fix: stabilize selected batch submit state

.gitignore

@@ -1,4 +1,18 @@
 .worktrees/
 .old-reference/
+.local/
 dist/
+dist-release/
+release/
 node_modules/
+
+# Local debug captures
+after-export-requests.txt
+before-export-requests.txt
+network-after-page2.txt
+
+# Unrelated local planning artifacts
+docs/superpowers/plans/2026-04-25-professional-capability-exam-guide.md
+docs/superpowers/specs/2026-04-25-professional-capability-exam-guide-design.md
+externaldocs/2026-04-25-专业能力测试冲刺讲义.html
+externaldocs/2026-04-25-专业能力测试冲刺讲义.pdf

README.md

@@ -1,36 +1,191 @@
-# Star Chart Search Enhancer
+# 星图增强插件
 
-Chrome MV3 extension for the Xingtu creator market page.
+这是一个供公司内部使用的 Chrome MV3 插件，用于增强巨量星图达人市场页面的使用体验。
 
-## Development
+主要功能：
+
+- 在星图达人列表页补充插件侧数据列
+- 支持勾选部分达人后导出 CSV
+- 支持将达人数据提交为批次
+- 集成 Logto 登录
+- 支持内部压缩包分发后通过 `Load unpacked` 安装
+
+当前固定扩展 ID：
+
+- `pkjopdibdnomhogjheclhnknmejccffg`
+
+---
+
+## 一、项目目录
+
+- `src/`
+  - 插件源码
+- `dist/`
+  - 开发构建产物
+- `dist-release/`
+  - 内部分发构建产物
+- `release/`
+  - 打包后的内部交付压缩包
+- `docs/`
+  - 项目说明文档
+- `tests/`
+  - 自动化测试
+- `scripts/`
+  - 构建和打包脚本
+
+---
+
+## 二、开发环境
+
+安装依赖：
+
+```bash
+npm install
+```
+
+运行测试：
+
+```bash
+npm test
+```
+
+开发构建：
+
+```bash
+npm run build
+```
+
+说明：
+
+- `npm run build` 会生成开发版到 `dist/`
+- 开发版包含本地调试需要的宽权限
+
+---
+
+## 三、内部交付构建
+
+生成内部使用构建：
+
+```bash
+npm run build:release
+```
+
+生成内部压缩包：
+
+```bash
+npm run package:internal
+```
+
+生成结果：
+
+- 构建目录：`dist-release/`
+- 压缩包：`release/star-chart-search-enhancer-internal.zip`
+
+说明：
+
+- 这个压缩包不是给 Chrome 商店上传的
+- 它是发给公司内部同事使用的交付包
+- 同事收到后需要解压，再到 `chrome://extensions` 中 `Load unpacked`
+
+---
+
+## 四、插件安装方式
+
+本项目当前采用公司内部手工安装方式：
+
+1. 解压内部压缩包
+2. 打开 `chrome://extensions`
+3. 打开右上角 `开发者模式`
+4. 点击 `加载已解压的扩展程序`
+5. 选择解压后的插件文件夹
+
+安装后请确认扩展 ID 是：
+
+- `pkjopdibdnomhogjheclhnknmejccffg`
+
+---
+
+## 五、认证与配置
+
+插件使用 Logto 登录。
+
+认证配置位于：
+
+- `src/shared/auth-config.ts`
+
+当前主要配置包括：
+
+- `logtoEndpoint`
+- `appId`
+- `apiResource`
+- `scopes`
+
+说明：
+
+- popup 中的开发调试面板默认关闭
+- 如果需要本地调试受保护接口，可以手动把 `enableDevAuthPanel` 改为 `true`
+
+---
+
+## 六、批次提交说明
+
+提交批次时，前端当前会提交以下核心字段：
+
+- `logtoUserId`
+- `creatorName`
+- `resource`
+- `batchName`
+- `createdAt`
+- `authors`
+
+说明：
+
+- `batchId` 不再由前端生成
+- 现在由后端生成 7 位数字批次 ID
+
+---
+
+## 七、重要文档
+
+给内部同事的安装与使用说明：
+
+- `docs/aigc-user-guide.md`
+
+内部压缩包分发说明：
+
+- `docs/internal-extension-distribution.md`
+
+---
+
+## 八、常用命令
 
 ```bash
 npm install
 npm test
 npm run build
+npm run build:release
+npm run package:internal
 ```
 
-## Load The Extension
+---
 
-1. Run `npm run build`
+## 九、维护注意事项
-2. Open `chrome://extensions`
-3. Enable developer mode
-4. Choose `Load unpacked`
-5. Select the `dist/` directory
 
-## Current Scope
+- 扩展 ID 已通过 `manifest.key` 固定
+- 不要泄露本地私钥文件 `.local/extension-key.pem`
+- 如果后端地址发生变化，需要同步更新：
+  - `scripts/manifest.mjs`
+  - 对应后端配置文件
+  - 相关文档
 
-- Adds two after-search-rate columns to the Xingtu market list
+---
-- Hydrates the current page immediately
-- Provides plugin-owned filter, sort, and CSV export controls
-- Triggers full-scan flow only when filter, sort, or export is used
 
-## Manual Verification
+## 十、当前状态
 
-1. Load the unpacked extension from `dist/`
+当前项目已经支持：
-2. Open `https://xingtu.cn/ad/creator/market`
+
-3. Confirm the two new columns appear
+- 新固定扩展 ID
-4. Confirm current-page rows move through loading and then render values or failure states
+- 内部压缩包分发
-5. Apply a threshold filter and confirm the list hides unmatched rows
+- 自定义批次名称弹窗
-6. Apply a sort and confirm row order changes
+- 后台静默导出
-7. Export CSV and confirm the file includes plugin status and after-search-rate fields
+- 批次提交不再由前端生成 `batchId`

docs/aigc-user-guide.md

@@ -0,0 +1,502 @@
+# 星图增强插件使用说明
+
+适用对象：AIGC 部门同事，默认不需要任何编程基础。
+
+这份说明会教你：
+
+- 如何安装插件
+- 如何登录插件
+- 如何在星图页面使用导出和提交批次功能
+- 如何更新插件
+- 遇到问题时应该怎么处理
+
+---
+
+## 一、这是什么
+
+这是一个给巨量星图达人列表页使用的 Chrome 插件。
+
+它的主要作用是：
+
+- 在星图达人列表页面提供增强数据
+- 支持勾选部分达人后导出 CSV
+- 支持把达人列表提交为批次
+
+插件名称：
+
+- `Star Chart Search Enhancer`
+
+当前固定扩展 ID：
+
+- `pkjopdibdnomhogjheclhnknmejccffg`
+
+如果你在 Chrome 扩展页里看到这个 ID，说明装的是正确版本。
+
+---
+
+## 二、安装前准备
+
+开始前请先确认：
+
+1. 你使用的是 `Google Chrome` 浏览器。
+2. 你已经拿到了同事发给你的插件压缩包：
+   - `star-chart-search-enhancer-internal.zip`
+3. 你可以正常访问：
+   - 巨量星图
+   - 公司登录系统
+
+注意：
+
+- 这个插件不是从 Chrome 网上应用店安装的。
+- 你必须手动解压并加载。
+
+---
+
+## 三、第一次安装
+
+### 第 1 步：解压压缩包
+
+找到收到的压缩包：
+
+- `star-chart-search-enhancer-internal.zip`
+
+右键解压。
+
+解压后你会得到一个文件夹。请记住这个文件夹的位置，不要删除。
+
+建议放在：
+
+- 桌面
+- 下载目录
+- 或者一个不会随手清理掉的位置
+
+不要放在：
+
+- 临时目录
+- 会被自动清理的文件夹
+
+原因：
+
+- Chrome 加载的是这个文件夹本身
+- 如果文件夹被删了，插件就失效了
+
+### 第 2 步：打开 Chrome 扩展页面
+
+在 Chrome 地址栏输入：
+
+```text
+chrome://extensions
+```
+
+然后按回车。
+
+### 第 3 步：打开开发者模式
+
+在扩展页面右上角，找到：
+
+- `开发者模式`
+
+把它打开。
+
+### 第 4 步：加载插件
+
+点击左上角或页面上的：
+
+- `加载已解压的扩展程序`
+
+然后选择刚才解压出来的那个文件夹。
+
+选择后，Chrome 会自动加载插件。
+
+### 第 5 步：确认是否安装成功
+
+在扩展列表中找到：
+
+- `Star Chart Search Enhancer`
+
+点击 `详情` 后，确认扩展 ID 是：
+
+- `pkjopdibdnomhogjheclhnknmejccffg`
+
+如果是这个 ID，说明安装的是正确版本。
+
+---
+
+## 四、固定到浏览器工具栏
+
+为了后续登录方便，建议把插件固定到工具栏。
+
+操作方法：
+
+1. 点击 Chrome 右上角的拼图图标
+2. 找到 `Star Chart Search Enhancer`
+3. 点击右边的图钉
+
+固定后，浏览器右上角就能直接看到插件图标。
+
+---
+
+## 五、如何登录
+
+### 第 1 步：打开插件弹窗
+
+点击 Chrome 右上角工具栏中的插件图标。
+
+### 第 2 步：点击登录
+
+如果当前未登录，你会看到登录按钮。
+
+点击：
+
+- `登录 Logto`
+
+### 第 3 步：完成登录
+
+系统会自动跳转到公司登录流程。
+
+按页面提示完成登录。
+
+### 第 4 步：确认登录成功
+
+登录成功后，再次点击插件图标。
+
+你会看到：
+
+- 已登录状态
+- 你的用户名信息
+- 退出登录按钮
+
+如果这里能正常显示，说明登录已经成功。
+
+---
+
+## 六、进入星图页面
+
+插件只在巨量星图达人市场页面生效。
+
+请打开类似下面的页面：
+
+```text
+https://xingtu.cn/ad/creator/market
+```
+
+进入后，等待页面加载完成。
+
+如果你已经登录插件，页面上会出现插件自己的工具栏和增强列。
+
+---
+
+## 七、页面上你会看到什么
+
+在星图页面中，插件会新增一组自己的操作区，常见元素包括：
+
+- 导出范围下拉框
+- `导出CSV` 按钮
+- `提交批次` 按钮
+- 状态提示文字
+- 每一行达人前面的勾选框
+
+其中：
+
+- `导出CSV`：把当前选择的数据导出为表格文件
+- `提交批次`：把当前选择的数据提交为批次
+
+---
+
+## 八、如何选择达人
+
+页面上每个达人前面都有一个勾选框。
+
+你可以：
+
+- 单独勾选某几个达人
+- 勾选表头复选框，快速全选当前页
+
+规则说明：
+
+- 如果你勾选了达人，再点击导出或提交，系统会优先处理你勾选的这些达人
+- 如果你没有勾选任何达人，则默认按当前导出范围处理全部达人
+
+---
+
+## 九、导出 CSV 的方法
+
+### 1. 选择导出范围
+
+在插件工具栏中，你会看到导出范围下拉框，可选：
+
+- `当前页`
+- `前5页`
+- `前10页`
+- `全部`
+- `自定义`
+
+如果选择 `自定义`，需要再输入页数。
+
+### 2. 如果只想导出部分达人
+
+先勾选你想要的达人，再点击导出。
+
+这样导出的 CSV 只会包含你勾选的人。
+
+### 3. 点击导出
+
+点击：
+
+- `导出CSV`
+
+### 4. 等待导出完成
+
+页面上会显示状态，例如：
+
+- `导出中...`
+
+导出完成后，浏览器会自动下载 CSV 文件。
+
+### 5. 去哪里找文件
+
+通常会在浏览器默认下载目录里找到。
+
+如果你不确定下载到了哪里：
+
+1. 打开 Chrome 下载列表
+2. 找到最新下载的 CSV 文件
+
+---
+
+## 十、提交批次的方法
+
+### 1. 选择范围
+
+和导出一样，先选择导出范围：
+
+- 当前页
+- 前5页
+- 前10页
+- 全部
+- 自定义
+
+### 2. 如果只想提交部分达人
+
+先勾选想提交的达人。
+
+### 3. 点击提交
+
+点击：
+
+- `提交批次`
+
+### 4. 输入批次名称
+
+这时会弹出一个自定义输入框，不再是浏览器原生弹窗。
+
+你会看到：
+
+- 标题
+- 输入框
+- `取消`
+- `确认提交`
+
+建议批次名称写得清楚一些，例如：
+
+- `618达人筛选第一批`
+- `食品饮料-KOL测试批次`
+- `5月女装达人候选`
+
+### 5. 确认提交
+
+输入后点击：
+
+- `确认提交`
+
+也可以直接按回车提交。
+
+### 6. 提交成功的提示
+
+如果成功，页面状态会显示：
+
+- `批次提交成功`
+
+如果失败，会看到错误提示。
+
+---
+
+## 十一、批次名称填写建议
+
+建议使用容易看懂的命名方式：
+
+- 时间 + 主题
+- 项目 + 人群
+- 场景 + 顺序编号
+
+推荐示例：
+
+- `2026-05-电商零食达人初筛`
+- `AIGC视频合作达人第一批`
+- `母婴品类候选达人-第1批`
+
+不推荐示例：
+
+- `测试`
+- `aaa`
+- `批次1`
+
+原因：
+
+- 后续回看时不容易分辨
+- 团队协作时不方便沟通
+
+---
+
+## 十二、如何更新插件
+
+当你收到新的插件压缩包时，不需要重新从零安装。
+
+按照下面做：
+
+### 方法一：替换文件夹后重新加载
+
+1. 删除旧的解压文件夹，或用新的内容覆盖旧文件夹
+2. 打开：
+   - `chrome://extensions`
+3. 找到：
+   - `Star Chart Search Enhancer`
+4. 点击：
+   - `重新加载`
+
+### 方法二：重新解压到新文件夹再重新加载
+
+1. 解压新的压缩包
+2. 打开：
+   - `chrome://extensions`
+3. 如果扩展还在，先看它当前对应的文件夹是否还是旧目录
+4. 如有需要，移除旧插件，再重新 `加载已解压的扩展程序`
+
+更新后请确认扩展 ID 仍然是：
+
+- `pkjopdibdnomhogjheclhnknmejccffg`
+
+如果 ID 不是这个，说明装错版本了。
+
+---
+
+## 十三、常见问题
+
+### 1. 看不到插件按钮
+
+处理方法：
+
+1. 点击浏览器右上角拼图图标
+2. 找到 `Star Chart Search Enhancer`
+3. 点击图钉固定
+
+### 2. 打开星图页面后没有出现插件工具栏
+
+先检查：
+
+1. 是否已经登录插件
+2. 是否打开的是星图达人市场页
+3. 插件是否启用
+
+如果还不行：
+
+1. 打开 `chrome://extensions`
+2. 找到插件
+3. 点击 `重新加载`
+4. 刷新星图页面
+
+### 3. 点击登录后没反应或登录失败
+
+先尝试：
+
+1. 关闭登录弹窗
+2. 再次点击插件图标
+3. 重新登录
+
+如果仍然失败，请把下面信息发给维护同事：
+
+- 出错时间
+- 浏览器截图
+- 是否能打开星图
+- 是否能看到插件图标
+
+### 4. 提交批次失败
+
+请先确认：
+
+1. 你已经登录插件
+2. 批次名称不是空的
+3. 当前页面数据已经加载出来
+
+如果还是失败，请把：
+
+- 页面提示内容
+- 提交时的截图
+- 使用的批次名称
+
+发给维护同事。
+
+### 5. 导出 CSV 没下载
+
+先检查：
+
+1. 浏览器是否拦截下载
+2. 默认下载目录里是否已有文件
+3. Chrome 下载列表里是否能看到记录
+
+### 6. 扩展列表里出现两个同名插件
+
+正确处理方式：
+
+1. 打开 `chrome://extensions`
+2. 查看两个扩展的 ID
+3. 保留：
+   - `pkjopdibdnomhogjheclhnknmejccffg`
+4. 删除不是这个 ID 的旧版本
+
+---
+
+## 十四、建议的日常使用流程
+
+推荐按下面顺序使用：
+
+1. 打开 Chrome
+2. 确认插件已启用
+3. 点击插件图标确认登录状态
+4. 打开星图达人市场页
+5. 等待页面数据加载完成
+6. 先勾选需要的人，或直接选择范围
+7. 需要表格时点 `导出CSV`
+8. 需要进入后续流程时点 `提交批次`
+
+---
+
+## 十五、遇到问题时请这样反馈
+
+如果需要找维护同事帮忙，请尽量一次性提供以下信息：
+
+- 你在做什么操作
+- 出问题的时间
+- 页面截图
+- 浏览器里看到的提示文字
+- 扩展 ID 是否为 `pkjopdibdnomhogjheclhnknmejccffg`
+
+这样能更快定位问题。
+
+---
+
+## 十六、给安装同事的一句话版本
+
+如果你要把最短说明发给同事，可以直接复制下面这段：
+
+```text
+1. 解压收到的插件压缩包
+2. 打开 chrome://extensions
+3. 打开右上角“开发者模式”
+4. 点击“加载已解压的扩展程序”
+5. 选择解压后的文件夹
+6. 确认插件名称是 Star Chart Search Enhancer
+7. 确认扩展 ID 是 pkjopdibdnomhogjheclhnknmejccffg
+8. 点击右上角插件图标完成登录
+9. 打开巨量星图达人市场页面开始使用
+```

docs/internal-extension-distribution.md

@@ -0,0 +1,31 @@
+# Internal Extension Distribution
+
+## Fixed Extension ID
+
+- Manifest key is fixed in the project.
+- The unpacked extension ID is `pkjopdibdnomhogjheclhnknmejccffg`.
+- Update Logto with:
+  - `https://pkjopdibdnomhogjheclhnknmejccffg.chromiumapp.org/callback`
+  - `https://pkjopdibdnomhogjheclhnknmejccffg.chromiumapp.org/`
+  - `chrome-extension://pkjopdibdnomhogjheclhnknmejccffg`
+
+## Internal Package
+
+1. Run `npm test`.
+2. Run `npm run package:internal`.
+3. Send `release/star-chart-search-enhancer-internal.zip` to coworkers.
+
+## Coworker Install Steps
+
+1. Unzip `star-chart-search-enhancer-internal.zip`.
+2. Open `chrome://extensions`.
+3. Enable developer mode.
+4. Click `Load unpacked`.
+5. Select the unzipped folder.
+6. Confirm the extension ID is `pkjopdibdnomhogjheclhnknmejccffg`.
+
+## Notes
+
+- Keep `.local/extension-key.pem` private and backed up internally.
+- Do not commit or share the private key with people who only need to install the extension.
+- If the batch submit backend changes away from `192.168.31.21:8083`, update `scripts/manifest.mjs` before packaging.

docs/superpowers/plans/2026-04-21-logto-auth.md

@@ -0,0 +1,853 @@
+# Logto Auth Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add Logto-based Chrome extension authentication with a popup login entry, background-owned auth flow, and content-script gating so the Xingtu enhancer is unusable until the user is authenticated.
+
+**Architecture:** Keep Logto-specific behavior inside `src/background/auth/*` and expose a small message contract from `src/shared/auth-messages.ts`. Add a standalone `popup` entry for sign-in / sign-out and dev diagnostics. Gate existing market content initialization behind an auth check so the page only boots the current enhancer after authentication succeeds.
+
+**Tech Stack:** Chrome MV3, TypeScript, Vitest, tsup build script, `@logto/chrome-extension`
+
+---
+
+## File Map
+
+### New files
+
+- `src/shared/auth-config.ts`
+- `src/shared/auth-messages.ts`
+- `src/background/auth/types.ts`
+- `src/background/auth/state.ts`
+- `src/background/auth/client.ts`
+- `src/background/auth/controller.ts`
+- `src/popup/index.html`
+- `src/popup/index.ts`
+- `src/popup/view.ts`
+- `src/content/market/auth-gate.ts`
+- `tests/auth-config.test.ts`
+- `tests/auth-messages.test.ts`
+- `tests/background-auth-controller.test.ts`
+- `tests/popup-entry.test.ts`
+- `tests/market-auth-gating.test.ts`
+
+### Existing files to modify
+
+- `package.json`
+- `package-lock.json`
+- `src/manifest.json`
+- `scripts/build.mjs`
+- `src/background/index.ts`
+- `src/content/index.ts`
+- `src/content/market/index.ts`
+- `tests/background-index.test.ts`
+- `tests/manifest.test.ts`
+- `README.md`
+- `externaldocs/2026-04-21-logto-auth-design.md`
+
+### Responsibilities
+
+- `src/shared/auth-config.ts`: parse placeholder config, validate required fields, expose a stable config object.
+- `src/shared/auth-messages.ts`: define request / response types and type guards for popup-content-background communication.
+- `src/background/auth/*`: isolate Logto client creation, auth state mapping, and runtime message handling.
+- `src/popup/*`: render login/logout UI and dev diagnostics using background messages only.
+- `src/content/market/auth-gate.ts`: render the disabled state and “go login” guidance when auth is missing.
+
+## Task 1: Shared Auth Contract And Config
+
+**Files:**
+- Create: `src/shared/auth-config.ts`
+- Create: `src/shared/auth-messages.ts`
+- Test: `tests/auth-config.test.ts`
+- Test: `tests/auth-messages.test.ts`
+- Modify: `package.json`
+- Modify: `package-lock.json`
+
+- [ ] **Step 1: Add the Logto SDK dependency in the manifest of the repo**
+
+Update `package.json` dependencies to include:
+
+```json
+{
+  "dependencies": {
+    "@logto/chrome-extension": "^<latest-compatible>"
+  }
+}
+```
+
+Run: `npm install`
+Expected: `package-lock.json` includes `@logto/chrome-extension`
+
+- [ ] **Step 2: Write the failing config tests**
+
+Create `tests/auth-config.test.ts` with cases for:
+
+```ts
+import { describe, expect, test } from "vitest";
+
+import { readAuthConfig } from "../src/shared/auth-config";
+
+describe("auth-config", () => {
+  test("returns the placeholder config in development", () => {
+    expect(readAuthConfig()).toEqual({
+      apiResource: "<your-global-api-resource-indicator>",
+      appId: "<chrome-extension-app-id>",
+      enableDevAuthPanel: false,
+      logtoEndpoint: "https://<your-tenant>.logto.app",
+      scopes: ["openid", "profile", "offline_access"]
+    });
+  });
+
+  test("rejects empty endpoint values", () => {
+    expect(() =>
+      readAuthConfig({
+        logtoEndpoint: ""
+      })
+    ).toThrow(/logtoEndpoint/i);
+  });
+});
+```
+
+Run: `npm test -- tests/auth-config.test.ts`
+Expected: FAIL because `readAuthConfig` does not exist yet
+
+- [ ] **Step 3: Write the failing message contract tests**
+
+Create `tests/auth-messages.test.ts` with cases for:
+
+```ts
+import { describe, expect, test } from "vitest";
+
+import {
+  isAuthRequestMessage,
+  isAuthResponseMessage
+} from "../src/shared/auth-messages";
+
+describe("auth-messages", () => {
+  test("accepts a get-state request", () => {
+    expect(isAuthRequestMessage({ type: "auth:get-state" })).toBe(true);
+  });
+
+  test("rejects unknown auth requests", () => {
+    expect(isAuthRequestMessage({ type: "auth:wat" })).toBe(false);
+  });
+
+  test("accepts a successful auth response envelope", () => {
+    expect(
+      isAuthResponseMessage({
+        ok: true,
+        type: "auth:state",
+        value: { isAuthenticated: false }
+      })
+    ).toBe(true);
+  });
+});
+```
+
+Run: `npm test -- tests/auth-messages.test.ts`
+Expected: FAIL because helpers and types do not exist yet
+
+- [ ] **Step 4: Implement the minimal shared config**
+
+Create `src/shared/auth-config.ts` with:
+
+```ts
+export interface AuthConfig {
+  apiResource: string;
+  appId: string;
+  enableDevAuthPanel: boolean;
+  logtoEndpoint: string;
+  scopes: string[];
+}
+
+const defaultAuthConfig: AuthConfig = {
+  apiResource: "<your-global-api-resource-indicator>",
+  appId: "<chrome-extension-app-id>",
+  enableDevAuthPanel: false,
+  logtoEndpoint: "https://<your-tenant>.logto.app",
+  scopes: ["openid", "profile", "offline_access"]
+};
+
+export function readAuthConfig(
+  overrides: Partial<AuthConfig> = {}
+): AuthConfig {
+  const nextConfig = { ...defaultAuthConfig, ...overrides };
+  if (!nextConfig.logtoEndpoint.trim()) {
+    throw new Error("auth config logtoEndpoint is required");
+  }
+  if (!nextConfig.appId.trim()) {
+    throw new Error("auth config appId is required");
+  }
+  if (!nextConfig.apiResource.trim()) {
+    throw new Error("auth config apiResource is required");
+  }
+  return nextConfig;
+}
+```
+
+- [ ] **Step 5: Implement the minimal shared message contract**
+
+Create `src/shared/auth-messages.ts` with:
+
+```ts
+export type AuthRequestMessage =
+  | { type: "auth:get-state" }
+  | { type: "auth:sign-in" }
+  | { type: "auth:sign-out" }
+  | { type: "auth:get-access-token" };
+
+export interface AuthStateValue {
+  accessTokenExpiresAt?: number | null;
+  isAuthenticated: boolean;
+  lastError?: string | null;
+  resource?: string | null;
+  scopes?: string[];
+  tokenAvailable?: boolean;
+  userInfo?: {
+    email?: string;
+    name?: string;
+    sub?: string;
+    username?: string;
+  } | null;
+}
+
+export type AuthResponseMessage =
+  | { ok: true; type: "auth:state"; value: AuthStateValue }
+  | { ok: true; type: "auth:token"; value: { accessToken: string } }
+  | { ok: true; type: "auth:ack" }
+  | { ok: false; type: "auth:error"; error: string };
+```
+
+Also add `isAuthRequestMessage()` and `isAuthResponseMessage()` type guards.
+
+- [ ] **Step 6: Run the shared auth tests and verify green**
+
+Run: `npm test -- tests/auth-config.test.ts tests/auth-messages.test.ts`
+Expected: PASS
+
+- [ ] **Step 7: Commit the shared contract slice**
+
+Run:
+
+```bash
+git add package.json package-lock.json src/shared/auth-config.ts src/shared/auth-messages.ts tests/auth-config.test.ts tests/auth-messages.test.ts
+git commit -m "feat: add shared auth config and message contracts"
+```
+
+## Task 2: Background Auth Controller
+
+**Files:**
+- Create: `src/background/auth/types.ts`
+- Create: `src/background/auth/state.ts`
+- Create: `src/background/auth/client.ts`
+- Create: `src/background/auth/controller.ts`
+- Modify: `src/background/index.ts`
+- Test: `tests/background-auth-controller.test.ts`
+- Modify: `tests/background-index.test.ts`
+
+- [ ] **Step 1: Write the failing background auth controller tests**
+
+Create `tests/background-auth-controller.test.ts` with cases for:
+
+```ts
+import { describe, expect, test, vi } from "vitest";
+
+import { createAuthController } from "../src/background/auth/controller";
+
+describe("background-auth-controller", () => {
+  test("returns unauthenticated state when the client is logged out", async () => {
+    const controller = createAuthController({
+      authClient: {
+        getAccessToken: vi.fn(),
+        getIdTokenClaims: vi.fn(),
+        isAuthenticated: vi.fn(async () => false),
+        signIn: vi.fn(),
+        signOut: vi.fn()
+      }
+    });
+
+    await expect(controller.getAuthState()).resolves.toEqual(
+      expect.objectContaining({
+        isAuthenticated: false
+      })
+    );
+  });
+
+  test("delegates sign in to the auth client", async () => {
+    const signIn = vi.fn(async () => undefined);
+    const controller = createAuthController({
+      authClient: {
+        getAccessToken: vi.fn(),
+        getIdTokenClaims: vi.fn(),
+        isAuthenticated: vi.fn(async () => false),
+        signIn,
+        signOut: vi.fn()
+      }
+    });
+
+    await controller.signIn();
+    expect(signIn).toHaveBeenCalledTimes(1);
+  });
+});
+```
+
+Run: `npm test -- tests/background-auth-controller.test.ts`
+Expected: FAIL because the controller does not exist
+
+- [ ] **Step 2: Extend the existing background runtime test with auth messages**
+
+Modify `tests/background-index.test.ts` to add:
+
+```ts
+test("responds to auth:get-state with auth status", async () => {
+  const listeners: Array<any> = [];
+  const sendResponse = vi.fn();
+
+  registerBackgroundMessageHandler(
+    {
+      runtime: {
+        onMessage: {
+          addListener(listener) {
+            listeners.push(listener);
+          }
+        }
+      }
+    },
+    {
+      authController: {
+        getAccessToken: vi.fn(),
+        getAuthState: vi.fn(async () => ({ isAuthenticated: false })),
+        signIn: vi.fn(),
+        signOut: vi.fn()
+      }
+    }
+  );
+
+  const result = listeners[0]({ type: "auth:get-state" }, {}, sendResponse);
+  expect(result).toBe(true);
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  expect(sendResponse).toHaveBeenCalledWith({
+    ok: true,
+    type: "auth:state",
+    value: { isAuthenticated: false }
+  });
+});
+```
+
+Run: `npm test -- tests/background-index.test.ts`
+Expected: FAIL because `registerBackgroundMessageHandler` only supports CSV download
+
+- [ ] **Step 3: Implement the minimal background auth controller**
+
+Create `src/background/auth/types.ts`:
+
+```ts
+export interface AuthClientLike {
+  getAccessToken(resource?: string): Promise<string>;
+  getIdTokenClaims(): Promise<Record<string, unknown> | null>;
+  isAuthenticated(): Promise<boolean>;
+  signIn(): Promise<void>;
+  signOut(): Promise<void>;
+}
+```
+
+Create `src/background/auth/state.ts` with a helper that maps client state into the shared `AuthStateValue`.
+
+Create `src/background/auth/controller.ts` with:
+
+```ts
+export function createAuthController(options: {
+  authClient: AuthClientLike;
+  config?: AuthConfig;
+}) {
+  return {
+    async getAuthState() {
+      const isAuthenticated = await options.authClient.isAuthenticated();
+      if (!isAuthenticated) {
+        return { isAuthenticated: false, resource: options.config?.apiResource ?? null };
+      }
+      const claims = await options.authClient.getIdTokenClaims();
+      return {
+        isAuthenticated: true,
+        resource: options.config?.apiResource ?? null,
+        scopes: options.config?.scopes ?? [],
+        userInfo: {
+          email: typeof claims?.email === "string" ? claims.email : undefined,
+          name: typeof claims?.name === "string" ? claims.name : undefined,
+          sub: typeof claims?.sub === "string" ? claims.sub : undefined,
+          username: typeof claims?.username === "string" ? claims.username : undefined
+        }
+      };
+    },
+    signIn: () => options.authClient.signIn(),
+    signOut: () => options.authClient.signOut(),
+    async getAccessToken() {
+      return options.authClient.getAccessToken(options.config?.apiResource);
+    }
+  };
+}
+```
+
+- [ ] **Step 4: Add the Logto client factory wrapper**
+
+Create `src/background/auth/client.ts` as the only place that imports `@logto/chrome-extension`:
+
+```ts
+import LogtoClient from "@logto/chrome-extension";
+
+import { readAuthConfig } from "../../shared/auth-config";
+
+export function createLogtoAuthClient() {
+  const config = readAuthConfig();
+  return new LogtoClient({
+    appId: config.appId,
+    endpoint: config.logtoEndpoint,
+    resources: [config.apiResource],
+    scopes: config.scopes
+  });
+}
+```
+
+- [ ] **Step 5: Integrate auth handling into `src/background/index.ts`**
+
+Refactor `registerBackgroundMessageHandler()` to accept optional dependencies:
+
+```ts
+registerBackgroundMessageHandler(chromeLike?, {
+  authController?: createAuthController(...)
+});
+```
+
+Handle:
+
+- `auth:get-state` -> `{ ok: true, type: "auth:state", value }`
+- `auth:sign-in` -> `{ ok: true, type: "auth:ack" }`
+- `auth:sign-out` -> `{ ok: true, type: "auth:ack" }`
+- `auth:get-access-token` -> `{ ok: true, type: "auth:token", value: { accessToken } }`
+
+Keep the existing CSV download path intact.
+
+- [ ] **Step 6: Run background tests and verify green**
+
+Run: `npm test -- tests/background-auth-controller.test.ts tests/background-index.test.ts`
+Expected: PASS
+
+- [ ] **Step 7: Commit the background auth slice**
+
+Run:
+
+```bash
+git add src/background/index.ts src/background/auth tests/background-auth-controller.test.ts tests/background-index.test.ts
+git commit -m "feat: add background auth controller"
+```
+
+## Task 3: Popup Entry, Manifest, And Build Output
+
+**Files:**
+- Create: `src/popup/index.html`
+- Create: `src/popup/index.ts`
+- Create: `src/popup/view.ts`
+- Modify: `src/manifest.json`
+- Modify: `scripts/build.mjs`
+- Modify: `tests/manifest.test.ts`
+- Test: `tests/popup-entry.test.ts`
+
+- [ ] **Step 1: Write the failing popup rendering tests**
+
+Create `tests/popup-entry.test.ts` with a JSDOM fixture:
+
+```ts
+import { describe, expect, test, vi } from "vitest";
+
+import { bootPopup } from "../src/popup/index";
+
+describe("popup-entry", () => {
+  test("renders a sign-in button when unauthenticated", async () => {
+    document.body.innerHTML = "<main id='app'></main>";
+
+    await bootPopup({
+      document,
+      sendMessage: vi.fn(async () => ({
+        ok: true,
+        type: "auth:state",
+        value: { isAuthenticated: false }
+      }))
+    });
+
+    expect(document.querySelector("button")?.textContent).toContain("登录");
+  });
+});
+```
+
+Run: `npm test -- tests/popup-entry.test.ts`
+Expected: FAIL because popup files do not exist
+
+- [ ] **Step 2: Extend manifest tests for auth permissions and popup**
+
+Modify `tests/manifest.test.ts` to assert:
+
+```ts
+expect(manifest.permissions).toEqual(
+  expect.arrayContaining(["downloads", "identity", "storage"])
+);
+expect(manifest.action?.default_popup).toBe("popup/index.html");
+```
+
+Run: `npm test -- tests/manifest.test.ts`
+Expected: FAIL because manifest does not include popup / auth permissions
+
+- [ ] **Step 3: Implement the minimal popup view**
+
+Create `src/popup/view.ts` with rendering helpers:
+
+```ts
+export function renderLoggedOut(root: HTMLElement, error?: string | null) {
+  root.innerHTML = `
+    <section data-popup-state="logged-out">
+      <h1>Star Chart Search Enhancer</h1>
+      <p>登录后才能使用星图增强功能</p>
+      ${error ? `<p data-popup-error="true">${error}</p>` : ""}
+      <button type="button" data-popup-sign-in="button">登录 Logto</button>
+    </section>
+  `;
+}
+```
+
+Also add `renderLoggedIn()` and `renderDevPanel()` helpers.
+
+- [ ] **Step 4: Implement the minimal popup bootstrap**
+
+Create `src/popup/index.ts` with:
+
+```ts
+import { renderLoggedIn, renderLoggedOut } from "./view";
+
+export async function bootPopup(options = {}) {
+  const currentDocument = options.document ?? document;
+  const root = currentDocument.querySelector("#app") as HTMLElement | null;
+  if (!root) {
+    throw new Error("popup root #app is required");
+  }
+  const sendMessage =
+    options.sendMessage ??
+    ((message: unknown) =>
+      chrome.runtime.sendMessage(message) as Promise<unknown>);
+
+  const stateResponse = await sendMessage({ type: "auth:get-state" });
+  if (!stateResponse.ok || stateResponse.type !== "auth:state") {
+    renderLoggedOut(root, "认证状态读取失败");
+    return;
+  }
+
+  if (!stateResponse.value.isAuthenticated) {
+    renderLoggedOut(root, stateResponse.value.lastError);
+    root.querySelector("[data-popup-sign-in='button']")?.addEventListener("click", async () => {
+      await sendMessage({ type: "auth:sign-in" });
+    });
+    return;
+  }
+
+  renderLoggedIn(root, stateResponse.value);
+}
+```
+
+Create `src/popup/index.html`:
+
+```html
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Star Chart Search Enhancer</title>
+  </head>
+  <body>
+    <main id="app"></main>
+    <script src="./index.js"></script>
+  </body>
+</html>
+```
+
+- [ ] **Step 5: Update build and manifest**
+
+Modify `scripts/build.mjs` to:
+
+- build `src/popup/index.ts` into `dist/popup/index.js`
+- create `dist/popup`
+- copy `src/popup/index.html` into `dist/popup/index.html`
+
+Modify `src/manifest.json` to:
+
+```json
+{
+  "permissions": ["downloads", "identity", "storage"],
+  "action": {
+    "default_popup": "popup/index.html"
+  }
+}
+```
+
+Preserve current background and content script entries.
+
+- [ ] **Step 6: Run popup and manifest tests**
+
+Run: `npm test -- tests/popup-entry.test.ts tests/manifest.test.ts`
+Expected: PASS
+
+- [ ] **Step 7: Commit the popup and manifest slice**
+
+Run:
+
+```bash
+git add src/popup src/manifest.json scripts/build.mjs tests/popup-entry.test.ts tests/manifest.test.ts
+git commit -m "feat: add popup auth entry and manifest wiring"
+```
+
+## Task 4: Content Auth Gating
+
+**Files:**
+- Create: `src/content/market/auth-gate.ts`
+- Modify: `src/content/index.ts`
+- Modify: `src/content/market/index.ts`
+- Test: `tests/market-auth-gating.test.ts`
+- Modify: `tests/market-content-entry.test.ts`
+
+- [ ] **Step 1: Write the failing content gating test**
+
+Create `tests/market-auth-gating.test.ts`:
+
+```ts
+import { describe, expect, test, vi } from "vitest";
+
+import { bootContentScript } from "../src/content/index";
+
+describe("market-auth-gating", () => {
+  test("shows a login gate instead of booting the market controller when unauthenticated", async () => {
+    document.body.innerHTML = "<div></div>";
+
+    const createMarketController = vi.fn();
+    await bootContentScript({
+      createMarketController,
+      document,
+      sendAuthMessage: vi.fn(async () => ({
+        ok: true,
+        type: "auth:state",
+        value: { isAuthenticated: false }
+      })),
+      window
+    });
+
+    expect(createMarketController).not.toHaveBeenCalled();
+    expect(document.body.textContent).toContain("请先登录插件");
+  });
+});
+```
+
+Run: `npm test -- tests/market-auth-gating.test.ts`
+Expected: FAIL because `bootContentScript` does not gate on auth yet
+
+- [ ] **Step 2: Add an integration assertion to the existing content entry tests**
+
+Modify `tests/market-content-entry.test.ts` to add:
+
+```ts
+test("boots the controller only after auth succeeds", async () => {
+  const createMarketController = vi.fn(() => ({ ready: Promise.resolve() }));
+  await bootContentScript({
+    createMarketController,
+    document,
+    sendAuthMessage: vi.fn(async () => ({
+      ok: true,
+      type: "auth:state",
+      value: { isAuthenticated: true }
+    })),
+    window
+  });
+  expect(createMarketController).toHaveBeenCalledTimes(1);
+});
+```
+
+Run: `npm test -- tests/market-content-entry.test.ts`
+Expected: FAIL until `bootContentScript` accepts the new auth dependency
+
+- [ ] **Step 3: Implement the auth gate UI**
+
+Create `src/content/market/auth-gate.ts`:
+
+```ts
+export function renderMarketAuthGate(document: Document): HTMLElement {
+  const root = document.createElement("section");
+  root.dataset.marketAuthGate = "root";
+  root.innerHTML = `
+    <strong>请先登录插件</strong>
+    <p>打开扩展弹窗完成登录后刷新本页</p>
+    <button type="button" data-market-auth-help="button">去登录</button>
+  `;
+  root.querySelector("[data-market-auth-help='button']")?.addEventListener("click", () => {
+    window.alert("请点击浏览器工具栏中的扩展图标完成登录");
+  });
+  document.body.prepend(root);
+  return root;
+}
+```
+
+- [ ] **Step 4: Gate `bootContentScript()` before controller startup**
+
+Modify `src/content/index.ts` to:
+
+- accept an injectable `sendAuthMessage`
+- call background with `{ type: "auth:get-state" }`
+- if unauthenticated, render the gate and return `{ ready: Promise.resolve() }` or `null`
+- only call `createMarketController()` after auth succeeds
+
+Suggested helper:
+
+```ts
+async function readAuthState(
+  sendMessage: (message: unknown) => Promise<unknown>
+): Promise<AuthStateValue | null> {
+  const response = await sendMessage({ type: "auth:get-state" });
+  return response.ok && response.type === "auth:state" ? response.value : null;
+}
+```
+
+- [ ] **Step 5: Keep market controller auth-agnostic**
+
+Only touch `src/content/market/index.ts` if the existing controller assumes it always owns the toolbar root. Prefer to keep auth gating in `src/content/index.ts`; only add defensive guards if the current toolbar boot sequence conflicts with the auth gate DOM.
+
+- [ ] **Step 6: Run content gating tests**
+
+Run: `npm test -- tests/market-auth-gating.test.ts tests/market-content-entry.test.ts`
+Expected: PASS
+
+- [ ] **Step 7: Commit the auth gate slice**
+
+Run:
+
+```bash
+git add src/content/index.ts src/content/market/auth-gate.ts src/content/market/index.ts tests/market-auth-gating.test.ts tests/market-content-entry.test.ts
+git commit -m "feat: gate market tools behind authentication"
+```
+
+## Task 5: Dev Diagnostics, Build Verification, And Docs
+
+**Files:**
+- Modify: `src/popup/view.ts`
+- Modify: `src/popup/index.ts`
+- Modify: `src/background/auth/controller.ts`
+- Modify: `README.md`
+- Modify: `externaldocs/2026-04-21-logto-auth-design.md`
+
+- [ ] **Step 1: Write the failing popup dev panel test**
+
+Extend `tests/popup-entry.test.ts` with:
+
+```ts
+test("renders the dev auth panel when enabled", async () => {
+  document.body.innerHTML = "<main id='app'></main>";
+
+  await bootPopup({
+    config: { enableDevAuthPanel: true },
+    document,
+    sendMessage: vi.fn(async () => ({
+      ok: true,
+      type: "auth:state",
+      value: {
+        accessTokenExpiresAt: 1700000000000,
+        isAuthenticated: true,
+        resource: "https://api.example.test",
+        scopes: ["openid", "profile"],
+        tokenAvailable: true,
+        userInfo: { email: "dev@example.com", name: "Dev" }
+      }
+    }))
+  });
+
+  expect(document.body.textContent).toContain("resource");
+  expect(document.body.textContent).toContain("token");
+});
+```
+
+Run: `npm test -- tests/popup-entry.test.ts`
+Expected: FAIL because the dev panel is not rendered yet
+
+- [ ] **Step 2: Implement minimal diagnostics**
+
+Update popup rendering to show when `enableDevAuthPanel` is true:
+
+- `resource`
+- `scopes`
+- `tokenAvailable`
+- `accessTokenExpiresAt`
+- `lastError`
+
+Update background state mapping to return `tokenAvailable` and `accessTokenExpiresAt` placeholders even when the exact expiry cannot be resolved yet:
+
+```ts
+return {
+  accessTokenExpiresAt: null,
+  isAuthenticated: true,
+  resource: config.apiResource,
+  scopes: config.scopes,
+  tokenAvailable: true,
+  userInfo
+};
+```
+
+- [ ] **Step 3: Run the popup suite and the full test suite**
+
+Run: `npm test -- tests/popup-entry.test.ts`
+Expected: PASS
+
+Run: `npm test`
+Expected: PASS across existing and new tests
+
+- [ ] **Step 4: Run the build and verify output structure**
+
+Run: `npm run build`
+Expected:
+
+- `dist/manifest.json`
+- `dist/background/index.js`
+- `dist/content/index.js`
+- `dist/content/market-page-bridge.js`
+- `dist/popup/index.html`
+- `dist/popup/index.js`
+
+- [ ] **Step 5: Update docs**
+
+Update `README.md` with:
+
+- how to load the popup
+- what placeholder Logto config values must be replaced
+- what “unauthenticated” looks like on the market page
+
+Update `externaldocs/2026-04-21-logto-auth-design.md` only if implementation choices diverge from the design. Also fix any current encoding artifacts in that spec while editing.
+
+- [ ] **Step 6: Commit the verification and docs slice**
+
+Run:
+
+```bash
+git add src/popup/view.ts src/popup/index.ts src/background/auth/controller.ts README.md externaldocs/2026-04-21-logto-auth-design.md
+git commit -m "docs: document logto auth flow and diagnostics"
+```
+
+## Final Verification Checklist
+
+- [ ] `npm test -- tests/auth-config.test.ts tests/auth-messages.test.ts`
+- [ ] `npm test -- tests/background-auth-controller.test.ts tests/background-index.test.ts`
+- [ ] `npm test -- tests/popup-entry.test.ts tests/manifest.test.ts`
+- [ ] `npm test -- tests/market-auth-gating.test.ts tests/market-content-entry.test.ts`
+- [ ] `npm test`
+- [ ] `npm run build`
+- [ ] Load `dist/` in `chrome://extensions`
+- [ ] Verify popup shows logged-out state before configuration is real
+- [ ] Verify market page shows auth gate when unauthenticated
+
+## Open Inputs Still Required From The User
+
+- Real `logtoEndpoint`
+- Real `appId`
+- Real `apiResource`
+- Any extra scopes beyond `openid profile offline_access`
+- Whether dev auth panel should be hard-disabled in production builds or controlled by config only

