dsh-xueqiu 1.7.0 → 1.7.2

package/README.en.md

@@ -0,0 +1,134 @@
+# dsh-xueqiu · Xueqiu Mini Market Panel
+
+> A Xueqiu (Snowball) market panel for DeepSeek Harness: **no login required** — live A-share/HK/US quotes, candlestick & minute charts, hot lists, search, 7×24 news and trending KOLs. The panel docks above the composer without covering the conversation; a draggable mini badge keeps live indices always visible.
+
+[![npm version](https://img.shields.io/npm/v/dsh-xueqiu?style=flat-square&label=npm)](https://www.npmjs.com/package/dsh-xueqiu)
+[![npm downloads](https://img.shields.io/npm/dm/dsh-xueqiu?style=flat-square)](https://www.npmjs.com/package/dsh-xueqiu)
+[![GitHub stars](https://img.shields.io/github/stars/kangjinghang/dsh-xueqiu?style=flat-square)](https://github.com/kangjinghang/dsh-xueqiu/stargazers)
+[![License](https://img.shields.io/badge/license-MIT-green?style=flat-square)](./LICENSE)
+[![dsh-plugin](https://img.shields.io/badge/dsh-plugin-xueqiu-1DA1F2?style=flat-square)](#install)
+
+[中文](./README.md)
+
+**[Features](#features) · [Screenshots](#screenshots) · [Install](#install) · [Usage](#usage) · [Stability](#stability-design) · [FAQ](#faq) · [Changelog](#changelog)**
+
+## Features
+
+| Feature | Notes |
+| --- | --- |
+| 📊 Live quotes | Major indices (SH/SZ/ChiNext/CSI300) + watchlist, CN-style red-up/green-down, **sortable columns** |
+| 🕯️ Candlestick | Candles + volume bars + **MA5/10/20** + **crosshair tooltip** (OHLC/pct/vol/MAs); 7 periods: 5m/15m/30m/60m/day/week/month |
+| ⏱️ Minute chart | Price + avg lines with prev-close baseline, crosshair for any minute |
+| 🔥 Hot list | Xueqiu trending stocks, switch CN/US/HK/global |
+| 🔍 Search | Stocks (one-click watch/add detail) and posts |
+| 📰 News | 7×24 live news, important items highlighted |
+| 👥 Trending KOLs | Per-stock hot users (followers / verified badge) |
+| 💼 Watchlist | Persisted locally, add/remove in one click |
+| 🧲 Docked panel | Full panel docks **above the composer** (official `conversation.input.dock` slot), flows with layout, **never covers messages** |
+| 🏷️ Mini badge | Floating badge with live SH/SZ indices; click toggles the panel, drag to reposition (position remembered) |
+| 📏 Resizable | Drag the bottom handle (160px–85% viewport, double-click resets); height persisted |
+| ⌨️ Esc collapse | Esc closes detail first, then the panel; reopen via badge or ticker bar |
+| 🛡️ Request guard | Concurrency 2 + 100ms min gap; **30s watchdog** force-releases hung slots; cookie risk-control auto reseed & retry; rate-limit backoff; **auto-pauses all polling while the tab is hidden** |
+| 🗂️ Progressive detail | Quote + kline render first; minute/finance/KOL merge in as they arrive |
+| ⏱️ Smart refresh | 20s during trading hours, slows down after close |
+| 🕐 Market sessions | Header shows **CN/HK/US** session (open·lunch·pre·closed), badge shows precise A-share session |
+| 🌗 Theme aware | Follows the DSH light/dark theme |
+
+All data comes from Xueqiu public web endpoints (anonymous cookie seeded by visiting the homepage + browser UA/Referer). **No login.**
+
+## Screenshots
+
+**Docked panel** — above the composer, index cards + watchlist + four tabs:
+
+![Panel](https://raw.githubusercontent.com/kangjinghang/dsh-xueqiu/main/assets/panel.png)
+
+**Stock detail** — 16 quote stats + candlestick (volume / MA5-10-20 / crosshair) + financials + trending users:
+
+![Detail](https://raw.githubusercontent.com/kangjinghang/dsh-xueqiu/main/assets/detail.png)
+
+**Mini badge** — always-on live indices, click to toggle, draggable:
+
+![Badge](https://raw.githubusercontent.com/kangjinghang/dsh-xueqiu/main/assets/badge.png)
+
+## Install
+
+### Option 1: Standard bundle plugin (recommended)
+
+```bash
+# from npm
+dsh plugin --profile web add dsh-xueqiu
+
+# or from GitHub source
+dsh plugin --profile web add github:kangjinghang/dsh-xueqiu
+
+# or a local checkout
+dsh plugin --profile web add ./dsh-xueqiu
+```
+
+Restart `dsh web` once after adding (plugin rows are discovered at startup), then refresh the page.
