## 0.2.6 - 2026-08-23
+
+- 跟随 DeepSeek 官方规则更新峰谷计费：自 2026-08-23 北京时间 00:00 起，周六、周日全天按低谷价计费；工作日高峰仍为 09:00–12:00、14:00–18:00。 / Updated peak/off-peak billing to match DeepSeek's official rule: from 2026-08-23 00:00 Beijing, Saturday and Sunday are all-day off-peak; weekday peak windows remain 09:00–12:00 and 14:00–18:00.
+- 环形卡片同步显示周末全天低谷，并将倒计时指向下一个工作日 09:00。 / Updated the ring card to show weekend all-day off-peak and count down to the next weekday 09:00.
+
+## 0.2.5 - 2026-08-23
+
+- 修复浮动峰谷卡片在窗口缩放、卡片放大或历史坐标过期后可能跑出视口的问题；加载、缩放、排版切换和 resize 都会重新钳制位置。 / Fixed floating peak cards escaping the viewport after resize, scale changes, or stale saved coordinates; load, scale, layout changes, and resize now re-clamp the position.
+- 恢复 Portal 挂载，确保自由浮动卡片和控制面板脱离侧边栏溢出裁剪。 / Restored Portal mounting so floating cards and the control panel escape sidebar overflow clipping.
+- 完成主题回退清理，移除峰谷控制面板、浮动卡片和开关中的硬编码浅色背景/文字回退。 / Completed theme fallback cleanup for the peak panel, floating card, and switches.
+- 保留账户安全、存储权限、刷新异常和偏好同步加固，并避免原始凭证错误文本进入日志或浏览器。 / Kept account-safety, storage-permission, refresh-failure, and preference-sync hardening without exposing raw credential errors to logs or the browser.
+- 新增浮动坐标边界、Portal 和完整主题回退回归测试；当前测试基线为 78/78。 / Added regression coverage for floating-coordinate bounds, Portal mounting, and complete theme fallbacks; the test baseline is now 78/78.
+
 ## 0.2.4 - 2026-08-22
 
 - 彻底修复暗色模式（Dark Mode）主题适配（Issue #26）：移除所有未主题化的浅色硬编码回退（`--dsw-alias-bg-elevated,#fff`、`--dsw-alias-bg-overlay,#fff` 等），全站统一使用 DSH 原生主题变量（`--dsw-alias-bg-layer-*` 与 `--dsw-alias-label-dimmed`），在深色模式下完美融入背景。 / Fully fixed Dark Mode theme compliance (Issue #26): replaced unthemed hardcoded light fallbacks with DSH native theme variables (`--dsw-alias-bg-layer-*`), rendering dark themes seamlessly without blinding white boxes.

package/README.md

@@ -22,8 +22,8 @@
 余额 ¥5.89 · 本场 ¥0.72 · 官 18.8M | 三方 800K · ↗充
 ```
 
-- **Official DeepSeek** — live balance (60s global refresh with fast boot retries), current-session cost locked to the price active for each usage event (including the 2026-08-17 peak/off-peak rollout), and token breakdown.
-- **24h peak/off-peak ring clock** — resident sidebar footer widget indicating real-time pricing windows (peak vs. 50% discount off-peak), countdown to next switch, and optional desktop switch notifications.
+- **Official DeepSeek** — live balance (60s global refresh with fast boot retries), an estimated current-session cost (not an official bill) locked to the price active for each usage event, including the 2026-08-17 peak/off-peak rollout, and token breakdown.
+- **v4 peak/off-peak ring clock** — a resident 24-hour sidebar footer widget for `v4-flash` and `v4-pro`, indicating real-time pricing windows (peak vs. 50% discount off-peak), countdown to the next switch, and optional desktop switch notifications. Weekdays use 09:00–12:00 and 14:00–18:00 Beijing time; Saturday and Sunday are all-day off-peak from 2026-08-23. Other models keep their flat rates.
 - **Third-party total** — current-session tokens (input / cache read / output). No balance guessing, no cost math, zero configuration.
 - **Provider classification** — observed wrapper routes appear in the settings page; opted-in routes join the official token/cost bucket and are priced with the official table.
 - **Click the chip** to open the detail panel: correctly formatted per-currency balances, cost and token splits, a freely editable low-balance threshold for the active account and currency (two decimals, persisted per account; alerts never mix currencies), manual refresh, and a jump to the official recharge page (first click shows the domain for confirmation — anti-phishing).
@@ -34,13 +34,14 @@
 - **Low-balance alert** — below the threshold the chip turns red with a breathing animation and fires one desktop notification; it resets automatically once the balance recovers.
 - **Theme-native UI** — built entirely on `--dsw-alias-*` theme variables, so light and dark themes both render correctly; the panel closes when you click outside and flips open-direction near screen edges.
 - **Clear current-session wallet data** — one button clears only the open conversation's token/cost records; it does not delete the conversation, and every other conversation is untouched.
-
 
-- Open the wallet panel → **账户管理** to add accounts (name + API key), switch the active one, or remove them.
+## Multi-account
+
+- Open the wallet panel → **Account Management（账户管理）** to add accounts (name + API key), switch the active one, or remove them.
 - The first account added becomes the active account automatically and is synced into the credentials seam.
 - Switching prompts a confirmation because it changes **LLM billing** for subsequent requests: the switch writes the account key into the credentials seam (`credentials.set('DEEPSEEK_API_KEY', ...)`), and since the llm-deepseek provider route resolves that reference per request, the very next LLM call is billed with the new account — no restart needed.
-- Account keys are stored plaintext in `$DSH_HOME/storages/accounts.json`; the UI only ever shows masked keys. Balance lookups prefer the active account's key and fall back to the credentials seam when no account is active.
-- Session cost follows the active account's currency: USD-settled accounts show `本约 $x` — a clearly-labeled estimate converted from the CNY price table at the vendor's long-standing list ratio (not a live FX rate); CNY accounts show the exact `本场 ¥x`.
+- Account keys are stored in plaintext in `$DSH_HOME/storages/accounts.json`; the UI only shows masked keys. Treat the DSH data directory as a local credential store and protect access to it. Balance lookups prefer the active account's key and fall back to the credentials seam when no account is active.
+- Session usage estimates follow the active account's currency: USD-settled accounts show `本约 $x`, converted from the CNY price table at the vendor's long-standing list ratio (not a live FX rate); CNY accounts show `本场 ¥x`. These are local estimates, not an official invoice.
 - If `DEEPSEEK_API_KEY` is supplied by the launching environment, switching is refused with a clear error (the credentials provider rejects shadowed writes) — unset it in your shell to enable switching.
 
 
@@ -78,6 +79,14 @@ dsh plugin --profile web add github:feibi-mochi/deepseek-harness-control-center
 
 Restart `dsh web`, then hard-refresh the page.
 
+## Quick use
+
+1. Click the wallet or peak/off-peak card to open its control panel.
+2. Choose horizontal or vertical layout, then use the scale control between 100% and 120%.
+3. Turn the official recharge button off when you need a smaller card; official and third-party rows can also be shown independently.
+4. Drag the card to any open area. If it is hard to find after a layout change, use **Reset/Dock（归位/停靠）** in the panel to return it to the sidebar.
+5. The card follows the host light/dark theme. A hard refresh after upgrading makes sure the new client bundle is loaded.
+
 ### Update
 