docs/superpowers/plans/2026-04-22-logto-protected-api-mock.md

@@ -0,0 +1,710 @@
+# Logto Protected API Mock Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a reusable protected-API client that pulls a Logto access token from the extension background, sends `Authorization: Bearer <token>` to a local mock API, and exposes a dev-only popup flow to verify the end-to-end request path before a real backend exists.
+
+**Architecture:** Keep Logto token ownership in the background and add a small reusable client in `src/shared` so both popup and future content code can call protected APIs the same way. Add a tiny local Node mock server that only checks for a Bearer header and returns fixed JSON. Use popup dev UI as the manual test entrypoint because it already has an authenticated extension context and avoids coupling the mock flow to the Xingtu page DOM.
+
+**Tech Stack:** Chrome MV3, TypeScript, Vitest, Node HTTP server, tsup, `@logto/chrome-extension`
+
+---
+
+## File Map
+
+### New files
+
+- `src/shared/protected-api-client.ts`
+- `scripts/mock-protected-api.mjs`
+- `tests/protected-api-client.test.ts`
+- `tests/mock-protected-api.test.ts`
+
+### Existing files to modify
+
+- `src/popup/index.ts`
+- `src/popup/view.ts`
+- `tests/popup-entry.test.ts`
+- `tests/background-index.test.ts`
+- `package.json`
+- `README.md`
+
+### Responsibilities
+
+- `src/shared/protected-api-client.ts`: reusable client that asks background for a token, injects the Bearer header, and normalizes success / unauthorized / missing-token errors.
+- `scripts/mock-protected-api.mjs`: minimal local server with one protected endpoint and a CLI start mode.
+- `src/popup/view.ts`: add a dev-only “测试受保护接口” button and a response/error output area.
+- `src/popup/index.ts`: wire the dev button to the protected API client and refresh the popup state after calls.
+- `tests/protected-api-client.test.ts`: lock down token injection and error behavior.
+- `tests/mock-protected-api.test.ts`: verify the mock server authorizes Bearer requests and rejects missing headers.
+- `tests/popup-entry.test.ts`: verify popup dev action triggers the protected client and renders results.
+
+## Task 1: Lock Down The Existing Token Message Contract
+
+**Files:**
+- Modify: `tests/background-index.test.ts`
+- Modify: `src/background/index.ts` only if the test exposes a gap
+
+- [ ] **Step 1: Write the failing background token response test**
+
+Add a case to `tests/background-index.test.ts`:
+
+```ts
+test("responds to auth:get-access-token with the current token", async () => {
+  const listeners: Array<
+    (message: unknown, sender: unknown, sendResponse: (response: unknown) => void) => boolean | void
+  > = [];
+  const sendResponse = vi.fn();
+
+  registerBackgroundMessageHandler(
+    {
+      runtime: {
+        onMessage: {
+          addListener(listener) {
+            listeners.push(listener);
+          }
+        }
+      }
+    },
+    {
+      authController: {
+        getAccessToken: vi.fn(async () => "test-access-token"),
+        getAuthState: vi.fn(),
+        signIn: vi.fn(),
+        signOut: vi.fn()
+      }
+    }
+  );
+
+  const result = listeners[0]({ type: "auth:get-access-token" }, {}, sendResponse);
+
+  expect(result).toBe(true);
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  expect(sendResponse).toHaveBeenCalledWith({
+    ok: true,
+    type: "auth:token",
+    value: { accessToken: "test-access-token" }
+  });
+});
+```
+
+- [ ] **Step 2: Run the focused background test**
+
+Run: `npm test -- tests/background-index.test.ts`
+
+Expected:
+- If it fails because token handling is broken or missing, continue to Step 3.
+- If it passes immediately, keep the test as a regression and skip production changes for this task.
+
+- [ ] **Step 3: Make the minimal background fix if needed**
+
+Ensure `src/background/index.ts` handles:
+
+```ts
+if (message.type === "auth:get-access-token") {
+  return {
+    ok: true,
+    type: "auth:token",
+    value: {
+      accessToken: await authController.getAccessToken()
+    }
+  };
+}
+```
+
+- [ ] **Step 4: Re-run the background test and confirm green**
+
+Run: `npm test -- tests/background-index.test.ts`
+
+Expected: PASS
+
+- [ ] **Step 5: Commit the token-contract slice**
+
+Run:
+
+```bash
+git add tests/background-index.test.ts src/background/index.ts
+git commit -m "test: cover auth access token responses"
+```
+
+## Task 2: Build The Reusable Protected API Client
+
+**Files:**
+- Create: `src/shared/protected-api-client.ts`
+- Create: `tests/protected-api-client.test.ts`
+
+- [ ] **Step 1: Write the failing protected client tests**
+
+Create `tests/protected-api-client.test.ts` with cases for:
+
+```ts
+import { describe, expect, test, vi } from "vitest";
+
+import { createProtectedApiClient } from "../src/shared/protected-api-client";
+
+describe("protected-api-client", () => {
+  test("requests a token before calling the protected endpoint", async () => {
+    const sendMessage = vi.fn(async () => ({
+      ok: true,
+      type: "auth:token",
+      value: { accessToken: "abc123" }
+    }));
+    const fetchImpl = vi.fn(async () => ({
+      ok: true,
+      status: 200,
+      json: async () => ({ ok: true })
+    }));
+
+    const client = createProtectedApiClient({
+      baseUrl: "http://127.0.0.1:4319",
+      fetchImpl,
+      sendMessage
+    });
+
+    await client.loadProtectedMockData();
+
+    expect(sendMessage).toHaveBeenCalledWith({ type: "auth:get-access-token" });
+    expect(fetchImpl).toHaveBeenCalledWith(
+      "http://127.0.0.1:4319/api/mock/protected",
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: "Bearer abc123"
+        }),
+        method: "GET"
+      })
+    );
+  });
+
+  test("throws before fetch when the token is unavailable", async () => {
+    const sendMessage = vi.fn(async () => ({
+      ok: false,
+      type: "auth:error",
+      error: "token missing"
+    }));
+    const fetchImpl = vi.fn();
+
+    const client = createProtectedApiClient({
+      baseUrl: "http://127.0.0.1:4319",
+      fetchImpl,
+      sendMessage
+    });
+
+    await expect(client.loadProtectedMockData()).rejects.toThrow(/token/i);
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  test("throws an authorization error on 401", async () => {
+    const client = createProtectedApiClient({
+      baseUrl: "http://127.0.0.1:4319",
+      fetchImpl: vi.fn(async () => ({
+        ok: false,
+        status: 401,
+        json: async () => ({ ok: false, error: "unauthorized" })
+      })),
+      sendMessage: vi.fn(async () => ({
+        ok: true,
+        type: "auth:token",
+        value: { accessToken: "abc123" }
+      }))
+    });
+
+    await expect(client.loadProtectedMockData()).rejects.toThrow(/unauthorized/i);
+  });
+});
+```
+
+- [ ] **Step 2: Run the protected client test to verify red**
+
+Run: `npm test -- tests/protected-api-client.test.ts`
+
+Expected: FAIL because `createProtectedApiClient` does not exist yet
+
+- [ ] **Step 3: Implement the minimal protected client**
+
+Create `src/shared/protected-api-client.ts` with:
+
+```ts
+import { isAuthResponseMessage } from "./auth-messages";
+
+interface FetchResponseLike {
+  json(): Promise<unknown>;
+  ok: boolean;
+  status: number;
+}
+
+type FetchLike = (
+  input: string,
+  init?: RequestInit
+) => Promise<FetchResponseLike>;
+
+type SendMessageLike = (message: unknown) => Promise<unknown>;
+
+export function createProtectedApiClient(options: {
+  baseUrl: string;
+  fetchImpl?: FetchLike;
+  sendMessage: SendMessageLike;
+}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+
+  return {
+    async loadProtectedMockData() {
+      const token = await readAccessToken(options.sendMessage);
+      const response = await fetchImpl(
+        new URL("/api/mock/protected", options.baseUrl).toString(),
+        {
+          headers: {
+            Authorization: `Bearer ${token}`
+          },
+          method: "GET"
+        }
+      );
+
+      if (response.status === 401 || response.status === 403) {
+        throw new Error("protected api unauthorized");
+      }
+
+      if (!response.ok) {
+        throw new Error(`protected api request failed: ${response.status}`);
+      }
+
+      return response.json();
+    }
+  };
+}
+
+async function readAccessToken(sendMessage: SendMessageLike): Promise<string> {
+  const response = await sendMessage({ type: "auth:get-access-token" });
+  if (
+    !isAuthResponseMessage(response) ||
+    !response.ok ||
+    response.type !== "auth:token" ||
+    !response.value.accessToken.trim()
+  ) {
+    throw new Error("protected api token unavailable");
+  }
+  return response.value.accessToken;
+}
+```
+
+- [ ] **Step 4: Run the protected client test to verify green**
+
+Run: `npm test -- tests/protected-api-client.test.ts`
+
+Expected: PASS
+
+- [ ] **Step 5: Refactor only if tests stay green**
+
+Optional small cleanup only:
+- extract URL builder helper
+- extract `buildAuthorizationHeaders(token)` helper if repeated
+
+Run: `npm test -- tests/protected-api-client.test.ts`
+
+Expected: PASS
+
+- [ ] **Step 6: Commit the client slice**
+
+Run:
+
+```bash
+git add src/shared/protected-api-client.ts tests/protected-api-client.test.ts
+git commit -m "feat: add protected api client"
+```
+
+## Task 3: Add A Popup Dev Trigger For Manual Verification
+
+**Files:**
+- Modify: `src/popup/index.ts`
+- Modify: `src/popup/view.ts`
+- Modify: `tests/popup-entry.test.ts`
+
+- [ ] **Step 1: Write the failing popup dev-flow tests**
+
+Add cases to `tests/popup-entry.test.ts` for:
+
+```ts
+test("renders a protected api test button in the dev panel", async () => {
+  const { bootPopup } = await import("../src/popup/index");
+
+  document.body.innerHTML = '<div id="app"></div>';
+  await bootPopup({
+    config: { enableDevAuthPanel: true },
+    document,
+    sendMessage: vi.fn(async () => ({
+      ok: true,
+      type: "auth:state",
+      value: {
+        isAuthenticated: true,
+        tokenAvailable: true
+      }
+    }))
+  });
+
+  expect(document.querySelector('[data-popup-test-protected-api="button"]')).not.toBeNull();
+});
+
+test("clicking the dev button runs the protected api client and prints the result", async () => {
+  const sendMessage = vi.fn(async (message: { type: string }) => {
+    if (message.type === "auth:get-state") {
+      return {
+        ok: true,
+        type: "auth:state",
+        value: {
+          isAuthenticated: true,
+          tokenAvailable: true
+        }
+      };
+    }
+    if (message.type === "auth:get-access-token") {
+      return {
+        ok: true,
+        type: "auth:token",
+        value: {
+          accessToken: "abc123"
+        }
+      };
+    }
+    return { ok: true, type: "auth:ack" };
+  });
+  const fetchImpl = vi.fn(async () => ({
+    ok: true,
+    status: 200,
+    json: async () => ({ ok: true, message: "authorized" })
+  }));
+
+  const { bootPopup } = await import("../src/popup/index");
+  document.body.innerHTML = '<div id="app"></div>';
+
+  await bootPopup({
+    config: { enableDevAuthPanel: true },
+    document,
+    fetchProtectedApi: () =>
+      createProtectedApiClient({
+        baseUrl: "http://127.0.0.1:4319",
+        fetchImpl,
+        sendMessage
+      }).loadProtectedMockData(),
+    sendMessage
+  });
+
+  document
+    .querySelector('[data-popup-test-protected-api="button"]')
+    ?.dispatchEvent(new MouseEvent("click"));
+
+  await new Promise((resolve) => setTimeout(resolve, 0));
+
+  expect(document.body.textContent).toContain("authorized");
+});
+```
+
+- [ ] **Step 2: Run the popup tests to verify red**
+
+Run: `npm test -- tests/popup-entry.test.ts`
+
+Expected: FAIL because the popup dev test entrypoint does not exist yet
+
+- [ ] **Step 3: Add the minimal popup UI**
+
+Update `src/popup/view.ts` so `renderDevPanel()` also renders:
+
+```html
+<button type="button" data-popup-test-protected-api="button">
+  测试受保护接口
+</button>
+<pre data-popup-protected-api-result="output"></pre>
+```
+
+Add a small helper for setting the output:
+
+```ts
+export function setProtectedApiResult(root: HTMLElement, value: string): void {
+  root
+    .querySelector('[data-popup-protected-api-result="output"]')
+    ?.replaceChildren(value);
+}
+```
+
+- [ ] **Step 4: Wire the popup button to the protected client**
+
+Update `src/popup/index.ts`:
+- inject an optional `fetchProtectedApi` dependency
+- default it to a `createProtectedApiClient(...)` instance using `sendMessage`
+- attach a click handler only when the dev panel is enabled and the user is logged in
+- write either the JSON response or the thrown error message into the output area
+
+Suggested shape:
+
+```ts
+interface BootPopupOptions {
+  config?: Partial<AuthConfig>;
+  document?: Document;
+  fetchProtectedApi?: () => Promise<unknown>;
+  sendMessage?: (message: unknown) => Promise<unknown>;
+}
+```
+
+- [ ] **Step 5: Run the popup tests to verify green**
+
+Run: `npm test -- tests/popup-entry.test.ts`
+
+Expected: PASS
+
+- [ ] **Step 6: Commit the popup dev slice**
+
+Run:
+
+```bash
+git add src/popup/index.ts src/popup/view.ts tests/popup-entry.test.ts
+git commit -m "feat: add popup protected api dev test"
+```
+
+## Task 4: Add The Local Mock Protected API Server
+
+**Files:**
+- Create: `scripts/mock-protected-api.mjs`
+- Create: `tests/mock-protected-api.test.ts`
+- Modify: `package.json`
+
+- [ ] **Step 1: Write the failing mock server tests**
+
+Create `tests/mock-protected-api.test.ts` with:
+
+```ts
+import { afterEach, describe, expect, test } from "vitest";
+
+import { createMockProtectedApiServer } from "../scripts/mock-protected-api.mjs";
+
+const servers: Array<{ close: () => Promise<void> }> = [];
+
+afterEach(async () => {
+  while (servers.length > 0) {
+    await servers.pop()?.close();
+  }
+});
+
+describe("mock-protected-api", () => {
+  test("returns mock data when a Bearer token is present", async () => {
+    const server = createMockProtectedApiServer({ port: 0 });
+    await server.start();
+    servers.push(server);
+
+    const response = await fetch(`${server.baseUrl}/api/mock/protected`, {
+      headers: {
+        Authorization: "Bearer abc123"
+      }
+    });
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual(
+      expect.objectContaining({
+        ok: true,
+        source: "mock-protected-api"
+      })
+    );
+  });
+
+  test("returns 401 when the Authorization header is missing", async () => {
+    const server = createMockProtectedApiServer({ port: 0 });
+    await server.start();
+    servers.push(server);
+
+    const response = await fetch(`${server.baseUrl}/api/mock/protected`);
+
+    expect(response.status).toBe(401);
+    await expect(response.json()).resolves.toEqual({
+      ok: false,
+      error: "unauthorized"
+    });
+  });
+});
+```
+
+- [ ] **Step 2: Run the mock server tests to verify red**
+
+Run: `npm test -- tests/mock-protected-api.test.ts`
+
+Expected: FAIL because the mock server module does not exist yet
+
+- [ ] **Step 3: Implement the minimal mock server**
+
+Create `scripts/mock-protected-api.mjs` with:
+
+```js
+import http from "node:http";
+
+export function createMockProtectedApiServer({ port = 4319 } = {}) {
+  let server;
+
+  return {
+    get baseUrl() {
+      const address = server?.address();
+      const resolvedPort =
+        typeof address === "object" && address ? address.port : port;
+      return `http://127.0.0.1:${resolvedPort}`;
+    },
+    async start() {
+      server = http.createServer((request, response) => {
+        if (request.url !== "/api/mock/protected") {
+          response.writeHead(404, { "content-type": "application/json" });
+          response.end(JSON.stringify({ ok: false, error: "not-found" }));
+          return;
+        }
+
+        const authHeader = request.headers.authorization ?? "";
+        const isBearer =
+          typeof authHeader === "string" &&
+          authHeader.startsWith("Bearer ") &&
+          authHeader.length > "Bearer ".length;
+
+        if (!isBearer) {
+          response.writeHead(401, { "content-type": "application/json" });
+          response.end(JSON.stringify({ ok: false, error: "unauthorized" }));
+          return;
+        }
+
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(
+          JSON.stringify({
+            ok: true,
+            source: "mock-protected-api",
+            message: "authorized",
+            receivedAuthHeader: authHeader
+          })
+        );
+      });
+
+      await new Promise((resolve) => server.listen(port, "127.0.0.1", resolve));
+    },
+    async close() {
+      if (!server) {
+        return;
+      }
+      await new Promise((resolve, reject) =>
+        server.close((error) => (error ? reject(error) : resolve()))
+      );
+    }
+  };
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const server = createMockProtectedApiServer();
+  await server.start();
+  console.log(`mock protected api listening on ${server.baseUrl}`);
+}
+```
+
+- [ ] **Step 4: Add a package script to start the mock API**
+
+Update `package.json`:
+
+```json
+{
+  "scripts": {
+    "mock:protected-api": "node scripts/mock-protected-api.mjs"
+  }
+}
+```
+
+- [ ] **Step 5: Run the mock server tests to verify green**
+
+Run: `npm test -- tests/mock-protected-api.test.ts`
+
+Expected: PASS
+
+- [ ] **Step 6: Commit the mock server slice**
+
+Run:
+
+```bash
+git add scripts/mock-protected-api.mjs tests/mock-protected-api.test.ts package.json
+git commit -m "feat: add mock protected api server"
+```
+
+## Task 5: Document And Verify The End-To-End Local Flow
+
+**Files:**
+- Modify: `README.md`
+
+- [ ] **Step 1: Write the failing documentation expectation**
+
+Before editing docs, list the missing verification steps in a scratch note:
+- how to enable the dev panel
+- how to start the mock server
+- how to click the popup test button
+- what success and failure look like
+
+Expected: current `README.md` does not explain this flow yet
+
+- [ ] **Step 2: Add the manual verification section**
+
+Update `README.md` with a short section:
+
+```md
+## Protected API Mock Test
+
+1. Set `enableDevAuthPanel` to `true` in `src/shared/auth-config.ts`
+2. Run `npm run mock:protected-api`
+3. Run `npm run build`
+4. Reload the unpacked extension
+5. Open the popup and log in
+6. Click `测试受保护接口`
+7. Confirm the popup shows a JSON result containing `"source": "mock-protected-api"`
+```
+
+- [ ] **Step 3: Run the relevant automated tests together**
+
+Run:
+
+```bash
+npm test -- tests/background-index.test.ts tests/protected-api-client.test.ts tests/popup-entry.test.ts tests/mock-protected-api.test.ts
+```
+
+Expected: PASS
+
+- [ ] **Step 4: Perform the manual smoke test**
+
+Run in separate terminals:
+
+```bash
+npm run mock:protected-api
+npm run build
+```
+
+Expected:
+- terminal 1 prints `mock protected api listening on http://127.0.0.1:4319`
+- extension loads from `dist/`
+- popup dev panel can trigger the protected endpoint
+- success output includes `"message": "authorized"`
+
+- [ ] **Step 5: Commit the docs and verification slice**
+
+Run:
+
+```bash
+git add README.md
+git commit -m "docs: add protected api mock verification steps"
+```
+
+## Final Verification
+
+- [ ] Run the full test suite:
+
+```bash
+npm test
+```
+
+Expected: PASS
+
+- [ ] Run the production build:
+
+```bash
+npm run build
+```
+
+Expected: build completes and writes updated assets to `dist/`
+
+- [ ] Confirm the only functional additions are:
+- background token response covered by tests
+- reusable protected API client
+- popup dev test button and result output
+- local mock protected API server
+- updated verification docs

docs/superpowers/plans/2026-04-22-market-backend-metrics-csv.md

@@ -0,0 +1,79 @@
+# Market Backend Metrics CSV Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Extend CSV export so it appends the six backend metrics already stored on each market record.
+
+**Architecture:** Keep the existing export flow intact and modify only the CSV column definition layer. Reuse `MarketRecord.backendMetrics` as the sole source for the six new CSV columns so the exported data matches what the plugin already loaded into memory.
+
+**Tech Stack:** TypeScript, existing market CSV exporter, Vitest
+
+---
+
+## File Map
+
+- Modify: `src/content/market/csv-exporter.ts`
+  - Append six backend metrics columns after existing CSV columns.
+- Modify: `tests/csv-exporter.test.ts`
+  - Add failing tests for backend metric headers and values.
+
+### Task 1: Backend Metrics CSV Columns
+
+**Files:**
+- Modify: `tests/csv-exporter.test.ts`
+- Modify: `src/content/market/csv-exporter.ts`
+
+- [ ] **Step 1: Write the failing CSV exporter tests**
+
+Add tests for:
+- the six backend metric headers appended after current columns
+- backend metric values exported from `record.backendMetrics`
+- blank cells when `backendMetrics` is absent
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npm test -- tests/csv-exporter.test.ts`
+Expected: FAIL because the exporter does not include backend metric columns yet.
+
+- [ ] **Step 3: Write the minimal exporter change**
+
+Append these six columns:
+- `看后搜率`
+- `看后搜数`
+- `新增A3数`
+- `新增A3率`
+- `CPA3`
+- `cp_search`
+
+Each column reads from:
+- `record.backendMetrics?.afterViewSearchRate`
+- `record.backendMetrics?.afterViewSearchCount`
+- `record.backendMetrics?.a3IncreaseCount`
+- `record.backendMetrics?.newA3Rate`
+- `record.backendMetrics?.cpa3`
+- `record.backendMetrics?.cpSearch`
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npm test -- tests/csv-exporter.test.ts`
+Expected: PASS
+
+- [ ] **Step 5: Run full verification**
+
+Run:
+
+```bash
+npm test
+npm run build
+```
+
+Expected:
+- full test suite passes
+- build succeeds
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/content/market/csv-exporter.ts tests/csv-exporter.test.ts docs/superpowers/specs/2026-04-22-market-backend-metrics-csv-design.md docs/superpowers/plans/2026-04-22-market-backend-metrics-csv.md
+git commit -m "feat: export backend metrics in csv"
+```

docs/superpowers/plans/2026-04-22-market-backend-metrics.md

@@ -0,0 +1,258 @@
+# Market Backend Metrics Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Connect the extension to the real backend creator search API and render six backend metrics in a new `秒探指标` column while preserving the two existing Xingtu rate columns.
+
+**Architecture:** Add a background-owned backend metrics request path that uses the existing Logto access token, then batch-request the visible page's `star_id` values from the content layer and map results back onto per-row UI state. Keep Xingtu-sourced rates untouched and add a second metrics structure for the backend-only values.
+
+**Tech Stack:** TypeScript, Chrome MV3 background messaging, existing Logto auth flow, Vitest, tsup
+
+---
+
+## File Map
+
+- Modify: `src/shared/auth-messages.ts`
+  - Add a background message contract for backend metrics search.
+- Create: `src/shared/backend-metrics-config.ts`
+  - Hold the default backend base URL in one place.
+- Create: `src/shared/backend-metrics-client.ts`
+  - Build the backend request and map response rows into extension-friendly metric objects.
+- Modify: `src/background/index.ts`
+  - Handle the new backend metrics runtime message and call the backend client with Logto token.
+- Modify: `src/content/market/types.ts`
+  - Add types for the six backend metrics and merged row state.
+- Modify: `src/content/market/result-store.ts`
+  - Persist backend metrics, loading, success, missing, and failure states.
+- Modify: `src/content/market/dom-sync.ts`
+  - Add one `秒探指标` column and render loading/success/missing/failure states.
+- Modify: `src/content/market/index.ts`
+  - Batch-load visible page `star_id` values through background and update row state.
+- Test: `tests/backend-metrics-client.test.ts`
+  - Verify request payloads and response mapping.
+- Modify: `tests/background-index.test.ts`
+  - Verify background handles backend metrics requests.
+- Modify: `tests/market-content-entry.test.ts`
+  - Verify the content controller batches visible `star_id` values and renders the new metrics column.
+- Modify: `tests/market-dom-sync.test.ts`
+  - Verify the new UI cell states.
+- Modify: `tests/auth-messages.test.ts`
+  - Verify new message guards.
+
+### Task 1: Shared Backend Metrics Contract
+
+**Files:**
+- Create: `src/shared/backend-metrics-config.ts`
+- Create: `src/shared/backend-metrics-client.ts`
+- Modify: `src/shared/auth-messages.ts`
+- Test: `tests/backend-metrics-client.test.ts`
+- Test: `tests/auth-messages.test.ts`
+
+- [ ] **Step 1: Write the failing shared tests**
+
+Add tests for:
+- default backend base URL export
+- request body shape using `type: "star_id"`
+- mapping backend fields:
+  - `avg_after_view_search_rate`
+  - `avg_after_view_search_cnt`
+  - `avg_a3_increase_cnt`
+  - `avg_new_a3_rate`
+  - `cpa3`
+  - `cp_search`
+- new runtime message guard recognition
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `npm test -- tests/backend-metrics-client.test.ts tests/auth-messages.test.ts`
+Expected: FAIL because the backend metrics files and message shapes do not exist yet.
+
+- [ ] **Step 3: Write minimal shared implementation**
+
+Implement:
+- `DEFAULT_BACKEND_METRICS_BASE_URL`
+- a backend client that posts to `/api/v1/history/talents/search`
+- request/response helpers for runtime messaging
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `npm test -- tests/backend-metrics-client.test.ts tests/auth-messages.test.ts`
+Expected: PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/shared/backend-metrics-config.ts src/shared/backend-metrics-client.ts src/shared/auth-messages.ts tests/backend-metrics-client.test.ts tests/auth-messages.test.ts
+git commit -m "feat: add backend metrics shared client"
+```
+
+### Task 2: Background Search Bridge
+
+**Files:**
+- Modify: `src/background/index.ts`
+- Modify: `tests/background-index.test.ts`
+
+- [ ] **Step 1: Write the failing background test**
+
+Add a test for a runtime message like:
+
+```ts
+{
+  type: "backend-metrics:search",
+  value: {
+    starIds: ["111", "222"]
+  }
+}
+```
+
+Expected behavior:
+- background reads the Logto access token
+- background calls the backend metrics client
+- background returns `{ ok: true, type: "backend-metrics:result", value: ... }`
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npm test -- tests/background-index.test.ts`
+Expected: FAIL because background does not handle the new message.
+
+- [ ] **Step 3: Write minimal background implementation**
+
+Add:
+- a new message type guard branch
+- lazy creation of the backend metrics client
+- token injection via the existing auth controller
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npm test -- tests/background-index.test.ts`
+Expected: PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/background/index.ts tests/background-index.test.ts
+git commit -m "feat: wire backend metrics search in background"
+```
+
+### Task 3: Row State and DOM Rendering
+
+**Files:**
+- Modify: `src/content/market/types.ts`
+- Modify: `src/content/market/result-store.ts`
+- Modify: `src/content/market/dom-sync.ts`
+- Modify: `tests/market-dom-sync.test.ts`
+
+- [ ] **Step 1: Write the failing DOM rendering tests**
+
+Add tests for:
+- header contains `秒探指标`
+- success state renders six metric labels and values
+- loading state renders `加载中...`
+- missing state renders `暂无数据`
+- failed state renders `加载失败`
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `npm test -- tests/market-dom-sync.test.ts`
+Expected: FAIL because the new column and states are not implemented.
+
+- [ ] **Step 3: Write minimal row-state and rendering implementation**
+
+Add:
+- backend metrics types
+- store methods for backend metrics status transitions
+- DOM helpers to insert and render the compact metrics panel
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `npm test -- tests/market-dom-sync.test.ts`
+Expected: PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/content/market/types.ts src/content/market/result-store.ts src/content/market/dom-sync.ts tests/market-dom-sync.test.ts
+git commit -m "feat: render backend metrics column"
+```
+
+### Task 4: Content Batch Loading
+
+**Files:**
+- Modify: `src/content/market/index.ts`
+- Modify: `tests/market-content-entry.test.ts`
+
+- [ ] **Step 1: Write the failing content integration tests**
+
+Add tests for:
+- collecting visible page `authorId` values as `star_id[]`
+- sending one background request for the page instead of one request per row
+- mapping result rows by `star_id`
+- rendering `暂无数据` when a row is absent from backend response
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `npm test -- tests/market-content-entry.test.ts`
+Expected: FAIL because the content controller still uses per-row Xingtu loading only.
+
+- [ ] **Step 3: Write minimal content implementation**
+
+Change the controller so it:
+- leaves old Xingtu rates logic intact
+- batches backend metrics requests per visible page
+- merges backend results into the store by `authorId`
+- updates the new metrics cell state
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `npm test -- tests/market-content-entry.test.ts`
+Expected: PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/content/market/index.ts tests/market-content-entry.test.ts
+git commit -m "feat: batch load backend metrics for market rows"
+```
+
+### Task 5: Full Verification
+
+**Files:**
+- Modify only if needed based on failures
+
+- [ ] **Step 1: Run focused backend metrics test suite**
+
+Run:
+
+```bash
+npm test -- tests/backend-metrics-client.test.ts tests/auth-messages.test.ts tests/background-index.test.ts tests/market-dom-sync.test.ts tests/market-content-entry.test.ts
+```
+
+Expected: PASS
+
+- [ ] **Step 2: Run the full test suite**
+
+Run: `npm test`
+Expected: PASS
+
+- [ ] **Step 3: Run production build**
+
+Run: `npm run build`
+Expected: PASS and updated assets in `dist/`
+
+- [ ] **Step 4: Manual verification checklist**
+
+Verify in the extension:
+- popup login still works
+- current page still shows old two Xingtu rate columns
+- new `秒探指标` column appears
+- rows show loading before data arrives
+- success rows show six backend metrics
+- unmatched rows show `暂无数据`
+- backend/network issues show `加载失败`
+
+- [ ] **Step 5: Final commit**
+
+```bash
+git add src/background/index.ts src/content/market/index.ts src/content/market/dom-sync.ts src/content/market/result-store.ts src/content/market/types.ts src/shared/backend-metrics-config.ts src/shared/backend-metrics-client.ts src/shared/auth-messages.ts tests/backend-metrics-client.test.ts tests/auth-messages.test.ts tests/background-index.test.ts tests/market-dom-sync.test.ts tests/market-content-entry.test.ts
+git commit -m "feat: add backend metrics to market plugin"
+```

docs/superpowers/plans/2026-04-22-market-batch-submit.md

@@ -0,0 +1,697 @@
+# Market Batch Submit Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a standalone `提交批次` toolbar action that collects the currently selected export range of Xingtu creators, prompts for a batch name, builds a batch payload with Logto user identity plus creator IDs, and submits the batch to a protected API endpoint with a Bearer token.
+
+**Architecture:** Reuse the existing export-range collection path so multi-page batch submission behaves exactly like CSV export. Keep responsibilities split: toolbar UI emits a submit intent, a batch-payload module assembles the request body, and a protected batch-submit client owns token injection plus POST behavior. For first-pass verification, extend the local mock server with a batch endpoint that echoes the submitted payload.
+
+**Tech Stack:** Chrome MV3, TypeScript, Vitest, tsup, Node HTTP server, `@logto/chrome-extension`
+
+---
+
+## File Map
+
+### New files
+
+- `src/content/market/batch-payload.ts`
+- `src/shared/batch-submit-client.ts`
+- `tests/batch-payload.test.ts`
+- `tests/batch-submit-client.test.ts`
+
+### Existing files to modify
+
+- `src/content/market/plugin-toolbar.ts`
+- `src/content/market/index.ts`
+- `src/shared/auth-messages.ts`
+- `src/background/auth/state.ts`
+- `src/popup/view.ts`
+- `scripts/mock-protected-api.mjs`
+- `tests/market-content-entry.test.ts`
+- `tests/popup-entry.test.ts`
+- `tests/mock-protected-api.test.ts`
+- `README.md`
+
+### Responsibilities
+
+- `src/content/market/plugin-toolbar.ts`: add a dedicated submit button and include it in busy-state handling.
+- `src/content/market/index.ts`: orchestrate prompt input, range collection reuse, payload creation, and batch submission.
+- `src/content/market/batch-payload.ts`: create the batch payload from batch name, timestamp, auth state, and market records.
+- `src/shared/batch-submit-client.ts`: POST JSON to the protected batch endpoint with `Authorization: Bearer <token>`.
+- `src/shared/auth-messages.ts` and `src/background/auth/state.ts`: expose stable access to Logto user `sub` and display name already present in auth state.
+- `scripts/mock-protected-api.mjs`: add a local `/api/mock/batches` endpoint that validates Bearer auth and echoes the payload.
+
+## Task 1: Add The Batch Payload Builder
+
+**Files:**
+- Create: `src/content/market/batch-payload.ts`
+- Create: `tests/batch-payload.test.ts`
+
+- [ ] **Step 1: Write the failing batch payload tests**
+
+Create `tests/batch-payload.test.ts` with cases for:
+
+```ts
+import { describe, expect, test } from "vitest";
+
+import { createBatchPayload } from "../src/content/market/batch-payload";
+
+describe("batch-payload", () => {
+  test("builds a batch id from the batch name and timestamp", () => {
+    const payload = createBatchPayload({
+      authState: {
+        isAuthenticated: true,
+        resource: "https://talent-search.intelligrow.cn",
+        userInfo: {
+          name: "王少卿",
+          sub: "p7pdhhtde8kj"
+        }
+      },
+      batchName: "618达人筛选第一批",
+      createdAt: "2026-04-22T12:30:00.000Z",
+      records: [
+        { authorId: "111", authorName: "达人A", status: "success" },
+        { authorId: "222", authorName: "达人B", status: "success" }
+      ]
+    });
+
+    expect(payload).toEqual({
+      authors: [
+        { authorId: "111", authorName: "达人A" },
+        { authorId: "222", authorName: "达人B" }
+      ],
+      batchId: "618达人筛选第一批-2026-04-22T12:30:00.000Z",
+      batchName: "618达人筛选第一批",
+      createdAt: "2026-04-22T12:30:00.000Z",
+      creatorName: "王少卿",
+      logtoUserId: "p7pdhhtde8kj",
+      resource: "https://talent-search.intelligrow.cn"
+    });
+  });
+
+  test("throws when the user id is unavailable", () => {
+    expect(() =>
+      createBatchPayload({
+        authState: {
+          isAuthenticated: true,
+          resource: "https://talent-search.intelligrow.cn",
+          userInfo: {
+            name: "王少卿"
+          }
+        },
+        batchName: "批次A",
+        createdAt: "2026-04-22T12:30:00.000Z",
+        records: [{ authorId: "111", authorName: "达人A", status: "success" }]
+      })
+    ).toThrow(/user/i);
+  });
+});
+```
+
+- [ ] **Step 2: Run the batch payload test to verify red**
+
+Run: `npm test -- tests/batch-payload.test.ts`
+
+Expected: FAIL because `createBatchPayload` does not exist yet
+
+- [ ] **Step 3: Implement the minimal batch payload builder**
+
+Create `src/content/market/batch-payload.ts` with:
+
+```ts
+import type { AuthStateValue } from "../../shared/auth-messages";
+import type { MarketRecord } from "./types";
+
+export interface BatchPayload {
+  authors: Array<{
+    authorId: string;
+    authorName: string;
+  }>;
+  batchId: string;
+  batchName: string;
+  createdAt: string;
+  creatorName: string;
+  logtoUserId: string;
+  resource: string;
+}
+
+export function createBatchPayload(options: {
+  authState: AuthStateValue;
+  batchName: string;
+  createdAt: string;
+  records: MarketRecord[];
+}): BatchPayload {
+  const logtoUserId = options.authState.userInfo?.sub?.trim();
+  if (!logtoUserId) {
+    throw new Error("batch submit user id unavailable");
+  }
+
+  const resource = options.authState.resource?.trim();
+  if (!resource) {
+    throw new Error("batch submit resource unavailable");
+  }
+
+  const batchName = options.batchName.trim();
+  if (!batchName) {
+    throw new Error("batch submit batch name is required");
+  }
+
+  return {
+    authors: options.records.map((record) => ({
+      authorId: record.authorId,
+      authorName: record.authorName
+    })),
+    batchId: `${batchName}-${options.createdAt}`,
+    batchName,
+    createdAt: options.createdAt,
+    creatorName:
+      options.authState.userInfo?.name ??
+      options.authState.userInfo?.username ??
+      logtoUserId,
+    logtoUserId,
+    resource
+  };
+}
+```
+
+- [ ] **Step 4: Run the batch payload test to verify green**
+
+Run: `npm test -- tests/batch-payload.test.ts`
+
+Expected: PASS
+
+- [ ] **Step 5: Commit the payload builder slice**
+
+Run:
+
+```bash
+git add src/content/market/batch-payload.ts tests/batch-payload.test.ts
+git commit -m "feat: add batch payload builder"
+```
+
+## Task 2: Build The Protected Batch Submit Client
+
+**Files:**
+- Create: `src/shared/batch-submit-client.ts`
+- Create: `tests/batch-submit-client.test.ts`
+
+- [ ] **Step 1: Write the failing batch submit client tests**
+
+Create `tests/batch-submit-client.test.ts` with:
+
+```ts
+import { describe, expect, test, vi } from "vitest";
+
+import { createBatchSubmitClient } from "../src/shared/batch-submit-client";
+
+describe("batch-submit-client", () => {
+  test("posts the batch payload with a Bearer token", async () => {
+    const sendMessage = vi.fn(async () => ({
+      ok: true,
+      type: "auth:token",
+      value: { accessToken: "abc123" }
+    }));
+    const fetchImpl = vi.fn(async () => ({
+      ok: true,
+      status: 200,
+      json: async () => ({ ok: true, acceptedCount: 2 })
+    }));
+
+    const client = createBatchSubmitClient({
+      baseUrl: "http://127.0.0.1:4319",
+      fetchImpl,
+      sendMessage
+    });
+
+    await client.submitBatch({
+      authors: [{ authorId: "111", authorName: "达人A" }],
+      batchId: "批次A-2026-04-22T12:30:00.000Z",
+      batchName: "批次A",
+      createdAt: "2026-04-22T12:30:00.000Z",
+      creatorName: "王少卿",
+      logtoUserId: "p7pdhhtde8kj",
+      resource: "https://talent-search.intelligrow.cn"
+    });
+
+    expect(fetchImpl).toHaveBeenCalledWith(
+      "http://127.0.0.1:4319/api/mock/batches",
+      expect.objectContaining({
+        body: JSON.stringify(
+          expect.objectContaining({
+            batchId: "批次A-2026-04-22T12:30:00.000Z"
+          })
+        ),
+        headers: expect.objectContaining({
+          Authorization: "Bearer abc123",
+          "Content-Type": "application/json"
+        }),
+        method: "POST"
+      })
+    );
+  });
+
+  test("throws on unauthorized responses", async () => {
+    const client = createBatchSubmitClient({
+      baseUrl: "http://127.0.0.1:4319",
+      fetchImpl: vi.fn(async () => ({
+        ok: false,
+        status: 401,
+        json: async () => ({ ok: false, error: "unauthorized" })
+      })),
+      sendMessage: vi.fn(async () => ({
+        ok: true,
+        type: "auth:token",
+        value: { accessToken: "abc123" }
+      }))
+    });
+
+    await expect(
+      client.submitBatch({
+        authors: [],
+        batchId: "批次A-2026-04-22T12:30:00.000Z",
+        batchName: "批次A",
+        createdAt: "2026-04-22T12:30:00.000Z",
+        creatorName: "王少卿",
+        logtoUserId: "p7pdhhtde8kj",
+        resource: "https://talent-search.intelligrow.cn"
+      })
+    ).rejects.toThrow(/unauthorized/i);
+  });
+});
+```
+
+- [ ] **Step 2: Run the batch submit client test to verify red**
+
+Run: `npm test -- tests/batch-submit-client.test.ts`
+
+Expected: FAIL because `createBatchSubmitClient` does not exist yet
+
+- [ ] **Step 3: Implement the minimal batch submit client**
+
+Create `src/shared/batch-submit-client.ts` with:
+
+```ts
+import { isAuthResponseMessage } from "./auth-messages";
+import type { BatchPayload } from "../content/market/batch-payload";
+
+interface FetchResponseLike {
+  json(): Promise<unknown>;
+  ok: boolean;
+  status: number;
+}
+
+type FetchLike = (
+  input: string,
+  init?: RequestInit
+) => Promise<FetchResponseLike>;
+
+type SendMessageLike = (message: unknown) => Promise<unknown>;
+
+export function createBatchSubmitClient(options: {
+  baseUrl: string;
+  fetchImpl?: FetchLike;
+  sendMessage: SendMessageLike;
+}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+
+  return {
+    async submitBatch(payload: BatchPayload) {
+      const token = await readAccessToken(options.sendMessage);
+      const response = await fetchImpl(
+        new URL("/api/mock/batches", options.baseUrl).toString(),
+        {
+          body: JSON.stringify(payload),
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json"
+          },
+          method: "POST"
+        }
+      );
+
+      if (response.status === 401 || response.status === 403) {
+        throw new Error("batch submit unauthorized");
+      }
+
+      if (!response.ok) {
+        throw new Error(`batch submit failed: ${response.status}`);
+      }
+
+      return response.json();
+    }
+  };
+}
+
+async function readAccessToken(sendMessage: SendMessageLike): Promise<string> {
+  const response = await sendMessage({ type: "auth:get-access-token" });
+  if (
+    !isAuthResponseMessage(response) ||
+    !response.ok ||
+    response.type !== "auth:token" ||
+    !response.value.accessToken.trim()
+  ) {
+    throw new Error("batch submit token unavailable");
+  }
+  return response.value.accessToken;
+}
+```
+
+- [ ] **Step 4: Run the batch submit client test to verify green**
+
+Run: `npm test -- tests/batch-submit-client.test.ts`
+
+Expected: PASS
+
+- [ ] **Step 5: Commit the batch submit client slice**
+
+Run:
+
+```bash
+git add src/shared/batch-submit-client.ts tests/batch-submit-client.test.ts
+git commit -m "feat: add batch submit client"
+```
+
+## Task 3: Extend The Toolbar With A Batch Submit Action
+
+**Files:**
+- Modify: `src/content/market/plugin-toolbar.ts`
+- Modify: `tests/market-content-entry.test.ts`
+
+- [ ] **Step 1: Write the failing toolbar tests**
+
+Add tests to `tests/market-content-entry.test.ts` for:
+
+```ts
+test("renders a batch submit button in the toolbar", async () => {
+  document.body.innerHTML = buildMarketFixture();
+
+  const { createMarketController } = await import("../src/content/market/index");
+  const controller = createMarketController({
+    document,
+    loadAuthorMetrics: async () => ({
+      success: true,
+      rates: {
+        personalVideoAfterSearchRate: "0.01% - 0.1%",
+        singleVideoAfterSearchRate: "0.01% - 0.1%"
+      }
+    }),
+    window
+  });
+
+  await controller.ready;
+
+  expect(document.querySelector('[data-plugin-batch-submit="button"]')).not.toBeNull();
+});
+```
+
+Also add a test that `setToolbarBusyState()` disables the batch submit button.
+
+- [ ] **Step 2: Run the focused market toolbar tests to verify red**
+
+Run: `npm test -- tests/market-content-entry.test.ts`
+
+Expected: FAIL because the batch submit button does not exist yet
+
+- [ ] **Step 3: Add the minimal toolbar button**
+
+Update `src/content/market/plugin-toolbar.ts`:
+
+- extend `PluginToolbarHandlers` with `onSubmitBatch()`
+- extend `PluginToolbarDom` with `batchSubmitButton: HTMLButtonElement`
+- create a new button:
+
+```ts
+const batchSubmitButton = document.createElement("button");
+batchSubmitButton.type = "button";
+batchSubmitButton.dataset.pluginBatchSubmit = "button";
+batchSubmitButton.textContent = "提交批次";
+```
+
+- append it next to `exportButton`
+- wire its click handler to `handlers.onSubmitBatch()`
+- include it in `readToolbarDom()` and `setToolbarBusyState()`
+
+- [ ] **Step 4: Re-run the focused market toolbar tests to verify green**
+
+Run: `npm test -- tests/market-content-entry.test.ts`
+
+Expected: PASS
+
+- [ ] **Step 5: Commit the toolbar slice**
+
+Run:
+
+```bash
+git add src/content/market/plugin-toolbar.ts tests/market-content-entry.test.ts
+git commit -m "feat: add batch submit toolbar action"
+```
+
+## Task 4: Wire Batch Submission Into The Market Controller
+
+**Files:**
+- Modify: `src/content/market/index.ts`
+- Modify: `src/shared/auth-messages.ts`
+- Modify: `src/background/auth/state.ts`
+- Modify: `tests/market-content-entry.test.ts`
+
+- [ ] **Step 1: Write the failing controller tests**
+
+Add tests to `tests/market-content-entry.test.ts` for:
+
+```ts
+test("prompts for a batch name before submitting the current range", async () => {
+  document.body.innerHTML = buildMarketFixture();
+  const prompt = vi.fn(() => "618达人筛选第一批");
+  const submitBatch = vi.fn(async () => ({ ok: true }));
+
+  const { createMarketController } = await import("../src/content/market/index");
+  const controller = createMarketController({
+    document,
+    getAuthState: async () => ({
+      isAuthenticated: true,
+      resource: "https://talent-search.intelligrow.cn",
+      userInfo: { name: "王少卿", sub: "p7pdhhtde8kj" }
+    }),
+    loadAuthorMetrics: async () => ({
+      success: true,
+      rates: {
+        personalVideoAfterSearchRate: "0.01% - 0.1%",
+        singleVideoAfterSearchRate: "0.01% - 0.1%"
+      }
+    }),
+    promptBatchName: prompt,
+    submitBatch,
+    window
+  });
+
+  await controller.ready;
+  (document.querySelector('[data-plugin-batch-submit="button"]') as HTMLButtonElement).click();
+  await Promise.resolve();
+
+  expect(prompt).toHaveBeenCalled();
+  expect(submitBatch).toHaveBeenCalledWith(
+    expect.objectContaining({
+      batchName: "618达人筛选第一批",
+      logtoUserId: "p7pdhhtde8kj"
+    })
+  );
+});
+
+test("shows an error when the batch name is blank", async () => {
+  // same setup, but prompt returns "   "
+  // expect toolbar status to contain "请输入批次名称"
+});
+
+test("does nothing when the prompt is cancelled", async () => {
+  // prompt returns null
+  // submitBatch is not called
+});
+```
+
+- [ ] **Step 2: Run the focused market controller tests to verify red**
+
+Run: `npm test -- tests/market-content-entry.test.ts`
+
+Expected: FAIL because batch submission wiring does not exist yet
+
+- [ ] **Step 3: Add the minimal market controller wiring**
+
+Update `src/content/market/index.ts`:
+
+- add optional dependencies:
+
+```ts
+getAuthState?: () => Promise<AuthStateValue>;
+promptBatchName?: () => string | null;
+submitBatch?: (payload: BatchPayload) => Promise<unknown>;
+```
+
+- default `getAuthState` to a `chrome.runtime.sendMessage({ type: "auth:get-state" })` wrapper
+- default `promptBatchName` to `() => window.prompt("请输入批次名称")`
+- default `submitBatch` to `createBatchSubmitClient(...).submitBatch`
+- add `onSubmitBatch` handler in `ensurePluginToolbar(...)`
+- behavior:
+  - read target via `readToolbarExportTarget()`
+  - prompt for batch name
+  - cancel on `null`
+  - reject blank names with `setToolbarExportStatus(toolbar, "请输入批次名称")`
+  - collect records via existing `exportRecords(target)`
+  - read auth state
+  - build payload with `createBatchPayload(...)`
+  - call `submitBatch(payload)`
+  - show `批次提交成功` on success
+  - show thrown message or `批次提交失败，请稍后重试` on failure
+
+- [ ] **Step 4: Extend auth state only if the tests expose a gap**
+
+If tests reveal missing fields, ensure `src/background/auth/state.ts` continues exposing:
+- `userInfo.sub`
+- `userInfo.name`
+- `resource`
+
+If `src/shared/auth-messages.ts` needs typing support, update only types, not message kinds.
+
+- [ ] **Step 5: Re-run the focused market controller tests to verify green**
+
+Run: `npm test -- tests/market-content-entry.test.ts`
+
+Expected: PASS
+
+- [ ] **Step 6: Commit the market controller slice**
+
+Run:
+
+```bash
+git add src/content/market/index.ts src/shared/auth-messages.ts src/background/auth/state.ts tests/market-content-entry.test.ts
+git commit -m "feat: wire market batch submission flow"
+```
+
+## Task 5: Extend The Mock Server And Popup Debugging
+
+**Files:**
+- Modify: `scripts/mock-protected-api.mjs`
+- Modify: `tests/mock-protected-api.test.ts`
+- Modify: `src/popup/view.ts`
+- Modify: `tests/popup-entry.test.ts` only if needed for debug output wording
+- Modify: `README.md`
+
+- [ ] **Step 1: Write the failing mock batch endpoint tests**
+
+Add cases to `tests/mock-protected-api.test.ts`:
+
+```ts
+test("accepts a batch payload when a Bearer token is present", async () => {
+  const server = createMockProtectedApiServer({ port: 0 });
+  await server.start();
+
+  const response = await fetch(`${server.baseUrl}/api/mock/batches`, {
+    body: JSON.stringify({
+      authors: [{ authorId: "111", authorName: "达人A" }],
+      batchId: "批次A-2026-04-22T12:30:00.000Z",
+      batchName: "批次A",
+      createdAt: "2026-04-22T12:30:00.000Z",
+      creatorName: "王少卿",
+      logtoUserId: "p7pdhhtde8kj",
+      resource: "https://talent-search.intelligrow.cn"
+    }),
+    headers: {
+      Authorization: "Bearer abc123",
+      "Content-Type": "application/json"
+    },
+    method: "POST"
+  });
+
+  expect(response.status).toBe(200);
+  await expect(response.json()).resolves.toEqual(
+    expect.objectContaining({
+      acceptedCount: 1,
+      ok: true,
+      source: "mock-batch-submit"
+    })
+  );
+});
+```
+
+- [ ] **Step 2: Run the mock server tests to verify red**
+
+Run: `npm test -- tests/mock-protected-api.test.ts`
+
+Expected: FAIL because the batch endpoint does not exist yet
+
+- [ ] **Step 3: Implement the minimal mock batch endpoint**
+
+Update `scripts/mock-protected-api.mjs`:
+
+- keep the existing `/api/mock/protected`
+- add `/api/mock/batches` for `POST`
+- require the same Bearer header validation
+- read the JSON body and return:
+
+```json
+{
+  "ok": true,
+  "source": "mock-batch-submit",
+  "acceptedCount": 1,
+  "batchId": "<echoed batch id>"
+}
+```
+
+- [ ] **Step 4: Update the docs**
+
+Add to `README.md`:
+- how to trigger `提交批次`
+- how the prompt should be filled
+- expected mock response
+
+- [ ] **Step 5: Re-run the mock server tests to verify green**
+
+Run: `npm test -- tests/mock-protected-api.test.ts`
+
+Expected: PASS
+
+- [ ] **Step 6: Commit the mock batch slice**
+
+Run:
+
+```bash
+git add scripts/mock-protected-api.mjs tests/mock-protected-api.test.ts README.md
+git commit -m "feat: add mock batch submit endpoint"
+```
+
+## Final Verification
+
+- [ ] Run the focused batch feature tests:
+
+```bash
+npm test -- tests/auth-config.test.ts tests/batch-payload.test.ts tests/batch-submit-client.test.ts tests/mock-protected-api.test.ts tests/market-content-entry.test.ts
+```
+
+Expected: PASS
+
+- [ ] Run the full test suite:
+
+```bash
+npm test
+```
+
+Expected: PASS
+
+- [ ] Run the production build:
+
+```bash
+npm run build
+```
+
+Expected: build completes and updates `dist/`
+
+- [ ] Perform the manual smoke test:
+
+1. Start `npm run mock:protected-api`
+2. Reload the unpacked extension from `dist/`
+3. Log in through the popup
+4. Open the Xingtu market page
+5. Choose an export range
+6. Click `提交批次`
+7. Enter a batch name in `prompt()`
+8. Confirm success text appears
+9. Verify the mock response contains the batch id and accepted creator count

docs/superpowers/plans/2026-04-22-market-scrollable-plugin-columns.md

@@ -0,0 +1,61 @@
+# Market Scrollable Plugin Columns Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Move plugin-generated market columns out of the right sticky area and into the horizontally scrollable middle area.
+
+**Architecture:** Keep Xingtu's native left and right sticky sections intact. Add a dedicated non-sticky plugin section for the injected columns and continue rendering row state through the existing `MarketRowDom` abstraction.
+
+**Tech Stack:** TypeScript, Vitest, jsdom
+
+---
+
+### Task 1: Lock The Intended Layout In Tests
+
+**Files:**
+- Modify: `tests/market-dom-sync.test.ts`
+- Modify: `tests/market-content-entry.test.ts`
+
+- [ ] **Step 1: Write failing tests for the layout boundary**
+
+Add assertions that:
+- the right sticky header/body widths remain native after plugin columns are added
+- plugin columns live in a dedicated non-sticky section instead of the right sticky section
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `npm test -- tests/market-dom-sync.test.ts tests/market-content-entry.test.ts`
+
+- [ ] **Step 3: Implement the minimal layout changes**
+
+Update the div-grid sync path so plugin columns are inserted into a separate scrollable section.
+
+- [ ] **Step 4: Re-run the same tests**
+
+Run: `npm test -- tests/market-dom-sync.test.ts tests/market-content-entry.test.ts`
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add tests/market-dom-sync.test.ts tests/market-content-entry.test.ts src/content/market/dom-sync.ts
+git commit -m "feat: move market plugin columns into scrollable section"
+```
+
+### Task 2: Verify No Export Regression
+
+**Files:**
+- Verify only: `src/content/market/index.ts`
+- Verify only: `src/content/market/export-range-controller.ts`
+- Verify only: `tests/full-scan-controller.test.ts`
+
+- [ ] **Step 1: Run export-related regression tests**
+
+Run: `npm test -- tests/full-scan-controller.test.ts`
+
+- [ ] **Step 2: Run build**
+
+Run: `npm run build`
+
+- [ ] **Step 3: Report any unrelated failures separately**
+
+Do not broaden the scope unless a new failure is caused by the layout change.

