feat(gpc): add auto mode permission checks

tests/background-account-history-settings.test.js

@@ -55,6 +55,7 @@ test('background account history settings are normalized independently from hotm
     extractFunction('normalizeAccountRunHistoryHelperBaseUrl'),
     extractFunction('normalizeVerificationResendCount'),
     extractFunction('normalizePlusPaymentMethod'),
+    extractFunction('normalizeGpcHelperPhoneMode'),
     extractFunction('normalizePhoneSmsProvider'),
     extractFunction('normalizePhoneSmsProviderOrder'),
     extractFunction('normalizeSignupMethod'),
@@ -207,6 +208,12 @@ return {
   );
   assert.equal(api.normalizePersistentSettingValue('gopayHelperApiUrl', ''), 'https://gpc.qlhazycoder.top');
   assert.equal(api.normalizePersistentSettingValue('gopayHelperApiKey', ' gpc-123 '), 'gpc-123');
+  assert.equal(api.normalizePersistentSettingValue('gopayHelperPhoneMode', 'auto'), 'auto');
+  assert.equal(api.normalizePersistentSettingValue('gopayHelperPhoneMode', 'builtin'), 'auto');
+  assert.equal(api.normalizePersistentSettingValue('gopayHelperPhoneMode', 'unknown'), 'manual');
+  assert.equal(api.normalizePersistentSettingValue('gopayHelperRemainingUses', '998'), 998);
+  assert.equal(api.normalizePersistentSettingValue('gopayHelperAutoModeEnabled', 1), true);
+  assert.equal(api.normalizePersistentSettingValue('gopayHelperApiKeyStatus', ' active '), 'active');
   assert.equal(api.normalizePersistentSettingValue('gopayHelperCountryCode', ' 86 '), '+86');
   assert.equal(api.normalizePersistentSettingValue('gopayHelperPhoneNumber', ' +86 138-0013-8000 '), '+8613800138000');
   assert.equal(api.normalizePersistentSettingValue('gopayHelperPin', ' 12-34-56 '), '123456');

tests/background-message-router-step2-skip.test.js

@@ -146,7 +146,7 @@ function createRouter(overrides = {}) {
     verifyHotmailAccount: async () => {},
     refreshGpcCardBalance: overrides.refreshGpcCardBalance || (async (state, options) => {
       events.balanceRefreshes.push({ state, options });
-      return { balance: '余额 3' };
+      return { balance: '余额 3', remainingUses: 3, autoModeEnabled: true, apiKeyStatus: 'active' };
     }),
   });
 
@@ -556,7 +556,7 @@ test('message router refreshes GPC balance through explicit sidepanel message',
     },
   }, {});
 
-  assert.deepStrictEqual(response, { ok: true, balance: '余额 3' });
+  assert.deepStrictEqual(response, { ok: true, balance: '余额 3', remainingUses: 3, autoModeEnabled: true, apiKeyStatus: 'active' });
   assert.equal(events.balanceRefreshes.length, 1);
   assert.equal(events.balanceRefreshes[0].state.gopayHelperApiUrl, 'http://localhost:18473/');
   assert.equal(events.balanceRefreshes[0].state.gopayHelperApiKey, 'payload_api_key');

tests/gopay-utils.test.js

@@ -15,6 +15,10 @@ test('GoPay utils normalize manual OTP input', () => {
   assert.equal(api.normalizeGpcOtpChannel('sms'), 'sms');
   assert.equal(api.normalizeGpcOtpChannel('wa'), 'whatsapp');
   assert.equal(api.normalizeGpcOtpChannel('unknown'), 'whatsapp');
+  assert.equal(api.normalizeGpcHelperPhoneMode('auto'), 'auto');
+  assert.equal(api.normalizeGpcHelperPhoneMode('builtin'), 'auto');
+  assert.equal(api.normalizeGpcHelperPhoneMode('manual'), 'manual');
+  assert.equal(api.normalizeGpcHelperPhoneMode('unknown'), 'manual');
 });
 
 test('GoPay utils keeps GPC helper payment method distinct', () => {
@@ -81,10 +85,21 @@ test('GoPay utils formats balance and maps linked-account errors', () => {
     api.formatGpcBalancePayload({
       code: 200,
       message: 'ok',
-      data: { remaining_uses: 0, total_uses: 3, used_uses: 3, status: 'active' },
+      data: { remaining_uses: 0, total_uses: 3, used_uses: 3, status: 'active', auto_mode_enabled: false },
     }),
-    '余额 0/3，已用 3，状态 active'
+    '余额 0/3，已用 3，状态 active，自动模式 未开通'
   );
+  assert.equal(
+    api.formatGpcBalancePayload({
+      code: 200,
+      message: 'ok',
+      data: { remaining_uses: 998, total_uses: 1000, used_uses: 2, status: 'active', auto_mode_enabled: true },
+    }),
+    '余额 998/1000，已用 2，状态 active，自动模式 已开通'
+  );
+  assert.equal(api.getGpcBalanceRemainingUses({ data: { remaining_uses: 998 } }), 998);
+  assert.equal(api.isGpcAutoModeEnabled({ data: { auto_mode_enabled: true } }), true);
+  assert.equal(api.isGpcAutoModeEnabled({ data: { auto_mode_enabled: false } }), false);
   assert.deepEqual(
     api.unwrapGpcResponse({ code: 200, message: 'ok', data: { task_id: 'task_1' } }),
     { task_id: 'task_1' }