 ```sh
@@ -129,8 +138,8 @@ For buildable DSH hosts, the npm package and repository include a versioned [Age
 | Item | Behavior |
 | --- | --- |
 | Token accounting | Listens to the `llm/stream` event and buckets per session and provider: `deepseek-official` plus explicitly opted-in wrapper routes use the official bucket; other providers stay third-party; each usage event also locks its contemporaneous official price, so multiple sessions and pricing windows never mix. |
-| Balance | The key from the credentials seam (or the active account's key) never leaves this machine except as the `Authorization` header of the official `/user/balance` request. |
-| Accounts | Keys live in `$DSH_HOME/storages/accounts.json` (plaintext, matching the harness's own credential storage); the UI only ever shows masked keys, and switching writes the chosen key into the credentials seam for LLM billing. |
+| Balance | The wallet plugin itself sends the active key directly only to the official `/user/balance` endpoint. When multi-account switching is enabled, the selected key is also written into the DSH credentials seam; DSH may then use it for subsequent model requests. |
+| Accounts | Keys live in `$DSH_HOME/storages/accounts.json` in plaintext, matching the harness's own credential storage. The UI only shows masked keys, and switching writes the chosen key into the credentials seam for subsequent LLM billing. Protect the DSH data directory as you would any local credential store. |
 | Session log | The plugin writes no events; its data lives in `$DSH_HOME/storages/wallet.json`. |
 | Local settings | Layout, scale, visibility, reminder, and panel settings stay in browser-compatible local storage. |
 | Permanent deletion | Opt-in and host-gated. The wallet never advertises the action unless the host implements the matching session deletion path. |
@@ -146,6 +155,7 @@ CNY per 1M tokens, curated from official announcements (cache writes are not bil
 - Since 2026-08-17 00:00 Beijing — peak/off-peak pricing for the v4 models (peak windows Beijing 09:00–12:00 / 14:00–18:00; off-peak is half the peak rate):
   - v4-flash (off-peak / peak): cache read 0.05 / 0.10, input 1.5 / 3, output 4.5 / 9
   - v4-pro (off-peak / peak): cache read 0.15 / 0.30, input 4.5 / 9, output 13.5 / 27
+- Since 2026-08-23 00:00 Beijing — Saturday and Sunday are no longer split into peak/off-peak windows; weekend calls use the off-peak rates all day. Weekday peak windows remain 09:00–12:00 and 14:00–18:00.
 
 deepseek-chat and deepseek-reasoner keep their flat rates. Each usage event is priced when it arrives; upgrading from 0.1.2 migrates legacy counters once using the then-current rate. Costs are estimates; the API-returned balance is authoritative.
 

package/index.js

@@ -35,14 +35,24 @@ const DEFAULT_THRESHOLD = 5
 const BALANCE_REFRESH_MS = 60_000
 const STORE_VERSION = 2
 
-// Beijing (UTC+8, no DST) peak windows: 09:00-12:00 and 14:00-18:00.
+// Beijing (UTC+8, no DST) weekday peak windows: 09:00-12:00 and 14:00-18:00.
+// From 2026-08-23 00:00 Beijing, Saturday and Sunday are off-peak all day.
 // Exposed to clients via snapshot.pricingWindows so the ring clock renders
 // from the active policy instead of hard-coding hours in the bundle.
 const PEAK_WINDOWS = [{ startHour: 9, endHour: 12 }, { startHour: 14, endHour: 18 }]
 const OFF_PEAK_RATE = 0.5
 const BEIJING_OFFSET_MS = 8 * 3600_000
+const WEEKEND_OFF_PEAK_SINCE = Date.UTC(2026, 7, 22, 16)
+
+function isBeijingWeekend(atMs) {
+  if (!Number.isFinite(atMs)) return false
+  const beijingDate = new Date(atMs + BEIJING_OFFSET_MS)
+  const day = beijingDate.getUTCDay()
+  return day === 0 || day === 6
+}
 
 export function isBeijingPeak(atMs) {
+  if (atMs >= WEEKEND_OFF_PEAK_SINCE && isBeijingWeekend(atMs)) return false
   const hours = ((atMs + BEIJING_OFFSET_MS) % 86_400_000) / 3_600_000
   return (hours >= 9 && hours < 12) || (hours >= 14 && hours < 18)
 }
@@ -78,7 +88,9 @@ export const PRICE_POLICIES = [
 export function ratesFor(model, atMs) {
   let entry
   for (const policy of PRICE_POLICIES) {
-    if (atMs >= policy.since && policy.models[model] !== undefined) entry = policy
+    // Own-property check: a model named `__proto__`/`toString` would otherwise
+    // resolve to an Object.prototype member and produce NaN costs.
+    if (atMs >= policy.since && Object.hasOwn(policy.models, model)) entry = policy
   }
   if (entry === undefined) return null
   const rates = entry.models[model]
@@ -258,9 +270,10 @@ function persistStore(logger) {
     saveTimer = null
   }
   try {
-    mkdirSync(dirname(STORE_PATH), { recursive: true })
+    mkdirSync(dirname(STORE_PATH), { recursive: true, mode: 0o700 })
     const tmp = STORE_PATH + '.tmp'
-    writeFileSync(tmp, JSON.stringify(store))
+    // Owner-only: the store carries usage accounting next to credential files.
+    writeFileSync(tmp, JSON.stringify(store), { mode: 0o600 })
     renameSync(tmp, STORE_PATH)
   } catch (error) {
     if (logger && typeof logger.warn === 'function') {
@@ -325,9 +338,10 @@ function persistAccounts(logger) {
     accountsSaveTimer = null
   }
   try {
-    mkdirSync(dirname(ACCOUNTS_PATH), { recursive: true })
+    mkdirSync(dirname(ACCOUNTS_PATH), { recursive: true, mode: 0o700 })
     const tmp = ACCOUNTS_PATH + '.tmp'
-    writeFileSync(tmp, JSON.stringify(accounts))
+    // This file holds plaintext API keys: owner-only, never group/world readable.
+    writeFileSync(tmp, JSON.stringify(accounts), { mode: 0o600 })
     renameSync(tmp, ACCOUNTS_PATH)
   } catch (error) {
     if (logger && typeof logger.warn === 'function') {
@@ -436,15 +450,20 @@ async function resolveBalanceKey(ctx) {
  */
 export async function activateAccount(ctx, id) {
   const account = findAccount(id)
-  if (account === null) return { ok: false, error: 'account not found' }
+  if (account === null) return { ok: false, error: 'account-not-found' }
   const credentials = ctx.get('credentials')
-  if (credentials === undefined) return { ok: false, error: 'credentials service unavailable' }
+  if (credentials === undefined) return { ok: false, error: 'credentials-unavailable' }
   try {
     await credentials.set(CREDENTIAL_REF, account.apiKey)
   } catch (error) {
     // e.g. the launching environment supplies DEEPSEEK_API_KEY read-only, so
-    // the write is shadowed and refused by the credentials provider.
-    return { ok: false, error: error instanceof Error ? error.message : String(error) }
+    // the write is shadowed and refused by the credentials provider. Keep the
+    // browser error bounded and do not log provider text that might contain
+    // paths, environment details, or key fragments.
+    if (ctx.logger && typeof ctx.logger.warn === 'function') {
+      ctx.logger.warn('dsh-wallet: credential write refused')
+    }
+    return { ok: false, error: 'credential-write-refused' }
   }
   accounts.activeId = account.id
   scheduleAccountsSave(ctx.logger)
@@ -509,12 +528,12 @@ let balance = { fetchedAt: 0, available: false, balances: [], error: null }
 let balanceRefresh = null
 
