fix: 修复异常页面的 TypeError，并兼容新版 /web/contest 比赛页面

[boomzero]

What does this PR aim to accomplish?:

Closes #1009
Closes #1029

1. [Bug] TypeError: Cannot read properties of undefined (reading 'xxx') #1009: pages whose DOM differs from what the script expects (403/404 pages, multi-subtask test point pages, etc.) throw TypeErrors, which DebugMode shows as an "internal error" popup.
2. New /web/contest/ pages break XMOJ-Script navigation and layout #1029: the new client-rendered contest pages under /web/contest/ (a Vue app mounted on #app) break the script's navigation and layout. The site no longer links to the old contest pages.

How does this PR accomplish the above?:

Error fixes (#1009)

• Every dereferenced querySelector result is checked for null. Page branches that rebuild their own container skip the page when it is missing.
• Paths that send requests stop instead of sending empty values: profile save, AutoCheat, ImproveACRate, ApplyData and GetUserInfo.
• The multi-subtask test point page (reinfo.php) goes through every result group and skips elements without a test point's structure. This fixes the "Cannot read properties of undefined" error reported in the issue.
• The old contest 403/404 pages now redirect to /web, which handles them itself.

New contest pages (#1029)

• /web gets the same Bootstrap 5 and skin setup as the legacy pages; the site's Bootstrap 3 CSS is removed there too.
  • The app's Bootstrap 3 markup is mapped to Bootstrap 5 classes on every render: navbar, dropdown, buttons, pagination and badges.
  • The legacy navbar behavior is shared rather than copied: the floating top bar (NavbarStyler), the ResetType user menu, Translate and RemoveUseless.
• InitializeContestWebApp re-applies the script's enhancements after async renders and in-app route changes. Vue's own elements are never replaced.
  • Countdowns.
  • Problem IDs and discussion links.
  • Copy buttons.
  • Open all / unsolved problems.
  • AutoCheat.
  • Read-only code editors.
  • Rank header translation.
  • The left-edge problem switcher, built from the contest API response.
• Contest problem IDs and I/O file names come from the new /api/contest/... JSON API. The submit page's fallback to the original problem after a contest ends no longer reads legacy contest HTML.

Old contest pages redirect to /web, and their handlers are removed

The site no longer links to these pages. The script redirects them at document-start:

Old page	New page
contest.php, contest.php?cid=X	/web/contest, /web/contest/X
problem.php?cid=X&pid=N	/web/contest/X/<letter>
problem_std.php, problem_solution.php	…/std, …/solution
contestrank-correct.php?cid=X	/web/contest/X/rank-correct

The handlers for those pages are removed (about 450 lines). problem.php?id=…, contestrank-oi.php, submitpage.php and status.php are still in use and unchanged. On ordinary problem pages the problem ID now comes from id. It was previously read from the contest cache, which gave null, so the I/O file name and the discussion count used the wrong problem.

Loading: fewer flashes and layout shifts

• While loading, pages hide the body instead of making the root transparent. A transparent root showed the browser's white canvas in dark mode.
• The canvas uses the active skin's background and color-scheme.
• A page is shown only once its navbar is converted and the top bar applied. There is a safety fallback: 1.5 s after main() starts, 4 s after DOMContentLoaded at the latest.
• The top bar is applied immediately instead of up to a second later.
• Measured in dark mode (headless Chromium, every 10 ms during each navigation): pages are first shown fully styled, with no navbar or content movement afterwards, where dev had 2–4 jumps per load.
• Server-rendered .php pages can still paint before a userscript manager injects the script.

Other fixes

• Monochrome skin: links in table headers were the same color as the header background (1:1 contrast), for example the problem letters in rank tables. They now reach 13.8:1 in dark mode and 21:1 in light.

Tests

• npm test runs tests/contest-web.test.cjs (9 tests), and a new Test workflow runs it on pull requests and on pushes to dev and master. The tests cover:
  • Route parsing.
  • The old-page redirect mapping.
  • Letter-to-index problem mapping.
  • API error handling.
  • Theme and canvas selection.
• tests/userscript-harness.cjs runs the script on the live site in Chromium the way a userscript manager does. It checks each /web page, the redirects, legacy pages and both user menus, and saves screenshots. Credentials come only from environment variables. The script's backend and all submit/modify/login/logout POSTs are blocked. See the header of the file for usage.

Verification

• The harness passes on the live site (logged in) for the /web contest pages, all six redirects, and the legacy problem and problem-set pages, in both the default and monochrome skins.
• Not verified in a real Tampermonkey install: it installs under automation, but Chrome did not run any user script there. A maintainer should still try the new and the classic UI by hand before ticking the box below.