docs/superpowers/plans/2026-04-23-market-native-action-bar.md

@@ -0,0 +1,161 @@
+# Market Native Action Bar Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Move the plugin export actions into Xingtu's native market action row and remove the old top toolbar and unused filter/sort controls.
+
+**Architecture:** Keep the existing export and batch-submit business logic, but replace the toolbar mount point and DOM shape. The new toolbar becomes a small inline action bar inserted into the native button row beside `自定义指标` and `导出`, while the controller only depends on export-range and action buttons.
+
+**Tech Stack:** TypeScript, Chrome MV3 content script, jsdom/Vitest
+
+---
+
+## File Map
+
+- Modify: `src/content/market/plugin-toolbar.ts`
+  - Replace the top toolbar with an inline native-style action bar.
+- Modify: `src/content/market/index.ts`
+  - Remove filter/sort toolbar dependencies.
+- Modify: `tests/market-content-entry.test.ts`
+  - Update toolbar assertions to the new placement and reduced control set.
+
+### Task 1: Lock The New Toolbar Shape In Tests
+
+**Files:**
+- Modify: `tests/market-content-entry.test.ts`
+
+- [ ] **Step 1: Write the failing toolbar placement tests**
+
+Add tests that assert:
+- the plugin toolbar is inserted next to the native `自定义指标` / `导出` action row
+- the toolbar no longer renders filter/sort controls
+- the toolbar still renders export range, custom page input, export button, batch button, and status text
+
+- [ ] **Step 2: Run the focused test to verify it fails**
+
+Run: `npx vitest run tests/market-content-entry.test.ts -t "renders the plugin action bar inside the native market action row"`
+Expected: FAIL because the toolbar still prepends to `document.body` and still contains filter/sort controls.
+
+- [ ] **Step 3: Add a failing busy-state regression test**
+
+Assert that during export:
+- export button is disabled
+- batch button is disabled
+- export range select is disabled
+- custom page input is disabled when visible
+
+- [ ] **Step 4: Run the focused busy-state test**
+
+Run: `npx vitest run tests/market-content-entry.test.ts -t "exporting all pages disables the native action bar controls during the task"`
+Expected: FAIL only if the new toolbar structure breaks existing busy-state selectors.
+
+### Task 2: Implement The Native Action Bar
+
+**Files:**
+- Modify: `src/content/market/plugin-toolbar.ts`
+
+- [ ] **Step 1: Replace the toolbar mount strategy**
+
+Implement a helper that finds the native action row containing `自定义指标` and `导出`, then inserts the plugin root into that row.
+
+- [ ] **Step 2: Replace the toolbar DOM structure**
+
+Create only:
+- export range select
+- custom pages input
+- export button
+- batch submit button
+- export status text
+
+Remove creation and lookup of:
+- filter inputs
+- filter button
+- sort field select
+- sort direction select
+- sort button
+
+- [ ] **Step 3: Apply native-style button and inline layout styling**
+
+Use lightweight inline styles / class reuse so the plugin controls visually align with the native button row.
+
+- [ ] **Step 4: Keep custom-range visibility logic working**
+
+Preserve:
+- `current`
+- `first-5`
+- `first-10`
+- `all`
+- `custom`
+
+When `custom` is selected, show the input; otherwise hide it.
+
+- [ ] **Step 5: Run the focused tests to verify green**
+
+Run:
+
+```bash
+npx vitest run tests/market-content-entry.test.ts -t "renders the plugin action bar inside the native market action row|exporting all pages disables the native action bar controls during the task"
+```
+
+Expected: PASS
+
+### Task 3: Remove Toolbar Filter/Sort Dependencies
+
+**Files:**
+- Modify: `src/content/market/index.ts`
+- Modify: `tests/market-content-entry.test.ts`
+
+- [ ] **Step 1: Remove toolbar filter/sort read paths**
+
+Delete the toolbar handlers and state reads that depend on removed controls.
+
+- [ ] **Step 2: Keep export and batch submission behavior intact**
+
+Ensure:
+- export still reads the selected range
+- batch submit still reads the selected range
+- status text still updates during progress and completion
+
+- [ ] **Step 3: Update affected tests**
+
+Adjust tests that previously asserted filter/sort button disabled state so they assert only the remaining controls.
+
+- [ ] **Step 4: Run focused regression tests**
+
+Run:
+
+```bash
+npx vitest run tests/market-content-entry.test.ts -t "custom export range blocks invalid page counts|prompts for a batch name before submitting the current range|exporting all pages disables the native action bar controls during the task"
+```
+
+Expected: PASS
+
+### Task 4: Final Verification
+
+**Files:**
+- Verify only: `src/content/market/plugin-toolbar.ts`
+- Verify only: `src/content/market/index.ts`
+- Verify only: `tests/market-content-entry.test.ts`
+
+- [ ] **Step 1: Run the targeted market content tests**
+
+Run:
+
+```bash
+npx vitest run tests/market-content-entry.test.ts
+```
+
+- [ ] **Step 2: Run build**
+
+Run:
+
+```bash
+npm run build
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/content/market/plugin-toolbar.ts src/content/market/index.ts tests/market-content-entry.test.ts docs/superpowers/specs/2026-04-23-market-native-action-bar-design.md docs/superpowers/plans/2026-04-23-market-native-action-bar.md
+git commit -m "feat: move market actions into native action bar"
+```

docs/superpowers/plans/2026-04-23-market-selection-export.md

@@ -0,0 +1,181 @@
+# Market Selection Export Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add cross-page creator selection checkboxes so CSV export and batch submission operate on selected creators within the chosen export range, with fallback to the full export range when no selected creators are present in that range.
+
+**Architecture:** Extend the market table DOM sync layer with a leading checkbox column and a current-page header select-all control, then keep selection state in the content controller as a `Set<authorId>`. Reuse the existing export-range pipeline by filtering resolved `MarketRecord[]` after range collection and before CSV generation or batch payload creation.
+
+**Tech Stack:** TypeScript, Chrome MV3 content script, existing DOM sync helpers, Vitest, jsdom
+
+---
+
+## File Map
+
+- Modify: `src/content/market/dom-sync.ts`
+  - Add checkbox column rendering, row checkbox references, header checkbox references, and checkbox state sync helpers.
+- Modify: `src/content/market/types.ts`
+  - Add minimal selection-related DOM typing if needed.
+- Modify: `src/content/market/index.ts`
+  - Store selected creator ids, respond to row and header checkbox changes, and filter export / batch records with fallback logic.
+- Test: `tests/market-dom-sync.test.ts`
+  - Cover injected checkbox header and row controls for both synthetic and div-grid layouts.
+- Test: `tests/market-content-entry.test.ts`
+  - Cover per-row selection, current-page select-all, cross-page persistence, export filtering, fallback behavior, and batch submission filtering.
+
+### Task 1: Checkbox Column DOM
+
+**Files:**
+- Modify: `src/content/market/dom-sync.ts`
+- Modify: `src/content/market/types.ts`
+- Test: `tests/market-dom-sync.test.ts`
+
+- [ ] **Step 1: Write the failing DOM tests**
+
+Add tests for:
+- synthetic tables inject a leading checkbox header cell and one checkbox cell per row
+- div-grid tables inject a leading checkbox column and current-page header checkbox
+- returned table DOM exposes row checkbox elements and the header checkbox
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `npm test -- tests/market-dom-sync.test.ts`
+Expected: FAIL because the checkbox column and DOM references do not exist yet.
+
+- [ ] **Step 3: Write minimal DOM implementation**
+
+Implement in `src/content/market/dom-sync.ts`:
+- a leading selection column key
+- row checkbox creation for synthetic rows
+- row checkbox column creation for div-grid rows
+- header checkbox creation for both layouts
+- `MarketRowDom` and `MarketTableDom` additions for checkbox references
+
+Keep the new column visually narrow and place it before the author column.
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `npm test -- tests/market-dom-sync.test.ts`
+Expected: PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/content/market/dom-sync.ts src/content/market/types.ts tests/market-dom-sync.test.ts
+git commit -m "feat: add market row selection column"
+```
+
+### Task 2: Controller Selection State
+
+**Files:**
+- Modify: `src/content/market/index.ts`
+- Test: `tests/market-content-entry.test.ts`
+
+- [ ] **Step 1: Write the failing controller tests**
+
+Add tests for:
+- clicking a row checkbox stores that creator selection
+- selection survives a page change and re-render
+- header checkbox selects all visible creators on the current page
+- header checkbox clears all visible creators on the current page
+- header checkbox becomes indeterminate when only part of the current page is selected
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `npm test -- tests/market-content-entry.test.ts -t "selection"`
+Expected: FAIL because the controller does not yet track selection or bind checkbox events.
+
+- [ ] **Step 3: Write minimal controller implementation**
+
+Implement in `src/content/market/index.ts`:
+- `selectedAuthorIds: Set<string>`
+- event listeners for row checkboxes and the header checkbox
+- current-page checkbox state sync during `applyCurrentView()`
+- current-page select-all behavior scoped only to visible rows from the current DOM table
+
+Do not persist selection in `resultStore`. Keep it controller-local and keyed by `authorId`.
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `npm test -- tests/market-content-entry.test.ts -t "selection"`
+Expected: PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/content/market/index.ts tests/market-content-entry.test.ts
+git commit -m "feat: track selected market creators"
+```
+
+### Task 3: Export and Batch Filtering
+
+**Files:**
+- Modify: `src/content/market/index.ts`
+- Test: `tests/market-content-entry.test.ts`
+
+- [ ] **Step 1: Write the failing filtering tests**
+
+Add tests for:
+- export uses only selected creators when the resolved export range contains selected creators
+- export falls back to the full resolved export range when none of the selected creators are inside that resolved range
+- batch submit uses the same selected-with-fallback record set
+- cross-page selections only apply when those selected creators are inside the chosen export range
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `npm test -- tests/market-content-entry.test.ts -t "selected"`
+Expected: FAIL because export and batch submit still use the full resolved range.
+
+- [ ] **Step 3: Write minimal filtering implementation**
+
+Implement in `src/content/market/index.ts`:
+- a helper that filters resolved `MarketRecord[]` by `selectedAuthorIds`
+- fallback to the original resolved records when the filtered subset is empty
+- use this helper in both:
+  - CSV export before `buildCsv(records)`
+  - batch submit before `createBatchPayload(...)`
+
+Keep the CSV exporter and batch payload builder unchanged. Only change the records passed into them.
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `npm test -- tests/market-content-entry.test.ts -t "selected"`
+Expected: PASS
+
+- [ ] **Step 5: Run focused verification**
+
+Run:
+- `npm test -- tests/market-dom-sync.test.ts`
+- `npm test -- tests/market-content-entry.test.ts`
+- `npm run build`
+
+Expected:
+- market DOM sync tests pass
+- market content controller tests pass
+- build exits 0
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/content/market/index.ts tests/market-content-entry.test.ts
+git commit -m "feat: filter market export by selected creators"
+```
+
+## Notes for Implementation
+
+- Scope the header checkbox to the current visible page only.
+- Recompute header checkbox state after every DOM re-sync and after every selection change.
+- Apply selection after export-range resolution, not before. This preserves current range semantics.
+- When no selected creators exist inside the resolved export range, keep current behavior and export / submit the whole resolved range.
+- Do not modify CSV headers or batch payload shape.
+
+## Final Verification
+
+- [ ] `npm test -- tests/market-dom-sync.test.ts tests/market-content-entry.test.ts`
+- [ ] `npm test -- tests/backend-metrics-client.test.ts tests/batch-submit-client.test.ts tests/background-index.test.ts tests/batch-payload.test.ts`
+- [ ] `npm run build`
+- [ ] Manual browser check:
+  - select a few creators on page 1 and page 3
+  - export `当前页` from page 1 and confirm only selected page 1 creators export
+  - export `前5页` and confirm selected creators across pages are included
+  - clear current page via header checkbox and confirm other-page selections remain

docs/superpowers/specs/2026-04-22-logto-protected-api-mock-design.md

@@ -0,0 +1,216 @@
+# Logto 受保护 API Mock 联调设计
+
+## 背景
+
+当前扩展已经具备基础的 Logto 登录能力：
+
+- popup 可触发登录和登出
+- background 可通过 `@logto/chrome-extension` 获取 access token
+- 页面功能在未登录时会被 auth gate 拦住
+
+但现阶段业务数据仍然来自页面站内接口，尚未真正验证“扩展拿到 Logto access token 后，请求受保护 API”这条链路。后续真实后端将由其他人提供，因此当前阶段的目标不是接入正式接口，而是先在本地完成一套可重复验证的模拟联调方案。
+
+## 目标
+
+- 新增一个专用于 Logto 受保护 API 的扩展客户端。
+- 扩展请求受保护 API 前，必须先通过 background 获取 access token。
+- 请求时自动附加 `Authorization: Bearer <token>` 请求头。
+- 提供一个本地 mock 受保护 API，用于验证扩展到后端的完整调用链路。
+- 提供自动化测试，分别覆盖：
+  - token 注入逻辑
+  - mock API 授权成功/失败行为
+
+## 非目标
+
+- 不接入真实业务后端。
+- 不做真实 JWT 签名校验、JWKS 拉取或资源权限判定。
+- 不修改现有星图页面数据采集逻辑为正式后端模式。
+- 不在本阶段设计复杂的 token 刷新监控或重试策略。
+
+## 方案对比
+
+### 方案 A：只做本地 mock 后端
+
+- 直接搭一个假接口，扩展请求它并观察返回。
+- 优点：最接近最终使用方式。
+- 缺点：如果联调失败，不容易快速判断问题出在 token 注入还是 mock 服务本身。
+
+### 方案 B：只做代码级测试
+
+- 不起本地服务，只用测试替身验证请求头是否带 token。
+- 优点：实现快，定位问题直接。
+- 缺点：无法证明完整链路可运行。
+
+### 方案 C：先代码级测试，再接本地 mock 后端
+
+- 先用单元测试锁定 token 注入行为，再起 mock 服务完成真实联调。
+- 优点：定位问题更快，同时保留完整链路验证。
+- 缺点：改动稍多于单一方案。
+
+推荐采用方案 C。
+
+## 架构设计
+
+### 1. 扩展受保护 API 客户端
+
+新增一个独立客户端模块，职责如下：
+
+- 向 background 发送 `auth:get-access-token` 消息
+- 读取返回的 access token
+- 使用该 token 请求指定后端地址
+- 将接口成功、未授权、网络失败这三类结果转成明确错误
+
+这个客户端不直接耦合星图 DOM，也不依赖 popup。它只负责“拿 token 并带 token 发请求”，这样后续替换正式后端时只需要调整接口地址和返回映射。
+
+### 2. Background 认证桥接
+
+现有 background 已支持 `auth:get-access-token`。本次不改变登录主流程，只把它当作唯一 token 来源：
+
+- content script 不直接接触 Logto SDK
+- 所有受保护 API 请求都通过 background 提供 token
+
+这样可以保持认证逻辑集中，符合 MV3 扩展的边界约束。
+
+### 3. 本地 mock 受保护 API
+
+新增一个轻量本地服务作为测试后端，建议职责保持极小：
+
+- 暴露固定测试 endpoint，例如 `/api/mock/protected`
+- 检查请求头中是否存在 `Authorization`
+- 如果请求头形如 `Bearer <非空字符串>`，返回固定假数据
+- 如果没有该头，返回 `401`
+
+本阶段不要求验证 token 是否来自真实 Logto，只验证“扩展是否按约定附带了 Bearer token”。
+
+## 数据流
+
+完整调用链路如下：
+
+1. 扩展中的业务入口调用受保护 API 客户端
+2. 客户端向 background 发送 `auth:get-access-token`
+3. background 返回当前 access token
+4. 客户端带上 `Authorization: Bearer <token>` 请求本地 mock API
+5. mock API 校验请求头并返回假数据
+6. 客户端将结果回传给调用方
+
+失败分支：
+
+- 如果 background 没返回合法 token，客户端直接报错，不发请求
+- 如果 mock API 返回 `401`，客户端将其识别为未授权错误
+- 如果请求超时或网络失败，客户端抛出网络错误
+
+## 接口设计
+
+### 扩展内客户端接口
+
+建议客户端提供单一入口，例如：
+
+- `loadProtectedMockData()`
+
+内部行为：
+
+- 先取 token
+- 再发 GET 请求
+- 返回结构化响应对象或抛出明确错误
+
+后续替换真实后端时，可以保留同样入口，内部再切换到真实 endpoint。
+
+### Mock API 返回
+
+成功时返回固定 JSON，例如：
+
+```json
+{
+  "ok": true,
+  "source": "mock-protected-api",
+  "message": "authorized",
+  "receivedAuthHeader": "Bearer ..."
+}
+```
+
+失败时返回：
+
+```json
+{
+  "ok": false,
+  "error": "unauthorized"
+}
+```
+
+## 错误处理
+
+### 无 token
+
+- 判定条件：background 未返回 `auth:token`，或 token 为空字符串
+- 处理方式：立即抛错，提示当前未登录或 token 不可用
+
+### 未授权
+
+- 判定条件：后端返回 `401` 或 `403`
+- 处理方式：抛出授权失败错误，供上层展示“请重新登录”
+
+### 网络失败
+
+- 判定条件：fetch 抛异常、连接失败、超时
+- 处理方式：抛出网络错误，不吞掉异常原因
+
+## 实现边界
+
+建议新增或调整如下模块：
+
+### `src/content/market` 下新增受保护 API 客户端
+
+- 不替换现有页面接口客户端
+- 独立处理 mock 受保护 API 访问
+- 便于后续把“页面抓取模式”和“后端接口模式”并行保留
+
+### `src/shared/auth-messages.ts`
+
+- 复用现有 `auth:get-access-token`
+- 若现有消息结构足够，则不新增消息类型
+
+### `scripts/` 或独立目录中的 mock 服务
+
+- 提供本地测试服务启动脚本
+- 默认监听本地固定端口
+- 返回固定 JSON 结果
+
+## 测试策略
+
+### 单元测试
+
+- 客户端请求前会先获取 access token
+- 拿到 token 后，请求头中包含 `Authorization: Bearer <token>`
+- token 缺失时不会发起 fetch
+- 接口返回 `401` 时抛出未授权错误
+- 接口返回成功时正确解析 JSON
+
+### 联调测试
+
+- 启动本地 mock 服务后，带 token 请求能成功
+- 不带 token 请求返回 `401`
+- 扩展客户端能读到 mock 返回的假数据
+
+## 手动验证
+
+1. 构建并加载扩展
+2. 在 popup 中完成 Logto 登录
+3. 启动本地 mock API
+4. 触发扩展中的受保护接口请求
+5. 确认 mock API 收到 `Authorization: Bearer <token>`
+6. 确认扩展端收到成功响应
+
+## 迁移到真实后端的路径
+
+当真实后端可用时，仅需要替换以下内容：
+
+- mock API 基地址
+- 具体 endpoint 路径
+- 返回数据结构映射
+- 若真实后端要求额外 scope，则补充 `auth-config` 中的 scopes
+
+核心认证链路保持不变：
+
+- 仍由 background 提供 token
+- 仍由独立客户端附带 `Bearer` 请求头
+- 仍按未授权和网络错误分别处理

docs/superpowers/specs/2026-04-22-market-backend-metrics-csv-design.md

@@ -0,0 +1,63 @@
+# Market Backend Metrics CSV Design
+
+## Goal
+
+Extend the existing CSV export so it includes the six backend metrics already shown in the plugin UI.
+
+## Confirmed Decisions
+
+- Reuse the current export flow.
+- Do not add a separate backend request for CSV export.
+- Read backend metrics directly from the in-memory `MarketRecord`.
+- Append the six backend metrics columns after the existing CSV columns.
+- Keep the existing CSV columns and ordering unchanged.
+- Use these exact CSV headers:
+  - `看后搜率`
+  - `看后搜数`
+  - `新增A3数`
+  - `新增A3率`
+  - `CPA3`
+  - `cp_search`
+- If a record has no backend metrics, export empty strings for these six columns.
+
+## Architecture
+
+- `src/content/market/csv-exporter.ts` remains the single place that defines CSV column layout.
+- The exporter will keep current base columns and Xingtu rate columns, then append six backend metrics columns.
+- No UI changes.
+- No batch submission changes.
+- No popup or config changes.
+
+## Data Source
+
+Each exported row will read from:
+
+- existing fields:
+  - `authorId`
+  - `authorName`
+  - `location`
+  - `price21To60s`
+  - `rates.singleVideoAfterSearchRate`
+  - `rates.personalVideoAfterSearchRate`
+- new backend metrics fields:
+  - `backendMetrics.afterViewSearchRate`
+  - `backendMetrics.afterViewSearchCount`
+  - `backendMetrics.a3IncreaseCount`
+  - `backendMetrics.newA3Rate`
+  - `backendMetrics.cpa3`
+  - `backendMetrics.cpSearch`
+
+## Failure Handling
+
+- Missing backend metrics: export blank cells
+- Existing rate formatting behavior remains unchanged
+- Backend loading state does not alter CSV structure; it only affects whether the cells contain values or blanks
+
+## Testing
+
+Add tests for:
+
+- backend metric headers appended to CSV
+- backend metric values exported correctly
+- empty backend metric cells when metrics are absent
+- no regression in current base/rate export behavior

docs/superpowers/specs/2026-04-22-market-backend-metrics-design.md

@@ -0,0 +1,110 @@
+# Market Backend Metrics Design
+
+## Goal
+
+Connect the current Chrome extension to the real backend search API and display six backend metrics in the plugin UI, while preserving the existing two Xingtu rate columns.
+
+## Confirmed Decisions
+
+- Keep the existing two Xingtu metrics unchanged:
+  - `singleVideoAfterSearchRate`
+  - `personalVideoAfterSearchRate`
+- Add one new UI column named `秒探指标`.
+- Render the six backend metrics inside that column as a compact 2-column metrics panel:
+  - `avg_after_view_search_rate`
+  - `avg_after_view_search_cnt`
+  - `avg_a3_increase_cnt`
+  - `avg_new_a3_rate`
+  - `cpa3`
+  - `cp_search`
+- Fetch backend metrics through the background service worker, not directly from the content script.
+- Use Logto access tokens from the existing background auth flow.
+- Query the backend by `star_id`, not by nickname.
+- Send one batched request per visible page of creators.
+- Use a code-level default backend base URL. Do not build a settings UI in this change.
+- Do not change CSV export or batch submission payloads in this change.
+
+## API Contract
+
+- Base URL:
+  - default to `http://192.168.31.29:8083`
+- Endpoint:
+  - `POST /api/v1/history/talents/search`
+- Headers:
+  - `Authorization: Bearer <Logto access token>`
+  - `Content-Type: application/json`
+- Request body:
+
+```json
+{
+  "type": "star_id",
+  "values": ["7252982749131178039", "7290491710910496809"],
+  "page": 1,
+  "size": 100
+}
+```
+
+## Architecture
+
+### Background
+
+- Add a new background message for backend metrics search.
+- The background handler:
+  - gets the current Logto access token
+  - calls the backend search API
+  - returns parsed metric rows to the content script
+
+This follows the same rule already used for protected API and batch submission: token-bearing business requests belong in the background layer.
+
+### Content
+
+- Replace per-row metric loading with page-level batched loading for backend metrics.
+- Collect all visible `authorId` values from the current page.
+- Send them to the background as `star_id[]`.
+- Map the backend response back to rows by `star_id`.
+
+### UI
+
+- Keep the old two columns where they are today.
+- Add one new `秒探指标` column.
+- Each cell shows:
+  - `加载中...`
+  - a compact 6-metric panel
+  - `暂无数据`
+  - `加载失败`
+
+## Data Model
+
+Add a new backend metrics structure to market records:
+
+- `afterViewSearchRate`
+- `afterViewSearchCount`
+- `a3IncreaseCount`
+- `newA3Rate`
+- `cpa3`
+- `cpSearch`
+
+The old Xingtu rates stay in the existing `rates` structure.
+
+## Failure Handling
+
+- No token: show `加载失败`
+- Backend request failure: show `加载失败`
+- Backend success but row missing in response: show `暂无数据`
+- Partial page matches: render matched rows, mark unmatched rows as `暂无数据`
+
+## Testing
+
+- Add failing tests first for:
+  - backend metrics request message handling
+  - backend metrics client request/response mapping
+  - page-level batch loading by `star_id`
+  - UI rendering of the new `秒探指标` column for loading, success, missing, and failure states
+- Run focused tests first, then full `npm test`, then `npm run build`
+
+## Out of Scope
+
+- Popup-based backend URL settings
+- CSV export changes for the six backend metrics
+- Batch submit payload changes
+- Cross-page deduplicated backend caching beyond current in-memory record storage

docs/superpowers/specs/2026-04-22-market-batch-submit-design.md

@@ -0,0 +1,305 @@
+# 星图达人批次提交设计
+
+## 背景
+
+当前插件已经具备以下能力：
+
+- 使用 Logto 登录并获取访问 `https://talent-search.intelligrow.cn` 的 access token
+- 读取星图市场页中的达人列表数据
+- 支持按当前页、前 5 页、前 10 页、全部、自定义页数进行多页采集
+- 支持导出 CSV
+
+下一阶段需要把“当前采集范围内的一批达人”提交给其他同学维护的后端接口，而不是逐条发送。用户期望在现有导出范围逻辑基础上，新增一个独立的“提交批次”动作，用来测试整批提交流程。
+
+## 目标
+
+- 在现有工具栏中新增一个独立的 `提交批次` 按钮
+- 提交动作复用当前导出范围逻辑，支持多页达人数据采集
+- 提交前通过浏览器 `prompt()` 让用户输入批次名称
+- 自动生成 `batchId = 批次名称 + 时间戳`
+- 将以下信息整合为单个批次 payload 发送给后端：
+  - Logto 用户 ID
+  - 星图达人 ID 列表
+  - 用户输入的批次名称
+  - 自动生成的批次 ID
+
+## 非目标
+
+- 不改造为逐条提交达人
+- 不移除或替代现有 `导出 CSV`
+- 不在首版实现复杂弹窗或表单 UI
+- 不在首版实现批次列表管理、重试历史、草稿保存
+
+## 方案对比
+
+### 方案 A：只提交当前页
+
+- 新按钮只处理当前页达人
+- 优点：实现最简单
+- 缺点：与现有多页导出/采集使用方式不一致，不符合真实业务需求
+
+### 方案 B：提交当前导出范围内的一整批达人
+
+- 复用现有导出范围控制器，提交当前选择范围内的所有达人
+- 优点：与用户当前使用习惯一致，便于从测试过渡到真实业务
+- 缺点：比只提交当前页多一层批次组装逻辑
+
+### 方案 C：先导出 CSV，再从 CSV 结果提交
+
+- 先走导出逻辑，再把导出结果转换为提交 payload
+- 优点：数据来源统一
+- 缺点：流程绕、耦合高，不适合作为长期模式
+
+推荐采用方案 B。
+
+## 交互设计
+
+### 工具栏按钮
+
+在现有工具栏中保留 `导出 CSV`，并新增：
+
+- `提交批次`
+
+两个按钮共享现有导出范围控件：
+
+- 当前页
+- 前 5 页
+- 前 10 页
+- 全部
+- 自定义
+
+### 批次名称输入
+
+用户点击 `提交批次` 时：
+
+1. 弹出浏览器 `prompt()`
+2. 提示文案建议为：`请输入批次名称`
+3. 用户输入如：`618 达人筛选第一批`
+
+处理规则：
+
+- 用户取消：直接终止，不报错
+- 输入为空或仅空格：提示 `请输入批次名称`
+- 输入有效：继续批次提交流程
+
+### 提交状态
+
+批次提交过程中：
+
+- `提交批次` 按钮禁用
+- `导出 CSV` 按钮与范围选择器一并禁用
+- 状态文案可复用现有导出状态区域
+
+建议状态文案：
+
+- 当前页：`提交中...`
+- 前 N 页：`提交中 3/5 页...`
+- 全部：`提交中 第 3 页...`
+
+### 成功与失败反馈
+
+成功：
+
+- 提示 `批次提交成功`
+
+失败：
+
+- 未登录：`请先登录插件`
+- 批次名为空：`请输入批次名称`
+- 接口失败：`批次提交失败，请稍后重试`
+
+## 批次数据模型
+
+首版建议 payload 结构如下：
+
+```json
+{
+  "logtoUserId": "p7pdhhtde8kj",
+  "creatorName": "王少卿",
+  "resource": "https://talent-search.intelligrow.cn",
+  "batchName": "618达人筛选第一批",
+  "batchId": "618达人筛选第一批-2026-04-22T12:30:00.000Z",
+  "createdAt": "2026-04-22T12:30:00.000Z",
+  "authors": [
+    {
+      "authorId": "111",
+      "authorName": "达人A"
+    },
+    {
+      "authorId": "222",
+      "authorName": "达人B"
+    }
+  ]
+}
+```
+
+### 字段来源
+
+- `logtoUserId`
+  - 来源：当前登录用户的 Logto `sub`
+- `creatorName`
+  - 来源：当前登录用户 `name` 或 `username`
+- `resource`
+  - 来源：当前认证配置中的 API resource
+- `batchName`
+  - 来源：用户在 `prompt()` 中输入
+- `createdAt`
+  - 来源：当前时间的 ISO 字符串
+- `batchId`
+  - 规则：`${batchName}-${createdAt}`
+- `authors`
+  - 来源：当前导出范围内采集出的达人记录
+
+### 达人字段
+
+首版只要求最小字段：
+
+- `authorId`
+- `authorName`
+
+后续如有需要，可增加：
+
+- `price21To60s`
+- 看后搜率字段
+- 城市/地区等补充信息
+
+## 数据流
+
+完整流程如下：
+
+1. 用户在工具栏选择导出范围
+2. 用户点击 `提交批次`
+3. 插件弹出 `prompt()` 请求输入批次名称
+4. 插件检查登录状态与用户信息
+5. 插件复用当前多页采集逻辑，获取当前范围内达人记录
+6. 插件读取 Logto 用户 ID
+7. 插件生成 `createdAt` 和 `batchId`
+8. 插件组装整批 payload
+9. 插件使用带 Bearer token 的客户端提交到后端
+10. 插件显示成功或失败状态
+
+## 模块边界
+
+建议按以下边界实现：
+
+### 工具栏层
+
+职责：
+
+- 渲染 `提交批次` 按钮
+- 管理按钮禁用态
+- 回传点击事件
+
+### 市场控制器层
+
+职责：
+
+- 响应 `提交批次` 点击
+- 调用 `prompt()` 获取批次名称
+- 复用现有导出范围采集逻辑
+- 调用批次 payload 组装器和提交客户端
+
+### 批次 payload 组装层
+
+职责：
+
+- 接收用户信息、批次名、时间戳、达人记录
+- 生成标准批次对象
+
+该层不负责网络请求，方便后续根据后端要求调整结构。
+
+### 批次提交客户端
+
+职责：
+
+- 获取 access token
+- 附带 `Authorization: Bearer <token>` 请求头
+- 向后端提交整批 JSON
+
+后续从 mock 接口切到真实接口时，应主要修改这一层。
+
+## 认证与授权
+
+当前系统已具备：
+
+- Logto 登录能力
+- 请求 `https://talent-search.intelligrow.cn` resource 的 access token
+- `talent-search:read` scope
+
+首版批次提交如果是写操作，后端后续可能需要新增写权限，例如：
+
+- `talent-search:write`
+- 或 `talent-search:batch:submit`
+
+如果后端要求新的写权限，则前端需要同步更新 `auth-config.ts` 中的 `scopes`。
+
+## 错误处理
+
+### 用户取消输入
+
+- 直接停止，不提示错误
+
+### 批次名为空
+
+- 不发请求
+- 直接提示 `请输入批次名称`
+
+### 未登录或取不到用户信息
+
+- 不发请求
+- 提示 `请先登录插件`
+
+### 采集失败
+
+- 复用当前导出多页采集失败逻辑
+- 不生成不完整 payload
+
+### 接口失败
+
+- 提示 `批次提交失败，请稍后重试`
+
+## 测试策略
+
+### 单元测试
+
+- 点击 `提交批次` 时会弹出 `prompt()`
+- 用户取消输入时不会继续提交
+- 空白批次名会报错
+- `batchId` 按 `批次名 + ISO 时间戳` 生成
+- payload 中包含：
+  - `logtoUserId`
+  - `batchName`
+  - `batchId`
+  - `authors[]`
+
+### 集成测试
+
+- `提交批次` 复用当前导出范围采集逻辑
+- 当前页模式只提交当前页达人
+- 多页模式会合并多页达人
+- 接口调用时带 Bearer token
+- 成功时显示成功状态
+- 失败时显示失败状态
+
+## 手动验证
+
+1. 登录插件
+2. 选择导出范围
+3. 点击 `提交批次`
+4. 在 `prompt()` 中输入批次名
+5. 确认请求 payload 中包含：
+   - Logto 用户 ID
+   - 多个达人 ID
+   - 批次名
+   - 批次 ID
+6. 确认后端返回成功
+
+## 后续扩展
+
+当真实接口稳定后，可以继续扩展：
+
+- 批次提交结果详情展示
+- 最近提交批次列表
+- 批次重试
+- 批次备注、标签
+- 写权限 scope 单独拆分

docs/superpowers/specs/2026-04-22-market-scrollable-plugin-columns-design.md

@@ -0,0 +1,35 @@
+# Market Scrollable Plugin Columns Design
+
+**Goal:** Keep the plugin-generated columns visible without letting them cover Xingtu's native middle columns.
+
+**Problem:** The current implementation injects plugin columns into the right sticky section. That expands the sticky width and causes native middle columns such as `预期播放量` and `互动率` to be visually covered.
+
+**Approved Direction:** Keep plugin columns always visible, but move them out of the right sticky area. The plugin columns should live in the horizontally scrollable middle area so they scroll together with the native table columns.
+
+## Design
+
+### Layout
+
+- Preserve the native left sticky author section.
+- Preserve the native right sticky section for Xingtu's own right-side columns, especially `21-60s报价` and `操作`.
+- Insert plugin columns as a separate non-sticky section immediately before the right sticky section.
+- Let the plugin section participate in the same horizontal flow as the middle columns so users reach it through horizontal scrolling.
+
+### DOM Sync Responsibilities
+
+- `syncDivGridRoot()` remains responsible for locating the author section, middle columns, and right sticky section.
+- Plugin header cells and plugin body columns should no longer be inserted into `actionHeader.parentElement` / `actionColumn.parentElement`.
+- A dedicated plugin section should be created or reused under the header row and body row.
+- Row alignment logic should still read plugin cells row-by-row for rendering, visibility, and ordering.
+
+### Behavior
+
+- Export, filtering, sorting, and row hydration should keep working unchanged.
+- Only column placement changes.
+- Existing synthetic table mode is unaffected.
+
+### Testing
+
+- Add regression coverage proving the right sticky section width stays at the native width.
+- Add regression coverage proving plugin columns render in a separate non-sticky section.
+- Keep existing export and hydration behavior green.

docs/superpowers/specs/2026-04-23-market-native-action-bar-design.md

@@ -0,0 +1,94 @@
+# Market Native Action Bar Design
+
+## Goal
+
+把插件当前位于页面顶部的工具栏移除，并将真正保留的市场页动作迁移到星图原生操作区中，与 `自定义指标` 和原生 `导出` 处于同一行。
+
+## Confirmed Decisions
+
+- 删除页面顶部整块插件工具栏。
+- 只保留这几个插件能力：
+  - 导出范围选择
+  - 自定义页数输入
+  - `导出 CSV`
+  - `提交批次`
+  - 状态文案
+- 排序和筛选控件从插件工具栏中删除。
+- 新的插件操作区放在 `自定义指标` 和原生 `导出` 左侧。
+- 主按钮风格尽量复用星图当前页的原生 `xt-button` / `el-button` 样式。
+- 不新增弹窗式复杂交互；导出范围继续直接显示在操作区内。
+
+## Layout
+
+### Placement
+
+- 在市场页标题区按钮行内查找 `自定义指标` 和原生 `导出` 所在的横向容器。
+- 在该容器中插入一个插件 action bar。
+- 插件 action bar 放在这两个原生按钮的左边。
+
+### Visual Structure
+
+插件 action bar 包含：
+
+- `导出范围` 下拉框
+- `自定义页数` 输入框，仅在 `自定义` 范围下显示
+- `导出 CSV` 按钮
+- `提交批次` 按钮
+- 状态文本
+
+视觉目标：
+
+- 两个主按钮与原生按钮高度、圆角、边框、字体风格一致
+- 范围选择器和页数输入框比按钮略窄，但整体高度对齐
+- 状态文案弱化显示，不抢占主要视觉注意力
+
+## Behavior
+
+- `导出 CSV` 和 `提交批次` 的业务逻辑保持不变。
+- 导出范围逻辑保持不变：
+  - 当前页
+  - 前 5 页
+  - 前 10 页
+  - 全部
+  - 自定义
+- 选择 `自定义` 时显示页数输入框，否则隐藏。
+- 正在导出或提交时：
+  - `导出 CSV` 按钮禁用
+  - `提交批次` 按钮禁用
+  - 范围下拉禁用
+  - 自定义页数输入禁用
+- 顶部原工具栏不再出现。
+
+## DOM Strategy
+
+- `ensurePluginToolbar()` 不再固定 prepend 到 `document.body`。
+- 它改为：
+  - 先查找市场页原生操作区
+  - 在原生按钮组内创建或复用插件 action bar
+  - 若页面局部重渲染导致节点丢失，内容脚本在后续同步中重新确保其存在
+- 工具栏 DOM 结构只保留本次需要的字段，删除筛选和排序输入控件。
+
+## Controller Impact
+
+- `src/content/market/index.ts` 不再从工具栏读取筛选和排序输入值。
+- 现有点击表头排序的能力本轮不主动扩展，但不以顶部工具栏为依赖。
+- 忙碌状态、状态文本、导出范围读取逻辑继续保留。
+
+## Testing
+
+需要增加或更新测试，覆盖：
+
+- 顶部旧工具栏不再挂载到 `document.body` 顶部
+- 新 action bar 挂载到原生按钮组，并位于 `自定义指标` / `导出` 左侧
+- 工具栏只保留导出范围、自定义页数、导出、提交、状态文案
+- 自定义范围显示/隐藏页数输入框
+- 导出和提交忙碌状态仍能正确禁用相关控件
+- 自定义范围校验和批次提交路径不回归
+
+## Out of Scope
+
+- 不新增新的筛选 UI
+- 不新增新的排序 UI
+- 不重做表头排序交互
+- 不改动 CSV 内容结构
+- 不改动批次 payload 结构

docs/superpowers/specs/2026-04-23-market-selection-export-design.md

@@ -0,0 +1,183 @@
+# Market Selection Export Design
+
+## Goal
+
+Add row-level selection checkboxes to the market table so users can selectively export CSV data and submit batches for chosen creators, while preserving the existing export range workflow.
+
+## Confirmed Decisions
+
+- Add one checkbox column before each creator row.
+- Add a header checkbox that selects or clears only the creators visible on the current page.
+- Selection state persists across pagination.
+- Selection affects both:
+  - CSV export
+  - batch submission
+- If the current export range contains any selected creators, export and submit only those selected creators within that range.
+- If the current export range contains no selected creators, fall back to all creators in the current export range.
+- Keep the existing export range selector and current toolbar layout.
+- Do not change the CSV column schema.
+- Do not change the batch payload shape. Only change which records are included.
+
+## User Experience
+
+### Table Controls
+
+- Each creator row gets a checkbox at the far left.
+- The table header gets a tri-state checkbox:
+  - unchecked: none of the current page creators are selected
+  - indeterminate: some but not all current page creators are selected
+  - checked: all current page creators are selected
+- Clicking the header checkbox toggles selection for the current visible page only.
+
+### Export and Submit Behavior
+
+- Export still starts from the current range selector:
+  - current page
+  - first 5 pages
+  - custom pages
+  - all pages
+- After range resolution:
+  - if any creators in that resolved range are selected, use only those selected creators
+  - if none are selected in that resolved range, use the full resolved range
+- Batch submit uses the same filtered creator set as CSV export.
+
+### Status Feedback
+
+- Keep the existing export status area.
+- Add lightweight selection feedback in the toolbar status text when helpful, for example:
+  - `已勾选 7 位达人`
+- Do not add extra selection mode toggles or secondary panels.
+
+## Data Model
+
+Selection is UI state, not record data.
+
+- Maintain selection in the controller as a `Set<string>` keyed by `authorId`.
+- Do not store selection inside the CSV exporter.
+- Do not mutate `MarketRecord` with persistent selection fields unless required for DOM wiring.
+- Resolve selection against `authorId` only so sorting, filtering, and row reordering do not break checkbox state.
+
+## DOM Design
+
+### Synthetic Table
+
+- Insert a selectable header cell before the author column.
+- Insert one checkbox cell per row.
+- Expose the row checkbox and header checkbox through `MarketRowDom` and table DOM helpers.
+
+### Div Grid Table
+
+- Clone a narrow column before the native author column.
+- Render checkbox cells aligned to each creator row.
+- Render the header checkbox in the sticky header section.
+- Reuse the existing plugin section insertion pattern so checkbox layout survives page refresh and plugin re-sync.
+
+## Controller Design
+
+### New Responsibilities
+
+- Track selected creator ids across page changes.
+- Re-apply checkbox state after every DOM re-sync.
+- Update header checkbox state after:
+  - row checkbox changes
+  - header checkbox changes
+  - pagination changes
+  - sorting and filtering changes
+
+### Export Flow
+
+Current flow:
+- resolve export target
+- collect `MarketRecord[]`
+- build CSV
+
+New flow:
+- resolve export target
+- collect `MarketRecord[]`
+- filter records by selection-with-fallback rule
+- build CSV
+
+### Batch Flow
+
+Current flow:
+- resolve export target
+- collect `MarketRecord[]`
+- build batch payload
+- submit
+
+New flow:
+- resolve export target
+- collect `MarketRecord[]`
+- filter records by selection-with-fallback rule
+- build batch payload from filtered records
+- submit
+
+## Filtering Rule
+
+Given the resolved export records:
+
+1. Find the subset whose `authorId` exists in the selection set.
+2. If that subset is non-empty, use it.
+3. If that subset is empty, use the original resolved records.
+
+This rule intentionally scopes selection to the chosen export range. For example:
+
+- If the user selected creators on page 1 and page 3
+- then exports `当前页` while viewing page 1
+- only page 1 selected creators are used
+- page 3 selections remain stored for later exports
+
+## File Impact
+
+- Modify: `src/content/market/dom-sync.ts`
+  - checkbox column insertion
+  - row and header checkbox lookup
+  - checkbox state sync helpers
+- Modify: `src/content/market/index.ts`
+  - selection state storage
+  - event handling
+  - export and batch record filtering
+- Modify: `src/content/market/types.ts`
+  - minimal DOM type additions if needed
+- Test: `tests/market-dom-sync.test.ts`
+  - checkbox column rendering
+  - header checkbox presence
+- Test: `tests/market-content-entry.test.ts`
+  - row selection
+  - current page header select all
+  - cross-page selection persistence
+  - export fallback when no selected creators are inside the resolved range
+  - export filtering when selected creators exist in the resolved range
+  - batch submit uses the same filtered set
+
+## Risks and Mitigations
+
+### Risk: Selection breaks after reordering
+
+Mitigation:
+- key selection only by `authorId`
+- never key by row index or DOM order
+
+### Risk: Header checkbox selects hidden or unloaded rows
+
+Mitigation:
+- limit header checkbox operations to current page visible row DOMs only
+
+### Risk: User expects selection to always override export range
+
+Mitigation:
+- keep selection constrained to the resolved export range
+- preserve current range selector semantics
+
+### Risk: Selection UI adds visual clutter
+
+Mitigation:
+- use a narrow first column
+- follow the host page checkbox look and spacing as closely as practical
+
+## Out of Scope
+
+- Bulk actions beyond export and batch submit
+- Selection persistence across browser reloads
+- Dedicated “selected only” mode in the toolbar
+- Server-side storage of selected creators