 async function performBalanceRefresh(ctx) {
-  const credentials = ctx.get('credentials')
-  if (credentials === undefined) {
-    balance = { fetchedAt: Date.now(), available: false, balances: [], error: 'no-credentials' }
-    return
-  }
   try {
+    const credentials = ctx.get('credentials')
+    if (credentials === undefined) {
+      balance = { fetchedAt: Date.now(), available: false, balances: [], error: 'no-credentials' }
+      return
+    }
     const key = await resolveBalanceKey(ctx)
     if (key === undefined || key === '') {
       balance = { fetchedAt: Date.now(), available: false, balances: [], error: 'no-api-key' }
@@ -564,9 +583,24 @@ async function performBalanceRefresh(ctx) {
 
 function refreshBalance(ctx) {
   if (balanceRefresh !== null) return balanceRefresh
-  balanceRefresh = performBalanceRefresh(ctx).finally(() => {
-    balanceRefresh = null
-  })
+  // Never let a refresh escape as an unhandled rejection: every caller uses
+  // `void refreshBalance(ctx)`, so a throw here would take the host process
+  // down (Node exits on unhandled rejections). Absorb it into the error state.
+  balanceRefresh = performBalanceRefresh(ctx)
+    .catch((error) => {
+      balance = {
+        fetchedAt: Date.now(),
+        available: false,
+        balances: [],
+        error: 'balance-unavailable',
+      }
+      if (ctx && ctx.logger && typeof ctx.logger.warn === 'function') {
+        ctx.logger.warn('dsh-wallet: balance refresh failed')
+      }
+    })
+    .finally(() => {
+      balanceRefresh = null
+    })
   return balanceRefresh
 }
 
@@ -609,8 +643,18 @@ function balanceTotal() {
 
 function sessionView(sessionId) {
   if (sessionId === undefined || sessionId === '') return { official: null, third: null }
+  // Own-property lookup only: session ids like `__proto__`, `constructor` or
+  // `toString` otherwise resolve to an Object.prototype member, slip past the
+  // undefined guard, and throw inside bucketTotals.
+  if (!Object.prototype.hasOwnProperty.call(store.sessions, sessionId)) {
+    return { official: null, third: null }
+  }
   const session = store.sessions[sessionId]
-  if (session === undefined) return { official: null, third: null }
+  if (session === null || typeof session !== 'object'
+    || session.official === null || typeof session.official !== 'object'
+    || session.third === null || typeof session.third !== 'object') {
+    return { official: null, third: null }
+  }
   const official = bucketTotals(session.official)
   const third = bucketTotals(session.third)
   return {
@@ -627,6 +671,7 @@ function sessionView(sessionId) {
 function snapshotView(sessionId) {
   const currency = balanceCurrency(balance.balances)
   const active = activeAccount()
+  const now = Date.now()
   return {
     ok: true,
     balance: {
@@ -658,7 +703,9 @@ function snapshotView(sessionId) {
       offsetMinutes: 480,
       windows: PEAK_WINDOWS.map(w => ({ startHour: w.startHour, endHour: w.endHour })),
       offPeakRate: OFF_PEAK_RATE,
-      isPeak: isBeijingPeak(Date.now()),
+      isPeak: isBeijingPeak(now),
+      weekendOffPeak: now >= WEEKEND_OFF_PEAK_SINCE && isBeijingWeekend(now),
+      weekendOffPeakSince: WEEKEND_OFF_PEAK_SINCE,
     },
     accounts: {
       activeId: accounts.activeId,

package/lib/client.js

@@ -23,7 +23,7 @@ window.__ModuleLoader__.load({
 
     var POLL_MS = 15000
     // Keep in lockstep with package.json; a test enforces the sync.
-    var WALLET_VERSION = '0.2.4'
+    var WALLET_VERSION = '0.2.6'
     var CONFIRM_KEY = 'dsh-wallet-recharge-confirmed'
     var CHIP_LAYOUT_KEY = 'dshw-chip-layout-v4'
     var PANEL_POS_KEY = 'dshw-panel-pos-v1'
@@ -62,11 +62,18 @@ window.__ModuleLoader__.load({
         ? root.__DSH_WALLET_ADAPTER__
         : {}
       var memory = Object.create(null)
+      // Keys whose native write was refused (quota, private mode, sandboxed
+      // WebView). Reads for those keys must come from memory, otherwise the
+      // fallback write is invisible and the UI keeps reading a stale value.
+      var memoryOnly = Object.create(null)
       var nativeStorage = extension.storage || root.localStorage || null
       var pageNotices = new Map()
 