tests/plus-checkout-billing-tab-resolution.test.js

@@ -903,11 +903,119 @@ test('GPC billing polls queue task, submits WhatsApp OTP then PIN, and waits unt
   assert.equal(pinCall.options.headers['X-API-Key'], 'gpc_billing_123');
   assert.ok(fetchCalls.findIndex((call) => call.url.endsWith('/api/gp/tasks/task_123/pin')) < fetchCalls.length - 1);
   assert.equal(events.states.some((state) => state.gopayHelperTaskId === 'task_123' && state.gopayHelperTaskStatus === 'completed'), true);
+  assert.equal(events.logs.some((entry) => entry.message === '步骤 7：GPC 任务状态：等待 WhatsApp OTP'), true);
+  assert.equal(events.logs.some((entry) => /whatsapp_otp_wait/.test(entry.message)), false);
   assert.equal(events.completed[0].step, 7);
   assert.equal(events.completed[0].payload.plusCheckoutSource, 'gpc-helper');
   assert.ok(events.sleeps.includes(3000));
 });
 
+
+test('GPC billing auto mode only polls until completed without OTP or PIN submission', async () => {
+  const fetchCalls = [];
+  let pollCount = 0;
+  const { events, executor } = createExecutorHarness({
+    frames: [],
+    stateByFrame: {},
+    fetchImpl: async (url, options = {}) => {
+      fetchCalls.push({ url, options });
+      if (url === 'https://gpc.qlhazycoder.top/api/gp/tasks/task_auto') {
+        pollCount += 1;
+        if (pollCount === 1) {
+          return {
+            ok: true,
+            status: 200,
+            json: async () => createGpcTaskResponse({ task_id: 'task_auto', phone_mode: 'auto', status: 'queued', status_text: '排队中', api_waiting_for: '' }),
+          };
+        }
+        if (pollCount === 2) {
+          return {
+            ok: true,
+            status: 200,
+            json: async () => createGpcTaskResponse({ task_id: 'task_auto', phone_mode: 'auto', status: 'active', status_text: '处理中', remote_stage: 'auto_otp_wait', api_waiting_for: 'auto_otp' }),
+          };
+        }
+        return {
+          ok: true,
+          status: 200,
+          json: async () => createGpcTaskResponse({ task_id: 'task_auto', phone_mode: 'auto', status: 'completed', status_text: '充值完成', remote_stage: 'completed', api_waiting_for: '' }),
+        };
+      }
+      throw new Error(`unexpected url: ${url}`);
+    },
+  });
+
+  await executor.executePlusCheckoutBilling({
+    plusPaymentMethod: 'gpc-helper',
+    plusCheckoutSource: 'gpc-helper',
+    gopayHelperTaskId: 'task_auto',
+    gopayHelperPhoneMode: 'auto',
+    gopayHelperApiUrl: 'https://gpc.qlhazycoder.top/',
+    gopayHelperApiKey: 'gpc_auto',
+  });
+
+  assert.equal(fetchCalls.length, 3);
+  assert.equal(fetchCalls.some((call) => /\/api\/gp\/tasks\/task_auto\/(otp|pin)$/.test(call.url)), false);
+  assert.equal(events.logs.some((entry) => entry.message === '步骤 7：GPC 任务状态：等待自动 OTP'), true);
+  assert.equal(events.logs.some((entry) => /auto_otp_wait/.test(entry.message)), false);
+  assert.equal(events.states.some((state) => state.plusManualConfirmationMethod === 'gopay-otp'), false);
+  assert.equal(events.states.some((state) => state.gopayHelperTaskId === 'task_auto' && state.gopayHelperPhoneMode === 'auto' && state.gopayHelperTaskStatus === 'completed'), true);
+  assert.equal(events.completed[0].step, 7);
+  assert.equal(events.completed[0].payload.plusCheckoutSource, 'gpc-helper');
+});
+
+test('GPC billing logs checkout order stage in Chinese', async () => {
+  let pollCount = 0;
+  const { events, executor } = createExecutorHarness({
+    frames: [],
+    stateByFrame: {},
+    fetchImpl: async (url) => {
+      if (url === 'https://gpc.qlhazycoder.top/api/gp/tasks/task_stage') {
+        pollCount += 1;
+        if (pollCount === 1) {
+          return {
+            ok: true,
+            status: 200,
+            json: async () => createGpcTaskResponse({
+              task_id: 'task_stage',
+              phone_mode: 'auto',
+              status: 'active',
+              status_text: '处理中',
+              remote_stage: 'checkout_order_start',
+              api_waiting_for: '',
+            }),
+          };
+        }
+        return {
+          ok: true,
+          status: 200,
+          json: async () => createGpcTaskResponse({
+            task_id: 'task_stage',
+            phone_mode: 'auto',
+            status: 'completed',
+            status_text: '充值完成',
+            remote_stage: 'completed',
+            api_waiting_for: '',
+          }),
+        };
+      }
+      throw new Error(`unexpected url: ${url}`);
+    },
+  });
+
+  await executor.executePlusCheckoutBilling({
+    plusPaymentMethod: 'gpc-helper',
+    plusCheckoutSource: 'gpc-helper',
+    gopayHelperTaskId: 'task_stage',
+    gopayHelperPhoneMode: 'auto',
+    gopayHelperApiUrl: 'https://gpc.qlhazycoder.top/',
+    gopayHelperApiKey: 'gpc_auto',
+  });
+
+  assert.equal(events.logs.some((entry) => entry.message === '步骤 7：GPC 任务状态：创建订单'), true);
+  assert.equal(events.logs.some((entry) => /checkout_order_start/.test(entry.message)), false);
+});
+
 test('GPC billing reads SMS OTP from local helper for sms_otp_wait', async () => {
   const fetchCalls = [];
   let pollCount = 0;