+
+### Option 2: Dynamic plugin (battle-tested)
+
+The `dynamic/` directory ships tested dynamic Cordis plugin sources (`host.js` + `client.js`). Ask any DSH agent session to load them:
+
+```
+Read dynamic/host.js and dynamic/client.js from this repo,
+define a plugin with cordis_define (kind: new):
+  code.host = contents of host.js, code.client = contents of client.js,
+  then cordis_run it.
+```
+
+## Usage
+
+- The panel docks above the composer, in the conversation column; `Collapse —` or `Esc` hides it.
+- The bottom-right mini badge shows live SH/SZ indices; **click** toggles the panel, **drag** to move (remembered).
+- The ticker bar under the composer also expands the panel on click.
+- Click any watchlist row, index card or hot-list row for the detail view: 16 stats + K-line/minute toggle (hover for crosshair) + financials + trending users.
+- **Resize**: drag the handle under the panel (160px–85% viewport); double-click resets; height is remembered.
+- Refresh cadence: 20s quotes / 60s content during trading hours; 60s / 3min after close.
+
+## Stability design
+
+The data layer is defended in depth — safe to leave open for hours:
+
+- **Request gate**: max 2 concurrent, 100ms minimum gap, mirroring the web client's rhythm.
+- **30s watchdog**: any hung request is force-released after 30s so the pipeline never freezes.
+- **TTL cache + in-flight dedup**: identical URLs hit cache within the window; concurrent duplicates share one Promise.
+- **Cookie self-healing**: anonymous cookie expiry (error 400016) or risk-control empty responses trigger automatic reseeding and retry.
+- **Rate-limit backoff**: 2s → 4s exponential backoff on "too frequent" errors.
+- **Hidden-tab pause**: all polling stops while the page is hidden and refreshes immediately on return.
+- **Progressive rendering**: quote + kline first; the rest merges in.
+
+## FAQ
+
+**Panel doesn't show up after install?** Restart `dsh web` once (see above) and hard-refresh (Ctrl/Cmd+Shift+R). If the badge is visible, click it to expand the panel.
+
+**Quotes suddenly empty / errors?** The anonymous cookie occasionally gets risk-controlled (error 400016 or empty body). The plugin reseeds and retries automatically; if it keeps failing, wait a minute and hit refresh, or collapse the panel to lower the request rate.
+
+**Why no period buttons in minute mode?** Minute mode shows only the current day; the 7 periods exist in K-line mode. By design.
+
+**Are session hints holiday-aware?** No — they're fixed-clock weekday estimates without holiday calendars, for reference only.
+
+**Where is my data stored?** Host-side files `~/.xueqiu-watchlist.json` and `~/.xueqiu-ui-state.json` — browser-independent.
+
+**Does it touch DSH itself?** No. All UI mounts in official slots (`conversation.input.dock` / `shell.overlay` / `conversation.composer.dock`); uninstalling removes everything.
+
+## Disclaimer
+
+- This is **not** an official Xueqiu product. "雪球/Xueqiu" is a trademark of Xueqiu Inc., referenced here only as the data source.
+- Data comes from public web endpoints for **study and research** only; **not investment advice**. Do not hammer the endpoints; respect the site's terms.