externaldocs/2026-04-21-logto-auth-design.md

@@ -0,0 +1,466 @@
+# Logto 登录集成设计
+
+日期：2026-04-21
+
+## 1. 背景
+
+当前项目是一个 Chrome MV3 扩展，主要运行在星图市场页面，通过内容脚本注入页面并提供筛选、排序、导出等增强能力。
+
+下一阶段需要为插件补齐登录能力，接入 Logto，目标是：
+
+- 让插件具备统一的登录态
+- 登录后可为未来的业务后端 API 获取 access token
+- 未登录时禁止使用当前插件能力
+- 这一版先打通登录、登出、会话持久化和 token 获取链路，不接真实业务后端
+
+## 2. 已确认的产品决策
+
+- 登录入口放在扩展 `popup`
+- 目标范围是“插件登录态 + 为未来后端 API 预留 access token 获取能力”
+- 当前版本暂不接真实后端 API
+- 未登录时，插件功能整体禁用
+- 仅允许内部已有 Logto 账号成员登录，不开放注册
+- `popup` 默认显示简洁账号信息，开发模式下显示调试信息
+- 未登录时，市场页禁用面板需要提供“去登录”引导
+- 配置项先使用占位值，不在设计文档里写死真实 tenant / appId / resource
+- 设计文档明确建议新增目录结构，而不是只写抽象功能
+
+## 3. 官方文档约束
+
+本设计基于以下 Logto 官方文档：
+
+- Chrome 扩展快速开始：<https://docs.logto.io/quick-starts/chrome-extension>
+- Global API resources：<https://docs.logto.io/zh-CN/authorization/global-api-resources>
+
+从官方文档抽取的关键约束如下：
+
+- Chrome 扩展应使用适配扩展场景的登录流程，重定向 URI 基于 `chrome.identity.getRedirectURL()`
+- Manifest 需要增加 `identity`、`storage` 等权限
+- 登录流程更适合由后台脚本统一承接，而不是由内容脚本直接执行
+- access token 应面向一个明确的 API resource，而不是把“登录成功”与“可访问后端 API”混为一谈
+
+这些约束直接决定了当前项目不能把认证逻辑塞进现有内容脚本入口。
+
+## 4. 目标与非目标
+
+### 4.1 目标
+
+- 在扩展 `popup` 中提供登录和登出入口
+- 在 `background service worker` 中统一处理 Logto 认证
+- 在内容脚本中基于登录态控制插件可用性
+- 登录成功后可读取基础用户信息
+- 为未来业务后端 API 预留 `getAccessToken(resource, scopes)` 能力
+- 通过 TDD 落地实现，保证认证状态切换和权限门控可回归测试
+
+### 4.2 非目标
+
+- 当前版本不接真实业务后端 API
+- 当前版本不支持开放注册
+- 当前版本不做复杂账号中心页面
+- 当前版本不要求多标签页实时广播登录态变化
+- 当前版本不默认展示完整 token 明文
+
+## 5. 推荐架构
+
+采用方案：`Background 认证中枢 + Popup 展示 + Content 只消费状态`
+
+### 5.1 模块边界
+
+#### `src/background/auth/*`
+
+职责：
+
+- 初始化 Logto 客户端
+- 执行 `signIn`
+- 执行 `signOut`
+- 执行 `getAuthState`
+- 执行 `getAccessToken`
+- 统一收敛认证错误
+
+约束：
+
+- 它是唯一直接接触 Logto SDK 和登录流程的层
+- 内容脚本和 popup 都不直接复制认证流程
+
+#### `src/popup/*`
+
+职责：
+
+- 作为唯一登录入口
+- 展示未登录态、已登录态、错误态
+- 在开发模式下显示调试信息
+- 向 background 发送认证消息
+
+#### `src/content/*`
+
+职责：
+
+- 页面启动时查询认证状态
+- 未登录时渲染禁用态工具栏
+- 已登录后再初始化现有筛选、排序、导出能力
+
+约束：
+
+- 不直接依赖 Logto SDK
+- 不自己发起登录
+- 不长期缓存 access token
+
+#### `src/shared/auth-messages.ts`
+
+职责：
+
+- 定义 popup / content / background 之间的消息协议
+- 避免认证消息散落在多个文件中
+
+### 5.2 为什么这样分层
+
+- 符合 Logto 官方 Chrome 扩展接法
+- 符合 MV3 生命周期特征，避免把认证流程绑死在不稳定的内容脚本生命周期上
+- 后续接业务后端时只需要扩展 background 的 token 获取逻辑
+- 权限边界清晰，未登录时不会出现“部分功能还能偷偷使用”的行为
+
+## 6. 推荐目录结构
+
+建议在当前项目中新增以下结构：
+
+```text
+src/
+  background/
+    auth/
+      client.ts
+      controller.ts
+      state.ts
+      types.ts
+    index.ts
+  popup/
+    index.html
+    index.ts
+    view.ts
+    types.ts
+  shared/
+    auth-messages.ts
+    auth-config.ts
+  content/
+    market/
+      auth-gate.ts
+      ...
+```
+
+目录约束：
+
+- `background/auth/*` 只做认证中枢，不掺杂市场业务逻辑
+- `popup/*` 只处理展示和用户交互
+- `shared/*` 放跨入口共享的数据结构和配置解析
+- `content/market/auth-gate.ts` 只做登录态门控，不直接写登录流程
+
+## 7. 配置设计
+
+当前版本只定义占位配置，不写死真实值。
+
+建议新增 `src/shared/auth-config.ts`，集中管理以下配置：
+
+```ts
+export interface AuthConfig {
+  logtoEndpoint: string;
+  appId: string;
+  apiResource: string;
+  scopes: string[];
+  enableDevAuthPanel: boolean;
+}
+```
+
+建议占位字段：
+
+- `logtoEndpoint`: `https://<your-tenant>.logto.app`
+- `appId`: `<chrome-extension-app-id>`
+- `apiResource`: `<your-global-api-resource-indicator>`
+- `scopes`: `["openid", "profile", "offline_access"]`
+- `enableDevAuthPanel`: `false`
+
+配置要求：
+
+- 缺失配置时必须明确报错
+- 不允许 silent fail
+- 后续真实接入时应能通过单点改动切换环境
+
+## 8. Manifest 变更要求
+
+现有 manifest 仅覆盖下载和内容脚本注入，接入 Logto 后至少需要补充：
+
+- `permissions` 增加 `identity`
+- `permissions` 保留或补充 `storage`
+- 新增 `action.default_popup`
+- 根据实际请求域名增加必要的 `host_permissions`
+
+示意要求：
+
+```json
+{
+  "permissions": ["downloads", "identity", "storage"],
+  "action": {
+    "default_popup": "popup/index.html"
+  }
+}
+```
+
+实际值需要结合构建输出路径调整，但规范上必须支持 popup 与 identity 登录流程。
+
+## 9. 认证与会话数据流
+
+### 9.1 登录流程
+
+1. 用户点击扩展图标，打开 `popup`
+2. `popup` 读取 background 返回的 `auth state`
+3. 如果未登录，点击“登录 Logto”
+4. `popup` 发送 `auth:sign-in` 给 background
+5. background 发起 Logto 登录流程
+6. 登录成功后，background 更新本地认证摘要状态
+7. `popup` 重新读取状态并渲染已登录信息
+
+### 9.2 内容脚本门控流程
+
+1. 内容脚本进入星图市场页
+2. 插件初始化前先发送 `auth:get-state`
+3. 如果未登录，渲染禁用态，不执行当前业务能力初始化
+4. 如果已登录，继续执行现有注入逻辑
+
+### 9.3 登出流程
+
+1. 用户在 `popup` 点击退出登录
+2. `popup` 发送 `auth:sign-out`
+3. background 清理会话
+4. `popup` 回到未登录态
+5. 已打开的市场页在刷新后进入禁用态
+
+### 9.4 token 策略
+
+当前版本采用：
+
+- Authorization Code Flow + PKCE
+- 基础 scopes：`openid profile offline_access`
+- `resource` 对应未来业务后端 API 的 global API resource
+
+约束：
+
+- `ID token` 仅用于身份展示
+- `Access token` 仅用于未来业务后端 API 调用
+- 内容脚本只按需向 background 请求 token，不本地长期存储
+
+## 10. 消息协议建议
+
+建议新增一组显式消息类型：
+
+```ts
+type AuthMessage =
+  | { type: "auth:get-state" }
+  | { type: "auth:sign-in" }
+  | { type: "auth:sign-out" }
+  | { type: "auth:get-access-token" };
+```
+
+建议的状态结构：
+
+```ts
+interface AuthState {
+  isAuthenticated: boolean;
+  userInfo: {
+    sub: string;
+    name?: string;
+    username?: string;
+    email?: string;
+  } | null;
+  scopes: string[];
+  resource: string | null;
+  accessTokenExpiresAt: number | null;
+  lastError: string | null;
+}
+```
+
+设计要求：
+
+- 状态必须可序列化
+- 消息响应必须有稳定结构
+- 失败时返回明确错误码或错误文案
+
+## 11. Popup 交互设计
+
+### 11.1 未登录态
+
+显示内容：
+
+- 插件名称
+- 说明文案：“登录后才能使用星图增强功能”
+- 主按钮：“登录 Logto”
+- 最近一次登录失败摘要（如果存在）
+
+### 11.2 已登录态
+
+默认展示：
+
+- 已登录状态
+- 用户名
+- 邮箱
+- `退出登录` 按钮
+
+### 11.3 开发调试态
+
+仅在 `enableDevAuthPanel` 开启时显示：
+
+- `isAuthenticated`
+- `sub`
+- `scopes`
+- `resource`
+- token 是否可获取
+- access token 预计过期时间
+- 最近一次认证错误
+- 手动“刷新状态”按钮
+
+默认不显示完整 token 字符串。
+
+## 12. 内容脚本权限门控设计
+
+### 12.1 未登录态
+
+插件工具栏应替换为禁用面板，显示：
+
+- 主提示：“请先登录插件”
+- 次提示：“打开扩展弹窗完成登录后刷新本页”
+- 引导按钮：“去登录”
+
+“去登录”按钮行为：
+
+- 不直接尝试从内容脚本打开 popup
+- 仅提示用户点击浏览器工具栏中的扩展图标完成登录
+
+未登录时：
+
+- 不初始化筛选
+- 不初始化排序
+- 不初始化导出
+- 不发起后续业务请求
+
+### 12.2 已登录态
+
+保持当前市场增强行为不变。
+
+### 12.3 登录失效态
+
+如果内容脚本运行过程中发现 background 返回未登录或 token 不可用：
+
+- 立即切回禁用态
+- 提示“登录已失效，请重新登录”
+
+## 13. 错误处理设计
+
+至少覆盖以下错误：
+
+- Logto 配置缺失
+- 登录取消
+- 登录回调失败
+- token 获取失败
+- popup 无法读取 background 状态
+- 内容脚本无法获取登录态
+
+设计要求：
+
+- popup 中展示用户可理解的错误摘要
+- background 中保留标准化错误结构
+- 内容脚本遇到认证错误时优先进入禁用态，而不是继续执行业务逻辑
+
+## 14. TDD 实施要求
+
+实现必须采用 TDD，遵循：
+
+1. 先写失败测试
+2. 明确验证测试因缺失功能而失败
+3. 再写最小实现让测试通过
+4. 最后做必要重构
+
+不允许先写生产代码再补测试。
+
+## 15. 测试分层建议
+
+### 15.1 单元测试：消息协议与状态结构
+
+建议文件：
+
+- `tests/auth-messages.test.ts`
+- `tests/auth-state-store.test.ts`
+
+覆盖点：
+
+- 消息类型收发正确
+- 状态序列化结构稳定
+- 配置缺失时能返回明确错误
+
+### 15.2 单元测试：background 认证协调器
+
+建议文件：
+
+- `tests/background-auth-controller.test.ts`
+
+覆盖点：
+
+- `signIn` 调用认证入口
+- `signOut` 清理会话
+- `getAuthState` 返回认证摘要
+- `getAccessToken` 在未登录或配置无效时失败明确
+
+### 15.3 单元测试：popup UI
+
+建议文件：
+
+- `tests/popup-entry.test.ts`
+
+覆盖点：
+
+- 未登录显示登录按钮
+- 已登录显示用户信息和退出按钮
+- 开发模式显示调试区
+- 错误态显示错误摘要
+
+### 15.4 集成测试：内容脚本门控
+
+建议文件：
+
+- `tests/market-auth-gating.test.ts`
+
+覆盖点：
+
+- 未登录时市场页工具栏进入禁用态
+- 已登录后才初始化现有筛选、排序、导出
+- 运行中登录失效时切回禁用态
+
+## 16. 验收标准
+
+- 扩展加载后存在可用的 `popup`
+- 未登录时 `popup` 显示登录入口
+- 登录成功后 `popup` 显示基础用户信息
+- 开发模式下 `popup` 能显示认证调试信息
+- 未登录时市场页插件整体禁用
+- 登录后刷新市场页，现有插件能力恢复
+- 登出后刷新市场页，插件重新禁用
+- 配置缺失时，popup / background / content 都能给出明确错误，而不是静默失败
+
+## 17. 后续实现顺序建议
+
+建议实施顺序：
+
+1. 补 manifest 与构建入口，先让 popup 可以独立加载
+2. 写 `auth-messages` 与 `auth-config` 的失败测试
+3. 写 background auth controller 的失败测试并落最小实现
+4. 写 popup 状态渲染测试并接上 background
+5. 写内容脚本门控测试，再把市场页逻辑接入认证态
+6. 最后补开发调试面板
+
+## 18. 当前仍保留为占位的实施参数
+
+这些值在真正开始编码前仍需由你提供：
+
+- Logto tenant endpoint
+- Logto Chrome extension appId
+- Global API resource 标识
+- 是否存在额外自定义 scopes
+- 调试面板是否区分开发包与生产包
+
+在这些真实值到位前，可以先完成目录搭建、消息协议、状态门控和测试骨架。

package-lock.json

@@ -1,13 +1,16 @@
 {
   "name": "market-plugin-impl",
-  "version": "0.0.0",
+  "version": "0.2.0421.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "market-plugin-impl",
-      "version": "0.0.0",
+      "version": "0.2.0421.2",
       "license": "UNLICENSED",
+      "dependencies": {
+        "@logto/chrome-extension": "^0.1.27"
+      },
       "devDependencies": {
         "jsdom": "^29.0.2",
         "tsup": "^8.5.1",
@@ -752,6 +755,48 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
+    "node_modules/@logto/browser": {
+      "version": "3.0.13",
+      "resolved": "https://registry.npmjs.org/@logto/browser/-/browser-3.0.13.tgz",
+      "integrity": "sha512-SlZ76XiVh2es6eFB1M+ldV6b60eC3+eeKoRQ8/AvOlpwHhrY/v2FPw5LOd/vZ+WYjzDqsxNtOMdhTdliHZ7V1g==",
+      "license": "MIT",
+      "dependencies": {
+        "@logto/client": "^3.1.8",
+        "@silverhand/essentials": "^2.9.3",
+        "js-base64": "^3.7.4"
+      }
+    },
+    "node_modules/@logto/chrome-extension": {
+      "version": "0.1.27",
+      "resolved": "https://registry.npmjs.org/@logto/chrome-extension/-/chrome-extension-0.1.27.tgz",
+      "integrity": "sha512-XIMS3ysrkjgDxtQs+9jcSc2jF74oKbHIqzoaSJ/nN2yqLqUadHInUelpR5D00HRvpNGrEDqzgtD6+kNuMOgSUw==",
+      "license": "MIT",
+      "dependencies": {
+        "@logto/browser": "^3.0.13"
+      }
+    },
+    "node_modules/@logto/client": {
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/@logto/client/-/client-3.1.8.tgz",
+      "integrity": "sha512-f6NcPOV/K1IpPm4ccARWeYpQVMeN4mfikGg+5Qw1rcIPYPUpD5BmDsQbVTAnDepCMbC7syzRerZmbwL8S3UL+A==",
+      "license": "MIT",
+      "dependencies": {
+        "@logto/js": "^6.1.2",
+        "@silverhand/essentials": "^2.9.3",
+        "camelcase-keys": "^9.1.3",
+        "jose": "^5.2.2"
+      }
+    },
+    "node_modules/@logto/js": {
+      "version": "6.1.2",
+      "resolved": "https://registry.npmjs.org/@logto/js/-/js-6.1.2.tgz",
+      "integrity": "sha512-YB/TfixPGI0Spbs8LXiKuASOKFUE9VmlTkXiPfgg3UXQsIPTU71KjKxEXZRePu3xdPNhsZ6WtnRfRvvcpP+KGQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@silverhand/essentials": "^2.9.3",
+        "camelcase-keys": "^9.1.3"
+      }
+    },
     "node_modules/@napi-rs/wasm-runtime": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
@@ -1395,6 +1440,16 @@
         "win32"
       ]
     },
+    "node_modules/@silverhand/essentials": {
+      "version": "2.9.3",
+      "resolved": "https://registry.npmjs.org/@silverhand/essentials/-/essentials-2.9.3.tgz",
+      "integrity": "sha512-OM9pyGc/yYJMVQw+fFOZZaTHXDWc45sprj+ky+QjC9inhf5w51L1WBmzAwFuYkHAwO1M19fxVf2sTH9KKP48yg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.12.0",
+        "pnpm": "^10.0.0"
+      }
+    },
     "node_modules/@standard-schema/spec": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
@@ -1617,6 +1672,36 @@
         "node": ">=8"
       }
     },
+    "node_modules/camelcase": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-8.0.0.tgz",
+      "integrity": "sha512-8WB3Jcas3swSvjIeA2yvCJ+Miyz5l1ZmB6HFb9R1317dt9LCQoswg/BGrmAmkWVEszSrrg4RwmO46qIm2OEnSA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/camelcase-keys": {
+      "version": "9.1.3",
+      "resolved": "https://registry.npmjs.org/camelcase-keys/-/camelcase-keys-9.1.3.tgz",
+      "integrity": "sha512-Rircqi9ch8AnZscQcsA1C47NFdaO3wukpmIRzYcDOrmvgt78hM/sj5pZhZNec2NM12uk5vTwRHZ4anGcrC4ZTg==",
+      "license": "MIT",
+      "dependencies": {
+        "camelcase": "^8.0.0",
+        "map-obj": "5.0.0",
+        "quick-lru": "^6.1.1",
+        "type-fest": "^4.3.2"
+      },
+      "engines": {
+        "node": ">=16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/chai": {
       "version": "6.2.2",
       "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
@@ -1887,6 +1972,15 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/jose": {
+      "version": "5.10.0",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-5.10.0.tgz",
+      "integrity": "sha512-s+3Al/p9g32Iq+oqXxkW//7jk2Vig6FF1CFqzVXoTUXt2qz89YWbL+OwS17NFYEvxC35n0FKeGO2LGYSxeM2Gg==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
     "node_modules/joycon": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/joycon/-/joycon-3.1.1.tgz",
@@ -1897,6 +1991,12 @@
         "node": ">=10"
       }
     },
+    "node_modules/js-base64": {
+      "version": "3.7.8",
+      "resolved": "https://registry.npmjs.org/js-base64/-/js-base64-3.7.8.tgz",
+      "integrity": "sha512-hNngCeKxIUQiEUN3GPJOkz4wF/YvdUdbNL9hsBcMQTkKzboD7T/q3OYOuuPZLUE6dBxSGpwhk5mwuDud7JVAow==",
+      "license": "BSD-3-Clause"
+    },
     "node_modules/jsdom": {
       "version": "29.0.2",
       "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-29.0.2.tgz",
@@ -2249,6 +2349,18 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/map-obj": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/map-obj/-/map-obj-5.0.0.tgz",
+      "integrity": "sha512-2L3MIgJynYrZ3TYMriLDLWocz15okFakV6J12HXvMXDHui2x/zgChzg1u9mFFGbbGWE+GsLpQByt4POb9Or+uA==",
+      "license": "MIT",
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/mdn-data": {
       "version": "2.27.1",
       "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.27.1.tgz",
@@ -2472,6 +2584,18 @@
         "node": ">=6"
       }
     },
+    "node_modules/quick-lru": {
+      "version": "6.1.2",
+      "resolved": "https://registry.npmjs.org/quick-lru/-/quick-lru-6.1.2.tgz",
+      "integrity": "sha512-AAFUA5O1d83pIHEhJwWCq/RQcRukCkn/NSm2QsTEMle5f2hP0ChI2+3Xb051PZCkLryI/Ir1MVKviT2FIloaTQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/readdirp": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
@@ -2857,6 +2981,18 @@
         }
       }
     },
+    "node_modules/type-fest": {
+      "version": "4.41.0",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.41.0.tgz",
+      "integrity": "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==",
+      "license": "(MIT OR CC0-1.0)",
+      "engines": {
+        "node": ">=16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/typescript": {
       "version": "6.0.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",

package.json

@@ -5,9 +5,16 @@
   "private": true,
   "scripts": {
     "build": "node scripts/build.mjs",
+    "build:release": "BUILD_TARGET=release node scripts/build.mjs",
+    "mock:protected-api": "node scripts/mock-protected-api.mjs",
+    "package:internal": "npm run build:release && node scripts/package-release.mjs",
+    "package:release": "npm run build:release && node scripts/package-release.mjs",
     "test": "vitest run --passWithNoTests",
     "test:watch": "vitest --passWithNoTests"
   },
+  "dependencies": {
+    "@logto/chrome-extension": "^0.1.27"
+  },
   "license": "UNLICENSED",
   "devDependencies": {
     "jsdom": "^29.0.2",

scripts/build.mjs

@@ -1,16 +1,22 @@
-import { cp, mkdir, rm } from "node:fs/promises";
+import { cp, mkdir, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { build } from "tsup";
+import { createManifest } from "./manifest.mjs";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const projectRoot = path.resolve(__dirname, "..");
-const distDir = path.join(projectRoot, "dist");
+const buildTarget = process.env.BUILD_TARGET === "release" ? "release" : "development";
+const distDir = path.join(
+  projectRoot,
+  buildTarget === "release" ? "dist-release" : "dist"
+);
 
 await rm(distDir, { recursive: true, force: true });
 await mkdir(path.join(distDir, "content"), { recursive: true });
 await mkdir(path.join(distDir, "background"), { recursive: true });
+await mkdir(path.join(distDir, "popup"), { recursive: true });
 
 await build({
   entry: {
@@ -50,7 +56,33 @@ await build({
   }
 });
 
-await cp(
+await build({
-  path.join(projectRoot, "src/manifest.json"),
+  entry: {
-  path.join(distDir, "manifest.json")
+    index: path.join(projectRoot, "src/popup/index.ts")
+  },
+  format: ["iife"],
+  platform: "browser",
+  target: "chrome114",
+  outDir: path.join(distDir, "popup"),
+  clean: false,
+  splitting: false,
+  sourcemap: false,
+  minify: false,
+  outExtension() {
+    return { js: ".js" };
+  }
+});
+
+await writeFile(
+  path.join(distDir, "manifest.json"),
+  `${JSON.stringify(createManifest({ target: buildTarget }), null, 2)}\n`
+);
+await cp(
+  path.join(projectRoot, "src/popup/index.html"),
+  path.join(distDir, "popup/index.html")
+);
+await cp(
+  path.join(projectRoot, "src/assets"),
+  path.join(distDir, "assets"),
+  { recursive: true }
 );

scripts/manifest.mjs

@@ -0,0 +1,76 @@
+const sharedIcons = {
+  16: "assets/icons/icon-16.png",
+  32: "assets/icons/icon-32.png",
+  48: "assets/icons/icon-48.png",
+  128: "assets/icons/icon-128.png"
+};
+const extensionKey =
+  "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0CaZJxcX97TbRXCR08L10t9EZFV31+wPnUgDf21j2f0qYaWdblzWXfVkeU9jGb2Hr2Etpp7F/XuBa6pcipUXkzMMBkJ42KOkciAwbuzTBoAtGB8o9aoWigtax+gGfSz+T3BjqxKBJtXqeqbIAKCDIlxRKIrY+KcY1Z+mD5BKcBHKsUDQPlHsrjc1g0wIBD5doz9LoOk1Wso6gK5cSeOp9lw5YHcu4TImR4yqxGiL6pZwnpciuX/g7qjWBZXn5gf0YBlDsBDDTt5upbP3NguUKgO2qA9M77LyeUwXl3aqbIxYi/VwsQ2t5w9PGWtnOUQQDWUcEg/9dfTb89esZXKATwIDAQAB";
+
+const sharedManifest = {
+  action: {
+    default_icon: {
+      16: sharedIcons[16],
+      32: sharedIcons[32]
+    },
+    default_popup: "popup/index.html"
+  },
+  background: {
+    service_worker: "background/index.js"
+  },
+  content_scripts: [
+    {
+      js: ["content/index.js"],
+      matches: [
+        "https://xingtu.cn/ad/creator/market*",
+        "https://*.xingtu.cn/ad/creator/market*"
+      ],
+      run_at: "document_start"
+    }
+  ],
+  description: "Bootstraps the Xingtu creator market content script.",
+  icons: sharedIcons,
+  key: extensionKey,
+  manifest_version: 3,
+  name: "Star Chart Search Enhancer",
+  permissions: ["downloads", "identity", "storage"],
+  version: "0.2.0421.2",
+  web_accessible_resources: [
+    {
+      matches: [
+        "https://xingtu.cn/*",
+        "https://*.xingtu.cn/*"
+      ],
+      resources: ["content/market-page-bridge.js"]
+    }
+  ]
+};
+
+const hostPermissionsByTarget = {
+  development: [
+    "http://*/*",
+    "https://login-api.intelligrow.cn/*",
+    "http://127.0.0.1:4319/*",
+    "https://*/*"
+  ],
+  release: [
+    "https://xingtu.cn/ad/creator/market*",
+    "https://*.xingtu.cn/ad/creator/market*",
+    "https://login-api.intelligrow.cn/*",
+    "https://talent-search.intelligrow.cn/*",
+    "http://192.168.31.21:8083/*"
+  ]
+};
+
+export function createManifest(options = {}) {
+  const target = options.target ?? "development";
+  const hostPermissions = hostPermissionsByTarget[target];
+  if (!hostPermissions) {
+    throw new Error(`Unsupported manifest target: ${target}`);
+  }
+
+  return {
+    ...sharedManifest,
+    host_permissions: hostPermissions
+  };
+}

scripts/mock-protected-api.mjs

@@ -0,0 +1,117 @@
+import http from "node:http";
+
+export function createMockProtectedApiServer({ port = 4319 } = {}) {
+  let server;
+
+  return {
+    get baseUrl() {
+      const address = server?.address();
+      const resolvedPort =
+        typeof address === "object" && address ? address.port : port;
+
+      return `http://127.0.0.1:${resolvedPort}`;
+    },
+    async start() {
+      server = http.createServer(async (request, response) => {
+        if (request.url === "/api/mock/protected") {
+          const authHeader = readBearerToken(request, response);
+          if (!authHeader) {
+            return;
+          }
+
+          response.writeHead(200, { "content-type": "application/json" });
+          response.end(
+            JSON.stringify({
+              ok: true,
+              source: "mock-protected-api",
+              message: "authorized",
+              receivedAuthHeader: authHeader
+            })
+          );
+          return;
+        }
+
+        if (request.url === "/api/mock/batches" && request.method === "POST") {
+          const authHeader = readBearerToken(request, response);
+          if (!authHeader) {
+            return;
+          }
+
+          const payload = await readJsonBody(request);
+          const authors = Array.isArray(payload?.authors) ? payload.authors : [];
+          response.writeHead(200, { "content-type": "application/json" });
+          response.end(
+            JSON.stringify({
+              ok: true,
+              source: "mock-batch-submit",
+              acceptedCount: authors.length,
+              batchId:
+                typeof payload?.batchId === "string" ? payload.batchId : null,
+              receivedAuthHeader: authHeader
+            })
+          );
+          return;
+        }
+
+        response.writeHead(404, { "content-type": "application/json" });
+        response.end(JSON.stringify({ ok: false, error: "not-found" }));
+      });
+
+      await new Promise((resolve) => {
+        server.listen(port, "127.0.0.1", resolve);
+      });
+    },
+    async close() {
+      if (!server) {
+        return;
+      }
+
+      await new Promise((resolve, reject) => {
+        server.close((error) => {
+          if (error) {
+            reject(error);
+            return;
+          }
+
+          resolve(undefined);
+        });
+      });
+    }
+  };
+}
+
+function readBearerToken(request, response) {
+  const authHeader = request.headers.authorization ?? "";
+  const isBearer =
+    typeof authHeader === "string" &&
+    authHeader.startsWith("Bearer ") &&
+    authHeader.length > "Bearer ".length;
+
+  if (!isBearer) {
+    response.writeHead(401, { "content-type": "application/json" });
+    response.end(JSON.stringify({ ok: false, error: "unauthorized" }));
+    return null;
+  }
+
+  return authHeader;
+}
+
+async function readJsonBody(request) {
+  const chunks = [];
+
+  for await (const chunk of request) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+
+  if (chunks.length === 0) {
+    return null;
+  }
+
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const server = createMockProtectedApiServer();
+  await server.start();
+  console.log(`mock protected api listening on ${server.baseUrl}`);
+}

scripts/package-release.mjs

@@ -0,0 +1,24 @@
+import { mkdir, rm } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const projectRoot = path.resolve(__dirname, "..");
+const sourceDir = path.join(projectRoot, "dist-release");
+const releaseDir = path.join(projectRoot, "release");
+const archivePath = path.join(
+  releaseDir,
+  "star-chart-search-enhancer-internal.zip"
+);
+
+await mkdir(releaseDir, { recursive: true });
+await rm(archivePath, { force: true });
+await execFileAsync("zip", ["-X", "-r", archivePath, "."], {
+  cwd: sourceDir
+});
+
+console.log(`Internal archive created at ${archivePath}`);

src/assets/icons/icon-source.svg

@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" fill="none">
+  <defs>
+    <linearGradient id="bg" x1="16" y1="12" x2="114" y2="116" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#9F1239"/>
+      <stop offset="1" stop-color="#4C0519"/>
+    </linearGradient>
+  </defs>
+  <rect x="8" y="8" width="112" height="112" rx="28" fill="url(#bg)"/>
+  <path d="M34 80L50 62L64 70L83 46" stroke="#FFF7ED" stroke-linecap="round" stroke-linejoin="round" stroke-width="10"/>
+  <circle cx="86" cy="44" r="8" fill="#FFF7ED"/>
+  <path d="M79 80C79 71.7157 85.7157 65 94 65C102.284 65 109 71.7157 109 80C109 88.2843 102.284 95 94 95C85.7157 95 79 88.2843 79 80Z" stroke="#FFF7ED" stroke-width="8"/>
+  <path d="M104 91L114 101" stroke="#FFF7ED" stroke-linecap="round" stroke-width="8"/>
+</svg>

src/background/auth/client.ts

@@ -0,0 +1,54 @@
+import LogtoClient from "@logto/chrome-extension";
+
+import { readAuthConfig } from "../../shared/auth-config";
+import type { AuthClientLike } from "./types";
+
+export function createLogtoAuthClient(): AuthClientLike {
+  const config = readAuthConfig();
+  const client = new LogtoClient({
+    appId: config.appId,
+    endpoint: config.logtoEndpoint,
+    resources: [config.apiResource],
+    scopes: config.scopes
+  });
+
+  return {
+    getAccessToken(resource?: string) {
+      return client.getAccessToken(resource);
+    },
+    getIdTokenClaims() {
+      return client.getIdTokenClaims();
+    },
+    isAuthenticated() {
+      return client.isAuthenticated();
+    },
+    signIn() {
+      return client.signIn(readChromeIdentity().getRedirectURL("/callback"));
+    },
+    signOut() {
+      return client.signOut(readChromeIdentity().getRedirectURL());
+    }
+  };
+}
+
+function readChromeIdentity(): {
+  getRedirectURL: (path?: string) => string;
+} {
+  const identity = (
+    globalThis as typeof globalThis & {
+      chrome?: {
+        identity?: {
+          getRedirectURL?: (path?: string) => string;
+        };
+      };
+    }
+  ).chrome?.identity;
+
+  if (typeof identity?.getRedirectURL !== "function") {
+    throw new Error("chrome.identity.getRedirectURL is unavailable");
+  }
+
+  return {
+    getRedirectURL: identity.getRedirectURL.bind(identity)
+  };
+}

src/background/auth/controller.ts

@@ -0,0 +1,39 @@
+import { readAuthConfig, type AuthConfig } from "../../shared/auth-config";
+import { createLoggedInAuthState, createLoggedOutAuthState } from "./state";
+import type { AuthClientLike } from "./types";
+
+export interface AuthController {
+  getAccessToken(): Promise<string>;
+  getAuthState(): Promise<ReturnType<typeof createLoggedOutAuthState>>;
+  signIn(): Promise<void>;
+  signOut(): Promise<void>;
+}
+
+export function createAuthController(options: {
+  authClient: AuthClientLike;
+  config?: AuthConfig;
+}): AuthController {
+  const config = options.config ?? readAuthConfig();
+
+  return {
+    async getAccessToken() {
+      return options.authClient.getAccessToken(config.apiResource);
+    },
+    async getAuthState() {
+      const isAuthenticated = await options.authClient.isAuthenticated();
+
+      if (!isAuthenticated) {
+        return createLoggedOutAuthState(config);
+      }
+
+      const claims = await options.authClient.getIdTokenClaims();
+      return createLoggedInAuthState(claims, config);
+    },
+    async signIn() {
+      await options.authClient.signIn();
+    },
+    async signOut() {
+      await options.authClient.signOut();
+    }
+  };
+}

src/background/auth/state.ts

@@ -0,0 +1,38 @@
+import type { AuthConfig } from "../../shared/auth-config";
+import type { AuthStateValue } from "../../shared/auth-messages";
+
+export function createLoggedOutAuthState(
+  config?: Pick<AuthConfig, "apiResource">
+): AuthStateValue {
+  return {
+    isAuthenticated: false,
+    resource: config?.apiResource ?? null
+  };
+}
+
+export function createLoggedInAuthState(
+  claims: Record<string, unknown> | null | undefined,
+  config?: Pick<AuthConfig, "apiResource" | "scopes">
+): AuthStateValue {
+  return {
+    accessTokenExpiresAt: null,
+    isAuthenticated: true,
+    resource: config?.apiResource ?? null,
+    scopes: config?.scopes ?? [],
+    tokenAvailable: true,
+    userInfo: {
+      email: readStringClaim(claims, "email"),
+      name: readStringClaim(claims, "name"),
+      sub: readStringClaim(claims, "sub"),
+      username: readStringClaim(claims, "username")
+    }
+  };
+}
+
+function readStringClaim(
+  claims: Record<string, unknown> | null | undefined,
+  key: string
+): string | undefined {
+  const value = claims?.[key];
+  return typeof value === "string" ? value : undefined;
+}

src/background/auth/types.ts

@@ -0,0 +1,7 @@
+export interface AuthClientLike {
+  getAccessToken(resource?: string): Promise<string>;
+  getIdTokenClaims(): Promise<Record<string, unknown> | null>;
+  isAuthenticated(): Promise<boolean>;
+  signIn(): Promise<void>;
+  signOut(): Promise<void>;
+}

src/background/index.ts

@@ -1,3 +1,15 @@
+import { createAuthController, type AuthController } from "./auth/controller";
+import { createLogtoAuthClient } from "./auth/client";
+import {
+  isAuthRequestMessage,
+  type AuthResponseMessage
+} from "../shared/auth-messages";
+import { createBatchSubmitClient } from "../shared/batch-submit-client";
+import { createBackendMetricsClient } from "../shared/backend-metrics-client";
+import { DEFAULT_BATCH_SUBMIT_BASE_URL } from "../shared/batch-submit-config";
+import { DEFAULT_BACKEND_METRICS_BASE_URL } from "../shared/backend-metrics-config";
+import { isBackendMetricsSearchRequestMessage } from "../shared/backend-metrics-messages";
+
 interface ChromeDownloadsLike {
   download(
     options: {
@@ -32,18 +44,25 @@ type DownloadMarketCsvMessage = {
   type: "download-market-csv";
 };
 
-export function registerBackgroundMessageHandler(
+type BatchSubmitMessage = {
-  chromeLike: ChromeLike = (
+  payload: unknown;
-    globalThis as typeof globalThis & {
+  type: "batch:submit";
-      chrome?: ChromeLike;
+};
-    }
-  ).chrome ?? {}
-): void {
-  chromeLike.runtime?.onMessage?.addListener((message, _sender, sendResponse) => {
-    if (!isDownloadMarketCsvMessage(message)) {
-      return;
-    }
 
+export function registerBackgroundMessageHandler(
+  chromeLike: ChromeLike = readChromeLike(),
+  dependencies: {
+    authController?: AuthController;
+    searchBackendMetrics?: (starIds: string[]) => Promise<unknown>;
+    submitBatch?: (payload: unknown) => Promise<unknown>;
+  } = {}
+): void {
+  let authController = dependencies.authController;
+  let searchBackendMetrics = dependencies.searchBackendMetrics;
+  let submitBatch = dependencies.submitBatch;
+
+  chromeLike.runtime?.onMessage?.addListener((message, _sender, sendResponse) => {
+    if (isDownloadMarketCsvMessage(message)) {
       void triggerCsvDownload(chromeLike, message)
         .then(() => {
           sendResponse({ ok: true });
@@ -56,7 +75,135 @@ export function registerBackgroundMessageHandler(
         });
 
       return true;
+    }
+
+    if (isBatchSubmitMessage(message)) {
+      authController ??= createAuthController({
+        authClient: createLogtoAuthClient()
       });
+      submitBatch ??= createBatchSubmitClient({
+        baseUrl: DEFAULT_BATCH_SUBMIT_BASE_URL,
+        getAccessToken: () => authController!.getAccessToken(),
+        sendMessage: () =>
+          Promise.reject(new Error("background batch submit does not use sendMessage"))
+      }).submitBatch;
+
+      void submitBatch(message.payload)
+        .then((value) => {
+          sendResponse({
+            ok: true,
+            type: "batch:ack",
+            value
+          });
+        })
+        .catch((error) => {
+          sendResponse({
+            error: error instanceof Error ? error.message : String(error),
+            ok: false,
+            type: "batch:error"
+          });
+        });
+
+      return true;
+    }
+
+    if (isBackendMetricsSearchRequestMessage(message)) {
+      authController ??= createAuthController({
+        authClient: createLogtoAuthClient()
+      });
+      searchBackendMetrics ??= createBackendMetricsClient({
+        baseUrl: DEFAULT_BACKEND_METRICS_BASE_URL,
+        getAccessToken: () => authController!.getAccessToken()
+      }).searchByStarIds;
+
+      void searchBackendMetrics(message.value.starIds)
+        .then((rows) => {
+          sendResponse({
+            ok: true,
+            type: "backend-metrics:result",
+            value: {
+              rows
+            }
+          });
+        })
+        .catch((error) => {
+          sendResponse({
+            error: error instanceof Error ? error.message : String(error),
+            ok: false,
+            type: "backend-metrics:error"
+          });
+        });
+
+      return true;
+    }
+
+    if (!isAuthRequestMessage(message)) {
+      return;
+    }
+
+    authController ??= createAuthController({
+      authClient: createLogtoAuthClient()
+    });
+
+    void handleAuthMessage(authController, message)
+      .then((response) => {
+        sendResponse(response);
+      })
+      .catch((error) => {
+        sendResponse({
+          error: error instanceof Error ? error.message : String(error),
+          ok: false,
+          type: "auth:error"
+        } satisfies AuthResponseMessage);
+      });
+
+    return true;
+  });
+}
+
+async function handleAuthMessage(
+  authController: AuthController,
+  message: Parameters<typeof isAuthRequestMessage>[0] & { type: string }
+): Promise<AuthResponseMessage> {
+  if (message.type === "auth:get-state") {
+    return {
+      ok: true,
+      type: "auth:state",
+      value: await authController.getAuthState()
+    };
+  }
+
+  if (message.type === "auth:get-access-token") {
+    return {
+      ok: true,
+      type: "auth:token",
+      value: {
+        accessToken: await authController.getAccessToken()
+      }
+    };
+  }
+
+  if (message.type === "auth:sign-in") {
+    await authController.signIn();
+    return {
+      ok: true,
+      type: "auth:ack"
+    };
+  }
+
+  await authController.signOut();
+  return {
+    ok: true,
+    type: "auth:ack"
+  };
+}
+
+function readChromeLike(): ChromeLike {
+  return (
+    globalThis as typeof globalThis & {
+      chrome?: ChromeLike;
+    }
+  ).chrome ?? {};
 }
 
 async function triggerCsvDownload(
@@ -92,4 +239,13 @@ function isDownloadMarketCsvMessage(
   );
 }
 
+function isBatchSubmitMessage(message: unknown): message is BatchSubmitMessage {
+  if (!message || typeof message !== "object") {
+    return false;
+  }
+
+  const candidate = message as Partial<BatchSubmitMessage>;
+  return candidate.type === "batch:submit" && "payload" in candidate;
+}
+
 registerBackgroundMessageHandler();

src/content/index.ts

@@ -2,6 +2,11 @@ import {
   createMarketController,
   type CreateMarketControllerOptions
 } from "./market/index";
+import { renderMarketAuthGate } from "./market/auth-gate";
+import {
+  isAuthResponseMessage,
+  type AuthStateValue
+} from "../shared/auth-messages";
 
 interface ChromeRuntimeLike {
   getURL?: (path: string) => string;
@@ -16,6 +21,7 @@ interface BootContentScriptOptions {
     options: CreateMarketControllerOptions
   ) => { dispose?: () => void; ready: Promise<void> };
   document?: Document;
+  sendAuthMessage?: (message: unknown) => Promise<unknown>;
   window?: Window;
 }
 
@@ -26,6 +32,8 @@ export async function bootContentScript(
   const currentDocument = options.document ?? document;
   const controllerFactory =
     options.createMarketController ?? createMarketController;
+  const sendAuthMessage =
+    options.sendAuthMessage ?? createRuntimeMessageSender();
 
   if (!isMarketPage(currentWindow.location.href)) {
     return null;
@@ -33,6 +41,17 @@ export async function bootContentScript(
 
   installMarketPageBridge(currentDocument);
 
+  const authState = await readAuthState(sendAuthMessage);
+  if (!authState?.isAuthenticated) {
+    await waitForBodyReady(currentDocument, currentWindow);
+    renderMarketAuthGate(currentDocument, currentWindow);
+    return {
+      ready: Promise.resolve()
+    };
+  }
+
+  await waitForBodyReady(currentDocument, currentWindow);
+
   return controllerFactory({
     document: currentDocument,
     onCsvReady: (csv: string) => {
@@ -46,6 +65,17 @@ export async function bootContentScript(
   });
 }
 
+async function readAuthState(
+  sendMessage: (message: unknown) => Promise<unknown>
+): Promise<AuthStateValue | null> {
+  const response = await sendMessage({ type: "auth:get-state" });
+  if (!isAuthResponseMessage(response) || !response.ok || response.type !== "auth:state") {
+    return null;
+  }
+
+  return response.value;
+}
+
 function isMarketPage(url: string): boolean {
   const parsedUrl = new URL(url);
   const isXingtuHost =
@@ -101,6 +131,40 @@ function requestCsvDownload(csv: string): boolean {
   return true;
 }
 
+function createRuntimeMessageSender(): (message: unknown) => Promise<unknown> {
+  return async (message: unknown) => {
+    const runtime = (
+      globalThis as typeof globalThis & {
+        chrome?: { runtime?: ChromeRuntimeLike };
+      }
+    ).chrome?.runtime;
+
+    if (typeof runtime?.sendMessage !== "function") {
+      return null;
+    }
+
+    return runtime.sendMessage(message);
+  };
+}
+
+async function waitForBodyReady(document: Document, currentWindow: Window): Promise<void> {
+  if (document.body) {
+    return;
+  }
+
+  await new Promise<void>((resolve) => {
+    const handleReady = () => {
+      if (document.body) {
+        document.removeEventListener("DOMContentLoaded", handleReady);
+        resolve();
+      }
+    };
+
+    document.addEventListener("DOMContentLoaded", handleReady);
+    currentWindow.setTimeout(handleReady, 0);
+  });
+}
+
 function downloadCsv(document: Document, window: Window, csv: string): void {
   const blob = new Blob(["\uFEFF", csv], {
     type: "text/csv;charset=utf-8"

src/content/market/api-client.ts

@@ -109,7 +109,7 @@ export function mapAuthorAseInfoResponse(payload: unknown): MarketApiResult {
     data.personal_avg_search_after_view_rate
   );
 