---

By submitting this pull request, I confirm the following:

1. I have read and understood the contributor's guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
2. I have commented on my proposed changes within the code.
3. I have tested my changes.
4. I am willing to help maintain this change if there are issues with it later.
5. It is compatible with the GNU General Public License v3.0
6. I have squashed any insignificant commits. (git rebase)
7. I have checked that another pull request for this purpose does not exist.
8. I have considered and confirmed that this submission will be valuable to others.
9. I accept that this submission may not be used, and the pull request can be closed at the will of the maintainer.
10. I give this submission freely and claim no ownership to its content.
11. I have verified that my changes work correctly in both the new UI and the old/classic UI.

---

• I have read the above and my PR is ready for review. Check this box to confirm

🤖 Generated with Claude Code

https://claude.ai/code/session_0135Ggqqp6xktQZytLRJQ9nc

[cloudflare-workers-and-pages]

Deploying xmoj-script-dev-channel with    Cloudflare Pages

Latest commit:	9840c3b
Status:	✅  Deploy successful!
Preview URL:	https://94145503.xmoj-script-dev-channel.pages.dev
Branch Preview URL:	https://claude-issue-1009-u2n0g5.xmoj-script-dev-channel.pages.dev

View logs

[sourcery-ai]

Reviewer's Guide

This PR systematically hardens XMOJ.user.js against missing DOM nodes by guarding querySelector dereferences and supplying safe fallbacks across page-specific features, including parsed response documents. It addresses null-related TypeErrors but does not fix errors caused by indexed collections or deeper child chains, and browser validation remains necessary for both UI variants.

Sequence diagram for guarded DOM updates

sequenceDiagram
    participant Script
    participant DOM
    participant Element

    Script->>DOM: querySelector(selector)
    DOM-->>Script: Element or null
    alt element exists
        Script->>Element: Set property or call method
    else element missing
        Script->>Script: Skip update or use fallback value
    end

Loading

Flow diagram for null-safe DOM manipulation

flowchart TD
    A[Page or parsed response has varying DOM] --> B{querySelector returns an element?}
    B -->|Yes| C[Read property or modify element]
    B -->|No| D[Skip operation or use safe fallback]
    D --> E[Continue page script without null TypeError]
    C --> E

Loading

File-Level Changes

Change	Details	Files
Added null guards around querySelector results throughout the userscript to prevent property access and method calls on missing DOM elements.	Guarded direct DOM mutations, event handlers, and conditional property reads on document and parsed documents. Added empty-value fallbacks for missing collections, text, script contents, and rating values. Updated multi-line conditions and selected nested-document operations while leaving unrelated indexed-element dereferences unchanged.	XMOJ.user.js
Applied defensive handling across page-specific features and UI variants.	Covered navigation, problem and contest pages, rankings, submission/captcha flows, user profiles, discussions, video pages, and auxiliary tools. Added guards for both new Bootstrap UI and classic/legacy DOM selectors.	XMOJ.user.js

Possibly linked issues

• [Bug] TypeError: Cannot read properties of undefined (reading 'xxx') #1009: The PR directly targets the reported missing-element TypeErrors across affected pages, despite leaving some undefined-index errors unresolved.
• [Bug] TypeError: Cannot read properties of undefined (reading 'xxx') #1009: PR通过全面检查querySelector返回值，修复异常页面缺失元素引发的TypeError，与该Bug直接相关。

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[boomzero]

@zsTree0830 测试一下吧

[sourcery-ai]

Sourcery assessment

Approved.

[sourcery-ai]

Hey - I've found 2 issues

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="XMOJ.user.js" line_range="4397" />
<code_context>
                         const RequestID = ++CaptchaRequestID;
                         const CaptchaInput = document.querySelector("#vcode");
-                        document.querySelector("#CaptchaElement").style.display = "block";
+                        if (document.querySelector("#CaptchaElement") != null) document.querySelector("#CaptchaElement").style.display = "block";
                         CaptchaInput.value = "";
                         SetCaptchaStatus(StatusMessage || "");
</code_context>
<issue_to_address>
**issue (broader_impact):** The new guard protects only `#CaptchaElement`; `RefreshCaptcha` still immediately executes `CaptchaInput.value = ""` even when `document.querySelector("#vcode")` returned `null`, so captcha refresh still throws the same null-property TypeError.