+- Endpoints may change at any time and break features — [issues](https://github.com/kangjinghang/dsh-xueqiu/issues) and PRs welcome.
+
+## Changelog
+
+- **1.7.2** (2025-08-19) — News tab pagination: scroll-to-bottom or "load earlier" fetches older items (max_id cursor, deduped); refresh resets to the latest page.
+- **1.7.1** (2025-08-19) — Fix static install (`dsh plugin add`) crashing `dsh web` startup: dual-mode RPC (harness.handle for dynamic runs, a loopback+same-origin fenced `/xq-rpc` webServer route for static installs) and a proper `__ModuleLoader__` CJS client bundle.
+- **1.7.0** (2025-08-19) — Hidden-tab polling pause + CN/HK/US market session hints.
+- **1.6.1** — Pipeline deadlock watchdog fix, tab-switch fix, badgePos restore fix, debug RPC.
+- **1.6.0** — Draggable panel height (smooth zero-rerender, double-click reset, persisted).
+- **1.5.x** — Request scheduling & cache hardening (concurrency 2 + 100ms gap, TTL cache, error-classified retries).
+- **1.4.x** — Progressive detail rendering, full kline periods, crosshair.
+
+## License
+
+[MIT](./LICENSE)

package/README.md

@@ -2,9 +2,26 @@
 
 > DeepSeek Harness 上的雪球行情面板：**免登录**查看 A股/港股/美股实时行情、K线、分时、热榜、搜索、7×24 快讯与热议用户。面板嵌入输入框上方不遮挡对话，迷你徽章常驻实时指数，交易时段智能刷新。
 
-![badge](https://img.shields.io/badge/dsh-plugin-xueqiu-1DA1F2)
-![badge](https://img.shields.io/badge/platform-web-blue)
-![license](https://img.shields.io/badge/license-MIT-green)
+[![npm version](https://img.shields.io/npm/v/dsh-xueqiu?style=flat-square&label=npm)](https://www.npmjs.com/package/dsh-xueqiu)
+[![npm downloads](https://img.shields.io/npm/dm/dsh-xueqiu?style=flat-square)](https://www.npmjs.com/package/dsh-xueqiu)
+[![GitHub stars](https://img.shields.io/github/stars/kangjinghang/dsh-xueqiu?style=flat-square)](https://github.com/kangjinghang/dsh-xueqiu/stargazers)
+[![License](https://img.shields.io/badge/license-MIT-green?style=flat-square)](./LICENSE)
+[![dsh-plugin](https://img.shields.io/badge/dsh-plugin-xueqiu-1DA1F2?style=flat-square)](#-安装)
+
+中文 | [English](./README.en.md)
+
+**[功能](#-功能) · [截图](#-截图) · [安装](#-安装) · [使用](#️-使用) · [稳定性](#-稳定性设计) · [FAQ](#-faq) · [更新日志](#-更新日志)**
+
+## 🆚 与同类行情插件
+
+| 能力 | dsh-xueqiu | 股票皮肤类插件 |
+| --- | --- | --- |
+| 面板形态 | 嵌入输入框上方，不遮挡对话 | 全局换肤/状态栏 |
+| K线/分时 | 蜡烛图+均线+十字光标，7 档周期 | 部分有 |
+| 热榜/快讯/KOL | 全有 | 多数无 |
+| 数据源 | 雪球（社区数据：帖子/热议用户独有） | 腾讯/Yahoo 等 |
+| 请求防护 | 闸门+看门狗+缓存+自愈+隐藏暂停 | 一般仅缓存 |
+| 主题 | 跟随 DSH 明暗 | 需整体换肤 |
 
 ## ✨ 功能
 
@@ -106,6 +123,26 @@ dsh-xueqiu/
 └── cordis.patch.yml      # bundle 层插入
 ```
 
+## ❓ FAQ
+
+**Q: 安装后面板不出现？**
+按安装说明重启一次 `dsh web`（插件行按启动缓存发现），再硬刷新页面（Ctrl/Cmd+Shift+R）。仍无面板时看右下角有无迷你徽章——徽章在则点徽章展开。
+
+**Q: 行情数据突然全空/报错？**
+雪球匿名 cookie 偶发被风控（错误码 400016 或空响应）。插件会自动重播种 cookie 并重试；连续失败时等 1–2 分钟再点「刷新」，或收起面板降低请求频率。
+
+**Q: K线周期里分时下为什么没有周期按钮？**
+分时模式只展示当日分钟线，K线模式才有 7 档周期，属设计行为。
+
+**Q: 交易时段提示节假日准吗？**
+不准。时段按每周一至周五的固定钟点本地推算，不含法定节假日调休，仅供参考。
+
+**Q: 自选股和面板设置存在哪？**
+宿主本地文件 `~/.xueqiu-watchlist.json` 与 `~/.xueqiu-ui-state.json`，与浏览器 localStorage 无关，换浏览器不丢。
+
+**Q: 会不会影响 DSH 本体？**
+插件 UI 全部挂在官方槽位（`conversation.input.dock` / `shell.overlay` / `conversation.composer.dock`），卸载即完全消失，不改 DSH 源码。
+
 ## ⚠️ 免责声明
 
 - 本项目**非雪球官方**产品，与雪球网/雪球公司无关；"雪球"为雪球公司商标，此处仅作数据来源描述。
@@ -114,6 +151,11 @@ dsh-xueqiu/
 
 ## 📋 更新日志
 
+- **1.7.2**（2025-08-19）
+  - 新增：快讯 tab 翻页——滚动到底或点「加载更早」自动加载历史快讯（max_id 游标，自动去重），「刷新」重置回最新一页。
+- **1.7.1**（2025-08-19）