-  if (!singleVideoAfterSearchRate || !personalVideoAfterSearchRate) {
+  if (!singleVideoAfterSearchRate && !personalVideoAfterSearchRate) {
     return {
       success: false,
       reason: "missing-rate"
@@ -119,8 +119,8 @@ export function mapAuthorAseInfoResponse(payload: unknown): MarketApiResult {
   return {
     success: true,
     rates: {
-      singleVideoAfterSearchRate,
+      ...(singleVideoAfterSearchRate ? { singleVideoAfterSearchRate } : {}),
-      personalVideoAfterSearchRate
+      ...(personalVideoAfterSearchRate ? { personalVideoAfterSearchRate } : {})
     }
   };
 }

src/content/market/auth-gate.ts

@@ -0,0 +1,29 @@
+export function renderMarketAuthGate(
+  document: Document,
+  currentWindow: Window
+): HTMLElement {
+  const existingGate = document.querySelector(
+    '[data-market-auth-gate="root"]'
+  ) as HTMLElement | null;
+
+  if (existingGate) {
+    return existingGate;
+  }
+
+  const root = document.createElement("section");
+  root.dataset.marketAuthGate = "root";
+  root.innerHTML = `
+    <strong>请先登录插件</strong>
+    <p>打开扩展弹窗完成登录后刷新本页</p>
+    <button type="button" data-market-auth-help="button">去登录</button>
+  `;
+
+  root
+    .querySelector('[data-market-auth-help="button"]')
+    ?.addEventListener("click", () => {
+      currentWindow.alert("请点击浏览器工具栏中的扩展图标完成登录");
+    });
+
+  document.body.prepend(root);
+  return root;
+}

src/content/market/batch-name-dialog.ts

@@ -0,0 +1,245 @@
+const DIALOG_STYLE_ID = "sces-batch-name-dialog-style";
+
+const activeDialogs = new WeakMap<
+  Document,
+  {
+    input: HTMLInputElement;
+    promise: Promise<string | null>;
+  }
+>();
+
+export function promptForBatchName(document: Document): Promise<string | null> {
+  const existingDialog = activeDialogs.get(document);
+  if (existingDialog) {
+    existingDialog.input.focus();
+    existingDialog.input.select();
+    return existingDialog.promise;
+  }
+
+  ensureDialogStyles(document);
+
+  const dialogRoot = document.createElement("div");
+  dialogRoot.dataset.pluginBatchNameDialog = "root";
+  dialogRoot.setAttribute("role", "dialog");
+  dialogRoot.setAttribute("aria-modal", "true");
+  dialogRoot.setAttribute("aria-labelledby", "sces-batch-name-title");
+  applyOverlayStyles(dialogRoot);
+
+  const dialogPanel = document.createElement("div");
+  applyPanelStyles(dialogPanel);
+
+  const title = document.createElement("h2");
+  title.id = "sces-batch-name-title";
+  title.textContent = "提交批次";
+  applyTitleStyles(title);
+
+  const description = document.createElement("p");
+  description.textContent = "请输入批次名称，便于后续在系统中识别和追踪。";
+  applyDescriptionStyles(description);
+
+  const input = document.createElement("input");
+  input.type = "text";
+  input.dataset.pluginBatchNameInput = "input";
+  input.placeholder = "例如：618达人筛选第一批";
+  input.maxLength = 60;
+  applyInputStyles(input);
+
+  const errorText = document.createElement("p");
+  errorText.dataset.pluginBatchNameError = "text";
+  applyErrorStyles(errorText);
+
+  const buttonRow = document.createElement("div");
+  applyButtonRowStyles(buttonRow);
+
+  const cancelButton = document.createElement("button");
+  cancelButton.type = "button";
+  cancelButton.dataset.pluginBatchNameCancel = "button";
+  cancelButton.textContent = "取消";
+  applySecondaryButtonStyles(cancelButton);
+
+  const confirmButton = document.createElement("button");
+  confirmButton.type = "button";
+  confirmButton.dataset.pluginBatchNameConfirm = "button";
+  confirmButton.textContent = "确认提交";
+  applyPrimaryButtonStyles(confirmButton);
+
+  buttonRow.append(cancelButton, confirmButton);
+  dialogPanel.append(title, description, input, errorText, buttonRow);
+  dialogRoot.appendChild(dialogPanel);
+  document.body.appendChild(dialogRoot);
+
+  const dialogPromise = new Promise<string | null>((resolve) => {
+    const closeDialog = (value: string | null) => {
+      activeDialogs.delete(document);
+      dialogRoot.remove();
+      document.removeEventListener("keydown", handleDocumentKeydown, true);
+      resolve(value);
+    };
+
+    const submitValue = () => {
+      const value = input.value.trim();
+      if (!value) {
+        errorText.textContent = "请输入批次名称";
+        input.setAttribute("aria-invalid", "true");
+        input.focus();
+        return;
+      }
+
+      closeDialog(value);
+    };
+
+    const handleDocumentKeydown = (event: KeyboardEvent) => {
+      if (event.key === "Escape") {
+        event.preventDefault();
+        closeDialog(null);
+        return;
+      }
+
+      if (event.key === "Enter") {
+        event.preventDefault();
+        submitValue();
+      }
+    };
+
+    input.addEventListener("input", () => {
+      if (!input.value.trim()) {
+        return;
+      }
+
+      errorText.textContent = "";
+      input.removeAttribute("aria-invalid");
+    });
+    cancelButton.addEventListener("click", () => {
+      closeDialog(null);
+    });
+    confirmButton.addEventListener("click", () => {
+      submitValue();
+    });
+    dialogRoot.addEventListener("click", (event) => {
+      if (event.target === dialogRoot) {
+        closeDialog(null);
+      }
+    });
+    document.addEventListener("keydown", handleDocumentKeydown, true);
+  });
+
+  activeDialogs.set(document, {
+    input,
+    promise: dialogPromise
+  });
+
+  input.focus();
+
+  return dialogPromise;
+}
+
+function ensureDialogStyles(document: Document): void {
+  if (document.getElementById(DIALOG_STYLE_ID)) {
+    return;
+  }
+
+  const style = document.createElement("style");
+  style.id = DIALOG_STYLE_ID;
+  style.textContent = `
+    [data-plugin-batch-name-dialog="root"] {
+      animation: sces-batch-name-fade-in 0.16s ease;
+    }
+
+    @keyframes sces-batch-name-fade-in {
+      from {
+        opacity: 0;
+      }
+      to {
+        opacity: 1;
+      }
+    }
+  `;
+  document.head.appendChild(style);
+}
+
+function applyOverlayStyles(root: HTMLElement): void {
+  root.style.position = "fixed";
+  root.style.inset = "0";
+  root.style.background = "rgba(15, 23, 42, 0.38)";
+  root.style.display = "flex";
+  root.style.alignItems = "center";
+  root.style.justifyContent = "center";
+  root.style.padding = "24px";
+  root.style.zIndex = "2147483647";
+}
+
+function applyPanelStyles(panel: HTMLElement): void {
+  panel.style.width = "min(420px, calc(100vw - 32px))";
+  panel.style.background = "#fffaf9";
+  panel.style.border = "1px solid rgba(127, 29, 45, 0.14)";
+  panel.style.borderRadius = "18px";
+  panel.style.boxShadow = "0 28px 70px rgba(15, 23, 42, 0.22)";
+  panel.style.padding = "24px";
+  panel.style.boxSizing = "border-box";
+}
+
+function applyTitleStyles(title: HTMLElement): void {
+  title.style.margin = "0";
+  title.style.color = "#4c0519";
+  title.style.fontSize = "20px";
+  title.style.fontWeight = "700";
+  title.style.lineHeight = "28px";
+}
+
+function applyDescriptionStyles(description: HTMLElement): void {
+  description.style.margin = "10px 0 0";
+  description.style.color = "#64748b";
+  description.style.fontSize = "13px";
+  description.style.lineHeight = "20px";
+}
+
+function applyInputStyles(input: HTMLInputElement): void {
+  input.style.width = "100%";
+  input.style.height = "42px";
+  input.style.marginTop = "18px";
+  input.style.padding = "0 14px";
+  input.style.boxSizing = "border-box";
+  input.style.border = "1px solid #d8c1c6";
+  input.style.borderRadius = "12px";
+  input.style.background = "#ffffff";
+  input.style.color = "#1f2937";
+  input.style.fontSize = "14px";
+  input.style.outline = "none";
+}
+
+function applyErrorStyles(errorText: HTMLElement): void {
+  errorText.style.minHeight = "20px";
+  errorText.style.margin = "8px 0 0";
+  errorText.style.color = "#b91c1c";
+  errorText.style.fontSize = "12px";
+  errorText.style.lineHeight = "18px";
+}
+
+function applyButtonRowStyles(buttonRow: HTMLElement): void {
+  buttonRow.style.display = "flex";
+  buttonRow.style.justifyContent = "flex-end";
+  buttonRow.style.gap = "10px";
+  buttonRow.style.marginTop = "18px";
+}
+
+function applySecondaryButtonStyles(button: HTMLButtonElement): void {
+  button.style.height = "36px";
+  button.style.padding = "0 16px";
+  button.style.border = "1px solid #d7dde6";
+  button.style.borderRadius = "10px";
+  button.style.background = "#ffffff";
+  button.style.color = "#334155";
+  button.style.fontWeight = "600";
+  button.style.cursor = "pointer";
+}
+
+function applyPrimaryButtonStyles(button: HTMLButtonElement): void {
+  button.style.height = "36px";
+  button.style.padding = "0 16px";
+  button.style.border = "1px solid #7f1d2d";
+  button.style.borderRadius = "10px";
+  button.style.background = "#7f1d2d";
+  button.style.color = "#ffffff";
+  button.style.fontWeight = "600";
+  button.style.cursor = "pointer";
+}

src/content/market/batch-payload.ts

@@ -0,0 +1,51 @@
+import type { AuthStateValue } from "../../shared/auth-messages";
+import type { MarketRecord } from "./types";
+
+export interface BatchPayload {
+  authors: Array<{
+    authorId: string;
+    authorName: string;
+  }>;
+  batchName: string;
+  createdAt: string;
+  creatorName: string;
+  logtoUserId: string;
+  resource: string;
+}
+
+export function createBatchPayload(options: {
+  authState: AuthStateValue;
+  batchName: string;
+  createdAt: string;
+  records: MarketRecord[];
+}): BatchPayload {
+  const logtoUserId = options.authState.userInfo?.sub?.trim();
+  if (!logtoUserId) {
+    throw new Error("batch submit user id unavailable");
+  }
+
+  const resource = options.authState.resource?.trim();
+  if (!resource) {
+    throw new Error("batch submit resource unavailable");
+  }
+
+  const batchName = options.batchName.trim();
+  if (!batchName) {
+    throw new Error("batch submit batch name is required");
+  }
+
+  return {
+    authors: options.records.map((record) => ({
+      authorId: record.authorId,
+      authorName: record.authorName
+    })),
+    batchName,
+    createdAt: options.createdAt,
+    creatorName:
+      options.authState.userInfo?.name ??
+      options.authState.userInfo?.username ??
+      logtoUserId,
+    logtoUserId,
+    resource
+  };
+}

src/content/market/csv-exporter.ts

@@ -43,9 +43,40 @@ const RATE_COLUMNS: CsvColumn[] = [
   }
 ];
 
+const BACKEND_METRIC_COLUMNS: CsvColumn[] = [
+  {
+    header: "看后搜率",
+    readValue: (record: MarketRecord) =>
+      record.backendMetrics?.afterViewSearchRate ?? ""
+  },
+  {
+    header: "看后搜数",
+    readValue: (record: MarketRecord) =>
+      record.backendMetrics?.afterViewSearchCount ?? ""
+  },
+  {
+    header: "新增A3数",
+    readValue: (record: MarketRecord) =>
+      record.backendMetrics?.a3IncreaseCount ?? ""
+  },
+  {
+    header: "新增A3率",
+    readValue: (record: MarketRecord) =>
+      record.backendMetrics?.newA3Rate ?? ""
+  },
+  {
+    header: "CPA3",
+    readValue: (record: MarketRecord) => record.backendMetrics?.cpa3 ?? ""
+  },
+  {
+    header: "cp_search",
+    readValue: (record: MarketRecord) => record.backendMetrics?.cpSearch ?? ""
+  }
+];
+
 export function buildMarketCsv(records: MarketRecord[]): string {
   const baseColumns = buildBaseColumns(records);
-  const csvColumns = [...baseColumns, ...RATE_COLUMNS];
+  const csvColumns = [...baseColumns, ...RATE_COLUMNS, ...BACKEND_METRIC_COLUMNS];
   const headerLine = csvColumns.map((column) => column.header).join(",");
   const rowLines = records.map((record) =>
     csvColumns.map((column) => escapeCsvCell(column.readValue(record))).join(",")
@@ -57,10 +88,11 @@ export function buildMarketCsv(records: MarketRecord[]): string {
 function buildBaseColumns(records: MarketRecord[]): CsvColumn[] {
   const orderedHeaders: string[] = [];
   const seenHeaders = new Set<string>();
+  const excludedHeaders = new Set(["代表视频"]);
 
   records.forEach((record) => {
     Object.keys(record.exportFields ?? {}).forEach((header) => {
-      if (seenHeaders.has(header)) {
+      if (seenHeaders.has(header) || excludedHeaders.has(header)) {
         return;
       }
 

src/content/market/export-range-controller.ts

@@ -10,6 +10,7 @@ interface ExportRangeControllerOptions {
   onProgress?: (state: { currentPage: number; totalPages?: number }) => void;
   prepareCurrentPageForExport(): Promise<void>;
   readCurrentPageRecords(): MarketRecord[];
+  readCurrentPageRowCount(): number;
   window: Window;
 }
 
@@ -26,13 +27,10 @@ export function createExportRangeController(options: ExportRangeControllerOption
           currentPage,
           totalPages: target.mode === "count" ? target.pageCount : undefined
         });
-        const currentPageReady = await waitForCurrentPageReady(expectedMinimumRowCount);
+        const currentPageRecords = await preparePageRecords(expectedMinimumRowCount);
-        if (!currentPageReady) {
+        if (!currentPageRecords) {
           throw new Error(`第 ${currentPage} 页加载超时，请稍后重试`);
         }
-
-        await options.prepareCurrentPageForExport();
-        const currentPageRecords = options.readCurrentPageRecords();
         currentPageRecords.forEach((record) => {
           const existingRecord = mergedRecords.get(record.authorId);
           mergedRecords.set(record.authorId, mergeMarketRecord(existingRecord, record));
@@ -63,6 +61,33 @@ export function createExportRangeController(options: ExportRangeControllerOption
     }
   };
 
+  async function preparePageRecords(
+    expectedMinimumRowCount: number | undefined
+  ): Promise<MarketRecord[] | null> {
+    for (let attempt = 0; attempt < 4; attempt += 1) {
+      const currentPageReady = await waitForCurrentPageReady();
+      if (!currentPageReady) {
+        return null;
+      }
+
+      await options.prepareCurrentPageForExport();
+      const currentPageRecords = options.readCurrentPageRecords();
+      if (
+        currentPageRecords.length > 0 &&
+        (
+          typeof expectedMinimumRowCount !== "number" ||
+          expectedMinimumRowCount <= 0 ||
+          isCurrentPageTerminal() ||
+          currentPageRecords.length >= expectedMinimumRowCount
+        )
+      ) {
+        return currentPageRecords;
+      }
+    }
+
+    return null;
+  }
+
   async function waitForPageChange(previousSignature: string): Promise<boolean> {
     const previousPageState = parsePageSignature(previousSignature);
 
@@ -82,9 +107,7 @@ export function createExportRangeController(options: ExportRangeControllerOption
     return false;
   }
 
-  async function waitForCurrentPageReady(
+  async function waitForCurrentPageReady(): Promise<boolean> {
-    expectedMinimumRowCount: number | undefined
-  ): Promise<boolean> {
     let stableAttemptCount = 0;
     let lastReadyFingerprint = "";
 
@@ -101,17 +124,6 @@ export function createExportRangeController(options: ExportRangeControllerOption
         continue;
       }
 
-      if (
-        typeof expectedMinimumRowCount === "number" &&
-        expectedMinimumRowCount > 0 &&
-        !pageState.isTerminalPage &&
-        pageState.rowCount < expectedMinimumRowCount
-      ) {
-        stableAttemptCount = 0;
-        lastReadyFingerprint = "";
-        continue;
-      }
-
       const readyFingerprint = [
         pageState.pageToken,
         pageState.authorIds,
@@ -146,9 +158,13 @@ export function createExportRangeController(options: ExportRangeControllerOption
       authorIds: pageSignature.authorIds,
       isTerminalPage: isPageControlDisabled(nextPageControl),
       pageToken: pageSignature.pageToken,
-      rowCount: options.readCurrentPageRecords().length
+      rowCount: options.readCurrentPageRowCount()
     };
   }
+
+  function isCurrentPageTerminal(): boolean {
+    return isPageControlDisabled(findNextPageControl(options.document));
+  }
 }
 
 function parsePageSignature(signature: string): {

src/content/market/filter-sort-controller.ts

@@ -3,6 +3,9 @@ import {
   parseRateLowerBound
 } from "../../shared/rate-normalizer";
 import type {
+  AfterSearchRates,
+  BackendMetrics,
+  MarketSortField,
   MarketFilterState,
   MarketRecord,
   MarketSortState
@@ -67,13 +70,26 @@ function compareRecords(
   rightRecord: MarketRecord,
   sort: MarketSortState
 ): number {
-  const leftValue = leftRecord.rates?.[sort.field];
+  if (isRateSortField(sort.field)) {
-  const rightValue = rightRecord.rates?.[sort.field];
+    return compareRateSortRecords(leftRecord, rightRecord, sort);
+  }
+
+  return compareBackendMetricRecords(leftRecord, rightRecord, sort);
+}
+
+function compareRateSortRecords(
+  leftRecord: MarketRecord,
+  rightRecord: MarketRecord,
+  sort: MarketSortState
+): number {
+  const field = sort.field as keyof Required<AfterSearchRates>;
+  const leftValue = leftRecord.rates?.[field];
+  const rightValue = rightRecord.rates?.[field];
   const leftLowerBound = parseRateLowerBound(leftValue ?? null);
   const rightLowerBound = parseRateLowerBound(rightValue ?? null);
 
   if (leftLowerBound == null && rightLowerBound == null) {
-    return 0;
+    return compareRecordIdentity(leftRecord, rightRecord);
   }
 
   if (leftLowerBound == null) {
@@ -91,5 +107,72 @@ function compareRecords(
   }
 
   const tieBreak = compareRateValues(leftValue, rightValue);
+  if (tieBreak !== 0) {
     return sort.direction === "asc" ? tieBreak : -tieBreak;
+  }
+
+  return compareRecordIdentity(leftRecord, rightRecord);
+}
+
+function compareBackendMetricRecords(
+  leftRecord: MarketRecord,
+  rightRecord: MarketRecord,
+  sort: MarketSortState
+): number {
+  const field = sort.field as keyof Required<BackendMetrics>;
+  const leftValue = parseBackendMetricValue(leftRecord.backendMetrics?.[field]);
+  const rightValue = parseBackendMetricValue(rightRecord.backendMetrics?.[field]);
+
+  if (leftValue == null && rightValue == null) {
+    return compareRecordIdentity(leftRecord, rightRecord);
+  }
+
+  if (leftValue == null) {
+    return 1;
+  }
+
+  if (rightValue == null) {
+    return -1;
+  }
+
+  if (leftValue !== rightValue) {
+    return sort.direction === "asc" ? leftValue - rightValue : rightValue - leftValue;
+  }
+
+  return compareRecordIdentity(leftRecord, rightRecord);
+}
+
+function parseBackendMetricValue(value: string | null | undefined): number | null {
+  if (!value) {
+    return null;
+  }
+
+  const normalizedValue = value.replace(/,/g, "").replace(/%/g, "").trim();
+  if (!normalizedValue) {
+    return null;
+  }
+
+  const numericValue = Number(normalizedValue);
+  return Number.isFinite(numericValue) ? numericValue : null;
+}
+
+function isRateSortField(
+  field: MarketSortField
+): field is keyof Required<AfterSearchRates> {
+  return (
+    field === "singleVideoAfterSearchRate" ||
+    field === "personalVideoAfterSearchRate"
+  );
+}
+
+function compareRecordIdentity(
+  leftRecord: MarketRecord,
+  rightRecord: MarketRecord
+): number {
+  const authorIdCompare = leftRecord.authorId.localeCompare(rightRecord.authorId);
+  if (authorIdCompare !== 0) {
+    return authorIdCompare;
+  }
+
+  return leftRecord.authorName.localeCompare(rightRecord.authorName);
 }

src/content/market/market-list-request-snapshot.ts

@@ -0,0 +1,173 @@
+export const MARKET_REQUEST_SNAPSHOT_ATTRIBUTE =
+  "data-sces-market-request-snapshot";
+const MARKET_SEARCH_ENDPOINT_PATH = "/gw/api/gsearch/search_for_author_square";
+
+export interface MarketListRequestSnapshot {
+  body?: string;
+  headers?: Record<string, string>;
+  method: string;
+  url: string;
+}
+
+export function readMarketListRequestSnapshot(
+  document: Document
+): MarketListRequestSnapshot | null {
+  const serializedSnapshot = document.documentElement.getAttribute(
+    MARKET_REQUEST_SNAPSHOT_ATTRIBUTE
+  );
+  if (!serializedSnapshot) {
+    return readMarketListRequestSnapshotFromPageState(document);
+  }
+
+  try {
+    const parsedSnapshot = normalizeMarketListRequestSnapshot(
+      JSON.parse(serializedSnapshot)
+    );
+    if (!parsedSnapshot) {
+      return readMarketListRequestSnapshotFromPageState(document);
+    }
+
+    return parsedSnapshot;
+  } catch {
+    return readMarketListRequestSnapshotFromPageState(document);
+  }
+}
+
+export function writeMarketListRequestSnapshot(
+  document: Document,
+  snapshot: MarketListRequestSnapshot
+): void {
+  document.documentElement.setAttribute(
+    MARKET_REQUEST_SNAPSHOT_ATTRIBUTE,
+    JSON.stringify(snapshot)
+  );
+}
+
+function isMarketListRequestSnapshot(
+  value: unknown
+): value is MarketListRequestSnapshot {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+
+  const candidate = value as Partial<MarketListRequestSnapshot>;
+  return (
+    typeof candidate.method === "string" &&
+    typeof candidate.url === "string" &&
+    (!("body" in candidate) || typeof candidate.body === "string") &&
+    (!("headers" in candidate) || isStringRecord(candidate.headers))
+  );
+}
+
+function normalizeMarketListRequestSnapshot(
+  value: unknown
+): MarketListRequestSnapshot | null {
+  if (!value || typeof value !== "object") {
+    return null;
+  }
+
+  const candidate = value as Partial<MarketListRequestSnapshot> & {
+    headers?: Record<string, unknown>;
+  };
+  const normalizedSnapshot: Partial<MarketListRequestSnapshot> = {
+    body: typeof candidate.body === "string" ? candidate.body : undefined,
+    method: typeof candidate.method === "string" ? candidate.method : undefined,
+    url: typeof candidate.url === "string" ? candidate.url : undefined
+  };
+
+  if (candidate.headers && typeof candidate.headers === "object") {
+    normalizedSnapshot.headers = Object.fromEntries(
+      Object.entries(candidate.headers)
+        .filter(([, entry]) =>
+          ["string", "number", "boolean"].includes(typeof entry)
+        )
+        .map(([key, entry]) => [key, String(entry)])
+    );
+  }
+
+  return isMarketListRequestSnapshot(normalizedSnapshot)
+    ? normalizedSnapshot
+    : null;
+}
+
+function isStringRecord(value: unknown): value is Record<string, string> {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+
+  return Object.values(value).every((entry) => typeof entry === "string");
+}
+
+function readMarketListRequestSnapshotFromPageState(
+  document: Document
+): MarketListRequestSnapshot | null {
+  const reqParams = findMarketReqParams(document);
+  if (!reqParams) {
+    return null;
+  }
+
+  return {
+    body: JSON.stringify(reqParams),
+    method: "POST",
+    url: buildMarketSearchUrl(document)
+  };
+}
+
+function findMarketReqParams(document: Document): Record<string, unknown> | null {
+  const marketRoot = document.querySelector(".base-author-list") as
+    | (Element & {
+        __vue__?: {
+          _setupState?: Record<string, unknown>;
+        };
+      })
+    | null;
+  const setupState = marketRoot?.__vue__?._setupState;
+  if (!setupState) {
+    return null;
+  }
+
+  const queue: unknown[] = Object.values(setupState);
+  while (queue.length > 0) {
+    const current = unwrapVueRef(queue.shift());
+    if (!isRecord(current)) {
+      continue;
+    }
+
+    const reqParams = unwrapVueRef(current.reqParams);
+    if (isRecord(reqParams)) {
+      return reqParams;
+    }
+
+    Object.values(current).forEach((value) => {
+      queue.push(value);
+    });
+  }
+
+  return null;
+}
+
+function buildMarketSearchUrl(document: Document): string {
+  if (
+    document.location?.origin &&
+    document.location.origin !== "null" &&
+    document.location.origin !== "about:blank"
+  ) {
+    return document.location.origin.includes("xingtu.cn")
+      ? MARKET_SEARCH_ENDPOINT_PATH
+      : new URL(MARKET_SEARCH_ENDPOINT_PATH, document.location.origin).toString();
+  }
+
+  return MARKET_SEARCH_ENDPOINT_PATH;
+}
+
+function unwrapVueRef(value: unknown): unknown {
+  if (isRecord(value) && "value" in value) {
+    return value.value;
+  }
+
+  return value;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}

src/content/market/market-list-row.ts

@@ -0,0 +1,513 @@
+import { normalizeFractionRateDisplay } from "../../shared/rate-normalizer";
+import type { MarketRowSnapshot } from "./types";
+
+export interface ParsedMarketListResponse {
+  currentPage?: number;
+  pageSize?: number;
+  records: MarketRowSnapshot[];
+  totalCount?: number;
+  totalPages?: number;
+}
+
+const PAGE_NUMBER_KEYS = [
+  "currentPage",
+  "page",
+  "pageNo",
+  "pageNum",
+  "page_no",
+  "page_num"
+] as const;
+
+const PAGE_SIZE_KEYS = [
+  "limit",
+  "pageSize",
+  "page_size",
+  "size"
+] as const;
+
+const TOTAL_COUNT_KEYS = [
+  "total",
+  "totalCount",
+  "total_count"
+] as const;
+
+const TOTAL_PAGE_KEYS = [
+  "pageCount",
+  "page_count",
+  "totalPage",
+  "totalPages",
+  "total_page",
+  "total_pages"
+] as const;
+
+export function mapMarketListRow(
+  row: Record<string, unknown>
+): MarketRowSnapshot {
+  const attributeDatas = readMarketAttributeDatas(row);
+  const singleVideoAfterSearchRate = normalizeMarketListRate(
+    readMarketFieldValue(row, attributeDatas, "avg_search_after_view_rate_30d")
+  );
+
+  return {
+    authorId:
+      readString(readMarketFieldValue(row, attributeDatas, "star_id")) ??
+      readString(readMarketFieldValue(row, attributeDatas, "id")) ??
+      "",
+    authorName:
+      readString(readMarketFieldValue(row, attributeDatas, "nickname")) ??
+      readString(readMarketFieldValue(row, attributeDatas, "nick_name")) ??
+      "",
+    exportFields: buildMarketExportFieldFallbacks(row, attributeDatas),
+    hasDirectRatesSource: true,
+    location: readMarketLocation(row, attributeDatas),
+    price21To60s: readMarketPrice21To60s(row, attributeDatas),
+    rates: singleVideoAfterSearchRate
+      ? {
+          singleVideoAfterSearchRate
+        }
+      : undefined
+  };
+}
+
+export function parseMarketListResponse(
+  payload: unknown
+): ParsedMarketListResponse | null {
+  const container = findMarketListContainer(payload);
+  if (!container) {
+    return null;
+  }
+
+  const marketList = readMarketListArray(container);
+  if (!marketList) {
+    return null;
+  }
+
+  return {
+    currentPage: readKnownNumberDeep(container, PAGE_NUMBER_KEYS) ?? undefined,
+    pageSize: readKnownNumberDeep(container, PAGE_SIZE_KEYS) ?? undefined,
+    records: marketList
+      .map((row) => (isRecord(row) ? mapMarketListRow(row) : null))
+      .filter(
+        (row): row is MarketRowSnapshot =>
+          row !== null && Boolean(row.authorId || row.authorName)
+      ),
+    totalCount: readKnownNumberDeep(container, TOTAL_COUNT_KEYS) ?? undefined,
+    totalPages: readKnownNumberDeep(container, TOTAL_PAGE_KEYS) ?? undefined
+  };
+}
+
+export function readKnownPaginationNumber(
+  value: unknown,
+  kind: "page" | "pageSize"
+): number | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+
+  return readKnownNumberDeep(value, kind === "page" ? PAGE_NUMBER_KEYS : PAGE_SIZE_KEYS);
+}
+
+function findMarketListContainer(value: unknown): Record<string, unknown> | null {
+  const queue: unknown[] = [value];
+
+  while (queue.length > 0) {
+    const current = queue.shift();
+    if (!isRecord(current)) {
+      continue;
+    }
+
+    if (readMarketListArray(current)) {
+      return current;
+    }
+
+    Object.values(current).forEach((entry) => {
+      queue.push(unwrapVueRef(entry));
+    });
+  }
+
+  return null;
+}
+
+function readMarketListArray(record: Record<string, unknown>): unknown[] | null {
+  const marketList = unwrapVueRef(record.marketList);
+  if (Array.isArray(marketList)) {
+    return marketList;
+  }
+
+  const authors = unwrapVueRef(record.authors);
+  if (Array.isArray(authors)) {
+    return authors;
+  }
+
+  return null;
+}
+
+function unwrapVueRef(value: unknown): unknown {
+  if (isRecord(value) && "value" in value) {
+    return value.value;
+  }
+
+  return value;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function readMarketAttributeDatas(
+  record: Record<string, unknown>
+): Record<string, unknown> {
+  return isRecord(record.attribute_datas) ? record.attribute_datas : {};
+}
+
+function readMarketFieldValue(
+  record: Record<string, unknown>,
+  attributeDatas: Record<string, unknown>,
+  field: string
+): unknown {
+  return record[field] ?? attributeDatas[field];
+}
+
+function readString(value: unknown): string | null {
+  return typeof value === "string" ? value : null;
+}
+
+function normalizeMarketListRate(value: unknown): string | null {
+  if (typeof value === "number") {
+    return normalizeFractionRateDisplay(String(value));
+  }
+
+  return typeof value === "string" ? normalizeFractionRateDisplay(value) : null;
+}
+
+function normalizeExportCellText(value: string | null | undefined): string {
+  return value?.replace(/\s+/g, " ").trim() ?? "";
+}
+
+function buildMarketExportFieldFallbacks(
+  record: Record<string, unknown>,
+  attributeDatas: Record<string, unknown>
+): Record<string, string> | undefined {
+  const exportFields: Record<string, string> = {};
+  const authorInfo = buildMarketAuthorInfo(record, attributeDatas);
+  const authorType = buildMarketAuthorType(record, attributeDatas);
+  const contentTheme = buildMarketContentTheme(record, attributeDatas);
+  const connectedUsers = formatWanValue(
+    readNumericValue(readMarketFieldValue(record, attributeDatas, "link_link_cnt_by_industry"))
+  );
+  const followerCount = formatWanValue(
+    readNumericValue(readMarketFieldValue(record, attributeDatas, "follower"))
+  );
+  const expectedCpm = formatDecimalDisplay(
+    readNumericValue(readMarketFieldValue(record, attributeDatas, "prospective_20_60_cpm"))
+  );
+  const expectedPlayCount = formatWanValue(
+    readNumericValue(readMarketFieldValue(record, attributeDatas, "expected_play_num"))
+  );
+  const interactionRate = formatFractionPercent(
+    readNumericValue(readMarketFieldValue(record, attributeDatas, "interact_rate_within_30d"))
+  );
+  const finishRate = formatFractionPercent(
+    readNumericValue(readMarketFieldValue(record, attributeDatas, "play_over_rate_within_30d"))
+  );
+  const burstRate = readBurstRateDisplay(
+    readNumericValue(readMarketFieldValue(record, attributeDatas, "burst_text_rate"))
+  );
+  const price21To60s = readMarketPrice21To60s(record, attributeDatas);
+  const representativeVideo = readMarketRepresentativeVideo(record, attributeDatas);
+
+  assignExportField(exportFields, "达人信息", authorInfo);
+  assignExportField(exportFields, "代表视频", representativeVideo);
+  assignExportField(exportFields, "达人类型", authorType);
+  assignExportField(exportFields, "内容主题", contentTheme);
+  assignExportField(exportFields, "连接用户数", connectedUsers);
+  assignExportField(exportFields, "粉丝数", followerCount);
+  assignExportField(exportFields, "预期CPM", expectedCpm);
+  assignExportField(exportFields, "预期播放量", expectedPlayCount);
+  assignExportField(exportFields, "互动率", interactionRate);
+  assignExportField(exportFields, "完播率", finishRate);
+  assignExportField(exportFields, "爆文率", burstRate);
+  assignExportField(exportFields, "21-60s报价", price21To60s);
+
+  return Object.keys(exportFields).length > 0 ? exportFields : undefined;
+}
+
+function assignExportField(
+  exportFields: Record<string, string>,
+  key: string,
+  value: string | undefined
+): void {
+  if (hasTextValue(value)) {
+    exportFields[key] = value;
+  }
+}
+
+function hasTextValue(value: string | undefined | null): boolean {
+  return Boolean(value && value.trim().length > 0);
+}
+
+function buildMarketAuthorInfo(
+  record: Record<string, unknown>,
+  attributeDatas: Record<string, unknown>
+): string | undefined {
+  const nickname =
+    readString(readMarketFieldValue(record, attributeDatas, "nickname")) ??
+    readString(readMarketFieldValue(record, attributeDatas, "nick_name")) ??
+    "";
+  const parts = [
+    nickname,
+    readMarketGenderLabel(readMarketFieldValue(record, attributeDatas, "gender")),
+    readString(readMarketFieldValue(record, attributeDatas, "city")) ?? ""
+  ].filter((value) => Boolean(value));
+
+  return parts.length > 0 ? parts.join(" ") : undefined;
+}
+
+function buildMarketAuthorType(
+  record: Record<string, unknown>,
+  attributeDatas: Record<string, unknown>
+): string | undefined {
+  const tagsRelation = readRecordLike(
+    readMarketFieldValue(record, attributeDatas, "tags_relation")
+  );
+  if (tagsRelation) {
+    const primaryTag = Object.keys(tagsRelation)[0];
+    if (hasTextValue(primaryTag)) {
+      return primaryTag;
+    }
+  }
+
+  return undefined;
+}
+
+function buildMarketContentTheme(
+  record: Record<string, unknown>,
+  attributeDatas: Record<string, unknown>
+): string | undefined {
+  const themes = readStringArray(
+    readMarketFieldValue(record, attributeDatas, "content_theme_labels_180d")
+  );
+  if (themes.length === 0) {
+    return undefined;
+  }
+
+  if (themes.length <= 2) {
+    return themes.join(" ");
+  }
+
+  return `${themes.slice(0, 2).join(" ")} ${themes.length - 2}+`;
+}
+
+function readMarketLocation(
+  record: Record<string, unknown>,
+  attributeDatas: Record<string, unknown>
+): string | undefined {
+  return readString(readMarketFieldValue(record, attributeDatas, "city")) ?? undefined;
+}
+
+function readMarketPrice21To60s(
+  record: Record<string, unknown>,
+  attributeDatas: Record<string, unknown>
+): string | undefined {
+  return formatCurrencyValue(
+    readNumericValue(readMarketFieldValue(record, attributeDatas, "price_20_60"))
+  );
+}
+
+function readMarketRepresentativeVideo(
+  record: Record<string, unknown>,
+  attributeDatas: Record<string, unknown>
+): string | undefined {
+  const items = readArrayLike(readMarketFieldValue(record, attributeDatas, "items"));
+  for (const item of items) {
+    if (!isRecord(item)) {
+      continue;
+    }
+
+    const title = readString(item.title);
+    if (hasTextValue(title)) {
+      return normalizeExportCellText(title);
+    }
+  }
+
+  return undefined;
+}
+
+function readMarketGenderLabel(value: unknown): string | undefined {
+  const rawValue = typeof value === "number" ? String(value) : readString(value);
+  if (rawValue === "1") {
+    return "男";
+  }
+
+  if (rawValue === "2") {
+    return "女";
+  }
+
+  return undefined;
+}
+
+function readBurstRateDisplay(value: number | null): string | undefined {
+  if (value === null) {
+    return undefined;
+  }
+
+  if (value <= 0) {
+    return "-";
+  }
+
+  return formatFractionPercent(value);
+}
+
+function formatCurrencyValue(value: number | null): string | undefined {
+  if (value === null) {
+    return undefined;
+  }
+
+  return `¥${value.toLocaleString("en-US", {
+    maximumFractionDigits: 0
+  })}`;
+}
+
+function formatWanValue(value: number | null): string | undefined {
+  if (value === null) {
+    return undefined;
+  }
+
+  return `${formatDecimalWithGrouping(value / 10000)}w`;
+}
+
+function formatFractionPercent(value: number | null): string | undefined {
+  if (value === null) {
+    return undefined;
+  }
+
+  return `${formatDecimalDisplay(value * 100)}%`;
+}
+
+function formatDecimalDisplay(value: number | null): string | undefined {
+  if (value === null) {
+    return undefined;
+  }
+
+  return value.toLocaleString("en-US", {
+    maximumFractionDigits: 1,
+    minimumFractionDigits: 0,
+    useGrouping: false
+  });
+}
+
+function formatDecimalWithGrouping(value: number): string {
+  return value.toLocaleString("en-US", {
+    maximumFractionDigits: 1,
+    minimumFractionDigits: 0
+  });
+}
+
+function readNumericValue(value: unknown): number | null {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value;
+  }
+
+  if (typeof value === "string") {
+    const trimmedValue = value.trim();
+    if (!trimmedValue) {
+      return null;
+    }
+
+    const parsedValue = Number(trimmedValue);
+    return Number.isFinite(parsedValue) ? parsedValue : null;
+  }
+
+  return null;
+}
+
+function readStringArray(value: unknown): string[] {
+  if (Array.isArray(value)) {
+    return value.filter((item): item is string => typeof item === "string");
+  }
+
+  if (typeof value === "string") {
+    try {
+      const parsedValue = JSON.parse(value);
+      return Array.isArray(parsedValue)
+        ? parsedValue.filter((item): item is string => typeof item === "string")
+        : [];
+    } catch {
+      return [];
+    }
+  }
+
+  return [];
+}
+
+function readArrayLike(value: unknown): unknown[] {
+  if (Array.isArray(value)) {
+    return value;
+  }
+
+  if (typeof value === "string") {
+    try {
+      const parsedValue = JSON.parse(value);
+      return Array.isArray(parsedValue) ? parsedValue : [];
+    } catch {
+      return [];
+    }
+  }
+
+  return [];
+}
+
+function readRecordLike(value: unknown): Record<string, unknown> | null {
+  if (isRecord(value)) {
+    return value;
+  }
+
+  if (typeof value === "string") {
+    try {
+      const parsedValue = JSON.parse(value);
+      return isRecord(parsedValue) ? parsedValue : null;
+    } catch {
+      return null;
+    }
+  }
+
+  return null;
+}
+
+function readKnownNumber(
+  record: Record<string, unknown>,
+  keys: readonly string[]
+): number | undefined {
+  for (const key of keys) {
+    const value = readNumericValue(record[key]);
+    if (value !== null) {
+      return value;
+    }
+  }
+
+  return undefined;
+}
+
+function readKnownNumberDeep(
+  value: unknown,
+  keys: readonly string[]
+): number | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+
+  const directValue = readKnownNumber(value, keys);
+  if (typeof directValue === "number") {
+    return directValue;
+  }
+
+  for (const nestedValue of Object.values(value)) {
+    const candidate =
+      readKnownNumberDeep(unwrapVueRef(nestedValue), keys);
+    if (typeof candidate === "number") {
+      return candidate;
+    }
+  }
+
+  return null;
+}

src/content/market/page-bridge.ts

@@ -1,6 +1,11 @@
 import { normalizeFractionRateDisplay } from "../../shared/rate-normalizer";
+import {
+  writeMarketListRequestSnapshot
+} from "./market-list-request-snapshot";
+import { parseMarketListResponse } from "./market-list-row";
 
 const BRIDGE_MARKER = "__SCES_MARKET_PAGE_BRIDGE_INSTALLED__";
+const MARKET_SEARCH_REQUEST_PATH = "/gw/api/gsearch/search_for_author_square";
 const SERIALIZED_MARKET_ROWS_ATTRIBUTE = "data-sces-market-rows";
 
 type MarketRow = {
@@ -24,6 +29,7 @@ function installMarketPageBridge() {
   }
 
   window[BRIDGE_MARKER] = true;
+  installMarketRequestSnapshotBridge();
   syncSerializedMarketRows();
 
   const observer = new MutationObserver(() => {
@@ -39,7 +45,16 @@ function installMarketPageBridge() {
   }, 1000);
 }
 
+function installMarketRequestSnapshotBridge() {
+  installFetchSnapshotBridge();
+  installXmlHttpRequestSnapshotBridge();
+}
+
 function syncSerializedMarketRows() {
+  if (typeof document === "undefined") {
+    return;
+  }
+
   const nextSerializedRows = JSON.stringify(readSerializedMarketRows());
   if (
     document.documentElement.getAttribute(SERIALIZED_MARKET_ROWS_ATTRIBUTE) !==
@@ -52,6 +67,131 @@ function syncSerializedMarketRows() {
   }
 }
 
+function installFetchSnapshotBridge() {
+  if (typeof window.fetch !== "function") {
+    return;
+  }
+
+  const originalFetch = window.fetch.bind(window);
+  window.fetch = async (input: RequestInfo | URL, init?: RequestInit) => {
+    const requestSnapshot = readFetchSnapshot(input, init);
+    const response = await originalFetch(input, init);
+    if (requestSnapshot) {
+      const clonedResponse = response.clone();
+      void captureMarketSnapshotFromResponse(requestSnapshot, () =>
+        clonedResponse.json()
+      );
+    }
+    return response;
+  };
+}
+
+function installXmlHttpRequestSnapshotBridge() {
+  const OriginalXmlHttpRequest = window.XMLHttpRequest;
+  if (!OriginalXmlHttpRequest) {
+    return;
+  }
+
+  const originalOpen = OriginalXmlHttpRequest.prototype.open;
+  const originalSend = OriginalXmlHttpRequest.prototype.send;
+  const originalSetRequestHeader = OriginalXmlHttpRequest.prototype.setRequestHeader;
+
+  OriginalXmlHttpRequest.prototype.open = function (
+    method: string,
+    url: string | URL,
+    ...rest: unknown[]
+  ) {
+    (
+      this as XMLHttpRequest & {
+        __scesMarketSnapshot?: {
+          headers: Record<string, string>;
+          method: string;
+          url: string;
+        };
+      }
+    ).__scesMarketSnapshot = {
+      headers: {},
+      method,
+      url: String(url)
+    };
+    return originalOpen.call(this, method, url, ...(rest as [boolean?, string?, string?]));
+  };
+
+  OriginalXmlHttpRequest.prototype.setRequestHeader = function (
+    name: string,
+    value: string
+  ) {
+    (
+      this as XMLHttpRequest & {
+        __scesMarketSnapshot?: {
+          headers: Record<string, string>;
+        };
+      }
+    ).__scesMarketSnapshot?.headers &&
+      ((this as XMLHttpRequest & {
+        __scesMarketSnapshot?: {
+          headers: Record<string, string>;
+        };
+      }).__scesMarketSnapshot!.headers[name] = value);
+    return originalSetRequestHeader.call(this, name, value);
+  };
+
+  OriginalXmlHttpRequest.prototype.send = function (body?: Document | XMLHttpRequestBodyInit | null) {
+    const snapshotState = (
+      this as XMLHttpRequest & {
+        __scesMarketSnapshot?: {
+          body?: string;
+          headers: Record<string, string>;
+          method: string;
+          url: string;
+        };
+      }
+    ).__scesMarketSnapshot;
+    if (snapshotState) {
+      snapshotState.body = typeof body === "string" ? body : undefined;
+      this.addEventListener("load", () => {
+        if (this.status < 200 || this.status >= 300 || typeof this.responseText !== "string") {
+          return;
+        }
+
+        void captureMarketSnapshotFromResponse(snapshotState, async () =>
+          JSON.parse(this.responseText)
+        );
+      });
+    }
+
+    return originalSend.call(this, body);
+  };
+}
+
+async function captureMarketSnapshotFromResponse(
+  snapshot: {
+    body?: string;
+    headers?: Record<string, string>;
+    method: string;
+    url: string;
+  },
+  readPayload: () => Promise<unknown>
+) {
+  if (!isMarketSearchRequest(snapshot.url)) {
+    return;
+  }
+
+  try {
+    const payload = await readPayload();
+    if (!parseMarketListResponse(payload)) {
+      return;
+    }
+
+    writeMarketListRequestSnapshot(document, {
+      body: snapshot.body,
+      headers: snapshot.headers,
+      method: snapshot.method,
+      url: snapshot.url
+    });
+  } catch {}
+}
+
 function readSerializedMarketRows() {
   const marketList = readMarketList();
   return marketList
@@ -71,7 +211,59 @@ function readSerializedMarketRows() {
     .filter((row) => Boolean(row.authorId || row.authorName));
 }
 
+function readFetchSnapshot(
+  input: RequestInfo | URL,
+  init?: RequestInit
+): {
+  body?: string;
+  headers?: Record<string, string>;
+  method: string;
+  url: string;
+} | null {
+  const request = input instanceof Request ? input : null;
+  const method = init?.method ?? request?.method ?? "GET";
+  const url = request?.url ?? String(input);
+  const body =
+    typeof init?.body === "string"
+      ? init.body
+      : typeof request?.bodyUsed === "boolean" && request.bodyUsed
+        ? undefined
+        : undefined;
+  const headers = serializeHeaders(init?.headers ?? request?.headers);
+
+  return {
+    body,
+    headers,
+    method,
+    url
+  };
+}
+
+function serializeHeaders(
+  headers: HeadersInit | undefined
+): Record<string, string> | undefined {
+  if (!headers) {
+    return undefined;
+  }
+
+  if (headers instanceof Headers) {
+    return Object.fromEntries(headers.entries());
+  }
+
+  if (Array.isArray(headers)) {
+    return Object.fromEntries(headers);
+  }
+
+  return Object.fromEntries(
+    Object.entries(headers).map(([key, value]) => [key, String(value)])
+  );
+}
+
 function readMarketList(): MarketRow[] {
+  if (typeof document === "undefined") {
+    return [];
+  }
+
   const marketRoot = document.querySelector(".base-author-list") as
     | (HTMLElement & {
         __vue__?: {
@@ -102,6 +294,15 @@ function readMarketList(): MarketRow[] {
   return [];
 }
 
+function isMarketSearchRequest(url: string): boolean {
+  return (
+    url === MARKET_SEARCH_REQUEST_PATH ||
+    url.startsWith(`${MARKET_SEARCH_REQUEST_PATH}?`) ||
+    url.includes(`${MARKET_SEARCH_REQUEST_PATH}?`) ||
+    url.endsWith(MARKET_SEARCH_REQUEST_PATH)
+  );
+}
+
 function looksLikeMarketList(value: unknown[]): boolean {
   const firstRow = value[0];
   return isRecord(firstRow) && ("star_id" in firstRow || "attribute_datas" in firstRow);

src/content/market/plugin-toolbar.ts

@@ -1,74 +1,49 @@
-import type { MarketExportScope, MarketExportTarget } from "./types";
+import type {
+  MarketExportScope,
+  MarketExportTarget
+} from "./types";
 
 export interface PluginToolbarHandlers {
-  onApplyFilter(): Promise<void> | void;
-  onApplySort(): Promise<void> | void;
   onExport(): Promise<void> | void;
+  onSubmitBatch(): Promise<void> | void;
 }
 
 export interface PluginToolbarDom {
+  batchSubmitButton: HTMLButtonElement;
   exportButton: HTMLButtonElement;
   exportCustomPagesInput: HTMLInputElement;
   exportRangeSelect: HTMLSelectElement;
   exportStatusText: HTMLElement;
-  filterApplyButton: HTMLButtonElement;
-  personalFilterInput: HTMLInputElement;
   root: HTMLElement;
-  singleFilterInput: HTMLInputElement;
+}
-  sortApplyButton: HTMLButtonElement;
+
-  sortDirectionSelect: HTMLSelectElement;
+const PLUGIN_ACTION_BUTTON_STYLE_ID = "sces-plugin-action-button-style";
-  sortFieldSelect: HTMLSelectElement;
+
+export function isPluginToolbarMounted(
+  root: HTMLElement,
+  document: Document
+): boolean {
+  const actionRow = findNativeActionRow(document);
+  return Boolean(actionRow && root.parentElement === actionRow && !root.hidden);
 }
 
 export function ensurePluginToolbar(
   document: Document,
   handlers: PluginToolbarHandlers
 ): PluginToolbarDom {
+  ensurePluginActionButtonTheme(document);
+
   const existingRoot = document.querySelector(
     "[data-plugin-toolbar='root']"
   ) as HTMLElement | null;
   if (existingRoot) {
+    ensureToolbarMounted(existingRoot, document);
     return readToolbarDom(existingRoot);
   }
 
   const root = document.createElement("section");
   root.dataset.pluginToolbar = "root";
-
+  applyToolbarRootStyles(root);
-  const singleFilterInput = document.createElement("input");
-  singleFilterInput.type = "number";
-  singleFilterInput.step = "0.01";
-  singleFilterInput.dataset.pluginFilterSingle = "input";
-
-  const personalFilterInput = document.createElement("input");
-  personalFilterInput.type = "number";
-  personalFilterInput.step = "0.01";
-  personalFilterInput.dataset.pluginFilterPersonal = "input";
-
-  const filterApplyButton = document.createElement("button");
-  filterApplyButton.type = "button";
-  filterApplyButton.dataset.pluginFilterApply = "button";
-  filterApplyButton.textContent = "应用筛选";
-
-  const sortFieldSelect = document.createElement("select");
-  sortFieldSelect.dataset.pluginSortField = "select";
-  appendOption(sortFieldSelect, "", "不排序");
-  appendOption(sortFieldSelect, "singleVideoAfterSearchRate", "单视频看后搜率");
-  appendOption(sortFieldSelect, "personalVideoAfterSearchRate", "个人视频看后搜率");
-
-  const sortDirectionSelect = document.createElement("select");
-  sortDirectionSelect.dataset.pluginSortDirection = "select";
-  appendOption(sortDirectionSelect, "desc", "降序");
-  appendOption(sortDirectionSelect, "asc", "升序");
-
-  const sortApplyButton = document.createElement("button");
-  sortApplyButton.type = "button";
-  sortApplyButton.dataset.pluginSortApply = "button";
-  sortApplyButton.textContent = "应用排序";
-
-  const exportButton = document.createElement("button");
-  exportButton.type = "button";
-  exportButton.dataset.pluginExport = "button";
-  exportButton.textContent = "导出CSV";
 
   const exportRangeSelect = document.createElement("select");
   exportRangeSelect.dataset.pluginExportRange = "select";
@@ -84,62 +59,64 @@ export function ensurePluginToolbar(
   exportCustomPagesInput.min = "1";
   exportCustomPagesInput.step = "1";
   exportCustomPagesInput.hidden = true;
+  exportCustomPagesInput.placeholder = "页数";
   exportCustomPagesInput.dataset.pluginExportCustomPages = "input";
 