**Triggers:** When the submit page has no `#vcode` input but the captcha refresh path runs.

**Suggested fix:** Check `CaptchaInput` for null before accessing it, or return from `RefreshCaptcha` when the input is absent.
</issue_to_address>

### Comment 2
<location path="XMOJ.user.js" line_range="3914" />
<code_context>
                 return null;
             }
             const ParsedDocument = new DOMParser().parseFromString(Response, "text/html");
-            let Rating = (parseInt(ParsedDocument.querySelector("#statics > tbody > tr:nth-child(4) > td:nth-child(2)").innerText.trim()) / parseInt(ParsedDocument.querySelector("#statics > tbody > tr:nth-child(3) > td:nth-child(2)").innerText.trim())).toFixed(3) * 1000;
</code_context>
<issue_to_address>
**issue (bug_risk):** When the outer container is absent, the new guard skips rebuilding the required DOM, but execution continues into code that assumes the rebuilt elements exist: rank handling indexes `HeaderCells[0]`, and the open-contest path passes a missing textarea from `querySelector` to `CodeMirror.fromTextArea`. The malformed page therefore still crashes instead of being safely ignored.

**Triggers:** When the page lacks the container matched by the guarded selector.

**Suggested fix:** Return from the page-specific branch when its required container is missing, or guard every downstream operation that depends on the generated DOM.
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 2 findings to address first, and most changes only turn selector failures into no-ops, but the profile-edit path now substitutes empty strings for missing form fields and can send those values to the account-modification endpoint, potentially persisting incorrect account data. Reverting prevents further occurrences, but values already written would need to be repaired separately.

Blocking findings: XMOJ.user.js:4397, XMOJ.user.js:3914

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0303ba78d8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sourcery-ai]

New security issues found

Sourcery withdrew this approval because the latest commits introduced blocking findings.

[sourcery-ai]

Sourcery assessment

Approved.

Sourcery withdrew this approval because it has stopped reviewing this pull request.

[sourcery-ai]

Sourcery has withdrawn its approval of this pull request. It auto-reviews a pull request 5 times, and this push is past that limit, so the approval no longer reflects code Sourcery has read.

Comment @sourcery-ai review to get a fresh review, which can approve again.

Re-reviews, rate limits and approvals

[cubic-dev-ai]

All reported issues were addressed across 4 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="XMOJ.user.js">

<violation number="1">
P1: This line renders the `GetNotice` response directly into `innerHTML` after removing `PurifyHTML`. Marked preserves raw HTML, so a malicious or compromised notice can inject event-handler or unsafe-link markup; restore sanitization before the mention replacement.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="XMOJ.user.js">

<violation number="1">
P1: This removes the sanitizer from notice rendering and allows HTML/event-handler XSS from `GetNotice` content. Keep `PurifyHTML` around `marked.parse` before applying the mention replacement.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[boomzero]

@sourcery-ai review

[sourcery-ai]

Sorry @boomzero, your pull request is larger than the review limit of 150,000 diff characters

[zsTree0830]

例如按钮等的适配没那么好欸，比例很奇怪
还有比赛题目页下面多出来老 UI 脚本没有的按钮 & 样例输入输出炸了
还有刷新时怎么 topbar 一直在缩小

[boomzero]

@zsTree0830 感谢测试！三个问题都已在 3a74844 中修复：

1. 按钮比例：比赛题目页的 提交/状态/题解/讨论 改为和旧版题目页一样的普通尺寸 btn-outline-secondary（之前是 btn-sm 加 btn-primary）。输入/输出文件名不再是大号 h3 标题，改为和旧版一样的普通文字行。
2. 底部多出的按钮和样例：新版应用会在题面下方再渲染一排按钮。旧版脚本在开启“去除多余内容”(RemoveUseless) 时会删掉这一排，现在 /web 也一样把它隐藏。样例输入输出改用旧版题目页的样式：输入和输出左右并排显示在卡片里，复制按钮在右侧。
3. 刷新时 topbar 缩小：原因是脚本启动时 <head> 可能已经解析完，旧的 bootstrap 3 / white.css / semantic.min.css 链接已经在页面里。早期的 MutationObserver 只能拦截之后新加入的链接，所以这些样式会一直生效到 DOMContentLoaded。在此期间根字号被改成 10px/14px，导航栏也随之先缩小再恢复。现在早期代码启动时会把已有的旧样式链接一并移除，实测多次刷新时根字号始终保持 16px，品牌字号保持 20px。

已在真实站点上对比旧版 problem.php 截图验证，麻烦再测一下 🙏

---

Generated by Claude Code

[zsTree0830]

我建议是和原来页面diff一下

包括页面：

• 比赛题目页 /web/contest/******
• 订正排名 /web/contest/******/rank-correct
• 题目详情页 /web/contest/******/***

还有比赛列表的搜索

[boomzero]

这两个渲染方式都不同，不可能完全一样啊

[boomzero]

经测试,我其实觉得问题不大

[zsTree0830]

只是觉得对手机端兼容性不太好
按钮太小了

[zsTree0830]

还有 /web/contest/****** 标签页切回去就要刷新一下

[zsTree0830]

原来 /web/contest 变成 SPA 了吗