tests/plus-checkout-create-wait.test.js

@@ -3,9 +3,42 @@ const assert = require('node:assert/strict');
 const fs = require('node:fs');
 
 const source = fs.readFileSync('background/steps/create-plus-checkout.js', 'utf8');
+const gopayUtilsSource = fs.readFileSync('gopay-utils.js', 'utf8');
 const globalScope = {};
+new Function('self', `${gopayUtilsSource};`)(globalScope);
 const api = new Function('self', `${source}; return self.MultiPageBackgroundPlusCheckoutCreate;`)(globalScope);
 
+function createGpcBalanceResponse(overrides = {}) {
+  return {
+    code: 200,
+    message: 'ok',
+    data: {
+      api_key: 'gpc_test',
+      status: 'active',
+      auto_mode_enabled: false,
+      total_uses: 1000,
+      remaining_uses: 998,
+      used_uses: 2,
+      ...overrides,
+    },
+  };
+}
+
+function createGpcTaskResponse(overrides = {}) {
+  return {
+    code: 200,
+    message: 'ok',
+    data: {
+      task_id: 'task_123',
+      status: 'active',
+      status_text: '处理中',
+      phone_mode: 'manual',
+      remote_stage: 'checkout_start',
+      ...overrides,
+    },
+  };
+}
+
 test('Plus checkout create does not wait 20 seconds after opening checkout page', async () => {
   const events = [];
   const executor = api.createPlusCheckoutCreateExecutor({
@@ -107,7 +140,7 @@ test('GoPay plus checkout create forwards gopay payment method to the checkout c
   assert.deepStrictEqual(events[0]?.payload, { paymentMethod: 'gopay' });
 });
 
-test('GPC checkout injects Plus script before reading ChatGPT session token and sends X-API-Key', async () => {
+test('GPC manual checkout injects Plus script before reading ChatGPT session token and sends X-API-Key', async () => {
   const events = [];
   const fetchCalls = [];
   const executor = api.createPlusCheckoutCreateExecutor({
@@ -128,18 +161,9 @@ test('GPC checkout injects Plus script before reading ChatGPT session token and
       return {
         ok: true,
         status: 200,
-        json: async () => ({
-          code: 200,
-          message: 'ok',
-          data: {
-            task_id: 'task_123',
-            status: 'active',
-            status_text: '处理中',
-            phone_mode: 'manual',
-            remote_stage: 'checkout_start',
-            otp_channel: 'whatsapp',
-          },
-        }),
+        json: async () => url.endsWith('/api/gp/balance')
+          ? createGpcBalanceResponse({ auto_mode_enabled: false, remaining_uses: 998 })
+          : createGpcTaskResponse({ otp_channel: 'whatsapp' }),
       };
     },
     registerTab: async (source, tabId) => events.push({ type: 'register', source, tabId }),
@@ -155,6 +179,7 @@ test('GPC checkout injects Plus script before reading ChatGPT session token and
   await executor.executePlusCheckoutCreate({
     email: 'Current.Round+GPC@Example.COM',
     plusPaymentMethod: 'gpc-helper',
+    gopayHelperPhoneMode: 'manual',
     gopayHelperApiUrl: 'https://gpc.qlhazycoder.top/',
     gopayHelperPhoneNumber: '+8613800138000',
     gopayPhone: '',
@@ -172,9 +197,11 @@ test('GPC checkout injects Plus script before reading ChatGPT session token and
     includeSession: true,
     includeAccessToken: true,
   });
-  assert.equal(fetchCalls.length, 1);
-  assert.equal(fetchCalls[0].url, 'https://gpc.qlhazycoder.top/api/gp/tasks');
-  const helperPayload = JSON.parse(fetchCalls[0].options.body);
+  assert.equal(fetchCalls.length, 2);
+  assert.equal(fetchCalls[0].url, 'https://gpc.qlhazycoder.top/api/gp/balance');
+  assert.equal(fetchCalls[0].options.headers['X-API-Key'], 'gpc_test_123');
+  assert.equal(fetchCalls[1].url, 'https://gpc.qlhazycoder.top/api/gp/tasks');
+  const helperPayload = JSON.parse(fetchCalls[1].options.body);
   assert.deepEqual(helperPayload, {
     access_token: 'session-access-token',
     phone_mode: 'manual',
@@ -182,7 +209,7 @@ test('GPC checkout injects Plus script before reading ChatGPT session token and
     phone_number: '13800138000',
     otp_channel: 'whatsapp',
   });
-  assert.equal(fetchCalls[0].options.headers['X-API-Key'], 'gpc_test_123');
+  assert.equal(fetchCalls[1].options.headers['X-API-Key'], 'gpc_test_123');
   assert.equal(Object.prototype.hasOwnProperty.call(helperPayload, 'card_key'), false);
   assert.equal(Object.prototype.hasOwnProperty.call(helperPayload, 'customer_email'), false);
   assert.equal(Object.prototype.hasOwnProperty.call(helperPayload, 'checkout_ui_mode'), false);
@@ -199,6 +226,165 @@ test('GPC checkout injects Plus script before reading ChatGPT session token and
   assert.equal(events.find((event) => event.type === 'complete')?.payload?.plusCheckoutSource, 'gpc-helper');
 });
 