       var storage = {
         getItem: function (key) {
+          if (memoryOnly[key] === true) {
+            return Object.prototype.hasOwnProperty.call(memory, key) ? memory[key] : null
+          }
           if (nativeStorage && typeof nativeStorage.getItem === 'function') {
             try { return nativeStorage.getItem(key) } catch (e) { /* storage may be disabled */ }
           }
@@ -76,13 +83,19 @@ window.__ModuleLoader__.load({
           value = String(value)
           memory[key] = value
           if (nativeStorage && typeof nativeStorage.setItem === 'function') {
-            try { nativeStorage.setItem(key, value); return } catch (e) { /* use memory below */ }
+            try {
+              nativeStorage.setItem(key, value)
+              delete memoryOnly[key]
+              return
+            } catch (e) { /* fall through to the memory-only marker */ }
           }
+          memoryOnly[key] = true
         },
         removeItem: function (key) {
           delete memory[key]
+          delete memoryOnly[key]
           if (nativeStorage && typeof nativeStorage.removeItem === 'function') {
-            try { nativeStorage.removeItem(key); return } catch (e) { /* use memory below */ }
+            try { nativeStorage.removeItem(key); return } catch (e) { /* memory copy is already gone */ }
           }
         }
       }
@@ -277,7 +290,7 @@ window.__ModuleLoader__.load({
       '.dshw_anchorHome{overflow:hidden;min-width:44px}',
       '.dshw_chipLift{z-index:80!important}',
       '.dshw_anchorHome>.dshw_chip{box-sizing:border-box;max-width:100%;min-width:0;overflow:hidden}',
-      '.dshw_chip{border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:transparent;height:22px;color:var(--dsw-alias-label-primary,#1f2328);white-space:nowrap;border-radius:999px;align-items:stretch;font-size:12px;line-height:1;display:inline-flex;position:relative;touch-action:none;user-select:none;cursor:grab}',
+      '.dshw_chip{border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:transparent;height:22px;color:var(--dsw-alias-label-primary,inherit);white-space:nowrap;border-radius:999px;align-items:stretch;font-size:12px;line-height:1;display:inline-flex;position:relative;touch-action:none;user-select:none;cursor:grab}',
       '.dshw_chip:hover,.dshw_chip:focus-within{border-color:var(--dsw-alias-brand-primary,#4aa3ff)}',
       '.dshw_chipLow{border-color:var(--dsw-alias-state-error-primary,#e5534b);color:var(--dsw-alias-state-error-primary,#e5534b);animation:dshwChipPulseIn 1.8s ease-in-out infinite}',
       '.dshw_chipLow:hover,.dshw_chipLow:focus-within{border-color:var(--dsw-alias-state-error-primary,#e5534b)}',
@@ -302,7 +315,7 @@ window.__ModuleLoader__.load({
       '.dshw_chipVertical.dshw_chipNoRecharge .dshw_chipMain{border-radius:7px}',
       '.dshw_recharge{color:var(--dsw-alias-brand-primary,#4aa3ff);border-left:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));padding:0 7px 0 6px;border-radius:0 999px 999px 0}',
       '.dshw_chipMain:focus-visible,.dshw_recharge:focus-visible,.dshw_btn:focus-visible,.dshw_floatBtn:focus-visible,.dshw_dot:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,#4aa3ff);outline-offset:2px}',
-      '.dshw_panel{z-index:40;border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,#21262d));box-sizing:border-box;width:min(276px,calc(100vw - 12px));max-height:calc(100vh - 16px);overflow:auto;color:var(--dsw-alias-label-primary,#1f2328);border-radius:8px;flex-direction:column;gap:4px;padding:8px 9px;font-size:12px;display:flex;position:fixed;box-shadow:0 4px 16px rgba(0,0,0,.35)}',
+      '.dshw_panel{z-index:40;border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,var(--dsw-alias-bg-base,transparent)));box-sizing:border-box;width:min(276px,calc(100vw - 12px));max-height:calc(100vh - 16px);overflow:auto;color:var(--dsw-alias-label-primary,inherit);border-radius:8px;flex-direction:column;gap:4px;padding:8px 9px;font-size:12px;display:flex;position:fixed;box-shadow:0 4px 16px rgba(0,0,0,.35)}',
       '.dshw_panelHeader{min-height:24px;cursor:move;touch-action:none;user-select:none}',
       '.dshw_panelHeader .dshw_btn{cursor:pointer}',
       '.dshw_row{justify-content:space-between;align-items:center;gap:6px;display:flex}',
@@ -319,7 +332,7 @@ window.__ModuleLoader__.load({
       '.dshw_check input{margin:0;accent-color:var(--dsw-alias-brand-primary,#4aa3ff)}',
       '.dshw_select{background:var(--dsw-alias-bg-layer-1,var(--dsw-alias-bg-base,rgba(127,127,127,.08)));border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));color:var(--dsw-alias-label-primary,inherit);border-radius:5px;padding:2px 4px;font-size:12px}',
       '.dshw_btn{border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:var(--dsw-alias-bg-layer-1,transparent);color:var(--dsw-alias-label-primary,inherit);border-radius:5px;padding:2px 6px;font-size:12px;cursor:pointer}',
-      '.dshw_btnPrimary{background:var(--dsw-alias-brand-primary,#4aa3ff);border-color:transparent;color:var(--dsw-alias-label-primary-foreground,#ffffff)}',
+      '.dshw_btnPrimary{background:var(--dsw-alias-brand-primary,#4aa3ff);border-color:transparent;color:var(--dsw-alias-label-primary-foreground,var(--dsw-alias-label-primary,inherit))}',
       // ---- v0.2 panel restyle: balance card, settings card, account scroll ----
       '.dshw_balanceCard{margin:2px 0 2px;padding:8px 10px;border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.2));border-radius:8px;background:var(--dsw-alias-bg-layer-1,var(--dsw-alias-bg-base,rgba(127,127,127,.06)))}',
       '.dshw_balLine{display:flex;align-items:center;gap:7px;white-space:nowrap}',
@@ -411,7 +424,7 @@ window.__ModuleLoader__.load({
       '.dshw_switch{position:relative;flex:none;width:34px;height:20px;display:inline-flex;cursor:pointer}',
       '.dshw_switch>input{position:absolute;inset:0;opacity:0;margin:0;cursor:pointer}',
       '.dshw_track{position:absolute;inset:0;border-radius:999px;background:var(--dsw-alias-border-l3,rgba(127,127,127,.3));transition:background-color .15s}',
-      '.dshw_knob{position:absolute;left:2px;top:2px;width:16px;height:16px;border-radius:50%;background:var(--dsw-alias-bg-layer-1,#fff);box-shadow:0 1px 3px rgba(0,0,0,.24);transition:transform .15s}',
+      '.dshw_knob{position:absolute;left:2px;top:2px;width:16px;height:16px;border-radius:50%;background:var(--dsw-alias-bg-layer-1,var(--dsw-alias-bg-base,transparent));box-shadow:0 1px 3px rgba(0,0,0,.24);transition:transform .15s}',
       '.dshw_switch>input:checked+.dshw_track{background:var(--dsw-alias-brand-primary,#4aa3ff)}',
       '.dshw_switch>input:checked~.dshw_knob{transform:translateX(14px)}',
       '.dshw_switch>input:focus-visible+.dshw_track{outline:2px solid var(--dsw-alias-brand-primary,#4aa3ff);outline-offset:2px}',
@@ -442,7 +455,7 @@ window.__ModuleLoader__.load({
       '.dshw_footRingVertical .dshw_footRingCountdown{font-size:10.5px;overflow:visible;white-space:nowrap}',
       '.dshw_footRingVertical .dshw_footRingBottom{justify-content:center}',
       '.dshw_footRingNoRecharge{padding-right:10px}',
-      '.dshw_footRingFloating{position:fixed;z-index:90;width:auto;min-width:180px;max-width:260px;margin:0!important;border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,#21262d));box-shadow:0 8px 24px rgba(0,0,0,.35);cursor:grab;touch-action:none}',
+      '.dshw_footRingFloating{position:fixed;z-index:90;width:auto;min-width:180px;max-width:260px;margin:0!important;border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,var(--dsw-alias-bg-base,transparent)));box-shadow:0 8px 24px rgba(0,0,0,.35);cursor:grab;touch-action:none}',
       '.dshw_footRingFloating.dshw_footRingVertical{min-width:132px;max-width:152px;width:140px;padding:9px 8px;gap:4px}',
       '.dshw_footRingFloating.dshw_footRingVertical .dshw_footRingResetBtn{position:absolute;top:4px;right:4px;font-size:9.5px;padding:1px 5px;line-height:13px}',
       '.dshw_footRingFloating.dshw_footRingDragging{cursor:grabbing;box-shadow:0 10px 30px rgba(0,0,0,.45)}',
@@ -459,8 +472,8 @@ window.__ModuleLoader__.load({
       '.dshw_footRingBottom{display:flex;align-items:center;justify-content:space-between;gap:6px;width:100%;min-height:18px}',
       '.dshw_footRingCountdown{font-size:11px;color:var(--dsw-alias-label-secondary,rgba(127,127,127,.85));line-height:1.2;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;flex:1 1 auto;min-width:0}',
       '.dshw_footRingBtnRechargeInline{border:1px solid var(--dsw-alias-brand-primary,#4aa3ff);background:var(--dsw-alias-brand-soft,rgba(74,163,255,.10));color:var(--dsw-alias-brand-primary,#4aa3ff);border-radius:4px;height:18px;padding:0 6px;font-size:10.5px;font-weight:600;line-height:16px;cursor:pointer;display:inline-flex;align-items:center;justify-content:center;transition:all .15s ease;user-select:none;flex:none}',
-      '.dshw_footRingBtnRechargeInline:hover{background:var(--dsw-alias-brand-primary,#4aa3ff);color:#fff}',
-      '.dshw_peakPanel{position:fixed;z-index:95;width:290px;box-sizing:border-box;border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,#21262d));color:var(--dsw-alias-label-primary,inherit);border-radius:12px;box-shadow:0 10px 32px rgba(0,0,0,.38);display:flex;flex-direction:column;gap:8px;padding:12px 14px;font-size:12px;user-select:none;touch-action:none}',
+      '.dshw_footRingBtnRechargeInline:hover{background:var(--dsw-alias-brand-primary,#4aa3ff);color:var(--dsw-alias-label-primary-foreground,var(--dsw-alias-label-primary,inherit))}',
+      '.dshw_peakPanel{position:fixed;z-index:95;width:290px;box-sizing:border-box;border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,var(--dsw-alias-bg-base,transparent)));color:var(--dsw-alias-label-primary,inherit);border-radius:12px;box-shadow:0 10px 32px rgba(0,0,0,.38);display:flex;flex-direction:column;gap:8px;padding:12px 14px;font-size:12px;user-select:none;touch-action:none}',
       '.dshw_peakPanelHeader{display:flex;align-items:center;justify-content:space-between;font-weight:650;font-size:12.5px;color:var(--dsw-alias-label-primary,inherit)}',
       '.dshw_peakPanelClose{border:none;background:transparent;color:inherit;font-size:16px;line-height:1;cursor:pointer;padding:2px 6px;border-radius:4px}',
       '.dshw_peakPanelClose:hover{background:var(--dsw-alias-interactive-bg-hover,rgba(127,127,127,.12))}',
@@ -471,23 +484,23 @@ window.__ModuleLoader__.load({
       '.dshw_ringNeutral{stroke:var(--dsw-alias-border-l3,rgba(127,127,127,.3))}',
       '.dshw_peakRing circle{transition:stroke-width .3s ease}',
       '.dshw_ringNow{stroke-width:6;filter:brightness(1.15)}',
-      '.dshw_ringPointer{fill:var(--dsw-alias-label-primary,#1f2328)}',
+      '.dshw_ringPointer{fill:var(--dsw-alias-label-primary,inherit)}',
       '.dshw_ringTick{fill:var(--dsw-alias-label-dimmed,var(--dsw-alias-label-tertiary,#8b949e))}',
       '@media (max-width:760px){.dshw_settingsGrid,.dshw_settingsSection .dshw_setCard{grid-template-columns:1fr}.dshw_settingsSection .dshw_setCard>.dshw_setCell.wide{grid-column:1}.dshw_accountAdd{grid-template-columns:1fr}.dshw_settingsFooter{align-items:flex-start;flex-direction:column-reverse}.dshw_settingsFooterActions{width:100%}.dshw_settingsFooterActions .dshw_btn{flex:1}.dshw_settingsHeroMeta{white-space:normal;flex-wrap:wrap}}',
       '.dshw_actionRow{display:grid;grid-template-columns:1fr 1fr;gap:6px;margin:2px 0}',
       '.dshw_textDanger{display:inline-flex;align-items:center;gap:5px;height:22px;padding:0 4px;border:none;background:transparent;font:inherit;font-size:11px;color:var(--dsw-alias-label-dimmed,var(--dsw-alias-label-tertiary,#8b949e));cursor:pointer;border-radius:4px;transition:color .12s,background-color .12s}',
       '.dshw_textDanger:hover{color:var(--dsw-alias-state-error-primary,#e5534b);background:var(--dsw-alias-state-error-soft,rgba(229,83,75,.12))}',
       '.dshw_overlay{position:fixed;inset:0;background:var(--dsw-alias-bg-mask-drop,rgba(0,0,0,.55));display:flex;align-items:center;justify-content:center;z-index:100}',
-      '.dshw_overlayBox{background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,#21262d));border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));color:var(--dsw-alias-label-primary,#1f2328);border-radius:8px;padding:14px 18px;width:min(320px,calc(100vw - 32px));box-sizing:border-box;font-size:13px;line-height:1.7}',
+      '.dshw_overlayBox{background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,var(--dsw-alias-bg-base,transparent)));border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));color:var(--dsw-alias-label-primary,inherit);border-radius:8px;padding:14px 18px;width:min(320px,calc(100vw - 32px));box-sizing:border-box;font-size:13px;line-height:1.7}',
       '.dshw_overlayRow{margin-top:10px;display:flex;gap:8px;justify-content:flex-end}',
-      '.dshw_float{position:fixed;z-index:80;min-width:230px;max-width:280px;border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,#21262d));color:var(--dsw-alias-label-primary,#1f2328);border-radius:12px;box-shadow:0 6px 20px rgba(0,0,0,.25);display:flex;flex-direction:column;gap:6px;padding:10px 12px;font-size:12px;user-select:none}',
+      '.dshw_float{position:fixed;z-index:80;min-width:230px;max-width:280px;border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,var(--dsw-alias-bg-base,transparent)));color:var(--dsw-alias-label-primary,inherit);border-radius:12px;box-shadow:0 6px 20px rgba(0,0,0,.25);display:flex;flex-direction:column;gap:6px;padding:10px 12px;font-size:12px;user-select:none}',
       '.dshw_floatHeader{display:flex;align-items:center;justify-content:space-between;cursor:move;font-weight:600;opacity:.9;touch-action:none}',
       '.dshw_floatBtn{border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:transparent;color:inherit;border-radius:5px;width:22px;height:20px;font-size:12px;line-height:1;cursor:pointer;padding:0}',
       '.dshw_floatBtn:hover{background:var(--dsw-alias-interactive-bg-hover,rgba(127,127,127,.1))}',
-      '.dshw_dot{position:fixed;z-index:80;width:36px;height:36px;border-radius:50%;border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,#21262d));color:var(--dsw-alias-label-primary,#1f2328);font-size:11px;display:flex;align-items:center;justify-content:center;cursor:pointer;box-shadow:0 2px 10px rgba(0,0,0,.25);user-select:none;touch-action:none}',
+      '.dshw_dot{position:fixed;z-index:80;width:36px;height:36px;border-radius:50%;border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,var(--dsw-alias-bg-base,transparent)));color:var(--dsw-alias-label-primary,inherit);font-size:11px;display:flex;align-items:center;justify-content:center;cursor:pointer;box-shadow:0 2px 10px rgba(0,0,0,.25);user-select:none;touch-action:none}',
       '.dshw_dotLow{border-color:var(--dsw-alias-state-error-primary,#e5534b);color:var(--dsw-alias-state-error-primary,#e5534b)}',
       '.dshw_noticeStack{position:fixed;z-index:120;top:max(12px,env(safe-area-inset-top));right:max(12px,env(safe-area-inset-right));width:min(340px,calc(100vw - 24px));display:flex;flex-direction:column;gap:8px;pointer-events:none}',
-      '.dshw_notice{box-sizing:border-box;width:100%;display:flex;align-items:flex-start;gap:8px;padding:10px 10px 10px 12px;border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));border-radius:9px;background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,#21262d));color:var(--dsw-alias-label-primary,#1f2328);box-shadow:0 6px 20px rgba(0,0,0,.25);font-size:12px;line-height:1.45;pointer-events:auto;cursor:pointer}',
+      '.dshw_notice{box-sizing:border-box;width:100%;display:flex;align-items:flex-start;gap:8px;padding:10px 10px 10px 12px;border:1px solid var(--dsw-alias-border-l2,rgba(127,127,127,.25));border-radius:9px;background:var(--dsw-alias-bg-layer-2,var(--dsw-alias-bg-layer-1,var(--dsw-alias-bg-base,transparent)));color:var(--dsw-alias-label-primary,inherit);box-shadow:0 6px 20px rgba(0,0,0,.25);font-size:12px;line-height:1.45;pointer-events:auto;cursor:pointer}',
       '.dshw_noticeCopy{min-width:0;display:flex;flex:1;flex-direction:column;gap:2px}.dshw_noticeCopy span{white-space:pre-line;overflow-wrap:anywhere}',
       '.dshw_noticeClose{flex:none;width:24px;height:24px;border:0;border-radius:5px;background:transparent;color:inherit;font-size:18px;line-height:1;cursor:pointer}.dshw_noticeClose:hover{background:var(--dsw-alias-interactive-bg-hover,rgba(127,127,127,.1))}',
       // Home-fit and compact modes are toggled by measured space (see the
@@ -539,7 +552,7 @@ window.__ModuleLoader__.load({
     // Noon = 0h at 12 o'clock, clockwise. Optional size scales the 76-unit
     // viewBox down for tight hosts (sidebar foot row / rail circle); optional
     // ariaText overrides the fallback label with the full screen-reader state.
-    function peakRingSVG(windows, nowHour, size, ariaText) {
+    function peakRingSVG(windows, nowHour, size, ariaText, allOffPeak) {
       var sizePx = typeof size === 'number' && size > 0 ? size : 76
       var R = 28
       var CX = 38
@@ -548,6 +561,18 @@ window.__ModuleLoader__.load({
       // No pricing policy resolved: one neutral full ring, no arcs, no pointer
       // — the clock shows an unconfigured state and claims no price.
       if (!Array.isArray(windows) || windows.length === 0) {
+        if (allOffPeak === true) {
+          return React.createElement('svg', {
+            width: sizePx, height: sizePx, viewBox: '0 0 76 76',
+            role: 'img', className: 'dshw_peakRing',
+            'aria-label': ariaText || '当前为周末低谷时段，全天半价'
+          },
+            React.createElement('circle', {
+              key: 'weekend-off', cx: CX, cy: CY, r: R, fill: 'none',
+              className: 'dshw_ringOff dshw_ringNow', strokeWidth: 6.5,
+              strokeDasharray: CIRC.toFixed(2) + ' 0', strokeDashoffset: '0'
+            }))
+        }
         return React.createElement('svg', {
           width: sizePx, height: sizePx, viewBox: '0 0 76 76',
           role: 'img', className: 'dshw_peakRing',
@@ -1085,6 +1110,26 @@ window.__ModuleLoader__.load({
       return (counters.input || 0) + (counters.output || 0) + (counters.cacheRead || 0) + (counters.cacheWrite || 0)
     }
 