+  const exportButton = document.createElement("button");
+  exportButton.type = "button";
+  exportButton.dataset.pluginExport = "button";
+  exportButton.textContent = "导出CSV";
+
+  const batchSubmitButton = document.createElement("button");
+  batchSubmitButton.type = "button";
+  batchSubmitButton.dataset.pluginBatchSubmit = "button";
+  batchSubmitButton.textContent = "提交批次";
+
   const exportStatusText = document.createElement("span");
   exportStatusText.dataset.pluginExportStatus = "text";
+  applyStatusStyles(exportStatusText);
 
   root.append(
-    singleFilterInput,
-    personalFilterInput,
-    filterApplyButton,
-    sortFieldSelect,
-    sortDirectionSelect,
-    sortApplyButton,
     exportRangeSelect,
     exportCustomPagesInput,
-    exportButton
+    exportButton,
+    batchSubmitButton,
+    exportStatusText
   );
-  root.append(exportStatusText);
-  document.body.prepend(root);
 
-  filterApplyButton.addEventListener("click", () => {
+  document.body.appendChild(root);
-    void handlers.onApplyFilter();
+  applyNativeControlStyles(document, {
-  });
+    batchSubmitButton,
-  sortApplyButton.addEventListener("click", () => {
+    exportButton,
-    void handlers.onApplySort();
+    exportCustomPagesInput,
+    exportRangeSelect
   });
+  ensureToolbarMounted(root, document);
+
   exportButton.addEventListener("click", () => {
     void handlers.onExport();
   });
+  batchSubmitButton.addEventListener("click", () => {
+    void handlers.onSubmitBatch();
+  });
   exportRangeSelect.addEventListener("change", () => {
     syncCustomPagesInputVisibility({
+      batchSubmitButton,
       exportButton,
       exportCustomPagesInput,
       exportRangeSelect,
       exportStatusText,
-      filterApplyButton,
+      root
-      personalFilterInput,
-      root,
-      singleFilterInput,
-      sortApplyButton,
-      sortDirectionSelect,
-      sortFieldSelect
     });
   });
 
   const toolbarDom = {
+    batchSubmitButton,
     exportButton,
     exportCustomPagesInput,
     exportRangeSelect,
     exportStatusText,
-    filterApplyButton,
+    root
-    personalFilterInput,
-    root,
-    singleFilterInput,
-    sortApplyButton,
-    sortDirectionSelect,
-    sortFieldSelect
   } satisfies PluginToolbarDom;
   syncCustomPagesInputVisibility(toolbarDom);
 
@@ -159,6 +136,9 @@ function appendOption(
 
 function readToolbarDom(root: HTMLElement): PluginToolbarDom {
   const toolbarDom = {
+    batchSubmitButton: root.querySelector(
+      '[data-plugin-batch-submit="button"]'
+    ) as HTMLButtonElement,
     exportButton: root.querySelector(
       '[data-plugin-export="button"]'
     ) as HTMLButtonElement,
@@ -171,25 +151,7 @@ function readToolbarDom(root: HTMLElement): PluginToolbarDom {
     exportStatusText: root.querySelector(
       '[data-plugin-export-status="text"]'
     ) as HTMLElement,
-    filterApplyButton: root.querySelector(
+    root
-      '[data-plugin-filter-apply="button"]'
-    ) as HTMLButtonElement,
-    personalFilterInput: root.querySelector(
-      '[data-plugin-filter-personal="input"]'
-    ) as HTMLInputElement,
-    root,
-    singleFilterInput: root.querySelector(
-      '[data-plugin-filter-single="input"]'
-    ) as HTMLInputElement,
-    sortApplyButton: root.querySelector(
-      '[data-plugin-sort-apply="button"]'
-    ) as HTMLButtonElement,
-    sortDirectionSelect: root.querySelector(
-      '[data-plugin-sort-direction="select"]'
-    ) as HTMLSelectElement,
-    sortFieldSelect: root.querySelector(
-      '[data-plugin-sort-field="select"]'
-    ) as HTMLSelectElement
   } satisfies PluginToolbarDom;
   syncCustomPagesInputVisibility(toolbarDom);
   return toolbarDom;
@@ -255,13 +217,8 @@ export function setToolbarBusyState(
   isBusy: boolean
 ): void {
   [
+    toolbar.batchSubmitButton,
     toolbar.exportButton,
-    toolbar.filterApplyButton,
-    toolbar.sortApplyButton,
-    toolbar.singleFilterInput,
-    toolbar.personalFilterInput,
-    toolbar.sortFieldSelect,
-    toolbar.sortDirectionSelect,
     toolbar.exportRangeSelect,
     toolbar.exportCustomPagesInput
   ].forEach((element) => {
@@ -280,3 +237,317 @@ function syncCustomPagesInputVisibility(toolbar: PluginToolbarDom): void {
   toolbar.exportCustomPagesInput.hidden =
     toolbar.exportRangeSelect.value !== "custom";
 }
+
+function ensureToolbarMounted(root: HTMLElement, document: Document): void {
+  const actionRow = findNativeActionRow(document);
+  if (!actionRow) {
+    root.hidden = true;
+    return;
+  }
+
+  const customizeButton = findNativeActionButton(actionRow, "自定义指标");
+  const insertionAnchor = customizeButton
+    ? findDirectChildAnchor(actionRow, customizeButton)
+    : null;
+  if (insertionAnchor) {
+    actionRow.insertBefore(root, insertionAnchor);
+  } else if (root.parentElement !== actionRow) {
+    actionRow.prepend(root);
+  }
+
+  root.hidden = false;
+}
+
+function findNativeActionRow(document: Document): HTMLElement | null {
+  const customizeButton = findNativeActionButton(document, "自定义指标");
+  const exportButton = findNativeActionButton(document, "导出");
+  const header = findHeaderContainer(customizeButton, exportButton);
+
+  const sharedActionRow =
+    customizeButton && exportButton
+      ? findSmallestSharedActionRow(customizeButton, exportButton, header)
+      : null;
+  if (sharedActionRow) {
+    return sharedActionRow;
+  }
+
+  const scope = header ?? document;
+  const candidates = Array.from(
+    scope.querySelectorAll(".xt-space.xt-space--medium, .search-content--header")
+  ).filter((element): element is HTMLElement =>
+    element instanceof document.defaultView!.HTMLElement
+  );
+
+  const rankedCandidates = candidates
+    .filter((candidate) =>
+      isNativeActionRowCandidate(candidate, customizeButton, exportButton)
+    )
+    .sort((left, right) => {
+      const depthDelta = getDepthWithinAncestor(right, header) - getDepthWithinAncestor(left, header);
+      if (depthDelta !== 0) {
+        return depthDelta;
+      }
+
+      return normalizeText(left.textContent).length - normalizeText(right.textContent).length;
+    });
+
+  return rankedCandidates[0] ?? null;
+}
+
+function findHeaderContainer(
+  customizeButton: HTMLElement | null,
+  exportButton: HTMLElement | null
+): HTMLElement | null {
+  return (
+    (customizeButton?.closest(".search-content--header") as HTMLElement | null) ??
+    (exportButton?.closest(".search-content--header") as HTMLElement | null)
+  );
+}
+
+function findSmallestSharedActionRow(
+  customizeButton: HTMLElement,
+  exportButton: HTMLElement,
+  boundary: HTMLElement | null
+): HTMLElement | null {
+  const exportAncestors = new Set(collectAncestorChain(exportButton, boundary));
+
+  for (const candidate of collectAncestorChain(customizeButton, boundary)) {
+    if (
+      exportAncestors.has(candidate) &&
+      isNativeActionRowCandidate(candidate, customizeButton, exportButton)
+    ) {
+      return candidate;
+    }
+  }
+
+  return null;
+}
+
+function collectAncestorChain(
+  element: HTMLElement,
+  boundary: HTMLElement | null
+): HTMLElement[] {
+  const ancestors: HTMLElement[] = [];
+  let current: HTMLElement | null = element.parentElement;
+
+  while (current) {
+    ancestors.push(current);
+    if (current === boundary) {
+      break;
+    }
+    current = current.parentElement;
+  }
+
+  return ancestors;
+}
+
+function isNativeActionRowCandidate(
+  candidate: HTMLElement,
+  customizeButton: HTMLElement | null,
+  exportButton: HTMLElement | null
+): boolean {
+  if (customizeButton && !candidate.contains(customizeButton)) {
+    return false;
+  }
+
+  if (exportButton && !candidate.contains(exportButton)) {
+    return false;
+  }
+
+  const directChildLabels = Array.from(candidate.children)
+    .flatMap((child) => {
+      const buttons: Element[] = [];
+      if (child instanceof candidate.ownerDocument.defaultView!.HTMLButtonElement) {
+        buttons.push(child);
+      }
+
+      buttons.push(...Array.from(child.querySelectorAll("button")));
+      return buttons;
+    })
+    .map((button) => normalizeText(button.textContent));
+  return (
+    directChildLabels.includes("导出") &&
+    (directChildLabels.includes("自定义指标") || Boolean(customizeButton))
+  );
+}
+
+function getDepthWithinAncestor(
+  element: HTMLElement,
+  boundary: HTMLElement | null
+): number {
+  let depth = 0;
+  let current: HTMLElement | null = element.parentElement;
+
+  while (current && current !== boundary) {
+    depth += 1;
+    current = current.parentElement;
+  }
+
+  return depth;
+}
+
+function findNativeActionButton(
+  root: ParentNode,
+  text: string
+): HTMLElement | null {
+  const document = root instanceof Document ? root : root.ownerDocument;
+  if (!document) {
+    return null;
+  }
+
+  const candidates = Array.from(root.querySelectorAll("button")).filter(
+    (element): element is HTMLElement =>
+      element instanceof document.defaultView!.HTMLElement
+  );
+  return (
+    candidates.find((element) => normalizeText(element.textContent) === text) ?? null
+  );
+}
+
+function applyToolbarRootStyles(root: HTMLElement): void {
+  root.style.display = "inline-flex";
+  root.style.alignItems = "center";
+  root.style.columnGap = "8px";
+  root.style.flexWrap = "wrap";
+}
+
+function applyNativeControlStyles(
+  document: Document,
+  controls: {
+    batchSubmitButton: HTMLButtonElement;
+    exportButton: HTMLButtonElement;
+    exportCustomPagesInput: HTMLInputElement;
+    exportRangeSelect: HTMLSelectElement;
+  }
+): void {
+  const primaryButton =
+    findButtonContainingText(document, "发布任务") ??
+    findButtonContainingText(document, "+发布任务");
+  const nativeButton =
+    primaryButton ??
+    findNativeActionButton(document, "自定义指标") ??
+    findNativeActionButton(document, "导出");
+
+  if (nativeButton) {
+    controls.exportButton.className = nativeButton.className;
+    controls.batchSubmitButton.className = nativeButton.className;
+  }
+
+  [controls.exportButton, controls.batchSubmitButton].forEach((button) => {
+    applyPrimaryButtonStyles(button);
+    button.style.whiteSpace = "nowrap";
+  });
+
+  [controls.exportRangeSelect, controls.exportCustomPagesInput].forEach((element) => {
+    element.style.height = "32px";
+    element.style.border = "1px solid #d0d7de";
+    element.style.borderRadius = "6px";
+    element.style.padding = "0 10px";
+    element.style.background = "#fff";
+    element.style.color = "#1f2329";
+    element.style.boxSizing = "border-box";
+  });
+
+  controls.exportRangeSelect.style.minWidth = "104px";
+  controls.exportCustomPagesInput.style.width = "72px";
+}
+
+function applyPrimaryButtonStyles(
+  button: HTMLButtonElement
+): void {
+  button.style.backgroundColor = "#7f1d2d";
+  button.style.border = "1px solid #7f1d2d";
+  button.style.borderRadius = "8px";
+  button.style.color = "#ffffff";
+  button.style.height = "32px";
+  button.style.padding = "0 15px";
+  button.style.boxSizing = "border-box";
+  button.style.fontWeight = "600";
+  button.style.transition =
+    "background-color 0.16s ease, border-color 0.16s ease, box-shadow 0.16s ease, transform 0.16s ease";
+}
+
+function applyStatusStyles(statusText: HTMLElement): void {
+  statusText.style.color = "#64748b";
+  statusText.style.fontSize = "12px";
+  statusText.style.lineHeight = "20px";
+  statusText.style.marginLeft = "4px";
+  statusText.style.whiteSpace = "nowrap";
+}
+
+function ensurePluginActionButtonTheme(document: Document): void {
+  if (document.getElementById(PLUGIN_ACTION_BUTTON_STYLE_ID)) {
+    return;
+  }
+
+  const style = document.createElement("style");
+  style.id = PLUGIN_ACTION_BUTTON_STYLE_ID;
+  style.textContent = `
+    [data-plugin-export="button"]:hover:not(:disabled),
+    [data-plugin-batch-submit="button"]:hover:not(:disabled) {
+      background-color: #6d1627 !important;
+      border-color: #6d1627 !important;
+    }
+
+    [data-plugin-export="button"]:active:not(:disabled),
+    [data-plugin-batch-submit="button"]:active:not(:disabled) {
+      background-color: #58111f !important;
+      border-color: #58111f !important;
+      transform: translateY(1px);
+    }
+
+    [data-plugin-export="button"]:focus-visible,
+    [data-plugin-batch-submit="button"]:focus-visible {
+      outline: none !important;
+      box-shadow: 0 0 0 3px rgba(127, 29, 45, 0.2) !important;
+    }
+
+    [data-plugin-export="button"]:disabled,
+    [data-plugin-batch-submit="button"]:disabled {
+      background-color: #c89ca4 !important;
+      border-color: #c89ca4 !important;
+      color: rgba(255, 255, 255, 0.95) !important;
+      cursor: not-allowed !important;
+      opacity: 1 !important;
+      transform: none !important;
+      box-shadow: none !important;
+    }
+  `;
+  document.head.appendChild(style);
+}
+
+function normalizeText(value: string | null | undefined): string {
+  return value?.replace(/\s+/g, " ").trim() ?? "";
+}
+
+function findButtonContainingText(
+  root: ParentNode,
+  text: string
+): HTMLElement | null {
+  const document = root instanceof Document ? root : root.ownerDocument;
+  if (!document) {
+    return null;
+  }
+
+  const candidates = Array.from(root.querySelectorAll("button")).filter(
+    (element): element is HTMLElement =>
+      element instanceof document.defaultView!.HTMLElement
+  );
+
+  return candidates.find((element) => normalizeText(element.textContent).includes(text)) ?? null;
+}
+
+function findDirectChildAnchor(
+  ancestor: HTMLElement,
+  descendant: HTMLElement
+): HTMLElement | null {
+  let current: HTMLElement | null = descendant;
+  let previous: HTMLElement | null = null;
+
+  while (current && current !== ancestor) {
+    previous = current;
+    current = current.parentElement;
+  }
+
+  return current === ancestor ? previous : null;
+}

src/content/market/result-store.ts

@@ -1,4 +1,5 @@
 import type {
+  BackendMetrics,
   MarketApiFailureReason,
   MarketRecord,
   MarketRowSnapshot
@@ -25,6 +26,26 @@ export function createMarketResultStore() {
       existingRecord.status = "loading";
       delete existingRecord.failureReason;
     },
+    setBackendMetricsFailed(authorId: string) {
+      const existingRecord = ensureRecord(authorId);
+      existingRecord.backendMetricsStatus = "failed";
+    },
+    setBackendMetricsLoading(authorId: string) {
+      const existingRecord = ensureRecord(authorId);
+      existingRecord.backendMetricsStatus = "loading";
+    },
+    setBackendMetricsMissing(authorId: string) {
+      const existingRecord = ensureRecord(authorId);
+      existingRecord.backendMetricsStatus = "missing";
+    },
+    setBackendMetricsSuccess(authorId: string, backendMetrics: BackendMetrics) {
+      const existingRecord = ensureRecord(authorId);
+      existingRecord.backendMetricsStatus = "success";
+      existingRecord.backendMetrics = {
+        ...existingRecord.backendMetrics,
+        ...backendMetrics
+      };
+    },
     setAuthorSuccess(authorId: string, rates: AfterSearchRates) {
       const existingRecord = ensureRecord(authorId);
       existingRecord.status = "success";
@@ -52,6 +73,10 @@ export function createMarketResultStore() {
         existingRecord.exportFields,
           row.exportFields
         );
+        existingRecord.backendMetrics = mergeFieldMap(
+          existingRecord.backendMetrics,
+          row.backendMetrics
+        );
         existingRecord.hasDirectRatesSource =
           existingRecord.hasDirectRatesSource || row.hasDirectRatesSource;
         existingRecord.rates = mergeFieldMap(existingRecord.rates, row.rates);
@@ -60,6 +85,7 @@ export function createMarketResultStore() {
 
     const nextRecord: MarketRecord = {
       ...row,
+      backendMetricsStatus: "idle",
       status: "idle"
     };
       records.set(row.authorId, nextRecord);
@@ -76,6 +102,7 @@ export function createMarketResultStore() {
     const nextRecord: MarketRecord = {
       authorId,
       authorName: authorId,
+      backendMetricsStatus: "idle",
       status: "idle"
     };
     records.set(authorId, nextRecord);

src/content/market/silent-export-controller.ts

@@ -0,0 +1,401 @@
+import {
+  readMarketListRequestSnapshot,
+  type MarketListRequestSnapshot
+} from "./market-list-request-snapshot";
+import {
+  parseMarketListResponse,
+  readKnownPaginationNumber
+} from "./market-list-row";
+import type { MarketExportTarget, MarketRecord } from "./types";
+
+interface FetchResponseLike {
+  json(): Promise<unknown>;
+  ok: boolean;
+}
+
+type FetchLike = (input: string, init?: RequestInit) => Promise<FetchResponseLike>;
+
+interface SilentExportControllerOptions {
+  document: Document;
+  fetchImpl?: FetchLike;
+  onProgress?: (state: { currentPage: number; totalPages?: number }) => void;
+}
+
+type PageSource = "body" | "none" | "url";
+
+const PAGE_NUMBER_KEYS = [
+  "currentPage",
+  "page",
+  "pageNo",
+  "pageNum",
+  "page_no",
+  "page_num"
+] as const;
+
+export function createSilentExportController(
+  options: SilentExportControllerOptions
+) {
+  const fetchImpl = options.fetchImpl ?? defaultFetch;
+
+  return {
+    async exportRecords(target: MarketExportTarget): Promise<MarketRecord[] | null> {
+      const snapshot = readMarketListRequestSnapshot(options.document);
+      if (!snapshot) {
+        return null;
+      }
+
+      const baseRequest = createPagedRequest(snapshot);
+      if (!baseRequest) {
+        return null;
+      }
+
+      const mergedRecords = new Map<string, MarketRecord>();
+      const maxPageCount = target.mode === "count" ? target.pageCount : 200;
+      let totalPagesHint: number | undefined;
+
+      for (let offset = 0; offset < maxPageCount; offset += 1) {
+        const pageNumber = baseRequest.initialPage + offset;
+        options.onProgress?.({
+          currentPage: offset + 1,
+          totalPages: target.mode === "count" ? target.pageCount : totalPagesHint
+        });
+
+        const payload = await fetchPagePayload(fetchImpl, baseRequest, pageNumber);
+        const parsedResponse = parseMarketListResponse(payload);
+        if (!parsedResponse) {
+          return null;
+        }
+
+        totalPagesHint = parsedResponse.totalPages ?? totalPagesHint;
+        if (parsedResponse.records.length === 0) {
+          break;
+        }
+
+        parsedResponse.records.forEach((record) => {
+          const existingRecord = mergedRecords.get(record.authorId);
+          mergedRecords.set(record.authorId, mergeMarketRecord(existingRecord, record));
+        });
+
+        if (target.mode === "count" && offset + 1 >= target.pageCount) {
+          break;
+        }
+
+        if (target.mode === "all") {
+          if (
+            typeof parsedResponse.totalPages === "number" &&
+            pageNumber >= parsedResponse.totalPages
+          ) {
+            break;
+          }
+
+          if (
+            typeof parsedResponse.pageSize === "number" &&
+            parsedResponse.records.length < parsedResponse.pageSize
+          ) {
+            break;
+          }
+        }
+      }
+
+      return Array.from(mergedRecords.values());
+    }
+  };
+}
+
+function createPagedRequest(
+  snapshot: MarketListRequestSnapshot
+): {
+  initialPage: number;
+  pageSource: PageSource;
+  snapshot: MarketListRequestSnapshot;
+} {
+  const bodyPage = readPageFromBody(snapshot.body);
+  if (bodyPage !== null) {
+    return {
+      initialPage: bodyPage,
+      pageSource: "body",
+      snapshot
+    };
+  }
+
+  const urlPage = readPageFromUrl(snapshot.url);
+  if (urlPage !== null) {
+    return {
+      initialPage: urlPage,
+      pageSource: "url",
+      snapshot
+    };
+  }
+
+  return {
+    initialPage: 1,
+    pageSource: "none",
+    snapshot
+  };
+}
+
+async function fetchPagePayload(
+  fetchImpl: FetchLike,
+  request: {
+    pageSource: PageSource;
+    snapshot: MarketListRequestSnapshot;
+  },
+  pageNumber: number
+): Promise<unknown> {
+  const nextUrl =
+    request.pageSource === "url"
+      ? mutateUrlPage(request.snapshot.url, pageNumber)
+      : request.snapshot.url;
+  const nextBody = mutateBodyPage(request.snapshot.body, pageNumber);
+
+  const response = await fetchImpl(nextUrl, {
+    body: nextBody,
+    credentials: "include",
+    headers: filterReplayHeaders(request.snapshot.headers, nextBody),
+    method: request.snapshot.method
+  });
+  if (!response.ok) {
+    throw new Error("静默导出请求失败");
+  }
+
+  return response.json();
+}
+
+function readPageFromUrl(url: string): number | null {
+  try {
+    const parsedUrl = new URL(url);
+    for (const key of PAGE_NUMBER_KEYS) {
+      const value = readNumericString(parsedUrl.searchParams.get(key));
+      if (value !== null) {
+        return value;
+      }
+    }
+  } catch {
+    return null;
+  }
+
+  return null;
+}
+
+function mutateUrlPage(url: string, pageNumber: number): string {
+  try {
+    const parsedUrl = new URL(url);
+    for (const key of PAGE_NUMBER_KEYS) {
+      if (!parsedUrl.searchParams.has(key)) {
+        continue;
+      }
+
+      parsedUrl.searchParams.set(key, String(pageNumber));
+      return parsedUrl.toString();
+    }
+
+    parsedUrl.searchParams.set("page", String(pageNumber));
+    return parsedUrl.toString();
+  } catch {
+    return url;
+  }
+}
+
+function readPageFromBody(body: string | undefined): number | null {
+  const parsedBody = parseBody(body);
+  if (!parsedBody) {
+    return null;
+  }
+
+  return readKnownPaginationNumber(parsedBody, "page");
+}
+
+function mutateBodyPage(body: string | undefined, pageNumber: number): string | undefined {
+  if (!body) {
+    return body;
+  }
+
+  const trimmedBody = body.trim();
+  if (!trimmedBody) {
+    return body;
+  }
+
+  try {
+    const parsedJson = JSON.parse(trimmedBody);
+    if (!replacePageNumberInValue(parsedJson, pageNumber) && isRecord(parsedJson)) {
+      parsedJson.page = pageNumber;
+    }
+
+    return JSON.stringify(parsedJson);
+  } catch {
+    const searchParams = new URLSearchParams(trimmedBody);
+    for (const key of PAGE_NUMBER_KEYS) {
+      if (!searchParams.has(key)) {
+        continue;
+      }
+
+      searchParams.set(key, String(pageNumber));
+      return searchParams.toString();
+    }
+
+    searchParams.set("page", String(pageNumber));
+    return searchParams.toString();
+  }
+}
+
+function parseBody(body: string | undefined): Record<string, unknown> | null {
+  if (!body) {
+    return null;
+  }
+
+  const trimmedBody = body.trim();
+  if (!trimmedBody) {
+    return null;
+  }
+
+  try {
+    const parsedBody = JSON.parse(trimmedBody);
+    return isRecord(parsedBody) ? parsedBody : null;
+  } catch {
+    const searchParams = new URLSearchParams(trimmedBody);
+    const payload: Record<string, unknown> = {};
+    searchParams.forEach((value, key) => {
+      payload[key] = value;
+    });
+    return payload;
+  }
+}
+
+function replacePageNumberInValue(value: unknown, pageNumber: number): boolean {
+  if (!isRecord(value)) {
+    return false;
+  }
+
+  let replaced = false;
+  PAGE_NUMBER_KEYS.forEach((key) => {
+    if (!(key in value)) {
+      return;
+    }
+
+    value[key] = pageNumber;
+    replaced = true;
+  });
+
+  if (replaced) {
+    return true;
+  }
+
+  return Object.values(value).some((entry) => replacePageNumberInValue(entry, pageNumber));
+}
+
+function filterReplayHeaders(
+  headers: Record<string, string> | undefined,
+  body: string | undefined
+): HeadersInit | undefined {
+  const filteredHeaders = Object.fromEntries(
+    Object.entries(headers ?? {}).filter(([key]) => {
+      const normalizedKey = key.toLowerCase();
+      return normalizedKey !== "content-length" && normalizedKey !== "host";
+    })
+  );
+
+  if (body) {
+    if (!hasHeader(filteredHeaders, "accept")) {
+      filteredHeaders.Accept = "application/json, text/plain, */*";
+    }
+    if (!hasHeader(filteredHeaders, "content-type")) {
+      filteredHeaders["Content-Type"] = "application/json";
+    }
+    if (!hasHeader(filteredHeaders, "x-login-source")) {
+      filteredHeaders["x-login-source"] = "1";
+    }
+    if (!hasHeader(filteredHeaders, "agw-js-conv")) {
+      filteredHeaders["Agw-Js-Conv"] = "str";
+    }
+  }
+
+  return Object.keys(filteredHeaders).length > 0 ? filteredHeaders : undefined;
+}
+
+function hasHeader(headers: Record<string, string>, key: string): boolean {
+  return Object.keys(headers).some((headerKey) => headerKey.toLowerCase() === key);
+}
+
+function readNumericString(value: string | null): number | null {
+  if (!value) {
+    return null;
+  }
+
+  const parsedValue = Number(value);
+  return Number.isFinite(parsedValue) ? parsedValue : null;
+}
+
+async function defaultFetch(input: string, init?: RequestInit) {
+  return fetch(input, init);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function mergeMarketRecord(
+  existingRecord: MarketRecord | undefined,
+  incomingRecord: MarketRecord
+): MarketRecord {
+  if (!existingRecord) {
+    return {
+      ...incomingRecord,
+      exportFields: mergeFieldMap(undefined, incomingRecord.exportFields),
+      rates: mergeFieldMap(undefined, incomingRecord.rates),
+      status: incomingRecord.status ?? "idle"
+    };
+  }
+
+  return {
+    ...existingRecord,
+    ...incomingRecord,
+    authorName: mergeStringValue(existingRecord.authorName, incomingRecord.authorName) ?? "",
+    exportFields: mergeFieldMap(
+      existingRecord.exportFields,
+      incomingRecord.exportFields
+    ),
+    failureReason: incomingRecord.failureReason ?? existingRecord.failureReason,
+    hasDirectRatesSource:
+      existingRecord.hasDirectRatesSource || incomingRecord.hasDirectRatesSource,
+    location: mergeStringValue(existingRecord.location, incomingRecord.location),
+    price21To60s: mergeStringValue(
+      existingRecord.price21To60s,
+      incomingRecord.price21To60s
+    ),
+    rates: mergeFieldMap(existingRecord.rates, incomingRecord.rates),
+    status: incomingRecord.status ?? existingRecord.status
+  };
+}
+
+function mergeFieldMap<T extends Record<string, string | undefined>>(
+  current: T | undefined,
+  incoming: T | undefined
+): T | undefined {
+  if (!current && !incoming) {
+    return undefined;
+  }
+
+  const merged = {
+    ...(current ?? {})
+  } as Record<string, string | undefined>;
+
+  Object.entries(incoming ?? {}).forEach(([key, value]) => {
+    const currentValue = merged[key];
+    if (hasTextValue(value) || !hasTextValue(currentValue)) {
+      merged[key] = value;
+    }
+  });
+
+  return merged as T;
+}
+
+function mergeStringValue(
+  current: string | undefined,
+  incoming: string | undefined
+): string | undefined {
+  return hasTextValue(incoming) ? incoming : current;
+}
+
+function hasTextValue(value: string | undefined): boolean {
+  return Boolean(value && value.trim().length > 0);
+}

src/content/market/types.ts

@@ -3,11 +3,25 @@ export interface AfterSearchRates {
   singleVideoAfterSearchRate?: string;
 }
 
+export interface BackendMetrics {
+  a3IncreaseCount?: string;
+  afterViewSearchCount?: string;
+  afterViewSearchRate?: string;
+  cpSearch?: string;
+  cpa3?: string;
+  newA3Rate?: string;
+}
+
+export type MarketSortField =
+  | keyof Required<AfterSearchRates>
+  | keyof Required<BackendMetrics>;
+
 export type MarketRecordStatus = "idle" | "loading" | "success" | "failed" | "missing";
 
 export interface MarketRowSnapshot {
   authorId: string;
   authorName: string;
+  backendMetrics?: BackendMetrics;
   exportFields?: Record<string, string>;
   hasDirectRatesSource?: boolean;
   location?: string;
@@ -16,6 +30,7 @@ export interface MarketRowSnapshot {
 }
 
 export interface MarketRecord extends MarketRowSnapshot {
+  backendMetricsStatus?: MarketRecordStatus;
   status: MarketRecordStatus;
   failureReason?: MarketApiFailureReason;
 }
@@ -38,7 +53,7 @@ export type MarketExportTarget =
 
 export interface MarketSortState {
   direction: "asc" | "desc";
-  field: keyof Required<AfterSearchRates>;
+  field: MarketSortField;
 }
 
 export type MarketApiFailureReason =
@@ -49,7 +64,7 @@ export type MarketApiFailureReason =
 
 export type MarketApiSuccessResult = {
   success: true;
-  rates: Required<AfterSearchRates>;
+  rates: AfterSearchRates;
 };
 
 export type MarketApiFailureResult = {

src/manifest.json

@@ -3,7 +3,27 @@
   "name": "Star Chart Search Enhancer",
   "version": "0.2.0421.2",
   "description": "Bootstraps the Xingtu creator market content script.",
-  "permissions": ["downloads"],
+  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0CaZJxcX97TbRXCR08L10t9EZFV31+wPnUgDf21j2f0qYaWdblzWXfVkeU9jGb2Hr2Etpp7F/XuBa6pcipUXkzMMBkJ42KOkciAwbuzTBoAtGB8o9aoWigtax+gGfSz+T3BjqxKBJtXqeqbIAKCDIlxRKIrY+KcY1Z+mD5BKcBHKsUDQPlHsrjc1g0wIBD5doz9LoOk1Wso6gK5cSeOp9lw5YHcu4TImR4yqxGiL6pZwnpciuX/g7qjWBZXn5gf0YBlDsBDDTt5upbP3NguUKgO2qA9M77LyeUwXl3aqbIxYi/VwsQ2t5w9PGWtnOUQQDWUcEg/9dfTb89esZXKATwIDAQAB",
+  "permissions": ["downloads", "identity", "storage"],
+  "icons": {
+    "16": "assets/icons/icon-16.png",
+    "32": "assets/icons/icon-32.png",
+    "48": "assets/icons/icon-48.png",
+    "128": "assets/icons/icon-128.png"
+  },
+  "host_permissions": [
+    "http://*/*",
+    "https://login-api.intelligrow.cn/*",
+    "http://127.0.0.1:4319/*",
+    "https://*/*"
+  ],
+  "action": {
+    "default_icon": {
+      "16": "assets/icons/icon-16.png",
+      "32": "assets/icons/icon-32.png"
+    },
+    "default_popup": "popup/index.html"
+  },
   "background": {
     "service_worker": "background/index.js"
   },
@@ -14,7 +34,7 @@
         "https://*.xingtu.cn/ad/creator/market*"
       ],
       "js": ["content/index.js"],
-      "run_at": "document_idle"
+      "run_at": "document_start"
     }
   ],
   "web_accessible_resources": [

src/popup/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Star Chart Search Enhancer</title>
+  </head>
+  <body>
+    <main id="app"></main>
+    <script src="./index.js"></script>
+  </body>
+</html>

src/popup/index.ts

@@ -0,0 +1,155 @@
+import {
+  renderDevPanel,
+  renderLoggedIn,
+  renderLoggedOut,
+  setProtectedApiResult
+} from "./view";
+import { readAuthConfig, type AuthConfig } from "../shared/auth-config";
+import {
+  isAuthResponseMessage,
+  type AuthResponseMessage
+} from "../shared/auth-messages";
+import { createProtectedApiClient } from "../shared/protected-api-client";
+
+interface BootPopupOptions {
+  config?: Partial<AuthConfig>;
+  document?: Document;
+  fetchProtectedApi?: () => Promise<unknown>;
+  sendMessage?: (message: unknown) => Promise<unknown>;
+}
+
+export async function bootPopup(options: BootPopupOptions = {}): Promise<void> {
+  const currentDocument = options.document ?? document;
+  const popupConfig = readAuthConfig(options.config);
+  const root = currentDocument.querySelector("#app");
+  const HTMLElementCtor = currentDocument.defaultView?.HTMLElement;
+
+  if (!root || (HTMLElementCtor && !(root instanceof HTMLElementCtor))) {
+    throw new Error("popup root #app is required");
+  }
+
+  const sendMessage =
+    options.sendMessage ??
+    ((message: unknown) =>
+      Promise.resolve(
+        (
+          globalThis as typeof globalThis & {
+            chrome?: {
+              runtime?: {
+                sendMessage?: (payload: unknown) => Promise<unknown>;
+              };
+            };
+          }
+        ).chrome?.runtime?.sendMessage?.(message)
+      ));
+  const fetchProtectedApi =
+    options.fetchProtectedApi ??
+    createProtectedApiClient({
+      baseUrl: "http://127.0.0.1:4319",
+      sendMessage
+    }).loadProtectedMockData;
+
+  await renderCurrentAuthState(root, popupConfig, sendMessage, fetchProtectedApi);
+}
+
+async function renderCurrentAuthState(
+  root: HTMLElement,
+  popupConfig: AuthConfig,
+  sendMessage: (message: unknown) => Promise<unknown>,
+  fetchProtectedApi: () => Promise<unknown>
+): Promise<void> {
+  const response = await sendMessage({ type: "auth:get-state" });
+  if (!isAuthResponseMessage(response) || !response.ok || response.type !== "auth:state") {
+    renderLoggedOut(root, "认证状态读取失败");
+    return;
+  }
+
+  if (!response.value.isAuthenticated) {
+    renderLoggedOut(root, response.value.lastError);
+    root
+      .querySelector('[data-popup-sign-in="button"]')
+      ?.addEventListener("click", () => {
+        void runAuthAction(root, popupConfig, sendMessage, {
+          actionMessage: { type: "auth:sign-in" },
+          fetchProtectedApi
+        });
+      });
+    return;
+  }
+
+  renderLoggedIn(root, response.value);
+  root
+    .querySelector('[data-popup-sign-out="button"]')
+    ?.addEventListener("click", () => {
+        void runAuthAction(root, popupConfig, sendMessage, {
+          actionMessage: { type: "auth:sign-out" },
+          fetchProtectedApi
+        });
+    });
+  if (popupConfig.enableDevAuthPanel) {
+    renderDevPanel(root, response.value);
+    root
+      .querySelector('[data-popup-test-protected-api="button"]')
+      ?.addEventListener("click", () => {
+        void runProtectedApiProbe(root, fetchProtectedApi);
+      });
+  }
+}
+
+async function runAuthAction(
+  root: HTMLElement,
+  popupConfig: AuthConfig,
+  sendMessage: (message: unknown) => Promise<unknown>,
+  options: {
+    actionMessage: { type: "auth:sign-in" } | { type: "auth:sign-out" };
+    fetchProtectedApi: () => Promise<unknown>;
+  }
+): Promise<void> {
+  const response = await sendMessage(options.actionMessage);
+
+  if (isActionError(response)) {
+    renderLoggedOut(root, response.error);
+    root
+      .querySelector('[data-popup-sign-in="button"]')
+      ?.addEventListener("click", () => {
+        void runAuthAction(root, popupConfig, sendMessage, options);
+      });
+    return;
+  }
+
+  await renderCurrentAuthState(
+    root,
+    popupConfig,
+    sendMessage,
+    options.fetchProtectedApi
+  );
+}
+
+function isActionError(response: unknown): response is Extract<AuthResponseMessage, { ok: false }> {
+  return (
+    isAuthResponseMessage(response) &&
+    !response.ok &&
+    response.type === "auth:error"
+  );
+}
+
+async function runProtectedApiProbe(
+  root: HTMLElement,
+  fetchProtectedApi: () => Promise<unknown>
+): Promise<void> {
+  setProtectedApiResult(root, "请求中...");
+
+  try {
+    const result = await fetchProtectedApi();
+    setProtectedApiResult(root, JSON.stringify(result, null, 2));
+  } catch (error) {
+    setProtectedApiResult(
+      root,
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+}
+
+if (typeof document !== "undefined") {
+  void bootPopup();
+}

src/popup/view.ts

@@ -0,0 +1,60 @@
+import type { AuthStateValue } from "../shared/auth-messages";
+
+export function renderLoggedOut(root: HTMLElement, error?: string | null): void {
+  root.innerHTML = `
+    <section data-popup-state="logged-out">
+      <h1>Star Chart Search Enhancer</h1>
+      <p>登录后才能使用星图增强功能</p>
+      ${error ? `<p data-popup-error="true">${error}</p>` : ""}
+      <button type="button" data-popup-sign-in="button">登录 Logto</button>
+    </section>
+  `;
+}
+
+export function renderLoggedIn(
+  root: HTMLElement,
+  authState: AuthStateValue
+): void {
+  const userInfo = authState.userInfo;
+
+  root.innerHTML = `
+    <section data-popup-state="logged-in">
+      <h1>Star Chart Search Enhancer</h1>
+      <p>已登录</p>
+      <p>${userInfo?.name ?? userInfo?.username ?? "未知用户"}</p>
+      <p>${userInfo?.email ?? ""}</p>
+      <button type="button" data-popup-sign-out="button">退出登录</button>
+    </section>
+  `;
+}
+
+export function renderDevPanel(
+  root: HTMLElement,
+  authState: AuthStateValue
+): void {
+  const panel = root.ownerDocument.createElement("section");
+  panel.dataset.popupDevPanel = "root";
+  panel.innerHTML = `
+    <h2>dev auth panel</h2>
+    <p>resource: ${authState.resource ?? ""}</p>
+    <p>scopes: ${(authState.scopes ?? []).join(", ")}</p>
+    <p>token: ${authState.tokenAvailable ? "available" : "missing"}</p>
+    <p>expires: ${authState.accessTokenExpiresAt ?? "unknown"}</p>
+    <p>error: ${authState.lastError ?? ""}</p>
+    <button type="button" data-popup-test-protected-api="button">测试受保护接口</button>
+    <pre data-popup-protected-api-result="output"></pre>
+  `;
+  root.appendChild(panel);
+}
+
+export function setProtectedApiResult(root: HTMLElement, value: string): void {
+  const output = root.querySelector(
+    '[data-popup-protected-api-result="output"]'
+  );
+
+  if (!output) {
+    return;
+  }
+
+  output.textContent = value;
+}

src/shared/auth-config.ts

@@ -0,0 +1,38 @@
+export interface AuthConfig {
+  apiResource: string;
+  appId: string;
+  enableDevAuthPanel: boolean;
+  logtoEndpoint: string;
+  scopes: string[];
+}
+
+const defaultAuthConfig: AuthConfig = {
+  apiResource: "https://talent-search.intelligrow.cn",
+  appId: "i4jkllbvih0554r4n0fd3",
+  enableDevAuthPanel: false,
+  logtoEndpoint: "https://login-api.intelligrow.cn",
+  scopes: ["openid", "profile", "offline_access", "talent-search:read"]
+};
+
+export function readAuthConfig(
+  overrides: Partial<AuthConfig> = {}
+): AuthConfig {
+  const nextConfig = {
+    ...defaultAuthConfig,
+    ...overrides
+  };
+
+  if (!nextConfig.logtoEndpoint.trim()) {
+    throw new Error("auth config logtoEndpoint is required");
+  }
+
+  if (!nextConfig.appId.trim()) {
+    throw new Error("auth config appId is required");
+  }
+
+  if (!nextConfig.apiResource.trim()) {
+    throw new Error("auth config apiResource is required");
+  }
+
+  return nextConfig;
+}

src/shared/auth-messages.ts

@@ -0,0 +1,84 @@
+export type AuthRequestMessage =
+  | { type: "auth:get-state" }
+  | { type: "auth:sign-in" }
+  | { type: "auth:sign-out" }
+  | { type: "auth:get-access-token" };
+
+export interface AuthStateValue {
+  accessTokenExpiresAt?: number | null;
+  isAuthenticated: boolean;
+  lastError?: string | null;
+  resource?: string | null;
+  scopes?: string[];
+  tokenAvailable?: boolean;
+  userInfo?: {
+    email?: string;
+    name?: string;
+    sub?: string;
+    username?: string;
+  } | null;
+}
+
+export type AuthResponseMessage =
+  | { ok: true; type: "auth:state"; value: AuthStateValue }
+  | { ok: true; type: "auth:token"; value: { accessToken: string } }
+  | { ok: true; type: "auth:ack" }
+  | { ok: false; type: "auth:error"; error: string };
+
+const authRequestTypes = new Set<AuthRequestMessage["type"]>([
+  "auth:get-state",
+  "auth:sign-in",
+  "auth:sign-out",
+  "auth:get-access-token"
+]);
+
+export function isAuthRequestMessage(
+  value: unknown
+): value is AuthRequestMessage {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+
+  const candidate = value as Partial<AuthRequestMessage>;
+  return typeof candidate.type === "string" && authRequestTypes.has(candidate.type);
+}
+
+export function isAuthResponseMessage(
+  value: unknown
+): value is AuthResponseMessage {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+
+  const candidate = value as Partial<AuthResponseMessage>;
+  if (candidate.ok === false) {
+    return candidate.type === "auth:error" && typeof candidate.error === "string";
+  }
+
+  if (candidate.ok !== true || typeof candidate.type !== "string") {
+    return false;
+  }
+
+  if (candidate.type === "auth:ack") {
+    return true;
+  }
+
+  if (candidate.type === "auth:token") {
+    return Boolean(
+      candidate.value &&
+        typeof candidate.value === "object" &&
+        typeof (candidate.value as { accessToken?: unknown }).accessToken === "string"
+    );
+  }
+
+  if (candidate.type === "auth:state") {
+    return Boolean(
+      candidate.value &&
+        typeof candidate.value === "object" &&
+        typeof (candidate.value as { isAuthenticated?: unknown }).isAuthenticated ===
+          "boolean"
+    );
+  }
+
+  return false;
+}