+
+test('GPC auto checkout only sends access token and API Key', async () => {
+  const events = [];
+  const fetchCalls = [];
+  const executor = api.createPlusCheckoutCreateExecutor({
+    addLog: async (message, level = 'info') => events.push({ type: 'log', message, level }),
+    chrome: {
+      tabs: {
+        create: async () => {
+          throw new Error('should not open token tab when direct access token exists');
+        },
+        remove: async () => {},
+      },
+    },
+    completeStepFromBackground: async (step, payload) => events.push({ type: 'complete', step, payload }),
+    ensureContentScriptReadyOnTabUntilStopped: async () => {},
+    fetch: async (url, options = {}) => {
+      fetchCalls.push({ url, options });
+      return {
+        ok: true,
+        status: 200,
+        json: async () => url.endsWith('/api/gp/balance')
+          ? createGpcBalanceResponse({ auto_mode_enabled: true, remaining_uses: 998 })
+          : createGpcTaskResponse({
+              task_id: 'task_auto',
+              status: 'queued',
+              status_text: '排队中',
+              phone_mode: 'auto',
+              api_waiting_for: '',
+            }),
+      };
+    },
+    registerTab: async () => {},
+    sendTabMessageUntilStopped: async () => ({}),
+    setState: async (payload) => events.push({ type: 'set-state', payload }),
+    sleepWithStop: async () => {},
+    waitForTabCompleteUntilStopped: async () => {},
+  });
+
+  await executor.executePlusCheckoutCreate({
+    plusPaymentMethod: 'gpc-helper',
+    gopayHelperPhoneMode: 'auto',
+    gopayHelperApiUrl: 'https://gpc.qlhazycoder.top/',
+    chatgptAccessToken: 'state-access-token',
+    gopayHelperApiKey: 'gpc_auto_123',
+  });
+
+  assert.equal(fetchCalls.length, 2);
+  assert.equal(fetchCalls[0].url, 'https://gpc.qlhazycoder.top/api/gp/balance');
+  assert.equal(fetchCalls[0].options.headers['X-API-Key'], 'gpc_auto_123');
+  assert.equal(fetchCalls[1].url, 'https://gpc.qlhazycoder.top/api/gp/tasks');
+  const helperPayload = JSON.parse(fetchCalls[1].options.body);
+  assert.deepEqual(helperPayload, {
+    access_token: 'state-access-token',
+    phone_mode: 'auto',
+  });
+  assert.equal(fetchCalls[1].options.headers['X-API-Key'], 'gpc_auto_123');
+  assert.equal(Object.prototype.hasOwnProperty.call(helperPayload, 'country_code'), false);
+  assert.equal(Object.prototype.hasOwnProperty.call(helperPayload, 'phone_number'), false);
+  assert.equal(Object.prototype.hasOwnProperty.call(helperPayload, 'otp_channel'), false);
+  assert.equal(Object.prototype.hasOwnProperty.call(helperPayload, 'pin'), false);
+  const statePayload = events.find((event) => event.type === 'set-state')?.payload || {};
+  assert.equal(statePayload.gopayHelperTaskId, 'task_auto');
+  assert.equal(statePayload.gopayHelperPhoneMode, 'auto');
+  assert.equal(statePayload.gopayHelperTaskStatus, 'queued');
+  assert.equal(events.find((event) => event.type === 'complete')?.step, 6);
+});
+
+test('GPC auto checkout blocks API Keys without auto mode permission', async () => {
+  const fetchCalls = [];
+  const executor = api.createPlusCheckoutCreateExecutor({
+    addLog: async () => {},
+    chrome: {
+      tabs: {
+        create: async () => {
+          throw new Error('should not open token tab when direct access token exists');
+        },
+        remove: async () => {},
+      },
+    },
+    completeStepFromBackground: async () => {},
+    ensureContentScriptReadyOnTabUntilStopped: async () => {},
+    fetch: async (url, options = {}) => {
+      fetchCalls.push({ url, options });
+      return {
+        ok: true,
+        status: 200,
+        json: async () => createGpcBalanceResponse({ auto_mode_enabled: false, remaining_uses: 998 }),
+      };
+    },
+    registerTab: async () => {},
+    sendTabMessageUntilStopped: async () => ({}),
+    setState: async () => {},
+    sleepWithStop: async () => {},
+    waitForTabCompleteUntilStopped: async () => {},
+  });
+
+  await assert.rejects(
+    () => executor.executePlusCheckoutCreate({
+      plusPaymentMethod: 'gpc-helper',
+      gopayHelperPhoneMode: 'auto',
+      gopayHelperApiUrl: 'https://gpc.qlhazycoder.top/',
+      chatgptAccessToken: 'state-access-token',
+      gopayHelperApiKey: 'gpc_auto_disabled',
+    }),
+    /未开通自动模式/
+  );
+
+  assert.equal(fetchCalls.length, 1);
+  assert.equal(fetchCalls[0].url, 'https://gpc.qlhazycoder.top/api/gp/balance');
+});
+
+test('GPC checkout blocks exhausted API Keys before creating task', async () => {
+  const fetchCalls = [];
+  const executor = api.createPlusCheckoutCreateExecutor({
+    addLog: async () => {},
+    chrome: {
+      tabs: {
+        create: async () => {
+          throw new Error('should not open token tab when direct access token exists');
+        },
+        remove: async () => {},
+      },
+    },
+    completeStepFromBackground: async () => {},
+    ensureContentScriptReadyOnTabUntilStopped: async () => {},
+    fetch: async (url, options = {}) => {
+      fetchCalls.push({ url, options });
+      return {
+        ok: true,
+        status: 200,
+        json: async () => createGpcBalanceResponse({ auto_mode_enabled: false, remaining_uses: 0 }),
+      };
+    },
+    registerTab: async () => {},
+    sendTabMessageUntilStopped: async () => ({}),
+    setState: async () => {},
+    sleepWithStop: async () => {},
+    waitForTabCompleteUntilStopped: async () => {},
+  });
+
+  await assert.rejects(
+    () => executor.executePlusCheckoutCreate({
+      plusPaymentMethod: 'gpc-helper',
+      gopayHelperPhoneMode: 'manual',
+      gopayHelperApiUrl: 'https://gpc.qlhazycoder.top/',
+      chatgptAccessToken: 'state-access-token',
+      gopayHelperPhoneNumber: '+8613800138000',
+      gopayHelperCountryCode: '+86',
+      gopayHelperPin: '123456',
+      gopayHelperApiKey: 'gpc_exhausted',
+    }),
+    /剩余次数不足/
+  );
+
+  assert.equal(fetchCalls.length, 1);
+  assert.equal(fetchCalls[0].url, 'https://gpc.qlhazycoder.top/api/gp/balance');
+});
+
 test('GPC checkout forwards selected SMS OTP channel', async () => {
   const fetchCalls = [];
   const executor = api.createPlusCheckoutCreateExecutor({
@@ -216,11 +402,9 @@ test('GPC checkout forwards selected SMS OTP channel', async () => {
       return {
         ok: true,
         status: 200,
-        json: async () => ({
-          code: 200,
-          message: 'ok',
-          data: { task_id: 'task_sms', status: 'active', phone_mode: 'manual', remote_stage: 'checkout_start' },
-        }),
+        json: async () => url.endsWith('/api/gp/balance')
+          ? createGpcBalanceResponse({ auto_mode_enabled: false, remaining_uses: 998 })
+          : createGpcTaskResponse({ task_id: 'task_sms', status: 'active', phone_mode: 'manual', remote_stage: 'checkout_start' }),
       };
     },
     registerTab: async () => {},
@@ -241,10 +425,13 @@ test('GPC checkout forwards selected SMS OTP channel', async () => {
     gopayHelperOtpChannel: 'sms',
   });
 