+  - 修复：`dsh plugin add` 静态安装后 `dsh web` 启动即崩（`harness is not defined`）——静态安装改走 `webServer` 前缀路由 `/xq-rpc`（带回环 + 同源双重栅栏），动态运行时仍走 `harness.handle`，双模式自动切换。
+  - 修复：静态安装的浏览器端 bundle 格式（`__ModuleLoader__` CJS 工厂）与网络通道（同源 fetch 替代 `host.call`），面板/徽章/指数条在静态模式下完整可用。
 - **1.7.0**（2025-08-19）
   - 新增：页面隐藏时自动暂停面板/徽章/指数条全部轮询，回到前台立即刷新——切走不浪费请求，显著降低雪球风控触发概率。
   - 新增：A 股/港股/美股三市场交易时段提示（盘中·午休·盘前·休市，本地 Intl 时区推算，不含节假日），面板头常驻显示，徽章显示精确 A 股时段，每分钟自动刷新。

package/dynamic/client.js

@@ -62,6 +62,8 @@ return {
       '.xq-news-item{font-size:12.5px;padding:6px 8px;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l1);border-radius:7px;}\n' +
       '.xq-news-item.xq-important{border-left:3px solid var(--dsw-alias-state-warn-primary);}\n' +
       '.xq-news-time{font-size:10.5px;color:var(--dsw-alias-label-secondary);margin-top:3px;}\n' +
+      '.xq-news-more{font-size:11.5px;color:var(--dsw-alias-label-secondary);text-align:center;padding:6px 0 2px;cursor:pointer;user-select:none;}\n' +
+      '.xq-news-more:hover{color:var(--dsw-alias-label-primary);}\n' +
       '.xq-detail-head{display:flex;align-items:center;gap:10px;margin-bottom:8px;flex-wrap:wrap;}\n' +
       '.xq-detail-name{font-size:15px;font-weight:700;}\n' +
       '.xq-detail-code{font-size:11px;color:var(--dsw-alias-label-secondary);}\n' +
@@ -461,6 +463,8 @@ return {
       const [hot, setHot] = React.useState([])
       const [hotMarket, setHotMarket] = React.useState('cn')
       const [news, setNews] = React.useState([])
+      const [newsMore, setNewsMore] = React.useState(false)   // 翻页加载中
+      const [newsNoMore, setNewsNoMore] = React.useState(false) // 已到最旧
       const [searchQ, setSearchQ] = React.useState('')
       const [searchMode, setSearchMode] = React.useState('stock')
       const [searchRes, setSearchRes] = React.useState([])
@@ -505,12 +509,32 @@ return {
         ]).then(function (res) {
           setHot((res[0] && res[0].list) || [])
           setNews((res[1] && res[1].items) || [])
+          setNewsMore(false)
+          setNewsNoMore(false)
           setErr('')
         }).catch(function (e) {
           setErr(String((e && e.message) || e))
         })
       }
 
+      // 快讯翻页：max_id = 当前最旧一条 id，返回严格更早的记录
+      function loadMoreNews() {
+        if (newsMore || newsNoMore || !news.length) return
+        const maxId = news[news.length - 1].id
+        setNewsMore(true)
+        call('news', { count: 20, max_id: maxId }).then(function (res) {
+          const items = (res && res.items) || []
+          const seen = {}
+          news.forEach(function (it) { seen[it.id] = true })
+          const fresh = items.filter(function (it) { return !seen[it.id] })
+          if (!fresh.length) setNewsNoMore(true)
+          else setNews(news.concat(fresh))
+          setNewsMore(false)
+        }).catch(function () {
+          setNewsMore(false)
+        })
+      }
+
       React.useEffect(function () {
         setLoading(true)
         refreshMarket().then(function () { return refreshContent() })
@@ -868,8 +892,20 @@ return {
             el('div', { key: 'm', className: 'xq-news-time' }, fmtTime(it.created_at) + (it.mark === 1 ? ' · 重要' : ''))
           ])
         })
+        // 滚动到底自动加载；手动入口兜底（滚轮惯性/触控板场景）
+        kids.push(el('div', {
+          key: 'more',
+          className: 'xq-news-more',
+          onClick: function () { loadMoreNews() }