src/shared/backend-metrics-client.ts

@@ -0,0 +1,217 @@
+import { DEFAULT_BACKEND_METRICS_BASE_URL } from "./backend-metrics-config";
+
+export interface BackendMetricsRow {
+  a3IncreaseCount: string;
+  afterViewSearchCount: string;
+  afterViewSearchRate: string;
+  cpSearch: string;
+  cpa3: string;
+  newA3Rate: string;
+  starId: string;
+}
+
+interface FetchResponseLike {
+  json(): Promise<unknown>;
+  ok: boolean;
+}
+
+type FetchLike = (
+  input: string,
+  init?: RequestInit
+) => Promise<FetchResponseLike>;
+
+interface BackendMetricsClientOptions {
+  baseUrl?: string;
+  fetchImpl?: FetchLike;
+  getAccessToken: () => Promise<string>;
+}
+
+export function createBackendMetricsClient(options: BackendMetricsClientOptions) {
+  const baseUrl = options.baseUrl ?? DEFAULT_BACKEND_METRICS_BASE_URL;
+  const fetchImpl = options.fetchImpl ?? defaultFetch;
+
+  return {
+    async searchByStarIds(starIds: string[]): Promise<BackendMetricsRow[]> {
+      const response = await fetchImpl(buildBackendMetricsSearchUrl(baseUrl), {
+        body: JSON.stringify(buildBackendMetricsSearchRequestBody(starIds)),
+        headers: {
+          Authorization: `Bearer ${await options.getAccessToken()}`,
+          "Content-Type": "application/json"
+        },
+        method: "POST"
+      });
+
+      if (!response.ok) {
+        throw new Error("backend metrics request failed");
+      }
+
+      return mapBackendMetricsSearchResponse(await response.json());
+    }
+  };
+}
+
+export function buildBackendMetricsSearchUrl(baseUrl: string): string {
+  return new URL("/api/v1/history/talents/search", baseUrl).toString();
+}
+
+export function buildBackendMetricsSearchRequestBody(starIds: string[]) {
+  return {
+    page: 1,
+    size: Math.max(20, starIds.length),
+    type: "star_id",
+    values: starIds
+  };
+}
+
+export function mapBackendMetricsSearchResponse(payload: unknown): BackendMetricsRow[] {
+  const rows = readResponseRows(payload);
+  if (!rows) {
+    throw new Error("backend metrics response is invalid");
+  }
+
+  return rows.flatMap((row) => {
+    if (!isRecord(row) || typeof row.star_id !== "string") {
+      return [];
+    }
+
+    return [
+      {
+        a3IncreaseCount: formatDecimalValue(
+          readAverageA3IncreaseCount(row)
+        ),
+        afterViewSearchCount: formatDecimalValue(row.avg_after_view_search_cnt),
+        afterViewSearchRate: formatRateValue(row.avg_after_view_search_rate),
+        cpSearch: formatDecimalValue(row.cp_search),
+        cpa3: formatDecimalValue(readCpa3Value(row)),
+        newA3Rate: formatRateValue(row.avg_new_a3_rate),
+        starId: row.star_id
+      }
+    ];
+  });
+}
+
+function readAverageA3IncreaseCount(row: Record<string, unknown>): number | null {
+  const directAverage = readFiniteNumber(row.avg_a3_increase_cnt);
+  if (directAverage !== null) {
+    return directAverage;
+  }
+
+  const totalNewA3 = readTotalNewA3Value(row);
+  const videoCount =
+    readFiniteNumber(row.video_count) ?? readNestedVideoCount(row.videos);
+  if (totalNewA3 === null || videoCount === null || videoCount <= 0) {
+    return null;
+  }
+
+  return totalNewA3 / videoCount;
+}
+
+function readCpa3Value(row: Record<string, unknown>): number | null {
+  const directCpa3 = readFiniteNumber(row.cpa3);
+  if (directCpa3 !== null) {
+    return directCpa3;
+  }
+
+  const totalCost = readFiniteNumber(row.total_estimated_video_cost);
+  const totalNewA3 = readTotalNewA3Value(row);
+  if (totalCost === null || totalNewA3 === null || totalNewA3 <= 0) {
+    return null;
+  }
+
+  return totalCost / totalNewA3;
+}
+
+function readTotalNewA3Value(row: Record<string, unknown>): number | null {
+  const derivedFromTotals = deriveTotalNewA3FromTotals(row);
+  if (derivedFromTotals !== null) {
+    return derivedFromTotals;
+  }
+
+  return deriveTotalNewA3FromVideos(row.videos);
+}
+
+function deriveTotalNewA3FromTotals(row: Record<string, unknown>): number | null {
+  const totalPlayCount = readFiniteNumber(row.total_play_cnt);
+  const averageNewA3Rate = readFiniteNumber(row.avg_new_a3_rate);
+  if (totalPlayCount === null || averageNewA3Rate === null) {
+    return null;
+  }
+
+  return totalPlayCount * averageNewA3Rate;
+}
+
+function deriveTotalNewA3FromVideos(value: unknown): number | null {
+  if (!Array.isArray(value)) {
+    return null;
+  }
+
+  let total = 0;
+  let hasFiniteValue = false;
+  value.forEach((video) => {
+    if (!isRecord(video)) {
+      return;
+    }
+
+    const newA3 = readFiniteNumber(video.new_a3);
+    if (newA3 === null) {
+      return;
+    }
+
+    hasFiniteValue = true;
+    total += newA3;
+  });
+
+  return hasFiniteValue ? total : null;
+}
+
+function readNestedVideoCount(value: unknown): number | null {
+  return Array.isArray(value) ? value.length : null;
+}
+
+function readResponseRows(payload: unknown): unknown[] | null {
+  if (!isRecord(payload) || payload.success !== true) {
+    return null;
+  }
+
+  const topLevelData = isRecord(payload.data) ? payload.data : null;
+  return Array.isArray(topLevelData?.data) ? topLevelData.data : null;
+}
+
+function formatRateValue(value: unknown): string {
+  const number = typeof value === "number" ? value : Number(value);
+  if (Number.isFinite(number)) {
+    const percentage = number * 100;
+    const formatted = new Intl.NumberFormat("en-US", {
+      maximumFractionDigits: 2,
+      minimumFractionDigits: percentage % 1 === 0 ? 0 : 2
+    }).format(percentage);
+    return `${formatted}%`;
+  }
+
+  return "";
+}
+
+function formatDecimalValue(value: unknown): string {
+  const number = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(number)) {
+    return "";
+  }
+
+  return new Intl.NumberFormat("en-US", {
+    maximumFractionDigits: 2,
+    minimumFractionDigits: 2
+  }).format(number);
+}
+
+async function defaultFetch(input: string, init?: RequestInit) {
+  return fetch(input, init);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function readFiniteNumber(value: unknown): number | null {
+  const number = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(number) ? number : null;
+}

src/shared/backend-metrics-config.ts

@@ -0,0 +1,2 @@
+export const DEFAULT_BACKEND_METRICS_BASE_URL =
+  "https://talent-search.intelligrow.cn";

src/shared/backend-metrics-messages.ts

@@ -0,0 +1,67 @@
+import type { BackendMetricsRow } from "./backend-metrics-client";
+
+export type BackendMetricsSearchRequestMessage = {
+  type: "backend-metrics:search";
+  value: {
+    starIds: string[];
+  };
+};
+
+export type BackendMetricsResponseMessage =
+  | {
+      ok: true;
+      type: "backend-metrics:result";
+      value: {
+        rows: BackendMetricsRow[];
+      };
+    }
+  | {
+      error: string;
+      ok: false;
+      type: "backend-metrics:error";
+    };
+
+export function isBackendMetricsSearchRequestMessage(
+  value: unknown
+): value is BackendMetricsSearchRequestMessage {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+
+  const candidate = value as Partial<BackendMetricsSearchRequestMessage>;
+  return (
+    candidate.type === "backend-metrics:search" &&
+    Boolean(
+      candidate.value &&
+        typeof candidate.value === "object" &&
+        Array.isArray((candidate.value as { starIds?: unknown }).starIds) &&
+        (candidate.value as { starIds: unknown[] }).starIds.every(
+          (starId) => typeof starId === "string"
+        )
+    )
+  );
+}
+
+export function isBackendMetricsResponseMessage(
+  value: unknown
+): value is BackendMetricsResponseMessage {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+
+  const candidate = value as Partial<BackendMetricsResponseMessage>;
+  if (candidate.ok === false) {
+    return (
+      candidate.type === "backend-metrics:error" &&
+      typeof candidate.error === "string"
+    );
+  }
+
+  return Boolean(
+    candidate.ok === true &&
+      candidate.type === "backend-metrics:result" &&
+      candidate.value &&
+      typeof candidate.value === "object" &&
+      Array.isArray((candidate.value as { rows?: unknown }).rows)
+  );
+}

src/shared/batch-submit-client.ts

@@ -0,0 +1,95 @@
+import type { BatchPayload } from "../content/market/batch-payload";
+import { isAuthResponseMessage } from "./auth-messages";
+import { DEFAULT_BATCH_SUBMIT_BASE_URL } from "./batch-submit-config";
+
+interface FetchResponseLike {
+  json(): Promise<unknown>;
+  ok: boolean;
+  status: number;
+}
+
+type FetchLike = (
+  input: string,
+  init?: RequestInit
+) => Promise<FetchResponseLike>;
+
+type GetAccessTokenLike = () => Promise<string>;
+type SendMessageLike = (message: unknown) => Promise<unknown>;
+
+export function createBatchSubmitClient(options: {
+  baseUrl?: string;
+  fetchImpl?: FetchLike;
+  getAccessToken?: GetAccessTokenLike;
+  sendMessage: SendMessageLike;
+}) {
+  const baseUrl = options.baseUrl ?? DEFAULT_BATCH_SUBMIT_BASE_URL;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const getAccessToken =
+    options.getAccessToken ?? (() => readAccessToken(options.sendMessage));
+
+  return {
+    async submitBatch(payload: BatchPayload) {
+      const token = await getAccessToken();
+      const response = await fetchImpl(
+        buildBatchSubmitUrl(baseUrl),
+        {
+          body: JSON.stringify(payload),
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json"
+          },
+          method: "POST"
+        }
+      );
+
+      if (response.status === 401 || response.status === 403) {
+        throw new Error("batch submit unauthorized");
+      }
+
+      if (!response.ok) {
+        throw new Error(`batch submit failed: ${response.status}`);
+      }
+
+      return readBatchSubmitResponse(await response.json());
+    }
+  };
+}
+
+export function buildBatchSubmitUrl(baseUrl: string): string {
+  return new URL("/api/v1/batch-status/batches", baseUrl).toString();
+}
+
+async function readAccessToken(sendMessage: SendMessageLike): Promise<string> {
+  const response = await sendMessage({ type: "auth:get-access-token" });
+
+  if (
+    !isAuthResponseMessage(response) ||
+    !response.ok ||
+    response.type !== "auth:token" ||
+    !response.value.accessToken.trim()
+  ) {
+    throw new Error("batch submit token unavailable");
+  }
+
+  return response.value.accessToken;
+}
+
+function readBatchSubmitResponse(payload: unknown): unknown {
+  if (!isRecord(payload)) {
+    throw new Error("batch submit response is invalid");
+  }
+
+  if (payload.success !== true) {
+    const message =
+      typeof payload.msg === "string" && payload.msg.trim()
+        ? payload.msg
+        : "batch submit failed";
+    throw new Error(message);
+  }
+
+  return "data" in payload ? payload.data : payload;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}

src/shared/batch-submit-config.ts

@@ -0,0 +1 @@
+export const DEFAULT_BATCH_SUBMIT_BASE_URL = "http://192.168.31.21:8083";

src/shared/protected-api-client.ts

@@ -0,0 +1,62 @@
+import { isAuthResponseMessage } from "./auth-messages";
+
+interface FetchResponseLike {
+  json(): Promise<unknown>;
+  ok: boolean;
+  status: number;
+}
+
+type FetchLike = (
+  input: string,
+  init?: RequestInit
+) => Promise<FetchResponseLike>;
+
+type SendMessageLike = (message: unknown) => Promise<unknown>;
+
+export function createProtectedApiClient(options: {
+  baseUrl: string;
+  fetchImpl?: FetchLike;
+  sendMessage: SendMessageLike;
+}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+
+  return {
+    async loadProtectedMockData() {
+      const token = await readAccessToken(options.sendMessage);
+      const response = await fetchImpl(
+        new URL("/api/mock/protected", options.baseUrl).toString(),
+        {
+          headers: {
+            Authorization: `Bearer ${token}`
+          },
+          method: "GET"
+        }
+      );
+
+      if (response.status === 401 || response.status === 403) {
+        throw new Error("protected api unauthorized");
+      }
+
+      if (!response.ok) {
+        throw new Error(`protected api request failed: ${response.status}`);
+      }
+
+      return response.json();
+    }
+  };
+}
+
+async function readAccessToken(sendMessage: SendMessageLike): Promise<string> {
+  const response = await sendMessage({ type: "auth:get-access-token" });
+
+  if (
+    !isAuthResponseMessage(response) ||
+    !response.ok ||
+    response.type !== "auth:token" ||
+    !response.value.accessToken.trim()
+  ) {
+    throw new Error("protected api token unavailable");
+  }
+
+  return response.value.accessToken;
+}

tests/auth-config.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, test } from "vitest";
+
+import { readAuthConfig } from "../src/shared/auth-config";
+
+describe("auth-config", () => {
+  test("returns the configured Logto settings", () => {
+    expect(readAuthConfig()).toEqual({
+      apiResource: "https://talent-search.intelligrow.cn",
+      appId: "i4jkllbvih0554r4n0fd3",
+      enableDevAuthPanel: false,
+      logtoEndpoint: "https://login-api.intelligrow.cn",
+      scopes: [
+        "openid",
+        "profile",
+        "offline_access",
+        "talent-search:read"
+      ]
+    });
+  });
+
+  test("rejects empty endpoint values", () => {
+    expect(() =>
+      readAuthConfig({
+        logtoEndpoint: ""
+      })
+    ).toThrow(/logtoEndpoint/i);
+  });
+});

tests/auth-messages.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  isAuthRequestMessage,
+  isAuthResponseMessage
+} from "../src/shared/auth-messages";
+
+describe("auth-messages", () => {
+  test("accepts a get-state request", () => {
+    expect(isAuthRequestMessage({ type: "auth:get-state" })).toBe(true);
+  });
+
+  test("rejects unknown auth requests", () => {
+    expect(isAuthRequestMessage({ type: "auth:wat" })).toBe(false);
+  });
+
+  test("accepts a successful auth response envelope", () => {
+    expect(
+      isAuthResponseMessage({
+        ok: true,
+        type: "auth:state",
+        value: { isAuthenticated: false }
+      })
+    ).toBe(true);
+  });
+});

tests/backend-metrics-client.test.ts

@@ -0,0 +1,137 @@
+import { describe, expect, test, vi } from "vitest";
+
+import { DEFAULT_BACKEND_METRICS_BASE_URL } from "../src/shared/backend-metrics-config";
+import {
+  buildBackendMetricsSearchRequestBody,
+  buildBackendMetricsSearchUrl,
+  createBackendMetricsClient,
+  mapBackendMetricsSearchResponse
+} from "../src/shared/backend-metrics-client";
+
+describe("backend-metrics-client", () => {
+  test("exports the default backend metrics base url", () => {
+    expect(DEFAULT_BACKEND_METRICS_BASE_URL).toBe(
+      "https://talent-search.intelligrow.cn"
+    );
+  });
+
+  test("builds the backend search url", () => {
+    expect(buildBackendMetricsSearchUrl("https://talent-search.intelligrow.cn")).toBe(
+      "https://talent-search.intelligrow.cn/api/v1/history/talents/search"
+    );
+  });
+
+  test("builds a star_id batch request body", () => {
+    expect(
+      buildBackendMetricsSearchRequestBody(["7252982749131178039", "7290491710910496809"])
+    ).toEqual({
+      page: 1,
+      size: 20,
+      type: "star_id",
+      values: ["7252982749131178039", "7290491710910496809"]
+    });
+  });
+
+  test("maps backend metrics rows into display-ready values", () => {
+    expect(
+      mapBackendMetricsSearchResponse({
+        data: {
+          data: [
+            {
+              avg_a3_increase_cnt: 78366.22448979592,
+              avg_after_view_search_cnt: 9689.959183673469,
+              avg_after_view_search_rate: 0.0036203703369054683,
+              avg_new_a3_rate: 0.034428135017531614,
+              cp_search: 14.460581961550774,
+              cpa3: 1.788046443373538,
+              star_id: "7252982749131178039"
+            }
+          ]
+        },
+        success: true
+      })
+    ).toEqual([
+      {
+        a3IncreaseCount: "78,366.22",
+        afterViewSearchCount: "9,689.96",
+        afterViewSearchRate: "0.36%",
+        cpSearch: "14.46",
+        cpa3: "1.79",
+        newA3Rate: "3.44%",
+        starId: "7252982749131178039"
+      }
+    ]);
+  });
+
+  test("derives A3 count and CPA3 from the live aggregate response shape", () => {
+    expect(
+      mapBackendMetricsSearchResponse({
+        data: {
+          data: [
+            {
+              avg_after_view_search_cnt: 25982,
+              avg_after_view_search_rate: 0.0010872130261527625,
+              avg_new_a3_rate: 0.11075860229946684,
+              cp_search: 21.168501270110077,
+              cpe: 0.630604497471276,
+              cpm: 23.014670324994974,
+              star_id: "7021245050621263906",
+              total_estimated_video_cost: 1100000,
+              total_play_cnt: 47795601,
+              video_count: 2
+            }
+          ]
+        },
+        success: true
+      })
+    ).toEqual([
+      {
+        a3IncreaseCount: "2,646,886.98",
+        afterViewSearchCount: "25,982.00",
+        afterViewSearchRate: "0.11%",
+        cpSearch: "21.17",
+        cpa3: "0.21",
+        newA3Rate: "11.08%",
+        starId: "7021245050621263906"
+      }
+    ]);
+  });
+
+  test("posts star ids with bearer auth when searching backend metrics", async () => {
+    const fetchImpl = async (_input: string, init?: RequestInit) => ({
+      json: async () => ({
+        data: {
+          data: []
+        },
+        success: true
+      }),
+      ok: true,
+      status: 200,
+      url: "https://talent-search.intelligrow.cn/api/v1/history/talents/search"
+    });
+    const fetchSpy = vi.fn(fetchImpl);
+    const client = createBackendMetricsClient({
+      fetchImpl: fetchSpy,
+      getAccessToken: async () => "test-token"
+    });
+
+    await client.searchByStarIds(["111", "222"]);
+
+    expect(fetchSpy).toHaveBeenCalledWith(
+      "https://talent-search.intelligrow.cn/api/v1/history/talents/search",
+      expect.objectContaining({
+        body: JSON.stringify({
+          page: 1,
+          size: 20,
+          type: "star_id",
+          values: ["111", "222"]
+        }),
+        headers: {
+          Authorization: "Bearer test-token",
+          "Content-Type": "application/json"
+        },
+        method: "POST"
+      })
+    );
+  });
+});

tests/backend-metrics-messages.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  isBackendMetricsResponseMessage,
+  isBackendMetricsSearchRequestMessage
+} from "../src/shared/backend-metrics-messages";
+
+describe("backend-metrics-messages", () => {
+  test("accepts a backend metrics search request", () => {
+    expect(
+      isBackendMetricsSearchRequestMessage({
+        type: "backend-metrics:search",
+        value: {
+          starIds: ["111", "222"]
+        }
+      })
+    ).toBe(true);
+  });
+
+  test("accepts a successful backend metrics response", () => {
+    expect(
+      isBackendMetricsResponseMessage({
+        ok: true,
+        type: "backend-metrics:result",
+        value: {
+          rows: [
+            {
+              a3IncreaseCount: "10.00",
+              afterViewSearchCount: "20.00",
+              afterViewSearchRate: "0.20%",
+              cpSearch: "1.10",
+              cpa3: "2.20",
+              newA3Rate: "1.50%",
+              starId: "111"
+            }
+          ]
+        }
+      })
+    ).toBe(true);
+  });
+});

tests/background-auth-client.test.ts

@@ -0,0 +1,50 @@
+import { describe, expect, test, vi } from "vitest";
+
+import { createLogtoAuthClient } from "../src/background/auth/client";
+
+vi.mock("@logto/chrome-extension", () => {
+  const signIn = vi.fn(async () => undefined);
+  const signOut = vi.fn(async () => undefined);
+  const MockLogtoClient = vi.fn(function MockLogtoClient() {
+    return {
+      getAccessToken: vi.fn(async () => "token"),
+      getIdTokenClaims: vi.fn(async () => null),
+      isAuthenticated: vi.fn(async () => false),
+      signIn,
+      signOut
+    };
+  });
+
+  return {
+    default: MockLogtoClient
+  };
+});
+
+describe("background-auth-client", () => {
+  test("uses chrome identity redirect URLs for sign in and sign out", async () => {
+    const getRedirectURL = vi.fn((path?: string) =>
+      path ? `https://extension.chromiumapp.org${path}` : "https://extension.chromiumapp.org/"
+    );
+
+    (
+      globalThis as typeof globalThis & {
+        chrome?: {
+          identity?: {
+            getRedirectURL?: (path?: string) => string;
+          };
+        };
+      }
+    ).chrome = {
+      identity: {
+        getRedirectURL
+      }
+    };
+
+    const authClient = createLogtoAuthClient();
+    await authClient.signIn();
+    await authClient.signOut();
+
+    expect(getRedirectURL).toHaveBeenNthCalledWith(1, "/callback");
+    expect(getRedirectURL).toHaveBeenNthCalledWith(2);
+  });
+});

tests/background-auth-controller.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, test, vi } from "vitest";
+
+import { createAuthController } from "../src/background/auth/controller";
+
+describe("background-auth-controller", () => {
+  test("returns unauthenticated state when the client is logged out", async () => {
+    const controller = createAuthController({
+      authClient: {
+        getAccessToken: vi.fn(),
+        getIdTokenClaims: vi.fn(),
+        isAuthenticated: vi.fn(async () => false),
+        signIn: vi.fn(),
+        signOut: vi.fn()
+      }
+    });
+
+    await expect(controller.getAuthState()).resolves.toEqual(
+      expect.objectContaining({
+        isAuthenticated: false
+      })
+    );
+  });
+
+  test("delegates sign in to the auth client", async () => {
+    const signIn = vi.fn(async () => undefined);
+    const controller = createAuthController({
+      authClient: {
+        getAccessToken: vi.fn(),
+        getIdTokenClaims: vi.fn(),
+        isAuthenticated: vi.fn(async () => false),
+        signIn,
+        signOut: vi.fn()
+      }
+    });
+
+    await controller.signIn();
+
+    expect(signIn).toHaveBeenCalledTimes(1);
+  });
+});

tests/background-index.test.ts

@@ -47,4 +47,224 @@ describe("background-index", () => {
     );
     expect(sendResponse).toHaveBeenCalledWith({ ok: true });
   });
+
+  test("responds to auth:get-state with auth status", async () => {
+    const listeners: Array<
+      (message: unknown, sender: unknown, sendResponse: (response: unknown) => void) => boolean | void
+    > = [];
+    const sendResponse = vi.fn();
+
+    registerBackgroundMessageHandler(
+      {
+        runtime: {
+          onMessage: {
+            addListener(listener) {
+              listeners.push(listener);
+            }
+          }
+        }
+      },
+      {
+        authController: {
+          getAccessToken: vi.fn(),
+          getAuthState: vi.fn(async () => ({ isAuthenticated: false })),
+          signIn: vi.fn(),
+          signOut: vi.fn()
+        }
+      }
+    );
+
+    const result = listeners[0]({ type: "auth:get-state" }, {}, sendResponse);
+
+    expect(result).toBe(true);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    expect(sendResponse).toHaveBeenCalledWith({
+      ok: true,
+      type: "auth:state",
+      value: { isAuthenticated: false }
+    });
+  });
+
+  test("responds to auth:get-access-token with the current token", async () => {
+    const listeners: Array<
+      (message: unknown, sender: unknown, sendResponse: (response: unknown) => void) => boolean | void
+    > = [];
+    const sendResponse = vi.fn();
+
+    registerBackgroundMessageHandler(
+      {
+        runtime: {
+          onMessage: {
+            addListener(listener) {
+              listeners.push(listener);
+            }
+          }
+        }
+      },
+      {
+        authController: {
+          getAccessToken: vi.fn(async () => "test-access-token"),
+          getAuthState: vi.fn(),
+          signIn: vi.fn(),
+          signOut: vi.fn()
+        }
+      }
+    );
+
+    const result = listeners[0](
+      { type: "auth:get-access-token" },
+      {},
+      sendResponse
+    );
+
+    expect(result).toBe(true);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    expect(sendResponse).toHaveBeenCalledWith({
+      ok: true,
+      type: "auth:token",
+      value: { accessToken: "test-access-token" }
+    });
+  });
+
+  test("submits batches through the background message handler", async () => {
+    const listeners: Array<
+      (message: unknown, sender: unknown, sendResponse: (response: unknown) => void) => boolean | void
+    > = [];
+    const sendResponse = vi.fn();
+    const submitBatch = vi.fn(async () => ({
+      acceptedCount: 1,
+      batchId: "批次A-2026-04-22T12:30:00.000Z",
+      ok: true
+    }));
+
+    registerBackgroundMessageHandler(
+      {
+        runtime: {
+          onMessage: {
+            addListener(listener) {
+              listeners.push(listener);
+            }
+          }
+        }
+      },
+      {
+        authController: {
+          getAccessToken: vi.fn(async () => "test-access-token"),
+          getAuthState: vi.fn(),
+          signIn: vi.fn(),
+          signOut: vi.fn()
+        },
+        submitBatch
+      }
+    );
+
+    const result = listeners[0](
+      {
+        payload: {
+          authors: [{ authorId: "111", authorName: "达人A" }],
+          batchName: "批次A",
+          createdAt: "2026-04-22T12:30:00.000Z",
+          creatorName: "王少卿",
+          logtoUserId: "p7pdhhtde8kj",
+          resource: "https://talent-search.intelligrow.cn"
+        },
+        type: "batch:submit"
+      },
+      {},
+      sendResponse
+    );
+
+    expect(result).toBe(true);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    expect(submitBatch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        batchName: "批次A"
+      })
+    );
+    expect(submitBatch.mock.calls[0]?.[0]).not.toHaveProperty("batchId");
+    expect(sendResponse).toHaveBeenCalledWith({
+      ok: true,
+      type: "batch:ack",
+      value: {
+        acceptedCount: 1,
+        batchId: "批次A-2026-04-22T12:30:00.000Z",
+        ok: true
+      }
+    });
+  });
+
+  test("searches backend metrics through the background message handler", async () => {
+    const listeners: Array<
+      (message: unknown, sender: unknown, sendResponse: (response: unknown) => void) => boolean | void
+    > = [];
+    const sendResponse = vi.fn();
+    const searchBackendMetrics = vi.fn(async () => [
+      {
+        a3IncreaseCount: "78,366.22",
+        afterViewSearchCount: "9,689.96",
+        afterViewSearchRate: "0.36%",
+        cpSearch: "14.46",
+        cpa3: "1.79",
+        newA3Rate: "3.44%",
+        starId: "111"
+      }
+    ]);
+
+    registerBackgroundMessageHandler(
+      {
+        runtime: {
+          onMessage: {
+            addListener(listener) {
+              listeners.push(listener);
+            }
+          }
+        }
+      },
+      {
+        authController: {
+          getAccessToken: vi.fn(async () => "test-access-token"),
+          getAuthState: vi.fn(),
+          signIn: vi.fn(),
+          signOut: vi.fn()
+        },
+        searchBackendMetrics
+      }
+    );
+
+    const result = listeners[0](
+      {
+        type: "backend-metrics:search",
+        value: {
+          starIds: ["111", "222"]
+        }
+      },
+      {},
+      sendResponse
+    );
+
+    expect(result).toBe(true);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    expect(searchBackendMetrics).toHaveBeenCalledWith(["111", "222"]);
+    expect(sendResponse).toHaveBeenCalledWith({
+      ok: true,
+      type: "backend-metrics:result",
+      value: {
+        rows: [
+          {
+            a3IncreaseCount: "78,366.22",
+            afterViewSearchCount: "9,689.96",
+            afterViewSearchRate: "0.36%",
+            cpSearch: "14.46",
+            cpa3: "1.79",
+            newA3Rate: "3.44%",
+            starId: "111"
+          }
+        ]
+      }
+    });
+  });
 });

tests/batch-payload.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, test } from "vitest";
+
+import { createBatchPayload } from "../src/content/market/batch-payload";
+
+describe("batch-payload", () => {
+  test("builds the batch payload without a client-side batch id", () => {
+    const payload = createBatchPayload({
+      authState: {
+        isAuthenticated: true,
+        resource: "https://talent-search.intelligrow.cn",
+        userInfo: {
+          name: "王少卿",
+          sub: "p7pdhhtde8kj"
+        }
+      },
+      batchName: "618达人筛选第一批",
+      createdAt: "2026-04-22T12:30:00.000Z",
+      records: [
+        { authorId: "111", authorName: "达人A", status: "success" },
+        { authorId: "222", authorName: "达人B", status: "success" }
+      ]
+    });
+
+    expect(payload).toEqual({
+      authors: [
+        { authorId: "111", authorName: "达人A" },
+        { authorId: "222", authorName: "达人B" }
+      ],
+      batchName: "618达人筛选第一批",
+      createdAt: "2026-04-22T12:30:00.000Z",
+      creatorName: "王少卿",
+      logtoUserId: "p7pdhhtde8kj",
+      resource: "https://talent-search.intelligrow.cn"
+    });
+  });
+
+  test("throws when the user id is unavailable", () => {
+    expect(() =>
+      createBatchPayload({
+        authState: {
+          isAuthenticated: true,
+          resource: "https://talent-search.intelligrow.cn",
+          userInfo: {
+            name: "王少卿"
+          }
+        },
+        batchName: "批次A",
+        createdAt: "2026-04-22T12:30:00.000Z",
+        records: [{ authorId: "111", authorName: "达人A", status: "success" }]
+      })
+    ).toThrow(/user/i);
+  });
+});

tests/batch-submit-client.test.ts

@@ -0,0 +1,123 @@
+import { describe, expect, test, vi } from "vitest";
+
+import { DEFAULT_BATCH_SUBMIT_BASE_URL } from "../src/shared/batch-submit-config";
+import { createBatchSubmitClient } from "../src/shared/batch-submit-client";
+
+describe("batch-submit-client", () => {
+  test("exports the default batch submit base url", () => {
+    expect(DEFAULT_BATCH_SUBMIT_BASE_URL).toBe("http://192.168.31.21:8083");
+  });
+
+  test("posts the batch payload with a Bearer token", async () => {
+    const sendMessage = vi.fn(async () => ({
+      ok: true,
+      type: "auth:token",
+      value: { accessToken: "abc123" }
+    }));
+    const fetchImpl = vi.fn(async () => ({
+      ok: true,
+      status: 200,
+      json: async () => ({
+        data: {
+          batch_id: "p7pdhhtde8kj-2026-04-22T12:30:00.000Z",
+          status: true,
+          talent_count: 1
+        },
+        msg: "",
+        success: true
+      })
+    }));
+
+    const client = createBatchSubmitClient({
+      baseUrl: "http://127.0.0.1:4319",
+      fetchImpl,
+      sendMessage
+    });
+
+    await client.submitBatch({
+      authors: [{ authorId: "111", authorName: "达人A" }],
+      batchName: "批次A",
+      createdAt: "2026-04-22T12:30:00.000Z",
+      creatorName: "王少卿",
+      logtoUserId: "p7pdhhtde8kj",
+      resource: "https://talent-search.intelligrow.cn"
+    });
+
+    expect(fetchImpl).toHaveBeenCalledWith(
+      "http://127.0.0.1:4319/api/v1/batch-status/batches",
+      expect.objectContaining({
+        body: JSON.stringify({
+          authors: [{ authorId: "111", authorName: "达人A" }],
+          batchName: "批次A",
+          createdAt: "2026-04-22T12:30:00.000Z",
+          creatorName: "王少卿",
+          logtoUserId: "p7pdhhtde8kj",
+          resource: "https://talent-search.intelligrow.cn"
+        }),
+        headers: expect.objectContaining({
+          Authorization: "Bearer abc123",
+          "Content-Type": "application/json"
+        }),
+        method: "POST"
+      })
+    );
+  });
+
+  test("throws when the batch submit api returns success false", async () => {
+    const client = createBatchSubmitClient({
+      baseUrl: "http://127.0.0.1:4319",
+      fetchImpl: vi.fn(async () => ({
+        ok: true,
+        status: 200,
+        json: async () => ({
+          data: null,
+          msg: "duplicate batch id",
+          success: false
+        })
+      })),
+      sendMessage: vi.fn(async () => ({
+        ok: true,
+        type: "auth:token",
+        value: { accessToken: "abc123" }
+      }))
+    });
+
+    await expect(
+      client.submitBatch({
+        authors: [],
+        batchName: "批次A",
+        createdAt: "2026-04-22T12:30:00.000Z",
+        creatorName: "王少卿",
+        logtoUserId: "p7pdhhtde8kj",
+        resource: "https://talent-search.intelligrow.cn"
+      })
+    ).rejects.toThrow(/duplicate batch id/i);
+  });
+
+  test("throws on unauthorized responses", async () => {
+    const client = createBatchSubmitClient({
+      baseUrl: "http://127.0.0.1:4319",
+      fetchImpl: vi.fn(async () => ({
+        ok: false,
+        status: 401,
+        json: async () => ({ error: "unauthorized", ok: false })
+      })),
+      sendMessage: vi.fn(async () => ({
+        ok: true,
+        type: "auth:token",
+        value: { accessToken: "abc123" }
+      }))
+    });
+
+    await expect(
+      client.submitBatch({
+        authors: [],
+        batchName: "批次A",
+        createdAt: "2026-04-22T12:30:00.000Z",
+        creatorName: "王少卿",
+        logtoUserId: "p7pdhhtde8kj",
+        resource: "https://talent-search.intelligrow.cn"
+      })
+    ).rejects.toThrow(/unauthorized/i);
+  });
+});

tests/csv-exporter.test.ts

@@ -15,7 +15,13 @@ describe("csv-exporter", () => {
         "地区",
         "21-60s报价",
         "单视频看后搜率",
-        "个人视频看后搜率"
+        "个人视频看后搜率",
+        "看后搜率",
+        "看后搜数",
+        "新增A3数",
+        "新增A3率",
+        "CPA3",
+        "cp_search"
       ].join(",")
     );
   });
@@ -27,10 +33,19 @@ describe("csv-exporter", () => {
         authorName: "Alice",
         exportFields: {
           达人信息: "Alice",
+          代表视频: "示例视频",
           粉丝数: "100w",
           "21-60s报价": "¥450,000"
         },
         status: "success",
+        backendMetrics: {
+          a3IncreaseCount: "78,366.22",
+          afterViewSearchCount: "9,689.96",
+          afterViewSearchRate: "0.36%",
+          cpSearch: "14.46",
+          cpa3: "1.79",
+          newA3Rate: "3.44%"
+        },
         rates: {
           singleVideoAfterSearchRate: "0.5%-1%",
           personalVideoAfterSearchRate: "1% - 3%"
@@ -40,11 +55,56 @@ describe("csv-exporter", () => {
 
     const [headerLine, rowLine] = csv.split("\n");
     expect(headerLine).toBe(
-      ["达人信息", "粉丝数", "21-60s报价", "单视频看后搜率", "个人视频看后搜率"].join(
+      [
-        ","
+        "达人信息",
-      )
+        "粉丝数",
+        "21-60s报价",
+        "单视频看后搜率",
+        "个人视频看后搜率",
+        "看后搜率",
+        "看后搜数",
+        "新增A3数",
+        "新增A3率",
+        "CPA3",
+        "cp_search"
+      ].join(",")
     );
-    expect(rowLine).toBe('Alice,100w,"¥450,000",0.5% - 1%,1% - 3%');
+    expect(rowLine).toBe(
+      'Alice,100w,"¥450,000",0.5% - 1%,1% - 3%,0.36%,"9,689.96","78,366.22",3.44%,1.79,14.46'
+    );
+  });
+
+  test("omits the representative video column from exported page fields", () => {
+    const csv = buildMarketCsv([
+      {
+        authorId: "123",
+        authorName: "Alice",
+        exportFields: {
+          达人信息: "Alice",
+          代表视频: "示例视频",
+          粉丝数: "100w"
+        },
+        status: "success"
+      } satisfies MarketRecord
+    ]);
+
+    const [headerLine, rowLine] = csv.split("\n");
+
+    expect(headerLine).toBe(
+      [
+        "达人信息",
+        "粉丝数",
+        "单视频看后搜率",
+        "个人视频看后搜率",
+        "看后搜率",
+        "看后搜数",
+        "新增A3数",
+        "新增A3率",
+        "CPA3",
+        "cp_search"
+      ].join(",")
+    );
+    expect(rowLine).toBe("Alice,100w,,,,,,,,");
   });
 
   test("escapes commas and quotes", () => {
@@ -77,7 +137,7 @@ describe("csv-exporter", () => {
     ]);
 
     const [, rowLine] = csv.split("\n");
-    expect(rowLine).toBe("123,Alice,,,,");
+    expect(rowLine).toBe("123,Alice,,,,,,,,,,");
   });
 
   test("uses normalized display values in export rows", () => {
@@ -97,4 +157,21 @@ describe("csv-exporter", () => {
     expect(rowLine).toContain("0.5% - 1%");
     expect(rowLine).toContain("0.02% - 0.1%");
   });
+
+  test("emits empty backend metric cells when backend metrics are absent", () => {
+    const csv = buildMarketCsv([
+      {
+        authorId: "123",
+        authorName: "Alice",
+        status: "success",
+        rates: {
+          singleVideoAfterSearchRate: "0.5%-1%",
+          personalVideoAfterSearchRate: "0.02 - 0.1%"
+        }
+      } satisfies MarketRecord
+    ]);
+
+    const [, rowLine] = csv.split("\n");
+    expect(rowLine).toBe("123,Alice,,,0.5% - 1%,0.02% - 0.1%,,,,,,");
+  });
 });

tests/filter-sort-controller.test.ts

@@ -93,4 +93,95 @@ describe("filter-sort-controller", () => {
 
     expect(result.slice(-2).map((record) => record.authorId)).toEqual(["c", "d"]);
   });
+
+  test("sorts by backend metric descending and keeps empty values at the end", () => {
+    const result = applyFilterAndSort(
+      [
+        {
+          ...baseRecords[0],
+          backendMetrics: {
+            afterViewSearchRate: "0.36%"
+          }
+        },
+        {
+          ...baseRecords[1],
+          backendMetrics: {
+            afterViewSearchRate: "1.4%"
+          }
+        },
+        baseRecords[2]
+      ],
+      {
+        sort: {
+          direction: "desc",
+          field: "afterViewSearchRate"
+        }
+      }
+    );
+
+    expect(result.map((record) => record.authorId)).toEqual(["b", "a", "c"]);
+  });
+
+  test("keeps equal rate buckets in a deterministic order across repeated sorts", () => {
+    const records: MarketRecord[] = [
+      {
+        authorId: "b",
+        authorName: "Beta",
+        status: "success",
+        rates: {
+          singleVideoAfterSearchRate: "0.5% - 1%"
+        }
+      },
+      {
+        authorId: "a",
+        authorName: "Alpha",
+        status: "success",
+        rates: {
+          singleVideoAfterSearchRate: "0.5% - 1%"
+        }
+      },
+      {
+        authorId: "d",
+        authorName: "Delta",
+        status: "success",
+        rates: {
+          singleVideoAfterSearchRate: "0.25% - 0.5%"
+        }
+      },
+      {
+        authorId: "c",
+        authorName: "Gamma",
+        status: "success",
+        rates: {
+          singleVideoAfterSearchRate: "0.25% - 0.5%"
+        }
+      }
+    ];
+
+    const firstResult = applyFilterAndSort(records, {
+      sort: {
+        direction: "desc",
+        field: "singleVideoAfterSearchRate"
+      }
+    });
+    const secondResult = applyFilterAndSort([...records].reverse(), {
+      sort: {
+        direction: "desc",
+        field: "singleVideoAfterSearchRate"
+      }
+    });
+
+    expect(firstResult.map((record) => record.authorId)).toEqual([
+      "a",
+      "b",
+      "c",
+      "d"
+    ]);
+    expect(secondResult.map((record) => record.authorId)).toEqual([
+      "a",
+      "b",
+      "c",
+      "d"
+    ]);
+  });
 });

tests/manifest.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "vitest";
 
 import manifest from "../src/manifest.json";
+import { createManifest } from "../scripts/manifest.mjs";
 
 describe("manifest", () => {
   test("injects the content script on the www Xingtu market page", () => {
@@ -9,12 +10,59 @@ describe("manifest", () => {
         expect.stringMatching(/^https:\/\/(\*\.|www\.)?xingtu\.cn\/ad\/creator\/market\*$/)
       ])
     );
+    expect(manifest.content_scripts?.[0]?.run_at).toBe("document_start");
   });
 
-  test("declares the downloads permission and background worker for csv export", () => {
+  test("declares the downloads and auth permissions plus background worker", () => {
     expect(manifest.permissions).toEqual(
-      expect.arrayContaining(["downloads"])
+      expect.arrayContaining(["downloads", "identity", "storage"])
+    );
+    expect(manifest.key).toBe(
+      "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0CaZJxcX97TbRXCR08L10t9EZFV31+wPnUgDf21j2f0qYaWdblzWXfVkeU9jGb2Hr2Etpp7F/XuBa6pcipUXkzMMBkJ42KOkciAwbuzTBoAtGB8o9aoWigtax+gGfSz+T3BjqxKBJtXqeqbIAKCDIlxRKIrY+KcY1Z+mD5BKcBHKsUDQPlHsrjc1g0wIBD5doz9LoOk1Wso6gK5cSeOp9lw5YHcu4TImR4yqxGiL6pZwnpciuX/g7qjWBZXn5gf0YBlDsBDDTt5upbP3NguUKgO2qA9M77LyeUwXl3aqbIxYi/VwsQ2t5w9PGWtnOUQQDWUcEg/9dfTb89esZXKATwIDAQAB"
+    );
+    expect(manifest.host_permissions).toEqual(
+      expect.arrayContaining([
+        "http://*/*",
+        "https://login-api.intelligrow.cn/*",
+        "http://127.0.0.1:4319/*",
+        "https://*/*"
+      ])
     );
     expect(manifest.background?.service_worker).toBe("background/index.js");
+    expect(manifest.action?.default_popup).toBe("popup/index.html");
+  });
+
+  test("builds a release manifest with narrowed host permissions", () => {
+    const releaseManifest = createManifest({ target: "release" });
+
+    expect(releaseManifest.permissions).toEqual(
+      expect.arrayContaining(["downloads", "identity", "storage"])
+    );
+    expect(releaseManifest.host_permissions).toEqual([
+      "https://xingtu.cn/ad/creator/market*",
+      "https://*.xingtu.cn/ad/creator/market*",
+      "https://login-api.intelligrow.cn/*",
+      "https://talent-search.intelligrow.cn/*",
+      "http://192.168.31.21:8083/*"
+    ]);
+    expect(releaseManifest.host_permissions).not.toEqual(
+      expect.arrayContaining(["http://*/*", "https://*/*", "http://127.0.0.1:4319/*"])
+    );
+  });
+
+  test("builds a release manifest with extension icons", () => {
+    const releaseManifest = createManifest({ target: "release" });
+
+    expect(releaseManifest.icons).toEqual({
+      "16": "assets/icons/icon-16.png",
+      "32": "assets/icons/icon-32.png",
+      "48": "assets/icons/icon-48.png",
+      "128": "assets/icons/icon-128.png"
+    });
+    expect(releaseManifest.key).toBe(manifest.key);
+    expect(releaseManifest.action?.default_icon).toEqual({
+      "16": "assets/icons/icon-16.png",
+      "32": "assets/icons/icon-32.png"
+    });
   });
 });

tests/market-api-client.test.ts

@@ -33,12 +33,10 @@ describe("market-api-client", () => {
     });
   });
 
-  test("returns a missing-rate failure when the payload omits a required field", () => {
+  test("returns a missing-rate failure when the payload omits both rate fields", () => {
     expect(
       mapAuthorAseInfoResponse({
-        data: {
+        data: {}
-          avg_search_after_view_rate: "<0.02%"
-        }
       })
     ).toMatchObject({
       success: false,
@@ -46,6 +44,21 @@ describe("market-api-client", () => {
     });
   });
 
+  test("maps a partially populated payload into partial rates", () => {
+    expect(
+      mapAuthorAseInfoResponse({
+        data: {
+          personal_avg_search_after_view_rate: "0.02 - 0.1%"
+        }
+      })
+    ).toMatchObject({
+      success: true,
+      rates: {
+        personalVideoAfterSearchRate: "0.02% - 0.1%"
+      }
+    });
+  });
+
   test("returns a request-failed result for non-ok responses", async () => {
     const client = createMarketApiClient({
       fetchImpl: async () => ({

tests/market-auth-gating.test.ts

@@ -0,0 +1,27 @@
+// @vitest-environment jsdom
+// @vitest-environment-options {"url":"https://xingtu.cn/ad/creator/market"}
+
+import { describe, expect, test, vi } from "vitest";
+
+import { bootContentScript } from "../src/content/index";
+
+describe("market-auth-gating", () => {
+  test("shows a login gate instead of booting the market controller when unauthenticated", async () => {
+    document.body.innerHTML = "<div></div>";
+
+    const createMarketController = vi.fn();
+    await bootContentScript({
+      createMarketController,
+      document,
+      sendAuthMessage: vi.fn(async () => ({
+        ok: true,
+        type: "auth:state",
+        value: { isAuthenticated: false }
+      })),
+      window
+    });
+
+    expect(createMarketController).not.toHaveBeenCalled();
+    expect(document.body.textContent).toContain("请先登录插件");
+  });
+});

tests/market-dom-sync.test.ts

@@ -39,6 +39,9 @@ describe("market-dom-sync", () => {
     const table = syncMarketTable(document);
 
     expect(table).not.toBeNull();
+    expect(
+      document.querySelector('[data-market-header-cell="selection"]')
+    ).not.toBeNull();
     expect(
       document.querySelector('[data-market-header-cell="singleVideoAfterSearchRate"]')
     ).not.toBeNull();
@@ -47,10 +50,28 @@ describe("market-dom-sync", () => {
         '[data-market-header-cell="personalVideoAfterSearchRate"]'
       )
     ).not.toBeNull();
-    expect(document.querySelectorAll("[data-market-row-cell]").length).toBe(4);
+    expect(
+      document.querySelector('[data-market-header-cell="afterViewSearchRate"]')
+    ).not.toBeNull();
+    expect(
+      document.querySelector('[data-market-header-cell="afterViewSearchCount"]')
+    ).not.toBeNull();
+    expect(
+      document.querySelector('[data-market-header-cell="a3IncreaseCount"]')
+    ).not.toBeNull();
+    expect(
+      document.querySelector('[data-market-header-cell="newA3Rate"]')
+    ).not.toBeNull();
+    expect(document.querySelector('[data-market-header-cell="cpa3"]')).not.toBeNull();
+    expect(
+      document.querySelector('[data-market-header-cell="cpSearch"]')
+    ).not.toBeNull();
+    expect(document.querySelectorAll("[data-market-row-cell]").length).toBe(18);
+    expect(table?.headerSelectionCheckbox).not.toBeNull();
+    expect(table?.rows[0]?.selectionCheckbox).not.toBeNull();
   });
 
-  test("renders loading, success, and failed states", () => {
+  test("renders loading, success, missing, and failed states", () => {
     const table = syncMarketTable(document);
     if (!table) {
       throw new Error("Expected market table");
@@ -67,6 +88,15 @@ describe("market-dom-sync", () => {
     renderMarketRowState(betaRow, {
       authorId: "b",
       authorName: "Beta",
+      backendMetrics: {
+        a3IncreaseCount: "78,366.22",
+        afterViewSearchCount: "9,689.96",
+        afterViewSearchRate: "0.36%",
+        cpSearch: "14.46",
+        cpa3: "1.79",
+        newA3Rate: "3.44%"
+      },
+      backendMetricsStatus: "success",
       status: "success",
       rates: {
         singleVideoAfterSearchRate: "0.5%-1%",
@@ -75,16 +105,39 @@ describe("market-dom-sync", () => {
     });
 
     expect(alphaRow.singleCell.textContent).toBe("加载中...");
+    expect(alphaRow.backendMetricsCells.afterViewSearchRate.textContent).toBe("加载中...");
     expect(betaRow.singleCell.textContent).toBe("0.5% - 1%");
     expect(betaRow.personalCell.textContent).toBe("0.02% - 0.1%");
+    expect(betaRow.backendMetricsCells.afterViewSearchRate.textContent).toBe("0.36%");
+    expect(betaRow.backendMetricsCells.afterViewSearchCount.textContent).toBe("9,689.96");
+    expect(betaRow.backendMetricsCells.a3IncreaseCount.textContent).toBe("78,366.22");
+    expect(betaRow.backendMetricsCells.newA3Rate.textContent).toBe("3.44%");
+    expect(betaRow.backendMetricsCells.cpa3.textContent).toBe("1.79");
+    expect(betaRow.backendMetricsCells.cpSearch.textContent).toBe("14.46");
 
     renderMarketRowState(betaRow, {
       authorId: "b",
       authorName: "Beta",
+      backendMetricsStatus: "missing",
+      status: "success",
+      rates: {
+        singleVideoAfterSearchRate: "0.5%-1%",
+        personalVideoAfterSearchRate: "0.02 - 0.1%"
+      }
+    });
+    expect(betaRow.backendMetricsCells.afterViewSearchRate.textContent).toBe("暂无数据");
+    expect(betaRow.backendMetricsCells.cpSearch.textContent).toBe("暂无数据");
+
+    renderMarketRowState(betaRow, {
+      authorId: "b",
+      authorName: "Beta",
+      backendMetricsStatus: "failed",
       status: "failed"
     });
     expect(betaRow.singleCell.textContent).toBe("加载失败");
     expect(betaRow.personalCell.textContent).toBe("加载失败");
+    expect(betaRow.backendMetricsCells.afterViewSearchRate.textContent).toBe("加载失败");
+    expect(betaRow.backendMetricsCells.cpSearch.textContent).toBe("加载失败");
   });
 
   test("hides rows outside the visible author ids", () => {
@@ -122,17 +175,73 @@ describe("market-dom-sync", () => {
       throw new Error("Expected market table");
     }
 