-  const helperPayload = JSON.parse(fetchCalls[0].options.body);
+  assert.equal(fetchCalls.length, 2);
+  assert.equal(fetchCalls[0].url, 'https://gpc.qlhazycoder.top/api/gp/balance');
+  assert.equal(fetchCalls[0].options.headers['X-API-Key'], 'gpc_sms');
+  const helperPayload = JSON.parse(fetchCalls[1].options.body);
   assert.equal(helperPayload.phone_mode, 'manual');
   assert.equal(helperPayload.otp_channel, 'sms');
-  assert.equal(fetchCalls[0].options.headers['X-API-Key'], 'gpc_sms');
+  assert.equal(fetchCalls[1].options.headers['X-API-Key'], 'gpc_sms');
   assert.equal(Object.prototype.hasOwnProperty.call(helperPayload, 'card_key'), false);
 });
 
@@ -264,6 +451,13 @@ test('GPC checkout surfaces unified queue API errors', async () => {
     ensureContentScriptReadyOnTabUntilStopped: async () => {},
     fetch: async (url, options = {}) => {
       fetchCalls.push({ url, options });
+      if (url.endsWith('/api/gp/balance')) {
+        return {
+          ok: true,
+          status: 200,
+          json: async () => createGpcBalanceResponse({ auto_mode_enabled: false, remaining_uses: 998 }),
+        };
+      }
       return {
         ok: false,
         status: 400,
@@ -295,9 +489,11 @@ test('GPC checkout surfaces unified queue API errors', async () => {
     /创建 GPC 订单失败：access_token 无效/
   );
 