+        }, newsMore ? '加载中…' : (newsNoMore ? '没有更早的快讯了' : '加载更早 ↑')))
         return news.length
-          ? el('div', { className: 'xq-news' }, kids)
+          ? el('div', {
+              className: 'xq-news',
+              onScroll: function (e) {
+                const n = e.target
+                if (n.scrollTop + n.clientHeight >= n.scrollHeight - 40) loadMoreNews()
+              }
+            }, kids)
           : el('div', { className: 'xq-muted' }, '暂无快讯')
       }
 

package/dynamic/host.js

@@ -375,7 +375,10 @@ return {
 
     async function actNews(args) {
       const count = Math.min(Math.max(parseInt(args.count, 10) || 20, 1), 50)
-      const data = await getJSON('/statuses/livenews/list.json', { since_id: -1, max_id: -1, count: count }, { base: SITE, ttl: 120000 })
+      // max_id 翻页游标：-1 取最新一页；传上一页最旧一条 id 继续往回翻
+      const maxId = parseInt(args.max_id, 10)
+      const cursor = isFinite(maxId) && maxId > 0 ? maxId : -1
+      const data = await getJSON('/statuses/livenews/list.json', { since_id: -1, max_id: cursor, count: count }, { base: SITE, ttl: 120000 })
       const items = (data && data.items) || []
       return {
         items: items.map(function (it) {
@@ -542,19 +545,53 @@ return {
       }
     }
 
-    ctx.effect(function () {
-      return harness.handle('xq.call', async function (req) {
-        const reqObj = (req && typeof req === 'object') ? req : {}
-        const action = reqObj.action
-        const args = reqObj.args || {}
-        if (!dispatch[action]) return { ok: false, error: '未知操作: ' + action }
-        try {
-          const data = await dispatch[action](args)
-          return { ok: true, data: sanitize(data) }
-        } catch (e) {
-          return { ok: false, error: String((e && e.message) || e) }
-        }
+    async function handleCall (req) {
+      const reqObj = (req && typeof req === 'object') ? req : {}
+      const action = reqObj.action
+      const args = reqObj.args || {}
+      if (!dispatch[action]) return { ok: false, error: '未知操作: ' + action }
+      try {
+        const data = await dispatch[action](args)
+        return { ok: true, data: sanitize(data) }
+      } catch (e) {
+        return { ok: false, error: String((e && e.message) || e) }
+      }
+    }
+
+    // 动态插件运行时提供 harness 门面；静态安装（bundle layer）没有，
+    // 改走 webServer 前缀路由，client 用同源 fetch 调 /xq-rpc。
+    if (typeof harness !== 'undefined') {
+      ctx.effect(function () {
+        return harness.handle('xq.call', handleCall)
       })
-    })
+    } else {
+      ctx.inject(['webServer'], function (webCtx) {
+        webCtx.effect(function () {
+          return webCtx.webServer.register({
+          kind: 'prefix',
+          path: '/xq-rpc',
+          handler: async function (req, res) {
+            // 同源栅栏：Host 头必须是回环，带 Origin 时必须同源（防 DNS rebinding/CSRF）
+            const hostHeader = String(req.headers.host || '')
+            const origin = req.headers.origin ? String(req.headers.origin) : ''
+            const hostAuth = hostHeader.replace(/:\d+$/, '')
+            const loopback = hostAuth === '127.0.0.1' || hostAuth === 'localhost' || hostAuth === '[::1]' || hostAuth === '::1'
+            if (!loopback) { res.writeHead(403); res.end('forbidden'); return }
+            if (origin && origin !== 'http://' + hostHeader && origin !== 'https://' + hostHeader) {