-    expect(readRightHeaderTexts()).toEqual([
+    expect(table.headerSelectionCheckbox).not.toBeNull();
-      "21-60s报价",
+    expect(table.rows[0]?.selectionCheckbox).not.toBeNull();
+    expect(readRightHeaderTexts()).toEqual(["21-60s报价", "操作"]);
+    expect(readSelectionHeaderText()).toBe("全选");
+    expect(readSelectionRowCheckboxCount()).toBe(2);
+    expect(readPluginHeaderTexts()).toEqual([
       "单视频看后搜率",
       "个人视频看后搜率",
-      "操作"
+      "看后搜率",
+      "看后搜数",
+      "新增A3数",
+      "新增A3率",
+      "CPA3",
+      "cp_search"
     ]);
+    expect(
+      document
+        .querySelector(".section-wrapper.sticky-header")
+        ?.classList.contains("hide-scrollbar")
+    ).toBe(false);
+    expect(
+      document.querySelector(".section-wrapper:not(.sticky-header)")?.classList.contains(
+        "hide-scrollbar"
+      )
+    ).toBe(false);
+    expect(readScrollHintText()).toBe("横向滚动可查看看后搜率、秒探指标");
+    expect(document.querySelectorAll('[data-testid="market-scroll-hint"]')).toHaveLength(1);
+    expect(
+      (
+        document.querySelector('[data-testid="plugin-header"]') as HTMLElement
+      ).style.position
+    ).not.toBe("sticky");
+    const pluginHeaderCells = Array.from(
+      document.querySelectorAll('[data-testid="plugin-header"] > .header-cell')
+    ) as HTMLElement[];
+    expect(pluginHeaderCells[0]?.style.width).toBe("160px");
+    expect(pluginHeaderCells[1]?.style.width).toBe("160px");
+    expect(pluginHeaderCells[0]?.style.whiteSpace).toBe("nowrap");
+    expect(pluginHeaderCells[1]?.style.whiteSpace).toBe("nowrap");
+    expect(
+      Number.parseFloat(
+        (
+          document.querySelector('[data-testid="right-header"]') as HTMLElement
+        ).style.width
+      )
+    ).toBe(350);
+    expect(
+      Number.parseFloat(
+        (
+          document.querySelector('[data-testid="right-section"]') as HTMLElement
+        ).style.width
+      )
+    ).toBe(350);
     expect(table.rows.map((row) => row.authorId)).toEqual(["111", "222"]);
 
     renderMarketRowState(table.rows[0], {
       authorId: "111",
       authorName: "达人 A",
+      backendMetrics: {
+        a3IncreaseCount: "78,366.22",
+        afterViewSearchCount: "9,689.96",
+        afterViewSearchRate: "0.36%",
+        cpSearch: "14.46",
+        cpa3: "1.79",
+        newA3Rate: "3.44%"
+      },
+      backendMetricsStatus: "success",
       status: "success",
       rates: {
         singleVideoAfterSearchRate: "0.5%-1%",
@@ -140,12 +249,21 @@ describe("market-dom-sync", () => {
       }
     });
 
-    expect(readRightRowTexts(0)).toEqual([
+    expect(readRightRowTexts(0)).toEqual(["¥450,000", "下单"]);
-      "¥450,000",
+    expect(readPluginRowTexts(0)).toEqual([
       "0.5% - 1%",
       "0.02% - 0.1%",
-      "下单"
+      "0.36%",
+      "9,689.96",
+      "78,366.22",
+      "3.44%",
+      "1.79",
+      "14.46"
     ]);
+    expect(table.rows[0].singleCell.style.width).toBe("160px");
+    expect(table.rows[0].personalCell.style.width).toBe("160px");
+    expect(table.rows[0].singleCell.style.whiteSpace).toBe("nowrap");
+    expect(table.rows[0].personalCell.style.whiteSpace).toBe("nowrap");
 
     applyRowVisibility(table, new Set(["222"]));
 
@@ -156,7 +274,8 @@ describe("market-dom-sync", () => {
     applyRowOrder(table, ["222", "111"]);
 
     expect(readAuthorNames()).toEqual(["达人 B", "达人 A"]);
-    expect(readRightRowTexts(0)).toEqual(["¥20,000", "", "", "下单"]);
+    expect(readRightRowTexts(0)).toEqual(["¥20,000", "下单"]);
+    expect(readPluginRowTexts(0)).toEqual(["", "", "", "", "", "", "", ""]);
     expect(table.rows[0].exportFields).toMatchObject({
       "21-60s报价": "¥450,000",
       "代表视频": "代表视频A",
@@ -164,6 +283,130 @@ describe("market-dom-sync", () => {
     });
   });
 
+  test("keeps a single scroll hint across repeated syncs", () => {
+    document.body.innerHTML = buildRealMarketGridFixture();
+
+    expect(syncMarketTable(document)).not.toBeNull();
+    expect(syncMarketTable(document)).not.toBeNull();
+
+    expect(document.querySelectorAll('[data-testid="market-scroll-hint"]')).toHaveLength(1);
+    expect(readScrollHintText()).toBe("横向滚动可查看看后搜率、秒探指标");
+  });
+
+  test("keeps reading native author rows after the selection column is injected", () => {
+    document.body.innerHTML = buildRealMarketGridFixture();
+
+    expect(syncMarketTable(document)?.rows.map((row) => row.authorId)).toEqual([
+      "111",
+      "222"
+    ]);
+
+    const table = syncMarketTable(document);
+
+    expect(table?.rows.map((row) => row.authorId)).toEqual(["111", "222"]);
+    expect(readAuthorNames()).toEqual(["达人 A", "达人 B"]);
+  });
+
+  test("inserts the selection column before the native author column", () => {
+    document.body.innerHTML = buildRealMarketGridFixture();
+
+    const table = syncMarketTable(document);
+    if (!table) {
+      throw new Error("Expected market table");
+    }
+
+    expect(readAuthorSectionColumnKeys()).toEqual(["selection", "author"]);
+  });
+
+  test("keeps the selection cells aligned to the native author row heights", () => {
+    document.body.innerHTML = buildRealMarketGridFixture();
+
+    const table = syncMarketTable(document);
+    if (!table) {
+      throw new Error("Expected market table");
+    }
+
+    expect(readSelectionCellHeights()).toEqual(["120px", "120px"]);
+  });
+
+  test("uses native-like alignment styles for plugin cells", () => {
+    document.body.innerHTML = buildRealMarketGridFixtureWithScopedAttributes();
+
+    const table = syncMarketTable(document);
+    if (!table) {
+      throw new Error("Expected market table");
+    }
+
+    const pluginHeaderCell = document.querySelector(
+      '[data-testid="plugin-header"] [data-market-header-cell="singleVideoAfterSearchRate"]'
+    ) as HTMLElement | null;
+    const pluginBodyCell = table.rows[0].singleCell;
+
+    expect(pluginHeaderCell?.style.display).toBe("flex");
+    expect(pluginHeaderCell?.style.alignItems).toBe("center");
+    expect(pluginBodyCell.style.display).toBe("flex");
+    expect(pluginBodyCell.style.alignItems).toBe("center");
+    expect(pluginBodyCell.style.paddingTop).toBe("12px");
+    expect(pluginBodyCell.style.paddingBottom).toBe("12px");
+  });
+
+  test("keeps native-like alignment styles after repeated syncs", () => {
+    document.body.innerHTML = buildRealMarketGridFixtureWithScopedAttributes();
+
+    expect(syncMarketTable(document)).not.toBeNull();
+    const secondTable = syncMarketTable(document);
+    if (!secondTable) {
+      throw new Error("Expected market table");
+    }
+
+    const pluginBodyCell = secondTable.rows[0].singleCell;
+    expect(pluginBodyCell.style.display).toBe("flex");
+    expect(pluginBodyCell.style.alignItems).toBe("center");
+    expect(pluginBodyCell.style.paddingTop).toBe("12px");
+    expect(pluginBodyCell.style.paddingBottom).toBe("12px");
+    expect(pluginBodyCell.hasAttribute("data-v-cell-scope")).toBe(true);
+  });
+
+  test("keeps export field alignment when a row is missing the price cell", () => {
+    document.body.innerHTML = buildRealMarketGridFixtureWithMissingPriceCell();
+
+    const initialTable = syncMarketTable(document);
+    if (!initialTable) {
+      throw new Error("Expected market table");
+    }
+
+    renderMarketRowState(initialTable.rows[1], {
+      authorId: "222",
+      authorName: "达人 B",
+      backendMetrics: {
+        a3IncreaseCount: "78,366.22",
+        afterViewSearchCount: "9,689.96",
+        afterViewSearchRate: "0.36%",
+        cpSearch: "14.46",
+        cpa3: "1.79",
+        newA3Rate: "3.44%"
+      },
+      backendMetricsStatus: "success",
+      status: "success",
+      rates: {
+        singleVideoAfterSearchRate: "0.5%-1%",
+        personalVideoAfterSearchRate: "0.02 - 0.1%"
+      }
+    });
+
+    const table = syncMarketTable(document);
+    if (!table) {
+      throw new Error("Expected market table after rerender");
+    }
+
+    expect(table.rows[1].exportFields).toMatchObject({
+      "21-60s报价": "",
+      "代表视频": "代表视频B",
+      "达人信息": "达人 B"
+    });
+    expect(table.rows[1].exportFields?.["21-60s报价"]).not.toContain("看后搜率");
+  });
+
   test("falls back to the market vue state when the DOM has no author id", () => {
     document.body.innerHTML = buildRealMarketGridFixtureWithoutAuthorIds();
     attachMarketVueState([
@@ -189,6 +432,146 @@ describe("market-dom-sync", () => {
     expect(table.rows.map((row) => row.authorId)).toEqual(["111", "222"]);
   });
 
+  test("fills blank export cells from the market vue state", () => {
+    document.body.innerHTML = buildRichMarketGridFixtureWithBlankSecondRow();
+    attachMarketVueState([
+      {
+        attribute_datas: {
+          avg_search_after_view_rate_30d: "0.003",
+          burst_text_rate: "1",
+          city: "温州",
+          content_theme_labels_180d: ["有趣剧情创作", "亲情剧集", "情感短剧"],
+          follower: "4550556",
+          gender: "2",
+          interact_rate_within_30d: "0.0572",
+          link_link_cnt_by_industry: "27029613",
+          nickname: "达人 A",
+          play_over_rate_within_30d: "0.263",
+          price_20_60: "155000",
+          prospective_20_60_cpm: "21.2362",
+          tags_relation: {
+            剧情搞笑: ["剧情"]
+          }
+        },
+        expected_play_num: "7298854",
+        star_id: "111"
+      },
+      {
+        attribute_datas: {
+          avg_search_after_view_rate_30d: "0.003",
+          burst_text_rate: "0",
+          city: "杭州",
+          content_theme_labels_180d: ["搞笑剧情", "大学宿舍趣事", "校园生活"],
+          follower: "901234",
+          gender: "2",
+          interact_rate_within_30d: "0.072",
+          link_link_cnt_by_industry: "20773000",
+          nickname: "达人 B",
+          play_over_rate_within_30d: "0.35",
+          price_20_60: "38000",
+          prospective_20_60_cpm: "182.5",
+          tags_relation: {
+            剧情搞笑: ["剧情"]
+          }
+        },
+        expected_play_num: "208000",
+        star_id: "222"
+      }
+    ]);
+
+    const table = syncMarketTable(document);
+    if (!table) {
+      throw new Error("Expected market table");
+    }
+
+    expect(table.rows[1].authorId).toBe("222");
+    expect(table.rows[1].price21To60s).toBe("¥38,000");
+    expect(table.rows[1].exportFields).toMatchObject({
+      "21-60s报价": "¥38,000",
+      互动率: "7.2%",
+      内容主题: "搞笑剧情 大学宿舍趣事 1+",
+      完播率: "35%",
+      爆文率: "-",
+      粉丝数: "90.1w",
+      达人信息: "达人 B 女 杭州",
+      达人类型: "剧情搞笑",
+      连接用户数: "2,077.3w",
+      预期CPM: "182.5",
+      预期播放量: "20.8w"
+    });
+    expect(table.rows[1].rates).toEqual({
+      singleVideoAfterSearchRate: "0.3%"
+    });
+  });
+
+  test("finds market rows in nested vue children", () => {
+    document.body.innerHTML = buildRichMarketGridFixtureWithBlankSecondRow();
+    attachNestedMarketVueState([
+      {
+        attribute_datas: {
+          city: "杭州",
+          follower: "901234",
+          gender: "2",
+          interact_rate_within_30d: "0.072",
+          link_link_cnt_by_industry: "20773000",
+          nickname: "达人 B",
+          play_over_rate_within_30d: "0.35",
+          price_20_60: "38000",
+          prospective_20_60_cpm: "182.5",
+          tags_relation: {
+            剧情搞笑: ["剧情"]
+          }
+        },
+        expected_play_num: "208000",
+        star_id: "222"
+      }
+    ]);
+
+    const table = syncMarketTable(document);
+    if (!table) {
+      throw new Error("Expected market table");
+    }
+
+    expect(table.rows[1].price21To60s).toBe("¥38,000");
+    expect(table.rows[1].exportFields).toMatchObject({
+      粉丝数: "90.1w",
+      预期播放量: "20.8w",
+      互动率: "7.2%"
+    });
+  });
+
+  test("prefers vue fallback when the price cell is polluted", () => {
+    document.body.innerHTML = buildRichMarketGridFixtureWithPollutedSecondPrice();
+    attachMarketVueState([
+      {
+        attribute_datas: {
+          city: "杭州",
+          follower: "901234",
+          gender: "2",
+          interact_rate_within_30d: "0.072",
+          link_link_cnt_by_industry: "20773000",
+          nickname: "达人 B",
+          play_over_rate_within_30d: "0.35",
+          price_20_60: "38000",
+          prospective_20_60_cpm: "182.5",
+          tags_relation: {
+            剧情搞笑: ["剧情"]
+          }
+        },
+        expected_play_num: "208000",
+        star_id: "222"
+      }
+    ]);
+
+    const table = syncMarketTable(document);
+    if (!table) {
+      throw new Error("Expected market table");
+    }
+
+    expect(table.rows[1].price21To60s).toBe("¥38,000");
+    expect(table.rows[1].exportFields?.["21-60s报价"]).toBe("¥38,000");
+  });
+
   test("falls back to serialized market rows when vue state is unavailable", () => {
     document.body.innerHTML = buildRealMarketGridFixtureWithoutAuthorIds();
     document.documentElement.setAttribute(
@@ -215,6 +598,7 @@ describe("market-dom-sync", () => {
     expect(table.rows[0].rates).toEqual({
       singleVideoAfterSearchRate: "0.02%"
     });
+    expect(readMarketPageSignature(document)).toContain("::111|222");
   });
 
   test("finds the real next-page button in Xingtu pagination", () => {
@@ -243,6 +627,16 @@ describe("market-dom-sync", () => {
     expect(isPageControlDisabled(nextControl)).toBe(false);
     expect(readMarketPageSignature(document)).toContain("1::111|222");
   });
+
+  test("reads market page signature without mutating the page", () => {
+    document.body.innerHTML = buildRealMarketGridFixture();
+
+    const signature = readMarketPageSignature(document);
+
+    expect(signature).toContain("::111|222");
+    expect(document.querySelector('[data-testid="plugin-header"]')).toBeNull();
+    expect(document.querySelector('[data-testid="plugin-section"]')).toBeNull();
+  });
 });
 
 function buildRealMarketGridFixture() {
@@ -330,8 +724,167 @@ function buildRealMarketGridFixtureWithoutAuthorIds() {
   `;
 }
 
+function buildRealMarketGridFixtureWithMissingPriceCell() {
+  return `
+    <div class="base-author-list">
+      <div class="section-wrapper sticky-header hide-scrollbar">
+        <div style="width: 310px; display: flex; position: sticky; left: 0; z-index: 11;">
+          <div class="header-cell" style="min-width: 310px;">达人信息</div>
+        </div>
+        <div class="middle-columns" style="width: 190px; display: flex;">
+          <div class="header-cell" style="min-width: 190px;">代表视频</div>
+        </div>
+        <div data-testid="right-header" style="width: 350px; display: flex; position: sticky; right: 0; z-index: 11;">
+          <div class="header-cell" style="min-width: 150px;">21-60s报价</div>
+          <div class="header-cell" style="min-width: 200px;">操作</div>
+        </div>
+      </div>
+      <div class="section-wrapper hide-scrollbar">
+        <div class="content-section" data-testid="author-section" style="width: 310px; display: flex; position: sticky; left: 0; z-index: 11;">
+          <div class="content-column" style="min-width: 310px;">
+            <div class="content-cell" data-testid="author-cell-111" style="height: 120px;">
+              <a href="https://xingtu.cn/ad/creator/author-homepage/douyin-video/111">达人 A</a>
+            </div>
+            <div class="content-cell" data-testid="author-cell-222" style="height: 120px;">
+              <a href="https://xingtu.cn/ad/creator/author-homepage/douyin-video/222">达人 B</a>
+            </div>
+          </div>
+        </div>
+        <div class="middle-columns" style="width: 190px; display: flex;">
+          <div class="content-column" style="min-width: 190px;">
+            <div class="content-cell" style="height: 120px;">代表视频A</div>
+            <div class="content-cell" style="height: 120px;">代表视频B</div>
+          </div>
+        </div>
+        <div data-testid="right-section" class="content-section" style="width: 350px; display: flex; position: sticky; right: 0; z-index: 11;">
+          <div class="content-column" style="min-width: 150px;">
+            <div class="content-cell" style="height: 120px;">¥450,000</div>
+          </div>
+          <div class="content-column" style="min-width: 200px;">
+            <div class="content-cell" data-testid="action-cell-111" style="height: 120px;">下单</div>
+            <div class="content-cell" data-testid="action-cell-222" style="height: 120px;">下单</div>
+          </div>
+        </div>
+      </div>
+    </div>
+  `;
+}
+
+function buildRealMarketGridFixtureWithScopedAttributes() {
+  return buildRealMarketGridFixture()
+    .replace(
+      '<div class="header-cell" style="min-width: 190px;">代表视频</div>',
+      '<div data-v-header-scope class="header-cell" style="min-width: 190px;">代表视频</div>'
+    )
+    .replace(
+      '<div class="content-cell" style="height: 120px;">代表视频A</div>',
+      '<div data-v-cell-scope class="content-cell" style="height: 120px;">代表视频A</div>'
+    )
+    .replace(
+      '<div class="content-cell" style="height: 120px;">代表视频B</div>',
+      '<div data-v-cell-scope class="content-cell" style="height: 120px;">代表视频B</div>'
+    );
+}
+
+function buildRichMarketGridFixtureWithBlankSecondRow() {
+  return `
+    <div class="base-author-list">
+      <div class="section-wrapper sticky-header hide-scrollbar">
+        <div style="width: 310px; display: flex; position: sticky; left: 0; z-index: 11;">
+          <div class="header-cell" style="min-width: 310px;">达人信息</div>
+        </div>
+        <div class="middle-columns" style="width: 1210px; display: flex;">
+          <div class="header-cell" style="min-width: 190px;">代表视频</div>
+          <div class="header-cell" style="min-width: 120px;">达人类型</div>
+          <div class="header-cell" style="min-width: 180px;">内容主题</div>
+          <div class="header-cell" style="min-width: 120px;">连接用户数</div>
+          <div class="header-cell" style="min-width: 120px;">粉丝数</div>
+          <div class="header-cell" style="min-width: 120px;">预期CPM</div>
+          <div class="header-cell" style="min-width: 120px;">预期播放量</div>
+          <div class="header-cell" style="min-width: 120px;">互动率</div>
+          <div class="header-cell" style="min-width: 120px;">完播率</div>
+          <div class="header-cell" style="min-width: 120px;">爆文率</div>
+        </div>
+        <div data-testid="right-header" style="width: 350px; display: flex; position: sticky; right: 0; z-index: 11;">
+          <div class="header-cell" style="min-width: 150px;">21-60s报价</div>
+          <div class="header-cell" style="min-width: 200px;">操作</div>
+        </div>
+      </div>
+      <div class="section-wrapper hide-scrollbar">
+        <div class="content-section" style="width: 310px; display: flex; position: sticky; left: 0; z-index: 11;">
+          <div class="content-column" style="min-width: 310px;">
+            <div class="content-cell" style="height: 120px;">
+              <a href="https://xingtu.cn/ad/creator/author-homepage/douyin-video/111">达人 A</a>
+            </div>
+            <div class="content-cell" style="height: 120px;"></div>
+          </div>
+        </div>
+        <div class="middle-columns" style="width: 1210px; display: flex;">
+          <div class="content-column" style="min-width: 190px;">
+            <div class="content-cell" style="height: 120px;">代表视频A</div>
+            <div class="content-cell" style="height: 120px;"></div>
+          </div>
+          <div class="content-column" style="min-width: 120px;">
+            <div class="content-cell" style="height: 120px;">剧情搞笑</div>
+            <div class="content-cell" style="height: 120px;"></div>
+          </div>
+          <div class="content-column" style="min-width: 180px;">
+            <div class="content-cell" style="height: 120px;">有趣剧情创作 亲情剧集 1+</div>
+            <div class="content-cell" style="height: 120px;"></div>
+          </div>
+          <div class="content-column" style="min-width: 120px;">
+            <div class="content-cell" style="height: 120px;">2,703w</div>
+            <div class="content-cell" style="height: 120px;"></div>
+          </div>
+          <div class="content-column" style="min-width: 120px;">
+            <div class="content-cell" style="height: 120px;">455.1w</div>
+            <div class="content-cell" style="height: 120px;"></div>
+          </div>
+          <div class="content-column" style="min-width: 120px;">
+            <div class="content-cell" style="height: 120px;">21.2</div>
+            <div class="content-cell" style="height: 120px;"></div>
+          </div>
+          <div class="content-column" style="min-width: 120px;">
+            <div class="content-cell" style="height: 120px;">729.9w</div>
+            <div class="content-cell" style="height: 120px;"></div>
+          </div>
+          <div class="content-column" style="min-width: 120px;">
+            <div class="content-cell" style="height: 120px;">5.7%</div>
+            <div class="content-cell" style="height: 120px;"></div>
+          </div>
+          <div class="content-column" style="min-width: 120px;">
+            <div class="content-cell" style="height: 120px;">26.3%</div>
+            <div class="content-cell" style="height: 120px;"></div>
+          </div>
+          <div class="content-column" style="min-width: 120px;">
+            <div class="content-cell" style="height: 120px;">100%</div>
+            <div class="content-cell" style="height: 120px;"></div>
+          </div>
+        </div>
+        <div class="content-section" style="width: 350px; display: flex; position: sticky; right: 0; z-index: 11;">
+          <div class="content-column" style="min-width: 150px;">
+            <div class="content-cell" style="height: 120px;">¥155,000</div>
+            <div class="content-cell" style="height: 120px;"></div>
+          </div>
+          <div class="content-column" style="min-width: 200px;">
+            <div class="content-cell" style="height: 120px;">下单</div>
+            <div class="content-cell" style="height: 120px;">下单</div>
+          </div>
+        </div>
+      </div>
+    </div>
+  `;
+}
+
+function buildRichMarketGridFixtureWithPollutedSecondPrice() {
+  return buildRichMarketGridFixtureWithBlankSecondRow().replace(
+    '<div class="content-cell" style="height: 120px;"></div>\n          </div>\n          <div class="content-column" style="min-width: 200px;">',
+    '<div class="content-cell" style="height: 120px;">看后搜率0.39%看后搜数2,248.33新增A3数0.00新增A3率0%CPA30.00cp_search20.01</div>\n          </div>\n          <div class="content-column" style="min-width: 200px;">'
+  );
+}
+
 function attachMarketVueState(
-  marketList: Array<{ attribute_datas?: { nickname?: string }; star_id?: string }>
+  marketList: Array<Record<string, unknown>>
 ) {
   const marketRoot = document.querySelector(".base-author-list");
   if (!(marketRoot instanceof HTMLElement)) {
@@ -350,6 +903,40 @@ function attachMarketVueState(
   });
 }
 
+function attachNestedMarketVueState(marketList: Array<Record<string, unknown>>) {
+  const marketRoot = document.querySelector(".base-author-list");
+  if (!(marketRoot instanceof HTMLElement)) {
+    throw new Error("Expected market root");
+  }
+
+  Object.defineProperty(marketRoot, "__vue__", {
+    configurable: true,
+    value: {
+      $children: [
+        {
+          $children: [
+            {
+              _setupState: {},
+              $children: [
+                {
+                  _setupState: {
+                    __$temp_1: {
+                      marketList
+                    }
+                  },
+                  $children: []
+                }
+              ]
+            }
+          ],
+          _setupState: {}
+        }
+      ],
+      _setupState: {}
+    }
+  });
+}
+
 function readRightHeaderTexts() {
   return Array.from(
     document.querySelectorAll('[data-testid="right-header"] > *'),
@@ -357,18 +944,74 @@ function readRightHeaderTexts() {
   );
 }
 
-function readRightRowTexts(rowIndex: number) {
+function readPluginHeaderTexts() {
   return Array.from(
-    document.querySelectorAll('[data-testid="right-section"] > .content-column'),
+    document.querySelectorAll('[data-testid="plugin-header"] > *'),
-    (column) =>
+    (cell) => cell.textContent?.trim() ?? ""
-      column.querySelectorAll(".content-cell")[rowIndex]?.textContent?.trim() ?? ""
   );
 }
 
-function readAuthorNames() {
+function readRightRowTexts(rowIndex: number) {
   return Array.from(
-    document.querySelectorAll('[data-testid="author-section"] .content-cell a'),
+    document.querySelectorAll('[data-testid="right-section"] > .content-column'),
-    (link) => link.textContent?.trim() ?? ""
+    (column) => readVisualCells(column as Element)[rowIndex]?.textContent?.trim() ?? ""
+  );
+}
+
+function readPluginRowTexts(rowIndex: number) {
+  return Array.from(
+    document.querySelectorAll('[data-testid="plugin-section"] > .content-column'),
+    (column) => readVisualCells(column as Element)[rowIndex]?.textContent?.trim() ?? ""
+  );
+}
+
+function readScrollHintText() {
+  return (
+    document.querySelector('[data-testid="market-scroll-hint"]')?.textContent?.trim() ?? ""
+  );
+}
+
+function readSelectionHeaderText() {
+  return (
+    document
+      .querySelector('[data-market-header-cell="selection"]')
+      ?.textContent?.trim() ?? ""
+  );
+}
+
+function readSelectionRowCheckboxCount() {
+  return document.querySelectorAll('[data-market-selection-checkbox="row"]').length;
+}
+
+function readAuthorNames() {
+  const authorColumn = Array.from(
+    document.querySelectorAll('[data-testid="author-section"] > .content-column')
+  ).find((column) => (column as HTMLElement).querySelector("a")) as Element | null;
+  return readVisualCells(authorColumn).map(
+    (cell) => cell.querySelector("a")?.textContent?.trim() ?? ""
+  );
+}
+
+function readAuthorSectionColumnKeys() {
+  return Array.from(
+    document.querySelectorAll('[data-testid="author-section"] > .content-column'),
+    (column) => {
+      const element = column as HTMLElement;
+      if (element.dataset.marketColumnGroup) {
+        return element.dataset.marketColumnGroup;
+      }
+
+      return element.querySelector("a") ? "author" : "unknown";
+    }
+  );
+}
+
+function readSelectionCellHeights() {
+  return Array.from(
+    document.querySelectorAll(
+      '[data-testid="author-section"] [data-market-column-group="selection"] > .content-cell'
+    ),
+    (cell) => (cell as HTMLElement).style.height
   );
 }
 
@@ -385,3 +1028,22 @@ function readRightActionHiddenStates() {
     (cell) => (cell as HTMLElement).hidden
   );
 }
+
+function readVisualCells(root: Element | null): HTMLElement[] {
+  if (!root) {
+    return [];
+  }
+
+  return Array.from(root.querySelectorAll(":scope > .content-cell"))
+    .filter((cell): cell is HTMLElement => cell instanceof HTMLElement)
+    .sort((left, right) => {
+      const leftOrder = Number(left.style.order || "0");
+      const rightOrder = Number(right.style.order || "0");
+      if (leftOrder !== rightOrder) {
+        return leftOrder - rightOrder;
+      }
+
+      const cells = Array.from(root.querySelectorAll(":scope > .content-cell"));
+      return cells.indexOf(left) - cells.indexOf(right);
+    });
+}

tests/market-page-bridge.test.ts

@@ -0,0 +1,129 @@
+// @vitest-environment jsdom
+// @vitest-environment-options {"url":"https://www.xingtu.cn/ad/creator/market"}
+
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+
+describe("market-page-bridge", () => {
+  beforeEach(() => {
+    document.body.innerHTML = '<div class="base-author-list"></div>';
+    document.documentElement.removeAttribute("data-sces-market-request-snapshot");
+    vi.spyOn(window, "setInterval").mockReturnValue(0 as unknown as number);
+  });
+
+  afterEach(() => {
+    delete (
+      window as Window & {
+        __SCES_MARKET_PAGE_BRIDGE_INSTALLED__?: boolean;
+      }
+    ).__SCES_MARKET_PAGE_BRIDGE_INSTALLED__;
+    vi.restoreAllMocks();
+    vi.resetModules();
+  });
+
+  test("ignores non-search market list responses when capturing the export snapshot", async () => {
+    const originalFetch = vi.fn(async () => ({
+      clone() {
+        return this;
+      },
+      json: async () => ({
+        authors: [
+          {
+            attribute_datas: {
+              nickname: "推荐达人"
+            },
+            star_id: "recommend-1"
+          }
+        ],
+        pagination: {
+          limit: 20,
+          page: 1,
+          total_count: 20
+        }
+      })
+    }));
+
+    (
+      window as Window & {
+        fetch: typeof fetch;
+      }
+    ).fetch = originalFetch as unknown as typeof fetch;
+
+    await import("../src/content/market/page-bridge");
+
+    await window.fetch("/gw/api/gauthor/demander_get_recommend_author_lists_v2", {
+      headers: {
+        Accept: "application/json, text/plain, */*"
+      },
+      method: "GET"
+    });
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(
+      document.documentElement.getAttribute("data-sces-market-request-snapshot")
+    ).toBeNull();
+  });
+
+  test("captures the search_for_author_square request for silent export", async () => {
+    const originalFetch = vi.fn(async () => ({
+      clone() {
+        return this;
+      },
+      json: async () => ({
+        authors: [
+          {
+            attribute_datas: {
+              nickname: "搜索达人"
+            },
+            star_id: "search-1"
+          }
+        ],
+        pagination: {
+          limit: 20,
+          page: 1,
+          total_count: 20
+        }
+      })
+    }));
+
+    (
+      window as Window & {
+        fetch: typeof fetch;
+      }
+    ).fetch = originalFetch as unknown as typeof fetch;
+
+    await import("../src/content/market/page-bridge");
+
+    await window.fetch("/gw/api/gsearch/search_for_author_square", {
+      body: JSON.stringify({
+        page_param: {
+          page: "1"
+        }
+      }),
+      headers: {
+        "Content-Type": "application/json"
+      },
+      method: "POST"
+    });
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(
+      JSON.parse(
+        document.documentElement.getAttribute(
+          "data-sces-market-request-snapshot"
+        ) ?? "null"
+      )
+    ).toEqual(
+      expect.objectContaining({
+        body: JSON.stringify({
+          page_param: {
+            page: "1"
+          }
+        }),
+        method: "POST",
+        url: "/gw/api/gsearch/search_for_author_square"
+      })
+    );
+  });
+});

tests/mock-protected-api.test.ts

@@ -0,0 +1,79 @@
+import { afterEach, describe, expect, test } from "vitest";
+
+import { createMockProtectedApiServer } from "../scripts/mock-protected-api.mjs";
+
+const servers: Array<{ close: () => Promise<void> }> = [];
+
+afterEach(async () => {
+  while (servers.length > 0) {
+    await servers.pop()?.close();
+  }
+});
+
+describe("mock-protected-api", () => {
+  test("returns mock data when a Bearer token is present", async () => {
+    const server = createMockProtectedApiServer({ port: 0 });
+    await server.start();
+    servers.push(server);
+
+    const response = await fetch(`${server.baseUrl}/api/mock/protected`, {
+      headers: {
+        Authorization: "Bearer abc123"
+      }
+    });
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual(
+      expect.objectContaining({
+        ok: true,
+        source: "mock-protected-api"
+      })
+    );
+  });
+
+  test("returns 401 when the Authorization header is missing", async () => {
+    const server = createMockProtectedApiServer({ port: 0 });
+    await server.start();
+    servers.push(server);
+
+    const response = await fetch(`${server.baseUrl}/api/mock/protected`);
+
+    expect(response.status).toBe(401);
+    await expect(response.json()).resolves.toEqual({
+      ok: false,
+      error: "unauthorized"
+    });
+  });
+
+  test("accepts a batch payload when a Bearer token is present", async () => {
+    const server = createMockProtectedApiServer({ port: 0 });
+    await server.start();
+    servers.push(server);
+
+    const response = await fetch(`${server.baseUrl}/api/mock/batches`, {
+      body: JSON.stringify({
+        authors: [{ authorId: "111", authorName: "达人A" }],
+        batchName: "批次A",
+        createdAt: "2026-04-22T12:30:00.000Z",
+        creatorName: "王少卿",
+        logtoUserId: "p7pdhhtde8kj",
+        resource: "https://talent-search.intelligrow.cn"
+      }),
+      headers: {
+        Authorization: "Bearer abc123",
+        "Content-Type": "application/json"
+      },
+      method: "POST"
+    });
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual(
+      expect.objectContaining({
+        acceptedCount: 1,
+        batchId: null,
+        ok: true,
+        source: "mock-batch-submit"
+      })
+    );
+  });
+});

tests/popup-entry.test.ts

@@ -0,0 +1,188 @@
+import { JSDOM } from "jsdom";
+import { beforeEach, describe, expect, test, vi } from "vitest";
+
+import { bootPopup } from "../src/popup/index";
+
+describe("popup-entry", () => {
+  let dom: JSDOM;
+
+  beforeEach(() => {
+    dom = new JSDOM("<!doctype html><html><body></body></html>");
+  });
+
+  test("renders a sign-in button when unauthenticated", async () => {
+    dom.window.document.body.innerHTML = "<main id='app'></main>";
+
+    await bootPopup({
+      document: dom.window.document,
+      sendMessage: vi.fn(async () => ({
+        ok: true,
+        type: "auth:state",
+        value: { isAuthenticated: false }
+      }))
+    });
+
+    expect(dom.window.document.querySelector("button")?.textContent).toContain(
+      "登录"
+    );
+  });
+
+  test("renders the dev auth panel when enabled", async () => {
+    dom.window.document.body.innerHTML = "<main id='app'></main>";
+
+    await bootPopup({
+      config: { enableDevAuthPanel: true },
+      document: dom.window.document,
+      sendMessage: vi.fn(async () => ({
+        ok: true,
+        type: "auth:state",
+        value: {
+          accessTokenExpiresAt: 1700000000000,
+          isAuthenticated: true,
+          resource: "https://api.example.test",
+          scopes: ["openid", "profile"],
+          tokenAvailable: true,
+          userInfo: { email: "dev@example.com", name: "Dev" }
+        }
+      }))
+    });
+
+    expect(dom.window.document.body.textContent).toContain("resource");
+    expect(dom.window.document.body.textContent).toContain("token");
+  });
+
+  test("renders a protected api test button in the dev panel", async () => {
+    dom.window.document.body.innerHTML = "<main id='app'></main>";
+
+    await bootPopup({
+      config: { enableDevAuthPanel: true },
+      document: dom.window.document,
+      sendMessage: vi.fn(async () => ({
+        ok: true,
+        type: "auth:state",
+        value: {
+          isAuthenticated: true,
+          tokenAvailable: true
+        }
+      }))
+    });
+
+    expect(
+      dom.window.document.querySelector('[data-popup-test-protected-api="button"]')
+    ).not.toBeNull();
+  });
+
+  test("clicking the dev button runs the protected api client and prints the result", async () => {
+    const fetchProtectedApi = vi.fn(async () => ({
+      message: "authorized",
+      ok: true,
+      source: "mock-protected-api"
+    }));
+    const sendMessage = vi.fn(async () => ({
+      ok: true,
+      type: "auth:state",
+      value: {
+        isAuthenticated: true,
+        tokenAvailable: true
+      }
+    }));
+
+    dom.window.document.body.innerHTML = "<main id='app'></main>";
+
+    await bootPopup({
+      config: { enableDevAuthPanel: true },
+      document: dom.window.document,
+      fetchProtectedApi,
+      sendMessage
+    });
+
+    (
+      dom.window.document.querySelector(
+        '[data-popup-test-protected-api="button"]'
+      ) as HTMLButtonElement | null
+    )?.click();
+
+    await Promise.resolve();
+
+    expect(fetchProtectedApi).toHaveBeenCalledTimes(1);
+    expect(dom.window.document.body.textContent).toContain("authorized");
+    expect(dom.window.document.body.textContent).toContain("mock-protected-api");
+  });
+
+  test("clicking sign-out sends the auth:sign-out message", async () => {
+    const sendMessage = vi
+      .fn()
+      .mockResolvedValueOnce({
+        ok: true,
+        type: "auth:state",
+        value: {
+          isAuthenticated: true,
+          userInfo: { email: "dev@example.com", name: "Dev" }
+        }
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        type: "auth:ack"
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        type: "auth:state",
+        value: {
+          isAuthenticated: false
+        }
+      });
+
+    dom.window.document.body.innerHTML = "<main id='app'></main>";
+
+    await bootPopup({
+      document: dom.window.document,
+      sendMessage
+    });
+
+    (
+      dom.window.document.querySelector('[data-popup-sign-out="button"]') as
+        | HTMLButtonElement
+        | null
+    )?.click();
+
+    await Promise.resolve();
+
+    expect(sendMessage).toHaveBeenCalledWith({ type: "auth:sign-out" });
+  });
+
+  test("shows the auth error when sign-in fails", async () => {
+    const sendMessage = vi
+      .fn()
+      .mockResolvedValueOnce({
+        ok: true,
+        type: "auth:state",
+        value: {
+          isAuthenticated: false
+        }
+      })
+      .mockResolvedValueOnce({
+        error: "redirect_uri_mismatch",
+        ok: false,
+        type: "auth:error"
+      });
+
+    dom.window.document.body.innerHTML = "<main id='app'></main>";
+
+    await bootPopup({
+      document: dom.window.document,
+      sendMessage
+    });
+
+    (
+      dom.window.document.querySelector('[data-popup-sign-in="button"]') as
+        | HTMLButtonElement
+        | null
+    )?.click();
+
+    await Promise.resolve();
+
+    expect(dom.window.document.body.textContent).toContain(
+      "redirect_uri_mismatch"
+    );
+  });
+});

tests/protected-api-client.test.ts

@@ -0,0 +1,73 @@
+import { describe, expect, test, vi } from "vitest";
+
+import { createProtectedApiClient } from "../src/shared/protected-api-client";
+
+describe("protected-api-client", () => {
+  test("requests a token before calling the protected endpoint", async () => {
+    const sendMessage = vi.fn(async () => ({
+      ok: true,
+      type: "auth:token",
+      value: { accessToken: "abc123" }
+    }));
+    const fetchImpl = vi.fn(async () => ({
+      ok: true,
+      status: 200,
+      json: async () => ({ ok: true })
+    }));
+
+    const client = createProtectedApiClient({
+      baseUrl: "http://127.0.0.1:4319",
+      fetchImpl,
+      sendMessage
+    });
+
+    await client.loadProtectedMockData();
+
+    expect(sendMessage).toHaveBeenCalledWith({ type: "auth:get-access-token" });
+    expect(fetchImpl).toHaveBeenCalledWith(
+      "http://127.0.0.1:4319/api/mock/protected",
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: "Bearer abc123"
+        }),
+        method: "GET"
+      })
+    );
+  });
+
+  test("throws before fetch when the token is unavailable", async () => {
+    const sendMessage = vi.fn(async () => ({
+      ok: false,
+      type: "auth:error",
+      error: "token missing"
+    }));
+    const fetchImpl = vi.fn();
+
+    const client = createProtectedApiClient({
+      baseUrl: "http://127.0.0.1:4319",
+      fetchImpl,
+      sendMessage
+    });
+
+    await expect(client.loadProtectedMockData()).rejects.toThrow(/token/i);
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  test("throws an authorization error on 401", async () => {
+    const client = createProtectedApiClient({
+      baseUrl: "http://127.0.0.1:4319",
+      fetchImpl: vi.fn(async () => ({
+        ok: false,
+        status: 401,
+        json: async () => ({ ok: false, error: "unauthorized" })
+      })),
+      sendMessage: vi.fn(async () => ({
+        ok: true,
+        type: "auth:token",
+        value: { accessToken: "abc123" }
+      }))
+    });
+
+    await expect(client.loadProtectedMockData()).rejects.toThrow(/unauthorized/i);
+  });
+});

tests/silent-export-controller.test.ts

@@ -0,0 +1,263 @@
+// @vitest-environment jsdom
+
+import { describe, expect, test } from "vitest";
+
+import { createSilentExportController } from "../src/content/market/silent-export-controller";
+
+describe("silent-export-controller", () => {
+  test("replays exports from the live market page state when the request snapshot attribute is missing", async () => {
+    document.body.innerHTML = '<div class="base-author-list"></div>';
+    const marketRoot = document.querySelector(".base-author-list") as HTMLElement & {
+      __vue__?: {
+        _setupState?: Record<string, unknown>;
+      };
+    };
+    marketRoot.__vue__ = {
+      _setupState: {
+        __$temp_1: {
+          reqParams: {
+            scene_param: {
+              platform_source: 1
+            },
+            page_param: {
+              limit: "20",
+              page: "2"
+            },
+            search_param: {
+              seach_type: 3
+            }
+          }
+        }
+      }
+    };
+
+    const requestedPages: number[] = [];
+    const requestedHeaders: Array<HeadersInit | undefined> = [];
+    const requestedUrls: string[] = [];
+    const controller = createSilentExportController({
+      document,
+      fetchImpl: async (url, init) => {
+        const body = JSON.parse(String(init?.body ?? "{}")) as {
+          page_param?: { page?: number | string };
+        };
+        const pageNo = Number(body.page_param?.page ?? 0);
+        requestedPages.push(pageNo);
+        requestedHeaders.push(init?.headers);
+        requestedUrls.push(url);
+
+        return {
+          json: async () => ({
+            authors: [
+              {
+                attribute_datas: {
+                  nickname: `达人${pageNo}`,
+                  price_20_60: pageNo * 1000
+                },
+                star_id: String(pageNo)
+              }
+            ],
+            pagination: {
+              limit: 20,
+              page: pageNo,
+              total_count: 100
+            }
+          }),
+          ok: true
+        };
+      }
+    });
+
+    const records = await controller.exportRecords({
+      mode: "count",
+      pageCount: 2
+    });
+
+    expect(requestedPages).toEqual([2, 3]);
+    expect(
+      requestedUrls.every((url) =>
+        url.endsWith("/gw/api/gsearch/search_for_author_square")
+      )
+    ).toBe(true);
+    expect(requestedHeaders).toEqual([
+      {
+        Accept: "application/json, text/plain, */*",
+        "Agw-Js-Conv": "str",
+        "Content-Type": "application/json",
+        "x-login-source": "1"
+      },
+      {
+        Accept: "application/json, text/plain, */*",
+        "Agw-Js-Conv": "str",
+        "Content-Type": "application/json",
+        "x-login-source": "1"
+      }
+    ]);
+    expect(records?.map((record) => record.authorId)).toEqual(["2", "3"]);
+  });
+
+  test("replays paged exports when the page number is nested inside the request body", async () => {
+    document.documentElement.setAttribute(
+      "data-sces-market-request-snapshot",
+      JSON.stringify({
+        body: JSON.stringify({
+          page_param: {
+            page: 2
+          }
+        }),
+        method: "POST",
+        url: "https://xingtu.cn/api/mock-market-search"
+      })
+    );
+
+    const requestedPages: number[] = [];
+    const controller = createSilentExportController({
+      document,
+      fetchImpl: async (_url, init) => {
+        const body = JSON.parse(String(init?.body ?? "{}")) as {
+          page_param?: { page?: number };
+        };
+        const pageNo = body.page_param?.page ?? 0;
+        requestedPages.push(pageNo);
+
+        return {
+          json: async () => ({
+            authors: [
+              {
+                attribute_datas: {
+                  nickname: `达人${pageNo}`,
+                  price_20_60: pageNo * 1000
+                },
+                star_id: String(pageNo)
+              }
+            ],
+            pagination: {
+              limit: 20,
+              page: pageNo,
+              total_count: 100
+            }
+          }),
+          ok: true
+        };
+      }
+    });
+
+    const records = await controller.exportRecords({
+      mode: "count",
+      pageCount: 2
+    });
+
+    expect(requestedPages).toEqual([2, 3]);
+    expect(records?.map((record) => record.authorId)).toEqual(["2", "3"]);
+  });
+
+  test("starts from page 1 when the captured request omits an explicit page number", async () => {
+    document.documentElement.setAttribute(
+      "data-sces-market-request-snapshot",
+      JSON.stringify({
+        body: JSON.stringify({
+          filters: {
+            keyword: "test"
+          }
+        }),
+        method: "POST",
+        url: "https://xingtu.cn/api/mock-market-search"
+      })
+    );
+
+    const requestedPages: number[] = [];
+    const controller = createSilentExportController({
+      document,
+      fetchImpl: async (_url, init) => {
+        const body = JSON.parse(String(init?.body ?? "{}")) as { page?: number };
+        const page = body.page ?? 0;
+        requestedPages.push(page);
+
+        return {
+          json: async () => ({
+            data: {
+              marketList: [
+                {
+                  attribute_datas: {
+                    nickname: `达人${page}`,
+                    price_20_60: page * 1000
+                  },
+                  star_id: String(page)
+                }
+              ]
+            }
+          }),
+          ok: true
+        };
+      }
+    });
+
+    const records = await controller.exportRecords({
+      mode: "count",
+      pageCount: 2
+    });
+
+    expect(requestedPages).toEqual([1, 2]);
+    expect(records?.map((record) => record.authorId)).toEqual(["1", "2"]);
+  });
+
+  test("accepts snapshot headers that contain non-string values from the live XHR capture", async () => {
+    document.body.innerHTML = "";
+    document.documentElement.setAttribute(
+      "data-sces-market-request-snapshot",
+      JSON.stringify({
+        body: JSON.stringify({
+          page_param: {
+            page: "1",
+            limit: "20"
+          }
+        }),
+        headers: {
+          Accept: "application/json, text/plain, */*",
+          "Content-Type": "application/json",
+          "x-login-source": 1,
+          "Agw-Js-Conv": "str"
+        },
+        method: "POST",
+        url: "/gw/api/gsearch/search_for_author_square"
+      })
+    );
+
+    const requestedPages: number[] = [];
+    const controller = createSilentExportController({
+      document,
+      fetchImpl: async (_url, init) => {
+        const body = JSON.parse(String(init?.body ?? "{}")) as {
+          page_param?: { page?: number | string };
+        };
+        requestedPages.push(Number(body.page_param?.page ?? 0));
+
+        return {
+          json: async () => ({
+            authors: [
+              {
+                attribute_datas: {
+                  nickname: "达人1"
+                },
+                star_id: "1"
+              }
+            ],
+            pagination: {
+              limit: 20,
+              page: 1,
+              total_count: 20
+            }
+          }),
+          ok: true
+        };
+      }
+    });
+
+    const records = await controller.exportRecords({
+      mode: "count",
+      pageCount: 1
+    });
+
+    expect(requestedPages).toEqual([1]);
+    expect(records?.map((record) => record.authorId)).toEqual(["1"]);
+  });
+});