-  assert.equal(fetchCalls.length, 1);
-  assert.equal(Object.prototype.hasOwnProperty.call(JSON.parse(fetchCalls[0].options.body), 'card_key'), false);
-  assert.equal(fetchCalls[0].options.headers['X-API-Key'], 'gpc_paid_456');
+  assert.equal(fetchCalls.length, 2);
+  assert.equal(fetchCalls[0].url, 'https://gpc.qlhazycoder.top/api/gp/balance');
+  assert.equal(fetchCalls[1].url, 'https://gpc.qlhazycoder.top/api/gp/tasks');
+  assert.equal(Object.prototype.hasOwnProperty.call(JSON.parse(fetchCalls[1].options.body), 'card_key'), false);
+  assert.equal(fetchCalls[1].options.headers['X-API-Key'], 'gpc_paid_456');
 });
 
 test('GPC checkout does not fall back to browser GoPay phone fields', async () => {
@@ -326,6 +522,7 @@ test('GPC checkout does not fall back to browser GoPay phone fields', async () =
   await assert.rejects(
     () => executor.executePlusCheckoutCreate({
       plusPaymentMethod: 'gpc-helper',
+      gopayHelperPhoneMode: 'manual',
       gopayHelperApiUrl: 'https://gpc.qlhazycoder.top/',
       chatgptAccessToken: 'state-access-token',
       email: 'helper-phone-test@example.com',

tests/sidepanel-auto-run-content-refresh.test.js

@@ -113,6 +113,9 @@ async function refreshContributionContentHint() {
   events.push({ type: 'refresh' });
   ${refreshImpl ? 'return (' + refreshImpl + ')();' : 'return null;'}
 }
+async function ensureGpcApiKeyReadyForStart() {
+  return true;
+}
 ${bundle}
 return {
   startAutoRunFromCurrentSettings,

tests/sidepanel-plus-payment-method.test.js

@@ -132,6 +132,10 @@ test('sidepanel Plus UI hides PayPal account selector while GoPay is selected',
   const bundle = [
     extractFunction('normalizePlusPaymentMethod'),
     extractFunction('getSelectedPlusPaymentMethod'),
+    extractFunction('normalizeGpcHelperPhoneModeValue'),
+    extractFunction('getGpcHelperAutoModeEnabled'),
+    extractFunction('hasGpcAutoModePermissionField'),
+    extractFunction('isGpcAutoModePermissionDenied'),
     extractFunction('normalizeGpcOtpChannelValue'),
     extractFunction('updatePlusModeUI'),
   ].join('\n');
@@ -141,6 +145,8 @@ let latestState = { plusPaymentMethod: 'gopay' };
 let currentPlusPaymentMethod = 'paypal';
 const inputPlusModeEnabled = { checked: true };
 const selectPlusPaymentMethod = { value: 'gopay', style: { display: 'none' } };
+const GPC_HELPER_PHONE_MODE_AUTO = 'auto';
+const GPC_HELPER_PHONE_MODE_MANUAL = 'manual';
 const rowPayPalAccount = { style: { display: '' } };
 ${bundle}
 return { updatePlusModeUI, selectPlusPaymentMethod, rowPayPalAccount };
@@ -209,21 +215,29 @@ test('sidepanel Plus UI shows GPC fields and purchase button only for GPC', () =
   const bundle = [
     extractFunction('normalizePlusPaymentMethod'),
     extractFunction('getSelectedPlusPaymentMethod'),
+    extractFunction('normalizeGpcHelperPhoneModeValue'),
+    extractFunction('getGpcHelperAutoModeEnabled'),
+    extractFunction('hasGpcAutoModePermissionField'),
+    extractFunction('isGpcAutoModePermissionDenied'),
     extractFunction('normalizeGpcOtpChannelValue'),
     extractFunction('updatePlusModeUI'),
   ].join('\n');
 
   const api = new Function(`
-let latestState = { plusPaymentMethod: 'gpc-helper' };
+let latestState = { plusPaymentMethod: 'gpc-helper', gopayHelperAutoModeEnabled: true };
 let currentPlusPaymentMethod = 'paypal';
 const inputPlusModeEnabled = { checked: true };
 const selectPlusPaymentMethod = { value: 'gpc-helper', style: { display: 'none' } };
+const GPC_HELPER_PHONE_MODE_AUTO = 'auto';
+const GPC_HELPER_PHONE_MODE_MANUAL = 'manual';
 const plusPaymentMethodCaption = { textContent: '' };
 const btnGpcCardKeyPurchase = { style: { display: 'none' } };
 const rowPayPalAccount = { style: { display: '' } };
 const rowPlusPaymentMethod = { style: { display: 'none' } };
 const rowGpcHelperApi = { style: { display: 'none' } };
 const rowGpcHelperCardKey = { style: { display: 'none' } };
+const rowGpcHelperPhoneMode = { style: { display: 'none' } };
+const selectGpcHelperPhoneMode = { value: 'manual' };
 const rowGpcHelperCountryCode = { style: { display: 'none' } };
 const rowGpcHelperPhone = { style: { display: 'none' } };
 const rowGpcHelperOtpChannel = { style: { display: 'none' } };
@@ -240,12 +254,13 @@ ${bundle}
 return {
   updatePlusModeUI,
   selectPlusPaymentMethod,
+  selectGpcHelperPhoneMode,
   selectGpcHelperOtpChannel,
   inputGpcHelperLocalSmsEnabled,
   btnGpcCardKeyPurchase,
   rowPayPalAccount,
   plusPaymentMethodCaption,
-  rows: { rowGpcHelperApi, rowGpcHelperCardKey, rowGpcHelperCountryCode, rowGpcHelperPhone, rowGpcHelperOtpChannel, rowGpcHelperLocalSmsEnabled, rowGpcHelperLocalSmsUrl, rowGpcHelperPin },
+  rows: { rowGpcHelperApi, rowGpcHelperCardKey, rowGpcHelperPhoneMode, rowGpcHelperCountryCode, rowGpcHelperPhone, rowGpcHelperOtpChannel, rowGpcHelperLocalSmsEnabled, rowGpcHelperLocalSmsUrl, rowGpcHelperPin },
 };
 `)();
 