+    // Keep the floating peak card reachable after a viewport resize, a
+    // persisted position from another screen size, or a scale change. `width`
+    // and `height` are the rendered dimensions from getBoundingClientRect(),
+    // so transformed 120% cards are clamped using their actual footprint.
+    function clampPeakPosition(pos, width, height, viewportWidth, viewportHeight, margin) {
+      margin = Number.isFinite(margin) ? Math.max(0, margin) : 8
+      viewportWidth = Number.isFinite(viewportWidth) ? viewportWidth : 1024
+      viewportHeight = Number.isFinite(viewportHeight) ? viewportHeight : 768
+      width = Number.isFinite(width) && width > 0 ? width : 180
+      height = Number.isFinite(height) && height > 0 ? height : 60
+      var x = pos && Number.isFinite(pos.x) ? pos.x : margin
+      var y = pos && Number.isFinite(pos.y) ? pos.y : margin
+      var maxX = Math.max(margin, viewportWidth - width - margin)
+      var maxY = Math.max(margin, viewportHeight - height - margin)
+      return {
+        x: Math.round(Math.min(maxX, Math.max(margin, x))),
+        y: Math.round(Math.min(maxY, Math.max(margin, y))),
+      }
+    }
+
     /**
      * Host settings-panel section: the same wallet controls as the chip panel,
      * as an independent card. Shares state with the chip through the same
@@ -1662,7 +1707,7 @@ window.__ModuleLoader__.load({
           type: 'button', className: 'dshw_btn dshw_btnPrimary',
           onClick: function () { if (close) close(); window.open('https://platform.deepseek.com/top_up', '_blank', 'noopener') }
         }, '↗ 去官方充值'))))
-      return React.createElement('div', { className: 'dshw_settingsSection', style: { display: 'flex', flexDirection: 'column', gap: '6px', fontSize: '12px', color: 'var(--dsw-alias-label-primary,#1f2328)' } }, rows)
+      return React.createElement('div', { className: 'dshw_settingsSection', style: { display: 'flex', flexDirection: 'column', gap: '6px', fontSize: '12px', color: 'var(--dsw-alias-label-primary,inherit)' } }, rows)
     }
 