+              res.writeHead(403); res.end('forbidden'); return
+            }
+            const chunks = []
+            for await (const c of req) chunks.push(c)
+            let body = {}
+            try { body = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}') } catch (e) { body = {} }
+            const result = await handleCall(body)
+            const text = JSON.stringify(result)
+            res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' })
+            res.end(text)
+          }
+          })
+        })
+      })
+    }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-xueqiu",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "雪球 mini 行情面板 — DeepSeek Harness 免登录 A股/港美股实时行情、K线(蜡烛/成交量/均线)、分时图、热榜、搜索、7x24 快讯、热议用户。嵌入式面板 + 可拖拽行情徽标，内置请求节流、TTL 缓存与 Cookie 自动续期。",
   "keywords": [
     "dsh",
@@ -46,5 +46,10 @@
     "cordis.patch.yml",
     "README.md",
     "LICENSE"
-  ]
+  ],
+  "scripts": {
+    "generate": "python3 scripts/gen-static.py",
+    "check": "python3 scripts/gen-static.py --check && node --check src/index.js && node --check src/client/index.js && node -e \"new Function(require('fs').readFileSync('dynamic/host.js','utf8'))\" && node -e \"new Function(require('fs').readFileSync('dynamic/client.js','utf8'))\" && bash scripts/static-smoke.sh",
+    "prepublishOnly": "npm run check"
+  }
 }

package/src/client/index.js

@@ -1,7 +1,26 @@
-return {
+// 由 scripts/gen-static.py 从 dynamic/client.js 生成 —— 勿手改；改 dynamic/ 后重新生成。
+// 静态 bundle 格式：classic script 注册到 __ModuleLoader__，factory 为 CJS 形式。
+window.__ModuleLoader__.load({
+  id: 'dsh-xueqiu',
+  factory: function (require) {
+    var module = { exports: {} }
+    var exports = module.exports
+    const React = require('react')
+
+    // 动态运行时 styles.insert 的替代：自管 <style> 标签（随插件停用移除交给卸载流程）
+    let _styleTag = null
+    function insertStyle (css) {
+      if (typeof document === 'undefined' || !document.head) return
+      _styleTag = document.createElement('style')
+      _styleTag.setAttribute('data-plugin', 'dsh-xueqiu')
+      _styleTag.textContent = css
+      document.head.appendChild(_styleTag)
+    }
+
+exports.default = {
   inject: ['timer'],
   apply(ctx) {
-    styles.insert('\n' +
+    insertStyle('\n' +
       '.xq-dock{background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l1);border-radius:10px;overflow:hidden;font-size:13px;line-height:1.45;color:var(--dsw-alias-label-primary);margin-bottom:6px;}\n' +
       '.xq-dock *{box-sizing:border-box;}\n' +
       '.xq-dock-head{display:flex;align-items:center;gap:8px;padding:7px 12px;border-bottom:1px solid var(--dsw-alias-border-l1);}\n' +
@@ -62,6 +81,8 @@ return {
       '.xq-news-item{font-size:12.5px;padding:6px 8px;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l1);border-radius:7px;}\n' +
       '.xq-news-item.xq-important{border-left:3px solid var(--dsw-alias-state-warn-primary);}\n' +
       '.xq-news-time{font-size:10.5px;color:var(--dsw-alias-label-secondary);margin-top:3px;}\n' +
+      '.xq-news-more{font-size:11.5px;color:var(--dsw-alias-label-secondary);text-align:center;padding:6px 0 2px;cursor:pointer;user-select:none;}\n' +
+      '.xq-news-more:hover{color:var(--dsw-alias-label-primary);}\n' +
       '.xq-detail-head{display:flex;align-items:center;gap:10px;margin-bottom:8px;flex-wrap:wrap;}\n' +