@@ -255,6 +270,7 @@ return {
   assert.equal(api.btnGpcCardKeyPurchase.style.display, '');
   assert.equal(api.rows.rowGpcHelperApi.style.display, '');
   assert.equal(api.rows.rowGpcHelperCardKey.style.display, '');
+  assert.equal(api.rows.rowGpcHelperPhoneMode.style.display, '');
   assert.equal(api.rows.rowGpcHelperPhone.style.display, '');
   assert.equal(api.rows.rowGpcHelperOtpChannel.style.display, '');
   assert.equal(api.rows.rowGpcHelperLocalSmsEnabled.style.display, '');
@@ -272,6 +288,15 @@ return {
   assert.equal(api.rows.rowGpcHelperLocalSmsEnabled.style.display, '');
   assert.equal(api.rows.rowGpcHelperLocalSmsUrl.style.display, '');
 
+  api.selectGpcHelperPhoneMode.value = 'auto';
+  api.updatePlusModeUI();
+  assert.equal(api.rows.rowGpcHelperPhoneMode.style.display, '');
+  assert.equal(api.rows.rowGpcHelperPhone.style.display, 'none');
+  assert.equal(api.rows.rowGpcHelperOtpChannel.style.display, 'none');
+  assert.equal(api.rows.rowGpcHelperLocalSmsEnabled.style.display, 'none');
+  assert.equal(api.rows.rowGpcHelperLocalSmsUrl.style.display, 'none');
+  assert.match(api.plusPaymentMethodCaption.textContent, /自动/);
+
   api.selectPlusPaymentMethod.value = 'gopay';
   api.updatePlusModeUI();
   assert.equal(api.btnGpcCardKeyPurchase.style.display, 'none');
@@ -279,6 +304,103 @@ return {
   assert.equal(api.rowPayPalAccount.style.display, 'none');
 });
 