     // Wall-clock hour (0-24, fractional) inside an IANA timezone, via Intl —
@@ -1689,8 +1734,47 @@ window.__ModuleLoader__.load({
       var windows = policy && Array.isArray(policy.windows) ? policy.windows.filter(function (w) {
         return w && Number.isFinite(w.startHour) && Number.isFinite(w.endHour) && w.endHour > w.startHour
       }) : []
+      var weekendOffPeak = policy && policy.weekendOffPeak === true
+      if (weekendOffPeak) {
+        var offsetMinutes = policy && Number.isFinite(policy.offsetMinutes) ? policy.offsetMinutes : 480
+        var beijingNow = Number.isFinite(nowMs) ? new Date(nowMs + offsetMinutes * 60000) : null
+        var day = beijingNow && Number.isFinite(beijingNow.getTime()) ? beijingNow.getUTCDay() : 6
+        var daysUntilMonday = day === 6 ? 2 : 1
+        var nextSwitchMs = beijingNow && Number.isFinite(beijingNow.getTime())
+          ? Date.UTC(
+            beijingNow.getUTCFullYear(), beijingNow.getUTCMonth(), beijingNow.getUTCDate() + daysUntilMonday,
+            9 - (offsetMinutes / 60), 0, 0, 0
+          ) - offsetMinutes * 60000
+          : NaN
+        var weekendMsLeft = Number.isFinite(nextSwitchMs) && Number.isFinite(nowMs)
+          ? Math.max(0, nextSwitchMs - nowMs)
+          : 0
+        var weekendHours = Math.floor(weekendMsLeft / 3600000)
+        var weekendMinutes = Math.floor((weekendMsLeft % 3600000) / 60000)
+        var weekendLeftText = weekendHours > 0
+          ? weekendHours + ' 小时 ' + weekendMinutes + ' 分'
+          : weekendMinutes + ' 分钟'
+        var weekendLeftShort = weekendHours > 0
+          ? weekendHours + 'h' + (weekendMinutes > 0 ? weekendMinutes + 'm' : '')
+          : weekendMinutes + 'm'
+        var weekendDateKey = beijingNow && Number.isFinite(beijingNow.getTime())
+          ? [beijingNow.getUTCFullYear(), String(beijingNow.getUTCMonth() + 1).padStart(2, '0'), String(beijingNow.getUTCDate()).padStart(2, '0')].join('-')
+          : 'weekend'
+        var weekendTzName = policy.timezone || 'Asia/Shanghai'
+        return {
+          configured: true, windows: [], weekendOffPeak: true, inPeak: false,
+          nextHour: 9,
+          ariaText: '当前为周末低谷时段，全天按半价计费，周一 09:00 恢复标准价',
+          tip: '峰谷时钟 · 当前周末低谷 · 周一 09:00 恢复标准价 · 还有 ' + weekendLeftText + ' · ' + weekendTzName,
+          periodName: '周末低谷', rateBadge: '半价',
+          countdownSummary: '周一 09:00 切换 · 剩 ' + weekendLeftShort,
+          windowSummary: '周末全天低谷 · 工作日高峰 09:00–12:00 / 14:00–18:00',
+          periodId: 'weekend-off-' + weekendDateKey,
+          switchBody: '周末低谷结束，已进入工作日高峰时段，按标准价计费',
+        }
+      }
       if (windows.length === 0) {
-        return { configured: false, windows: [], ariaText: '峰谷计费时段未配置', tip: '峰谷时钟 · 计费时段未配置', periodId: null }
+        return { configured: false, windows: [], weekendOffPeak: false, ariaText: '峰谷计费时段未配置', tip: '峰谷时钟 · 计费时段未配置', periodId: null }
       }
       var inPeak = false
       var segStart = null
@@ -1753,7 +1837,7 @@ window.__ModuleLoader__.load({
       var tip = '峰谷时钟 · 当前' + period + ' · ' + switchText + ' · 还有 ' + leftText
         + ' · 高峰 ' + winText + '（' + tzName + '）' + localNote
       return {
-        configured: true, windows: windows, inPeak: inPeak,
+        configured: true, windows: windows, weekendOffPeak: false, inPeak: inPeak,
         nextHour: nextHour, ariaText: ariaText, tip: tip,
         periodName: periodName, rateBadge: rateBadge,
         countdownSummary: countdownSummary, windowSummary: windowSummary,
@@ -1809,6 +1893,12 @@ window.__ModuleLoader__.load({
       var [nowMs, setNowMs] = React.useState(function () { return Date.now() })
       var dragRef = React.useRef(null)
       var didDragRef = React.useRef(false)
+      // Guards the self-echo: every preference write dispatches the shared
+      // change events so OTHER surfaces resync, but this component must not
+      // re-read storage from its own dispatch — the listener would setState a
+      // second time from a different call stack and race the update already
+      // queued, which can drop the write that started it.
+      var suppressSelfSyncRef = React.useRef(false)
       var [panelOpen, setPanelOpen] = React.useState(false)
       var [panelPos, setPanelPos] = React.useState({ left: 16, top: 16 })
       var cardNodeRef = React.useRef(null)
@@ -1828,6 +1918,8 @@ window.__ModuleLoader__.load({
         loadSnap()
         var listensEvents = typeof window.addEventListener === 'function'
         function onRingChange() {
+          // Skip our own echo (see suppressSelfSyncRef).
+          if (suppressSelfSyncRef.current) return
           try {
             setShown(compatibility.storage.getItem(PEAK_RING_KEY) !== 'false')
             setOrient(compatibility.storage.getItem(PEAK_ORIENT_KEY) || 'horizontal')
@@ -1956,6 +2048,33 @@ window.__ModuleLoader__.load({
         } catch (e) { /* ignore */ }
       }, [policy, nowMs])
 