       '.xq-detail-name{font-size:15px;font-weight:700;}\n' +
       '.xq-detail-code{font-size:11px;color:var(--dsw-alias-label-secondary);}\n' +
@@ -104,7 +125,7 @@ return {
     function el(type, props, children) { return React.createElement(type, props, children) }
 
     async function call(action, args) {
-      const r = await host.call('xq.call', { action: action, args: args || {} })
+      const r = await fetch('/xq-rpc', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ action: action, args: args || {} }) }).then(function (res) { return res.json() })
       if (!r || !r.ok) throw new Error((r && r.error) || '调用失败')
       return r.data
     }
@@ -461,6 +482,8 @@ return {
       const [hot, setHot] = React.useState([])
       const [hotMarket, setHotMarket] = React.useState('cn')
       const [news, setNews] = React.useState([])
+      const [newsMore, setNewsMore] = React.useState(false)   // 翻页加载中
+      const [newsNoMore, setNewsNoMore] = React.useState(false) // 已到最旧
       const [searchQ, setSearchQ] = React.useState('')
       const [searchMode, setSearchMode] = React.useState('stock')
       const [searchRes, setSearchRes] = React.useState([])
@@ -505,12 +528,32 @@ return {
         ]).then(function (res) {
           setHot((res[0] && res[0].list) || [])
           setNews((res[1] && res[1].items) || [])
+          setNewsMore(false)
+          setNewsNoMore(false)
           setErr('')
         }).catch(function (e) {
           setErr(String((e && e.message) || e))
         })
       }
 
+      // 快讯翻页：max_id = 当前最旧一条 id，返回严格更早的记录
+      function loadMoreNews() {
+        if (newsMore || newsNoMore || !news.length) return
+        const maxId = news[news.length - 1].id
+        setNewsMore(true)
+        call('news', { count: 20, max_id: maxId }).then(function (res) {
+          const items = (res && res.items) || []
+          const seen = {}
+          news.forEach(function (it) { seen[it.id] = true })
+          const fresh = items.filter(function (it) { return !seen[it.id] })
+          if (!fresh.length) setNewsNoMore(true)
+          else setNews(news.concat(fresh))
+          setNewsMore(false)
+        }).catch(function () {
+          setNewsMore(false)
+        })
+      }
+
       React.useEffect(function () {
         setLoading(true)
         refreshMarket().then(function () { return refreshContent() })
@@ -868,8 +911,20 @@ return {
             el('div', { key: 'm', className: 'xq-news-time' }, fmtTime(it.created_at) + (it.mark === 1 ? ' · 重要' : ''))
           ])
         })
+        // 滚动到底自动加载；手动入口兜底（滚轮惯性/触控板场景）
+        kids.push(el('div', {
+          key: 'more',
+          className: 'xq-news-more',
+          onClick: function () { loadMoreNews() }
+        }, newsMore ? '加载中…' : (newsNoMore ? '没有更早的快讯了' : '加载更早 ↑')))
         return news.length
-          ? el('div', { className: 'xq-news' }, kids)
+          ? el('div', {
+              className: 'xq-news',
+              onScroll: function (e) {
+                const n = e.target
+                if (n.scrollTop + n.clientHeight >= n.scrollHeight - 40) loadMoreNews()
+              }
+            }, kids)
           : el('div', { className: 'xq-muted' }, '暂无快讯')
       }
 
@@ -1131,3 +1186,6 @@ return {
 
   }
 }
+    return module.exports
+  }
+})

package/src/index.js

@@ -375,7 +375,10 @@ export default {
 
     async function actNews(args) {