+test('sidepanel hides GPC auto mode selector when API Key has no auto permission', () => {
+  const bundle = [
+    extractFunction('normalizePlusPaymentMethod'),
+    extractFunction('getSelectedPlusPaymentMethod'),
+    extractFunction('normalizeGpcHelperPhoneModeValue'),
+    extractFunction('getGpcHelperAutoModeEnabled'),
+    extractFunction('hasGpcAutoModePermissionField'),
+    extractFunction('isGpcAutoModePermissionDenied'),
+    extractFunction('normalizeGpcOtpChannelValue'),
+    extractFunction('updatePlusModeUI'),
+  ].join('\n');
+
+  const api = new Function(`
+let latestState = { plusPaymentMethod: 'gpc-helper', gopayHelperPhoneMode: 'auto', gopayHelperAutoModeEnabled: false, gopayHelperBalancePayload: { auto_mode_enabled: false } };
+let currentPlusPaymentMethod = 'gpc-helper';
+const inputPlusModeEnabled = { checked: true };
+const selectPlusPaymentMethod = { value: 'gpc-helper', style: { display: 'none' } };
+const GPC_HELPER_PHONE_MODE_AUTO = 'auto';
+const GPC_HELPER_PHONE_MODE_MANUAL = 'manual';
+const plusPaymentMethodCaption = { textContent: '' };
+const btnGpcCardKeyPurchase = { style: { display: 'none' } };
+const rowPayPalAccount = { style: { display: '' } };
+const rowPlusPaymentMethod = { style: { display: 'none' } };
+const rowGpcHelperApi = { style: { display: 'none' } };
+const rowGpcHelperCardKey = { style: { display: 'none' } };
+const rowGpcHelperPhoneMode = { style: { display: 'none' } };
+const selectGpcHelperPhoneMode = { value: 'auto' };
+const rowGpcHelperCountryCode = { style: { display: 'none' } };
+const rowGpcHelperPhone = { style: { display: 'none' } };
+const rowGpcHelperOtpChannel = { style: { display: 'none' } };
+const selectGpcHelperOtpChannel = { value: 'whatsapp' };
+const rowGpcHelperLocalSmsEnabled = { style: { display: 'none' } };
+const inputGpcHelperLocalSmsEnabled = { checked: false };
+const rowGpcHelperLocalSmsUrl = { style: { display: 'none' } };
+const rowGpcHelperPin = { style: { display: 'none' } };
+${bundle}
+return { updatePlusModeUI, selectGpcHelperPhoneMode, plusPaymentMethodCaption, rows: { rowGpcHelperPhoneMode, rowGpcHelperPhone, rowGpcHelperOtpChannel, rowGpcHelperPin } };
+`)();
+
+  api.updatePlusModeUI();
+
+  assert.equal(api.rows.rowGpcHelperPhoneMode.style.display, 'none');
+  assert.equal(api.selectGpcHelperPhoneMode.value, 'manual');
+  assert.equal(api.rows.rowGpcHelperPhone.style.display, '');
+  assert.equal(api.rows.rowGpcHelperOtpChannel.style.display, '');
+  assert.equal(api.rows.rowGpcHelperPin.style.display, '');
+  assert.match(api.plusPaymentMethodCaption.textContent, /手动/);
+});
+
+test('sidepanel keeps selected GPC auto mode before permission has been queried', () => {
+  const bundle = [
+    extractFunction('normalizePlusPaymentMethod'),
+    extractFunction('getSelectedPlusPaymentMethod'),
+    extractFunction('normalizeGpcHelperPhoneModeValue'),
+    extractFunction('getGpcHelperAutoModeEnabled'),
+    extractFunction('hasGpcAutoModePermissionField'),
+    extractFunction('isGpcAutoModePermissionDenied'),
+    extractFunction('normalizeGpcOtpChannelValue'),
+    extractFunction('updatePlusModeUI'),
+  ].join('\n');
+
+  const api = new Function(`
+let latestState = { plusPaymentMethod: 'gpc-helper', gopayHelperPhoneMode: 'auto', gopayHelperAutoModeEnabled: false, gopayHelperBalancePayload: null };
+let currentPlusPaymentMethod = 'gpc-helper';
+const inputPlusModeEnabled = { checked: true };
+const selectPlusPaymentMethod = { value: 'gpc-helper', style: { display: 'none' } };
+const GPC_HELPER_PHONE_MODE_AUTO = 'auto';
+const GPC_HELPER_PHONE_MODE_MANUAL = 'manual';
+const plusPaymentMethodCaption = { textContent: '' };
+const rowPayPalAccount = { style: { display: '' } };
+const rowPlusPaymentMethod = { style: { display: 'none' } };
+const rowGpcHelperApi = { style: { display: 'none' } };
+const rowGpcHelperCardKey = { style: { display: 'none' } };
+const rowGpcHelperPhoneMode = { style: { display: 'none' } };
+const selectGpcHelperPhoneMode = { value: 'auto' };
+const rowGpcHelperCountryCode = { style: { display: 'none' } };
+const rowGpcHelperPhone = { style: { display: 'none' } };
+const rowGpcHelperOtpChannel = { style: { display: 'none' } };
+const selectGpcHelperOtpChannel = { value: 'whatsapp' };
+const rowGpcHelperLocalSmsEnabled = { style: { display: 'none' } };
+const inputGpcHelperLocalSmsEnabled = { checked: false };
+const rowGpcHelperLocalSmsUrl = { style: { display: 'none' } };
+const rowGpcHelperPin = { style: { display: 'none' } };
+${bundle}
+return { updatePlusModeUI, selectGpcHelperPhoneMode, plusPaymentMethodCaption, rows: { rowGpcHelperPhoneMode, rowGpcHelperPhone, rowGpcHelperOtpChannel, rowGpcHelperPin } };
+`)();
+
+  api.updatePlusModeUI();
+
+  assert.equal(api.rows.rowGpcHelperPhoneMode.style.display, '');
+  assert.equal(api.selectGpcHelperPhoneMode.value, 'auto');
+  assert.equal(api.rows.rowGpcHelperPhone.style.display, 'none');
+  assert.equal(api.rows.rowGpcHelperOtpChannel.style.display, 'none');
+  assert.equal(api.rows.rowGpcHelperPin.style.display, 'none');
+  assert.match(api.plusPaymentMethodCaption.textContent, /自动/);
+});
+
 test('sidepanel resolves pending GoPay manual confirmation from DATA_UPDATED state', async () => {
   const bundle = [
     extractFunction('openPlusManualConfirmationDialog'),

tests/step-definitions-module.test.js

@@ -111,7 +111,7 @@ test('step definitions module exposes ordered normal and Plus step metadata', ()
   assert.deepStrictEqual(api.getStepIds({ plusModeEnabled: true, plusPaymentMethod: 'gpc-helper' }), [1, 2, 3, 4, 5, 6, 7, 10, 11, 12, 13]);
   assert.equal(api.getLastStepId({ plusModeEnabled: true, plusPaymentMethod: 'gpc-helper' }), 13);
   assert.equal(gpcSteps[5].title, '创建 GPC 订单');
-  assert.equal(gpcSteps[6].title, 'GPC OTP/PIN 验证');
+  assert.equal(gpcSteps[6].title, '等待 GPC 任务完成');
 });
 
 test('sidepanel html loads shared step definitions before sidepanel bootstrap', () => {
@@ -142,6 +142,9 @@ test('sidepanel html exposes Plus mode, PayPal, and GoPay settings', () => {
   assert.match(html, />转换 API Key</);
   assert.match(html, /GPC API Key/);
   assert.match(html, /id="input-gpc-helper-card-key"/);
+  assert.match(html, /GPC 模式/);
+  assert.match(html, /id="select-gpc-helper-phone-mode"/);
+  assert.match(html, /<option value="auto">自动模式<\/option>/);
   assert.match(html, /id="btn-gpc-helper-balance"/);
   assert.match(html, /id="input-gpc-helper-phone"/);
   assert.match(html, /id="select-gpc-helper-otp-channel"/);