+      var isFreeFloating = dock === 'free'
+      var isVertical = orient === 'vertical' && (wide || isFreeFloating)
+      var isRail = !wide && !isFreeFloating
+
+      // A saved floating coordinate is not trustworthy after a window resize
+      // or scale change. Re-measure the rendered card (including transform)
+      // and persist the corrected coordinate before it can disappear outside
+      // the viewport. This hook must run even while the card is still loading,
+      // otherwise React sees a changing hook count when the snapshot arrives.
+      useLayoutEffect(function () {
+        if (!isFreeFloating || !cardNodeRef.current) return
+        var node = cardNodeRef.current
+        function fitFloatingPeakCard() {
+          if (!node || typeof node.getBoundingClientRect !== 'function') return
+          var rect = node.getBoundingClientRect()
+          var current = latestPosRef.current || pos || { x: rect.left, y: rect.top }
+          var fitted = clampPeakPosition(current, rect.width, rect.height, window.innerWidth, window.innerHeight, 8)
+          if (fitted.x === current.x && fitted.y === current.y && pos !== null) return
+          latestPosRef.current = fitted
+          setPos(fitted)
+          try { compatibility.storage.setItem(PEAK_POS_KEY, JSON.stringify(fitted)) } catch (e) { /* ignore */ }
+        }
+        fitFloatingPeakCard()
+        window.addEventListener('resize', fitFloatingPeakCard)
+        return function () { window.removeEventListener('resize', fitFloatingPeakCard) }
+      }, [isFreeFloating, pos, peakScale, orient, showRecharge])
+
       if (!shown || snapshot === undefined) return null
       var tzName = policy && policy.timezone ? policy.timezone : 'Asia/Shanghai'
       var offsetMinutes = policy && typeof policy.offsetMinutes === 'number' ? policy.offsetMinutes : 480
@@ -1971,33 +2090,41 @@ window.__ModuleLoader__.load({
       var costLabel = sessionCostLabel(balCurrency)
       var low = snapshot && snapshot.lowBalance === true
 