       const count = Math.min(Math.max(parseInt(args.count, 10) || 20, 1), 50)
-      const data = await getJSON('/statuses/livenews/list.json', { since_id: -1, max_id: -1, count: count }, { base: SITE, ttl: 120000 })
+      // max_id 翻页游标：-1 取最新一页；传上一页最旧一条 id 继续往回翻
+      const maxId = parseInt(args.max_id, 10)
+      const cursor = isFinite(maxId) && maxId > 0 ? maxId : -1
+      const data = await getJSON('/statuses/livenews/list.json', { since_id: -1, max_id: cursor, count: count }, { base: SITE, ttl: 120000 })
       const items = (data && data.items) || []
       return {
         items: items.map(function (it) {
@@ -542,19 +545,53 @@ export default {
       }
     }
 
-    ctx.effect(function () {
-      return harness.handle('xq.call', async function (req) {
-        const reqObj = (req && typeof req === 'object') ? req : {}
-        const action = reqObj.action
-        const args = reqObj.args || {}
-        if (!dispatch[action]) return { ok: false, error: '未知操作: ' + action }
-        try {
-          const data = await dispatch[action](args)
-          return { ok: true, data: sanitize(data) }
-        } catch (e) {
-          return { ok: false, error: String((e && e.message) || e) }
-        }
+    async function handleCall (req) {
+      const reqObj = (req && typeof req === 'object') ? req : {}
+      const action = reqObj.action
+      const args = reqObj.args || {}
+      if (!dispatch[action]) return { ok: false, error: '未知操作: ' + action }
+      try {
+        const data = await dispatch[action](args)
+        return { ok: true, data: sanitize(data) }
+      } catch (e) {
+        return { ok: false, error: String((e && e.message) || e) }
+      }
+    }
+
+    // 动态插件运行时提供 harness 门面；静态安装（bundle layer）没有，
+    // 改走 webServer 前缀路由，client 用同源 fetch 调 /xq-rpc。
+    if (typeof harness !== 'undefined') {
+      ctx.effect(function () {
+        return harness.handle('xq.call', handleCall)
       })
-    })
+    } else {
+      ctx.inject(['webServer'], function (webCtx) {
+        webCtx.effect(function () {
+          return webCtx.webServer.register({
+          kind: 'prefix',
+          path: '/xq-rpc',
+          handler: async function (req, res) {
+            // 同源栅栏：Host 头必须是回环，带 Origin 时必须同源（防 DNS rebinding/CSRF）
+            const hostHeader = String(req.headers.host || '')
+            const origin = req.headers.origin ? String(req.headers.origin) : ''
+            const hostAuth = hostHeader.replace(/:\d+$/, '')
+            const loopback = hostAuth === '127.0.0.1' || hostAuth === 'localhost' || hostAuth === '[::1]' || hostAuth === '::1'
+            if (!loopback) { res.writeHead(403); res.end('forbidden'); return }
+            if (origin && origin !== 'http://' + hostHeader && origin !== 'https://' + hostHeader) {
+              res.writeHead(403); res.end('forbidden'); return
+            }
+            const chunks = []
+            for await (const c of req) chunks.push(c)
+            let body = {}
+            try { body = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}') } catch (e) { body = {} }
+            const result = await handleCall(body)
+            const text = JSON.stringify(result)
+            res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' })
+            res.end(text)
+          }
+          })
+        })
+      })
+    }
   }
 }