-      var isFreeFloating = dock === 'free'
-      var isVertical = orient === 'vertical' && (wide || isFreeFloating)
-      var isRail = !wide && !isFreeFloating
+      // Announce a preference change to the other surfaces (settings page, a
+      // second window) while suppressing our own listener, so this component's
+      // queued setState is the single writer for this interaction.
+      function announcePrefs(includeRingEvent) {
+        suppressSelfSyncRef.current = true
+        try {
+          try { compatibility.dispatch(SETTINGS_EVENT) } catch (e) { /* ignore */ }
+          if (includeRingEvent !== false) {
+            try { compatibility.dispatch(PEAK_RING_EVENT) } catch (e) { /* ignore */ }
+          }
+        } finally {
+          suppressSelfSyncRef.current = false
+        }
+      }
 
       function updateOrient(val) {
         setOrient(val)
         try { compatibility.storage.setItem(PEAK_ORIENT_KEY, val) } catch (e) { /* ignore */ }
-        try { compatibility.dispatch(SETTINGS_EVENT) } catch (e) { /* ignore */ }
-        try { compatibility.dispatch(PEAK_RING_EVENT) } catch (e) { /* ignore */ }
+        announcePrefs()
       }
       function updateScale(val) {
         val = Math.min(1.2, Math.max(1.0, Math.round(val * 20) / 20))
         setPeakScale(val)
         try { compatibility.storage.setItem(PEAK_SCALE_KEY, String(val)) } catch (e) { /* ignore */ }
-        try { compatibility.dispatch(SETTINGS_EVENT) } catch (e) { /* ignore */ }
-        try { compatibility.dispatch(PEAK_RING_EVENT) } catch (e) { /* ignore */ }
+        announcePrefs()
       }
       function updateRecharge(val) {
         setShowRecharge(val)
         try { compatibility.storage.setItem(PEAK_RECHARGE_KEY, String(val)) } catch (e) { /* ignore */ }
-        try { compatibility.dispatch(SETTINGS_EVENT) } catch (e) { /* ignore */ }
-        try { compatibility.dispatch(PEAK_RING_EVENT) } catch (e) { /* ignore */ }
+        announcePrefs()
       }
       function updateNotify(val) {
         setPeakNotify(val)
         try { compatibility.storage.setItem(PEAK_NOTIFY_KEY, String(val)) } catch (e) { /* ignore */ }
-        try { compatibility.dispatch(SETTINGS_EVENT) } catch (e) { /* ignore */ }
+        announcePrefs(false)
       }
 
       function handlePointerDown(e) {
@@ -2037,11 +2164,10 @@ window.__ModuleLoader__.load({
           if (dragRef.current.dragged) {
             var w = dragRef.current.rectWidth || (isVertical ? 140 : 180)
             var h = dragRef.current.rectHeight || (isVertical ? 120 : 60)
-            var maxX = (window.innerWidth || 1024) - w - 8
-            var maxY = (window.innerHeight || 768) - h - 8
-            var nextX = Math.max(8, Math.min(maxX, moveEvent.clientX - dragRef.current.grabOffsetX))
-            var nextY = Math.max(8, Math.min(maxY, moveEvent.clientY - dragRef.current.grabOffsetY))
-            var nextPos = { x: Math.round(nextX), y: Math.round(nextY) }
+            var nextPos = clampPeakPosition({
+              x: moveEvent.clientX - dragRef.current.grabOffsetX,
+              y: moveEvent.clientY - dragRef.current.grabOffsetY,
+            }, w, h, window.innerWidth, window.innerHeight, 8)
             latestPosRef.current = nextPos
             setPos(nextPos)
           }
@@ -2056,9 +2182,20 @@ window.__ModuleLoader__.load({
             setDragging(false)
             setDock('free')
             setPos(finalPos)
-            try { compatibility.dispatch(SETTINGS_EVENT) } catch (err) { /* ignore */ }
+            announcePrefs(false)
           }
           dragRef.current = null
+          // Release the "this was a drag, swallow the click" latch after the
+          // click that follows pointerup. Without this the flag stays true
+          // whenever the next pointerdown never arrives (pointer released
+          // outside the window, a cancelled gesture), and every later click on
+          // the card is swallowed — the control panel then refuses to open
+          // until the page is reloaded.
+          if (typeof window.setTimeout === 'function') {
+            window.setTimeout(function () { didDragRef.current = false }, 0)
+          } else {
+            didDragRef.current = false
+          }
           window.removeEventListener('pointermove', onMove)
           window.removeEventListener('pointerup', onUp)
           window.removeEventListener('pointercancel', onUp)
@@ -2076,11 +2213,11 @@ window.__ModuleLoader__.load({
         try {
           compatibility.storage.setItem(PEAK_DOCK_KEY, 'sidebar')
           compatibility.storage.removeItem(PEAK_POS_KEY)
-          compatibility.dispatch(SETTINGS_EVENT)
-          compatibility.dispatch(PEAK_RING_EVENT)
         } catch (err) { /* ignore */ }
+        announcePrefs()
       }
 
+
       var cardStyle = {}
       if (isFreeFloating) {
         cardStyle.position = 'fixed'
@@ -2154,7 +2291,7 @@ window.__ModuleLoader__.load({
           onClick: handleResetDock
         }, '↩ 归位') : null,
         React.createElement('div', { style: { flex: 'none', display: 'flex', alignItems: 'center', justifyContent: 'center' } },
-          peakRingSVG(state.configured ? state.windows : null, wallHourIn(tzName, offsetMinutes, new Date(nowMs)), clockSize, state.ariaText)
+          peakRingSVG(state.configured ? state.windows : null, wallHourIn(tzName, offsetMinutes, new Date(nowMs)), clockSize, state.ariaText, state.weekendOffPeak)
         ),
         !isRail ? React.createElement('div', { className: 'dshw_footRingLabel' },
           React.createElement('div', { className: 'dshw_footRingHeader' },
@@ -3853,6 +3990,7 @@ window.__ModuleLoader__.load({
       computeSnapPreview: computeSnapPreview,
       computeSideDockX: computeSideDockX,
       computePanelPosition: computePanelPosition,
+      clampPeakPosition: clampPeakPosition,
       createCompatibilityAdapter: createCompatibilityAdapter,
       fmtCurrency: fmtCurrency,
       selectBalanceInfo: selectBalanceInfo,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "deepseek-harness-wallet",
   "description": "Local-first account monitoring, usage accounting, official recharge, completion reminders, flexible layout, host-gated session controls, and multi-account management with hot account switching for DeepSeek Harness.",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "type": "module",
   "main": "index.js",
   "exports": {